From 0c9f522f2d41c7e055a602a0d2c41dc7af01010b Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Tue, 24 Feb 2026 10:09:32 +0000 Subject: fsl-mc: Add minimal infrastructure to use platform MSI Add the tiny bit of infrastructure required to use platform MSI instead of the current hack. This means providing a write_msi_msg callback, as well as irq domain and devid retrieval helpers. Reviewed-by: Ioana Ciornei Tested-by: Ioana Ciornei # LX2160ARDB, LS2088ARDB Tested-by: Sascha Bischoff Signed-off-by: Marc Zyngier Acked-by: Thomas Gleixner Link: https://lore.kernel.org/r/20260224100936.3752303-3-maz@kernel.org Signed-off-by: Christophe Leroy (CS GROUP) --- include/linux/fsl/mc.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h index 897d6211c163..bcc38c0fc230 100644 --- a/include/linux/fsl/mc.h +++ b/include/linux/fsl/mc.h @@ -361,9 +361,11 @@ int mc_send_command(struct fsl_mc_io *mc_io, struct fsl_mc_command *cmd); #ifdef CONFIG_FSL_MC_BUS #define dev_is_fsl_mc(_dev) ((_dev)->bus == &fsl_mc_bus_type) +u32 fsl_mc_get_msi_id(struct device *dev); #else /* If fsl-mc bus is not present device cannot belong to fsl-mc bus */ #define dev_is_fsl_mc(_dev) (0) +#define fsl_mc_get_msi_id(_dev) (0) #endif /* Macro to check if a device is a container device */ -- cgit v1.2.3 From 14b1cbcc6cec0b02298f4adf717646cd943b7ef6 Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Tue, 24 Feb 2026 10:09:35 +0000 Subject: fsl-mc: Remove legacy MSI implementation Get rid of most of the fsl_mc MSI infrastructure, which is now replaced by common code. Reviewed-by: Ioana Ciornei Tested-by: Ioana Ciornei # LX2160ARDB, LS2088ARDB Tested-by: Sascha Bischoff Signed-off-by: Marc Zyngier Acked-by: Thomas Gleixner Link: https://lore.kernel.org/r/20260224100936.3752303-6-maz@kernel.org Signed-off-by: Christophe Leroy (CS GROUP) --- include/linux/fsl/mc.h | 4 ---- include/linux/irqdomain_defs.h | 1 - 2 files changed, 5 deletions(-) (limited to 'include') diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h index bcc38c0fc230..e9522233f9b5 100644 --- a/include/linux/fsl/mc.h +++ b/include/linux/fsl/mc.h @@ -425,10 +425,6 @@ int __must_check fsl_mc_object_allocate(struct fsl_mc_device *mc_dev, void fsl_mc_object_free(struct fsl_mc_device *mc_adev); -struct irq_domain *fsl_mc_msi_create_irq_domain(struct fwnode_handle *fwnode, - struct msi_domain_info *info, - struct irq_domain *parent); - int __must_check fsl_mc_allocate_irqs(struct fsl_mc_device *mc_dev); void fsl_mc_free_irqs(struct fsl_mc_device *mc_dev); diff --git a/include/linux/irqdomain_defs.h b/include/linux/irqdomain_defs.h index 36653e2ee1c9..3a03bdfeeee9 100644 --- a/include/linux/irqdomain_defs.h +++ b/include/linux/irqdomain_defs.h @@ -17,7 +17,6 @@ enum irq_domain_bus_token { DOMAIN_BUS_PLATFORM_MSI, DOMAIN_BUS_NEXUS, DOMAIN_BUS_IPI, - DOMAIN_BUS_FSL_MC_MSI, DOMAIN_BUS_TI_SCI_INTA_MSI, DOMAIN_BUS_WAKEUP, DOMAIN_BUS_VMD_MSI, -- cgit v1.2.3 From cf8e9203cc653f0a82639f7ce8089fa92afe6739 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Thu, 26 Feb 2026 14:09:42 -0800 Subject: virt: fsl_hypervisor: fix header kernel-doc warnings Correct struct member names to placate kernel-doc warnings: Warning: include/uapi/linux/fsl_hypervisor.h:148 struct member 'local_vaddr' not described in 'fsl_hv_ioctl_memcpy' Warning: include/uapi/linux/fsl_hypervisor.h:148 struct member 'remote_paddr' not described in 'fsl_hv_ioctl_memcpy' Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20260226220942.1035295-1-rdunlap@infradead.org Signed-off-by: Christophe Leroy (CS GROUP) --- include/uapi/linux/fsl_hypervisor.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/fsl_hypervisor.h b/include/uapi/linux/fsl_hypervisor.h index 1e237fba951f..ab4388441e80 100644 --- a/include/uapi/linux/fsl_hypervisor.h +++ b/include/uapi/linux/fsl_hypervisor.h @@ -114,9 +114,9 @@ struct fsl_hv_ioctl_stop { * @target: the partition ID of the target partition, or -1 for this * partition * @reserved: reserved, must be set to 0 - * @local_addr: user-space virtual address of a buffer in the local + * @local_vaddr: user-space virtual address of a buffer in the local * partition - * @remote_addr: guest physical address of a buffer in the + * @remote_paddr: guest physical address of a buffer in the * remote partition * @count: the number of bytes to copy. Both the local and remote * buffers must be at least 'count' bytes long -- cgit v1.2.3 From 328815979c4a45e71410391d57cd7299c7c6d405 Mon Sep 17 00:00:00 2001 From: Chenyu Chen Date: Fri, 27 Mar 2026 16:21:58 +0800 Subject: drm/edid: Parse AMD Vendor-Specific Data Block Parse the AMD VSDB v3 from CTA extension blocks and store the result in struct drm_amd_vsdb_info, a new field of drm_display_info. This includes replay mode, panel type, and luminance ranges. Signed-off-by: Chenyu Chen Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20260327082342.1286878-2-chen-yu.chen@amd.com Signed-off-by: Mario Limonciello (AMD) --- include/drm/drm_connector.h | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) (limited to 'include') diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index af8b92d2d5b7..f83f28cae207 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -693,6 +693,39 @@ enum drm_bus_flags { DRM_BUS_FLAG_SHARP_SIGNALS = BIT(8), }; +/** + * struct drm_amd_vsdb_info - AMD-specific VSDB information + * + * This structure holds information parsed from the AMD Vendor-Specific Data + * Block (VSDB) version 3. + */ +struct drm_amd_vsdb_info { + /** + * @version: Version of the Vendor-Specific Data Block (VSDB) + */ + u8 version; + + /** + * @replay_mode: Panel Replay supported + */ + bool replay_mode; + + /** + * @panel_type: Panel technology type + */ + u8 panel_type; + + /** + * @luminance_range1: Luminance for max back light + */ + struct drm_luminance_range_info luminance_range1; + + /** + * @luminance_range2: Luminance for min back light + */ + struct drm_luminance_range_info luminance_range2; +}; + /** * struct drm_display_info - runtime data about the connected sink * @@ -883,6 +916,11 @@ struct drm_display_info { * Defaults to CEC_PHYS_ADDR_INVALID (0xffff). */ u16 source_physical_address; + + /** + * @amd_vsdb: AMD-specific VSDB information. + */ + struct drm_amd_vsdb_info amd_vsdb; }; int drm_display_info_set_bus_formats(struct drm_display_info *info, -- cgit v1.2.3 From 0563e28e0851ff327542f180974d14c525981a6f Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Tue, 31 Mar 2026 14:40:57 +0300 Subject: drm/i915: move VLV IOSF sideband to display parent interface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove another direct dependency from display to i915 core by moving the VLV IOSF sideband calls to the display parent interface. Xe doesn't need this, so it'll remain optional and NULL. Reviewed-by: Ville Syrjälä Link: https://patch.msgid.link/15dfc67b58f5b5b381be0f9bc66d60b43bebfecf.1774957233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/intel/display_parent_interface.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include') diff --git a/include/drm/intel/display_parent_interface.h b/include/drm/intel/display_parent_interface.h index 97ec94a2e749..c0d18d5577f3 100644 --- a/include/drm/intel/display_parent_interface.h +++ b/include/drm/intel/display_parent_interface.h @@ -6,6 +6,7 @@ #include +enum vlv_iosf_sb_unit; struct dma_fence; struct drm_crtc; struct drm_device; @@ -176,6 +177,13 @@ struct intel_display_stolen_interface { void (*node_free)(const struct intel_stolen_node *node); }; +struct intel_display_vlv_iosf_interface { + void (*get)(struct drm_device *drm, unsigned long unit_mask); + void (*put)(struct drm_device *drm, unsigned long unit_mask); + u32 (*read)(struct drm_device *drm, enum vlv_iosf_sb_unit unit, u32 addr); + int (*write)(struct drm_device *drm, enum vlv_iosf_sb_unit unit, u32 addr, u32 val); +}; + struct intel_display_vma_interface { int (*fence_id)(const struct i915_vma *vma); }; @@ -235,6 +243,9 @@ struct intel_display_parent_interface { /** @stolen: Stolen memory. */ const struct intel_display_stolen_interface *stolen; + /** @vlv_iosf: VLV IOSF sideband. Optional. */ + const struct intel_display_vlv_iosf_interface *vlv_iosf; + /** @vma: VMA interface. Optional. */ const struct intel_display_vma_interface *vma; -- cgit v1.2.3 From 2c0c1e9a6663c1c62d53a92592ec60ae169a8ee9 Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Tue, 31 Mar 2026 14:40:58 +0300 Subject: drm/{i915, xe}: add shared header for VLV IOSF sideband units and registers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move vlv_iosf_sb_reg.h to include/drm/intel/vlv_iosf_sb_regs.h. Use _regs.h suffix to align better with other register headers. Move enum vlv_iosf_sb_unit there as well, breaking the final include tie related to IOSF sideband between display and i915 core. With this, we can completely remove the xe compat vls_iosf_sb*.h headers. Reviewed-by: Ville Syrjälä Link: https://patch.msgid.link/41b060b0d6453de39ca775eab10ee12b25c45b7d.1774957233.git.jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/intel/vlv_iosf_sb_regs.h | 192 +++++++++++++++++++++++++++++++++++ 1 file changed, 192 insertions(+) create mode 100644 include/drm/intel/vlv_iosf_sb_regs.h (limited to 'include') diff --git a/include/drm/intel/vlv_iosf_sb_regs.h b/include/drm/intel/vlv_iosf_sb_regs.h new file mode 100644 index 000000000000..42d1def5534b --- /dev/null +++ b/include/drm/intel/vlv_iosf_sb_regs.h @@ -0,0 +1,192 @@ +/* SPDX-License-Identifier: MIT */ +/* + * Copyright © 2022 Intel Corporation + */ + +#ifndef _VLV_IOSF_SB_REGS_H_ +#define _VLV_IOSF_SB_REGS_H_ + +enum vlv_iosf_sb_unit { + VLV_IOSF_SB_BUNIT, + VLV_IOSF_SB_CCK, + VLV_IOSF_SB_CCU, + VLV_IOSF_SB_DPIO, + VLV_IOSF_SB_DPIO_2, + VLV_IOSF_SB_FLISDSI, + VLV_IOSF_SB_GPIO, + VLV_IOSF_SB_NC, + VLV_IOSF_SB_PUNIT, +}; + +/* See configdb bunit SB addr map */ +#define BUNIT_REG_BISOC 0x11 + +/* PUNIT_REG_*SSPM0 */ +#define _SSPM0_SSC(val) ((val) << 0) +#define SSPM0_SSC_MASK _SSPM0_SSC(0x3) +#define SSPM0_SSC_PWR_ON _SSPM0_SSC(0x0) +#define SSPM0_SSC_CLK_GATE _SSPM0_SSC(0x1) +#define SSPM0_SSC_RESET _SSPM0_SSC(0x2) +#define SSPM0_SSC_PWR_GATE _SSPM0_SSC(0x3) +#define _SSPM0_SSS(val) ((val) << 24) +#define SSPM0_SSS_MASK _SSPM0_SSS(0x3) +#define SSPM0_SSS_PWR_ON _SSPM0_SSS(0x0) +#define SSPM0_SSS_CLK_GATE _SSPM0_SSS(0x1) +#define SSPM0_SSS_RESET _SSPM0_SSS(0x2) +#define SSPM0_SSS_PWR_GATE _SSPM0_SSS(0x3) + +/* PUNIT_REG_*SSPM1 */ +#define SSPM1_FREQSTAT_SHIFT 24 +#define SSPM1_FREQSTAT_MASK (0x1f << SSPM1_FREQSTAT_SHIFT) +#define SSPM1_FREQGUAR_SHIFT 8 +#define SSPM1_FREQGUAR_MASK (0x1f << SSPM1_FREQGUAR_SHIFT) +#define SSPM1_FREQ_SHIFT 0 +#define SSPM1_FREQ_MASK (0x1f << SSPM1_FREQ_SHIFT) + +#define PUNIT_REG_VEDSSPM0 0x32 +#define PUNIT_REG_VEDSSPM1 0x33 + +#define PUNIT_REG_DSPSSPM 0x36 +#define DSPFREQSTAT_SHIFT_CHV 24 +#define DSPFREQSTAT_MASK_CHV (0x1f << DSPFREQSTAT_SHIFT_CHV) +#define DSPFREQGUAR_SHIFT_CHV 8 +#define DSPFREQGUAR_MASK_CHV (0x1f << DSPFREQGUAR_SHIFT_CHV) +#define DSPFREQSTAT_SHIFT 30 +#define DSPFREQSTAT_MASK (0x3 << DSPFREQSTAT_SHIFT) +#define DSPFREQGUAR_SHIFT 14 +#define DSPFREQGUAR_MASK (0x3 << DSPFREQGUAR_SHIFT) +#define DSP_MAXFIFO_PM5_STATUS (1 << 22) /* chv */ +#define DSP_AUTO_CDCLK_GATE_DISABLE (1 << 7) /* chv */ +#define DSP_MAXFIFO_PM5_ENABLE (1 << 6) /* chv */ +#define _DP_SSC(val, pipe) ((val) << (2 * (pipe))) +#define DP_SSC_MASK(pipe) _DP_SSC(0x3, (pipe)) +#define DP_SSC_PWR_ON(pipe) _DP_SSC(0x0, (pipe)) +#define DP_SSC_CLK_GATE(pipe) _DP_SSC(0x1, (pipe)) +#define DP_SSC_RESET(pipe) _DP_SSC(0x2, (pipe)) +#define DP_SSC_PWR_GATE(pipe) _DP_SSC(0x3, (pipe)) +#define _DP_SSS(val, pipe) ((val) << (2 * (pipe) + 16)) +#define DP_SSS_MASK(pipe) _DP_SSS(0x3, (pipe)) +#define DP_SSS_PWR_ON(pipe) _DP_SSS(0x0, (pipe)) +#define DP_SSS_CLK_GATE(pipe) _DP_SSS(0x1, (pipe)) +#define DP_SSS_RESET(pipe) _DP_SSS(0x2, (pipe)) +#define DP_SSS_PWR_GATE(pipe) _DP_SSS(0x3, (pipe)) + +#define PUNIT_REG_ISPSSPM0 0x39 +#define PUNIT_REG_ISPSSPM1 0x3a + +#define PUNIT_REG_PWRGT_CTRL 0x60 +#define PUNIT_REG_PWRGT_STATUS 0x61 +#define PUNIT_PWRGT_MASK(pw_idx) (3 << ((pw_idx) * 2)) +#define PUNIT_PWRGT_PWR_ON(pw_idx) (0 << ((pw_idx) * 2)) +#define PUNIT_PWRGT_CLK_GATE(pw_idx) (1 << ((pw_idx) * 2)) +#define PUNIT_PWRGT_RESET(pw_idx) (2 << ((pw_idx) * 2)) +#define PUNIT_PWRGT_PWR_GATE(pw_idx) (3 << ((pw_idx) * 2)) + +#define PUNIT_PWGT_IDX_RENDER 0 +#define PUNIT_PWGT_IDX_MEDIA 1 +#define PUNIT_PWGT_IDX_DISP2D 3 +#define PUNIT_PWGT_IDX_DPIO_CMN_BC 5 +#define PUNIT_PWGT_IDX_DPIO_TX_B_LANES_01 6 +#define PUNIT_PWGT_IDX_DPIO_TX_B_LANES_23 7 +#define PUNIT_PWGT_IDX_DPIO_TX_C_LANES_01 8 +#define PUNIT_PWGT_IDX_DPIO_TX_C_LANES_23 9 +#define PUNIT_PWGT_IDX_DPIO_RX0 10 +#define PUNIT_PWGT_IDX_DPIO_RX1 11 +#define PUNIT_PWGT_IDX_DPIO_CMN_D 12 + +#define PUNIT_REG_GPU_LFM 0xd3 +#define PUNIT_REG_GPU_FREQ_REQ 0xd4 +#define PUNIT_REG_GPU_FREQ_STS 0xd8 +#define GPLLENABLE (1 << 4) +#define GENFREQSTATUS (1 << 0) +#define PUNIT_REG_MEDIA_TURBO_FREQ_REQ 0xdc +#define PUNIT_REG_CZ_TIMESTAMP 0xce + +#define PUNIT_FUSE_BUS2 0xf6 /* bits 47:40 */ +#define PUNIT_FUSE_BUS1 0xf5 /* bits 55:48 */ + +#define FB_GFX_FMAX_AT_VMAX_FUSE 0x136 +#define FB_GFX_FREQ_FUSE_MASK 0xff +#define FB_GFX_FMAX_AT_VMAX_2SS4EU_FUSE_SHIFT 24 +#define FB_GFX_FMAX_AT_VMAX_2SS6EU_FUSE_SHIFT 16 +#define FB_GFX_FMAX_AT_VMAX_2SS8EU_FUSE_SHIFT 8 + +#define FB_GFX_FMIN_AT_VMIN_FUSE 0x137 +#define FB_GFX_FMIN_AT_VMIN_FUSE_SHIFT 8 + +#define PUNIT_REG_DDR_SETUP2 0x139 +#define FORCE_DDR_FREQ_REQ_ACK (1 << 8) +#define FORCE_DDR_LOW_FREQ (1 << 1) +#define FORCE_DDR_HIGH_FREQ (1 << 0) + +#define PUNIT_GPU_STATUS_REG 0xdb +#define PUNIT_GPU_STATUS_MAX_FREQ_SHIFT 16 +#define PUNIT_GPU_STATUS_MAX_FREQ_MASK 0xff +#define PUNIT_GPU_STATIS_GFX_MIN_FREQ_SHIFT 8 +#define PUNIT_GPU_STATUS_GFX_MIN_FREQ_MASK 0xff + +#define PUNIT_GPU_DUTYCYCLE_REG 0xdf +#define PUNIT_GPU_DUTYCYCLE_RPE_FREQ_SHIFT 8 +#define PUNIT_GPU_DUTYCYCLE_RPE_FREQ_MASK 0xff + +#define IOSF_NC_FB_GFX_FREQ_FUSE 0x1c +#define FB_GFX_MAX_FREQ_FUSE_SHIFT 3 +#define FB_GFX_MAX_FREQ_FUSE_MASK 0x000007f8 +#define FB_GFX_FGUARANTEED_FREQ_FUSE_SHIFT 11 +#define FB_GFX_FGUARANTEED_FREQ_FUSE_MASK 0x0007f800 +#define IOSF_NC_FB_GFX_FMAX_FUSE_HI 0x34 +#define FB_FMAX_VMIN_FREQ_HI_MASK 0x00000007 +#define IOSF_NC_FB_GFX_FMAX_FUSE_LO 0x30 +#define FB_FMAX_VMIN_FREQ_LO_SHIFT 27 +#define FB_FMAX_VMIN_FREQ_LO_MASK 0xf8000000 + +#define VLV_TURBO_SOC_OVERRIDE 0x04 +#define VLV_OVERRIDE_EN 1 +#define VLV_SOC_TDP_EN (1 << 1) +#define VLV_BIAS_CPU_125_SOC_875 (6 << 2) +#define CHV_BIAS_CPU_50_SOC_50 (3 << 2) + +/* vlv2 north clock has */ +#define CCK_FUSE_REG 0x8 +#define CCK_FUSE_HPLL_FREQ_MASK 0x3 +#define CCK_REG_DSI_PLL_FUSE 0x44 +#define CCK_REG_DSI_PLL_CONTROL 0x48 +#define DSI_PLL_VCO_EN (1 << 31) +#define DSI_PLL_LDO_GATE (1 << 30) +#define DSI_PLL_P1_POST_DIV_SHIFT 17 +#define DSI_PLL_P1_POST_DIV_MASK (0x1ff << 17) +#define DSI_PLL_P2_MUX_DSI0_DIV2 (1 << 13) +#define DSI_PLL_P3_MUX_DSI1_DIV2 (1 << 12) +#define DSI_PLL_MUX_MASK (3 << 9) +#define DSI_PLL_MUX_DSI0_DSIPLL (0 << 10) +#define DSI_PLL_MUX_DSI0_CCK (1 << 10) +#define DSI_PLL_MUX_DSI1_DSIPLL (0 << 9) +#define DSI_PLL_MUX_DSI1_CCK (1 << 9) +#define DSI_PLL_CLK_GATE_MASK (0xf << 5) +#define DSI_PLL_CLK_GATE_DSI0_DSIPLL (1 << 8) +#define DSI_PLL_CLK_GATE_DSI1_DSIPLL (1 << 7) +#define DSI_PLL_CLK_GATE_DSI0_CCK (1 << 6) +#define DSI_PLL_CLK_GATE_DSI1_CCK (1 << 5) +#define DSI_PLL_LOCK (1 << 0) +#define CCK_REG_DSI_PLL_DIVIDER 0x4c +#define DSI_PLL_LFSR (1 << 31) +#define DSI_PLL_FRACTION_EN (1 << 30) +#define DSI_PLL_FRAC_COUNTER_SHIFT 27 +#define DSI_PLL_FRAC_COUNTER_MASK (7 << 27) +#define DSI_PLL_USYNC_CNT_SHIFT 18 +#define DSI_PLL_USYNC_CNT_MASK (0x1ff << 18) +#define DSI_PLL_N1_DIV_SHIFT 16 +#define DSI_PLL_N1_DIV_MASK (3 << 16) +#define DSI_PLL_M1_DIV_SHIFT 0 +#define DSI_PLL_M1_DIV_MASK (0x1ff << 0) +#define CCK_CZ_CLOCK_CONTROL 0x62 +#define CCK_GPLL_CLOCK_CONTROL 0x67 +#define CCK_DISPLAY_CLOCK_CONTROL 0x6b +#define CCK_DISPLAY_REF_CLOCK_CONTROL 0x6c +#define CCK_TRUNK_FORCE_ON (1 << 17) +#define CCK_TRUNK_FORCE_OFF (1 << 16) +#define CCK_FREQUENCY_STATUS (0x1f << 8) +#define CCK_FREQUENCY_STATUS_SHIFT 8 +#define CCK_FREQUENCY_VALUES (0x1f << 0) + +#endif /* _VLV_IOSF_SB_REGS_H_ */ -- cgit v1.2.3 From c02697cb9388b48086314fca90758016bd51b8e4 Mon Sep 17 00:00:00 2001 From: David Zhang Date: Mon, 30 Mar 2026 09:37:01 -0700 Subject: accel/amdxdna: Add basic support for AIE4 devices Add initial support for AIE4 devices (PCI device IDs 0x17F2 and 0x1B0B), including: Device initialization Basic mailbox communication SR-IOV enablement This lays the groundwork for full AIE4 support. Co-developed-by: Hayden Laccabue Signed-off-by: Hayden Laccabue Signed-off-by: David Zhang Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260330163705.3153647-3-lizhi.hou@amd.com --- include/uapi/drm/amdxdna_accel.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/drm/amdxdna_accel.h b/include/uapi/drm/amdxdna_accel.h index 61d3686fa3b1..0b11e8e3ea5d 100644 --- a/include/uapi/drm/amdxdna_accel.h +++ b/include/uapi/drm/amdxdna_accel.h @@ -29,7 +29,8 @@ extern "C" { enum amdxdna_device_type { AMDXDNA_DEV_TYPE_UNKNOWN = -1, - AMDXDNA_DEV_TYPE_KMQ, + AMDXDNA_DEV_TYPE_KMQ = 0, + AMDXDNA_DEV_TYPE_PF = 2, }; enum amdxdna_drm_ioctl_id { -- cgit v1.2.3 From 89f55d5859f894aada0a09f1539901a628d9a0fb Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Tue, 31 Mar 2026 12:49:16 +0300 Subject: drm/{i915, xe}: move fbdev fb calls to parent interface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move the driver specific fbdev fb calls to the display parent interface. Reuse the existing struct intel_display_bo_interface, as this is mostly about gem objects. Put everything behind IS_ENABLED(CONFIG_DRM_FBDEV_EMULATION) to catch configuration issues at build or link time. v2: Rebase Reviewed-by: Michał Grzelak # v1 Link: https://patch.msgid.link/a6bb24909a58181cfc41b91a4c6538a181d27158.1774950508.git.jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/intel/display_parent_interface.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/drm/intel/display_parent_interface.h b/include/drm/intel/display_parent_interface.h index c0d18d5577f3..258e6388ef77 100644 --- a/include/drm/intel/display_parent_interface.h +++ b/include/drm/intel/display_parent_interface.h @@ -16,6 +16,7 @@ struct drm_gem_object; struct drm_mode_fb_cmd2; struct drm_plane_state; struct drm_scanout_buffer; +struct fb_info; struct i915_vma; struct intel_dpt; struct intel_dsb_buffer; @@ -44,6 +45,12 @@ struct intel_display_bo_interface { struct drm_gem_object *(*framebuffer_lookup)(struct drm_device *drm, struct drm_file *filp, const struct drm_mode_fb_cmd2 *user_mode_cmd); +#if IS_ENABLED(CONFIG_DRM_FBDEV_EMULATION) + struct drm_gem_object *(*fbdev_create)(struct drm_device *drm, int size); + void (*fbdev_destroy)(struct drm_gem_object *obj); + int (*fbdev_fill_info)(struct drm_gem_object *obj, struct fb_info *info, struct i915_vma *vma); + u32 (*fbdev_pitch_align)(u32 stride); +#endif }; struct intel_display_dpt_interface { -- cgit v1.2.3 From dc2d30e7db8321a6696d266838f7af7e9d1c7155 Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Fri, 27 Mar 2026 17:18:29 +0000 Subject: drm/doc: document DRM_IOCTL_SYNCOBJ_EVENTFD MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit struct drm_syncobj_eventfd was documented, but DRM_IOCTL_SYNCOBJ_EVENTFD was not. This prevents references to this define from being properly linkified in docs. Signed-off-by: Simon Ser Reviewed-by: Christian König Reviewed-by: Pekka Paalanen Cc: Simona Vetter Cc: Daniel Stone Cc: Michel Dänzer Link: https://patch.msgid.link/20260327171812.128290-1-contact@emersion.fr --- include/uapi/drm/drm.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/uapi/drm/drm.h b/include/uapi/drm/drm.h index 27cc159c1d27..495462e44a17 100644 --- a/include/uapi/drm/drm.h +++ b/include/uapi/drm/drm.h @@ -1323,6 +1323,13 @@ extern "C" { */ #define DRM_IOCTL_MODE_GETFB2 DRM_IOWR(0xCE, struct drm_mode_fb_cmd2) +/** + * DRM_IOCTL_SYNCOBJ_EVENTFD - Register an eventfd to be signalled by a syncobj. + * + * This can be used to integrate a syncobj in an event loop. + * + * The IOCTL argument is a struct drm_syncobj_eventfd. + */ #define DRM_IOCTL_SYNCOBJ_EVENTFD DRM_IOWR(0xCF, struct drm_syncobj_eventfd) /** -- cgit v1.2.3 From 3d353d6c535319894c3e1b9349cae0531159f087 Mon Sep 17 00:00:00 2001 From: Animesh Manna Date: Mon, 30 Mar 2026 19:06:18 +0530 Subject: drm/display: Add drm helper to check pr optimization support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add api to check panel replay optimization supported or not to drm-core DP tunneling framework which can be used by other driver as well. v2: Split generic drm changes from Intel specific changes. [Jouni] Reviewed-by: Jouni Högander Suggested-by: Imre Deak Signed-off-by: Animesh Manna Acked-by: Maarten Lankhorst Link: https://patch.msgid.link/20260330133620.3750559-2-animesh.manna@intel.com --- include/drm/display/drm_dp_tunnel.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/drm/display/drm_dp_tunnel.h b/include/drm/display/drm_dp_tunnel.h index 87212c847915..4aa3ce9fd829 100644 --- a/include/drm/display/drm_dp_tunnel.h +++ b/include/drm/display/drm_dp_tunnel.h @@ -53,6 +53,7 @@ int drm_dp_tunnel_destroy(struct drm_dp_tunnel *tunnel); int drm_dp_tunnel_enable_bw_alloc(struct drm_dp_tunnel *tunnel); int drm_dp_tunnel_disable_bw_alloc(struct drm_dp_tunnel *tunnel); bool drm_dp_tunnel_bw_alloc_is_enabled(const struct drm_dp_tunnel *tunnel); +bool drm_dp_tunnel_pr_optimization_supported(const struct drm_dp_tunnel *tunnel); int drm_dp_tunnel_alloc_bw(struct drm_dp_tunnel *tunnel, int bw); int drm_dp_tunnel_get_allocated_bw(struct drm_dp_tunnel *tunnel); int drm_dp_tunnel_update_state(struct drm_dp_tunnel *tunnel); @@ -140,6 +141,11 @@ static inline bool drm_dp_tunnel_bw_alloc_is_enabled(const struct drm_dp_tunnel return false; } +static inline bool drm_dp_tunnel_pr_optimization_supported(const struct drm_dp_tunnel *tunnel) +{ + return false; +} + static inline int drm_dp_tunnel_alloc_bw(struct drm_dp_tunnel *tunnel, int bw) { -- cgit v1.2.3 From d96366c7027aa1f335d1391983ff3c140f02c64e Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Tue, 7 Apr 2026 22:36:28 +0300 Subject: drm/i915/mchbar: move intel_mchbar_regs.h under include/drm/intel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since the mchbar registers are used from both i915 display and core, move intel_mchbar_regs.h to include/drm/intel/mchbar_regs.h. Drop the intel_ prefix from the name to reduce tautology. With this, we can drop the corresponding xe display compat header. v2: Rebase Reviewed-by: Ville Syrjälä Link: https://patch.msgid.link/6c951b2c05db74ea517d52a3912986f7eb886422.1775590536.git.jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/intel/mchbar_regs.h | 273 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 273 insertions(+) create mode 100644 include/drm/intel/mchbar_regs.h (limited to 'include') diff --git a/include/drm/intel/mchbar_regs.h b/include/drm/intel/mchbar_regs.h new file mode 100644 index 000000000000..ca0d421be16c --- /dev/null +++ b/include/drm/intel/mchbar_regs.h @@ -0,0 +1,273 @@ +/* SPDX-License-Identifier: MIT */ +/* + * Copyright © 2022 Intel Corporation + */ + +#ifndef __INTEL_MCHBAR_REGS__ +#define __INTEL_MCHBAR_REGS__ + +#include "i915_reg_defs.h" + +/* + * MCHBAR mirror. + * + * This mirrors the MCHBAR MMIO space whose location is determined by + * device 0 function 0's pci config register 0x44 or 0x48 and matches it in + * every way. It is not accessible from the CP register read instructions. + * + * Starting from Haswell, you can't write registers using the MCHBAR mirror, + * just read. On MTL+ the mirror no longer exists. + */ + +#define MCHBAR_MIRROR_BASE 0x10000 +#define MCHBAR_MIRROR_END 0x13fff + +#define MCHBAR_MIRROR_BASE_SNB 0x140000 +#define MCHBAR_MIRROR_END_SNB 0x147fff +#define MCHBAR_MIRROR_END_ICL_RKL 0x14ffff +#define MCHBAR_MIRROR_END_TGL 0x15ffff + +#define CTG_STOLEN_RESERVED _MMIO(MCHBAR_MIRROR_BASE + 0x34) +#define ELK_STOLEN_RESERVED _MMIO(MCHBAR_MIRROR_BASE + 0x48) +#define G4X_STOLEN_RESERVED_ADDR1_MASK (0xFFFF << 16) +#define G4X_STOLEN_RESERVED_ADDR2_MASK (0xFFF << 4) +#define G4X_STOLEN_RESERVED_ENABLE (1 << 0) + +/* Pineview MCH register contains DDR3 setting */ +#define CSHRDDR3CTL _MMIO(MCHBAR_MIRROR_BASE + 0x1a8) +#define CSHRDDR3CTL_DDR3 (1 << 2) + +/* 915-945 and GM965 MCH register controlling DRAM channel access */ +#define DCC _MMIO(MCHBAR_MIRROR_BASE + 0x200) +#define DCC_ADDRESSING_MODE_SINGLE_CHANNEL (0 << 0) +#define DCC_ADDRESSING_MODE_DUAL_CHANNEL_ASYMMETRIC (1 << 0) +#define DCC_ADDRESSING_MODE_DUAL_CHANNEL_INTERLEAVED (2 << 0) +#define DCC_ADDRESSING_MODE_MASK (3 << 0) +#define DCC_CHANNEL_XOR_DISABLE (1 << 10) +#define DCC_CHANNEL_XOR_BIT_17 (1 << 9) +#define DCC2 _MMIO(MCHBAR_MIRROR_BASE + 0x204) +#define DCC2_MODIFIED_ENHANCED_DISABLE (1 << 20) + +/* 965 MCH register controlling DRAM channel configuration */ +#define C0DRB3_BW _MMIO(MCHBAR_MIRROR_BASE + 0x206) +#define C1DRB3_BW _MMIO(MCHBAR_MIRROR_BASE + 0x606) + +/* Clocking configuration register */ +#define CLKCFG _MMIO(MCHBAR_MIRROR_BASE + 0xc00) +#define CLKCFG_FSB_400 (0 << 0) /* hrawclk 100 */ +#define CLKCFG_FSB_400_ALT (5 << 0) /* hrawclk 100 */ +#define CLKCFG_FSB_533 (1 << 0) /* hrawclk 133 */ +#define CLKCFG_FSB_667 (3 << 0) /* hrawclk 166 */ +#define CLKCFG_FSB_800 (2 << 0) /* hrawclk 200 */ +#define CLKCFG_FSB_1067 (6 << 0) /* hrawclk 266 */ +#define CLKCFG_FSB_1067_ALT (0 << 0) /* hrawclk 266 */ +#define CLKCFG_FSB_1333 (7 << 0) /* hrawclk 333 */ +#define CLKCFG_FSB_1333_ALT (4 << 0) /* hrawclk 333 */ +#define CLKCFG_FSB_1600_ALT (6 << 0) /* hrawclk 400 */ +#define CLKCFG_FSB_MASK (7 << 0) +#define CLKCFG_MEM_533 (1 << 4) +#define CLKCFG_MEM_667 (2 << 4) +#define CLKCFG_MEM_800 (3 << 4) +#define CLKCFG_MEM_MASK (7 << 4) + +#define HPLLVCO_MOBILE _MMIO(MCHBAR_MIRROR_BASE + 0xc0f) +#define HPLLVCO _MMIO(MCHBAR_MIRROR_BASE + 0xc38) + +#define TSC1 _MMIO(MCHBAR_MIRROR_BASE + 0x1001) +#define TSE (1 << 0) +#define TR1 _MMIO(MCHBAR_MIRROR_BASE + 0x1006) +#define TSFS _MMIO(MCHBAR_MIRROR_BASE + 0x1020) +#define TSFS_SLOPE_MASK 0x0000ff00 +#define TSFS_SLOPE_SHIFT 8 +#define TSFS_INTR_MASK 0x000000ff + +/* Memory latency timer register */ +#define MLTR_ILK _MMIO(MCHBAR_MIRROR_BASE + 0x1222) +/* the unit of memory self-refresh latency time is 0.5us */ +#define MLTR_WM2_MASK REG_GENMASK(13, 8) +#define MLTR_WM1_MASK REG_GENMASK(5, 0) + +#define CSIPLL0 _MMIO(MCHBAR_MIRROR_BASE + 0x2c10) +#define DDRMPLL1 _MMIO(MCHBAR_MIRROR_BASE + 0x2c20) + +#define ILK_GDSR _MMIO(MCHBAR_MIRROR_BASE + 0x2ca4) +#define ILK_GRDOM_FULL (0 << 1) +#define ILK_GRDOM_RENDER (1 << 1) +#define ILK_GRDOM_MEDIA (3 << 1) +#define ILK_GRDOM_MASK (3 << 1) +#define ILK_GRDOM_RESET_ENABLE (1 << 0) + +#define BXT_D_CR_DRP0_DUNIT8 0x1000 +#define BXT_D_CR_DRP0_DUNIT9 0x1200 +#define BXT_D_CR_DRP0_DUNIT_START 8 +#define BXT_D_CR_DRP0_DUNIT_END 11 +#define BXT_D_CR_DRP0_DUNIT(x) _MMIO(MCHBAR_MIRROR_BASE_SNB + \ + _PICK_EVEN((x) - 8, BXT_D_CR_DRP0_DUNIT8,\ + BXT_D_CR_DRP0_DUNIT9)) +#define BXT_DRAM_RANK_MASK 0x3 +#define BXT_DRAM_RANK_SINGLE 0x1 +#define BXT_DRAM_RANK_DUAL 0x3 +#define BXT_DRAM_WIDTH_MASK (0x3 << 4) +#define BXT_DRAM_WIDTH_SHIFT 4 +#define BXT_DRAM_WIDTH_X8 (0x0 << 4) +#define BXT_DRAM_WIDTH_X16 (0x1 << 4) +#define BXT_DRAM_WIDTH_X32 (0x2 << 4) +#define BXT_DRAM_WIDTH_X64 (0x3 << 4) +#define BXT_DRAM_SIZE_MASK (0x7 << 6) +#define BXT_DRAM_SIZE_SHIFT 6 +#define BXT_DRAM_SIZE_4GBIT (0x0 << 6) +#define BXT_DRAM_SIZE_6GBIT (0x1 << 6) +#define BXT_DRAM_SIZE_8GBIT (0x2 << 6) +#define BXT_DRAM_SIZE_12GBIT (0x3 << 6) +#define BXT_DRAM_SIZE_16GBIT (0x4 << 6) +#define BXT_DRAM_TYPE_MASK (0x7 << 22) +#define BXT_DRAM_TYPE_SHIFT 22 +#define BXT_DRAM_TYPE_DDR3 (0x0 << 22) +#define BXT_DRAM_TYPE_LPDDR3 (0x1 << 22) +#define BXT_DRAM_TYPE_LPDDR4 (0x2 << 22) +#define BXT_DRAM_TYPE_DDR4 (0x4 << 22) + +#define MCHBAR_CH0_CR_TC_PRE_0_0_0_MCHBAR _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x4000) +#define DG1_DRAM_T_RDPRE_MASK REG_GENMASK(16, 11) +#define DG1_DRAM_T_RP_MASK REG_GENMASK(6, 0) +#define MCHBAR_CH0_CR_TC_PRE_0_0_0_MCHBAR_HIGH _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x4004) +#define DG1_DRAM_T_RCD_MASK REG_GENMASK(15, 9) +#define DG1_DRAM_T_RAS_MASK REG_GENMASK(8, 1) + +#define SKL_MAD_INTER_CHANNEL_0_0_0_MCHBAR_MCMAIN _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5000) +#define SKL_DRAM_DDR_TYPE_MASK REG_GENMASK(1, 0) +#define SKL_DRAM_DDR_TYPE_DDR4 REG_FIELD_PREP(SKL_DRAM_DDR_TYPE_MASK, 0) +#define SKL_DRAM_DDR_TYPE_DDR3 REG_FIELD_PREP(SKL_DRAM_DDR_TYPE_MASK, 1) +#define SKL_DRAM_DDR_TYPE_LPDDR3 REG_FIELD_PREP(SKL_DRAM_DDR_TYPE_MASK, 2) +#define SKL_DRAM_DDR_TYPE_LPDDR4 REG_FIELD_PREP(SKL_DRAM_DDR_TYPE_MASK, 3) + +/* snb MCH registers for reading the DRAM channel configuration */ +#define MAD_DIMM_C0 _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5004) +#define MAD_DIMM_C1 _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5008) +#define MAD_DIMM_C2 _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x500C) +#define MAD_DIMM_ECC_MASK (0x3 << 24) +#define MAD_DIMM_ECC_OFF (0x0 << 24) +#define MAD_DIMM_ECC_IO_ON_LOGIC_OFF (0x1 << 24) +#define MAD_DIMM_ECC_IO_OFF_LOGIC_ON (0x2 << 24) +#define MAD_DIMM_ECC_ON (0x3 << 24) +#define MAD_DIMM_ENH_INTERLEAVE (0x1 << 22) +#define MAD_DIMM_RANK_INTERLEAVE (0x1 << 21) +#define MAD_DIMM_B_WIDTH_X16 (0x1 << 20) /* X8 chips if unset */ +#define MAD_DIMM_A_WIDTH_X16 (0x1 << 19) /* X8 chips if unset */ +#define MAD_DIMM_B_DUAL_RANK (0x1 << 18) +#define MAD_DIMM_A_DUAL_RANK (0x1 << 17) +#define MAD_DIMM_A_SELECT (0x1 << 16) +/* DIMM sizes are in multiples of 256mb. */ +#define MAD_DIMM_B_SIZE_SHIFT 8 +#define MAD_DIMM_B_SIZE_MASK (0xff << MAD_DIMM_B_SIZE_SHIFT) +#define MAD_DIMM_A_SIZE_SHIFT 0 +#define MAD_DIMM_A_SIZE_MASK (0xff << MAD_DIMM_A_SIZE_SHIFT) + +#define SKL_MAD_DIMM_CH0_0_0_0_MCHBAR_MCMAIN _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x500C) +#define SKL_MAD_DIMM_CH1_0_0_0_MCHBAR_MCMAIN _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5010) +#define SKL_DIMM_S_RANK_MASK REG_GENMASK(26, 26) +#define SKL_DIMM_S_RANK_1 REG_FIELD_PREP(SKL_DIMM_S_RANK_MASK, 0) +#define SKL_DIMM_S_RANK_2 REG_FIELD_PREP(SKL_DIMM_S_RANK_MASK, 1) +#define SKL_DIMM_S_WIDTH_MASK REG_GENMASK(25, 24) +#define SKL_DIMM_S_WIDTH_X8 REG_FIELD_PREP(SKL_DIMM_S_WIDTH_MASK, 0) +#define SKL_DIMM_S_WIDTH_X16 REG_FIELD_PREP(SKL_DIMM_S_WIDTH_MASK, 1) +#define SKL_DIMM_S_WIDTH_X32 REG_FIELD_PREP(SKL_DIMM_S_WIDTH_MASK, 2) +#define SKL_DIMM_S_SIZE_MASK REG_GENMASK(21, 16) +#define SKL_DIMM_L_RANK_MASK REG_GENMASK(10, 10) +#define SKL_DIMM_L_RANK_1 REG_FIELD_PREP(SKL_DIMM_L_RANK_MASK, 0) +#define SKL_DIMM_L_RANK_2 REG_FIELD_PREP(SKL_DIMM_L_RANK_MASK, 1) +#define SKL_DIMM_L_WIDTH_MASK REG_GENMASK(9, 8) +#define SKL_DIMM_L_WIDTH_X8 REG_FIELD_PREP(SKL_DIMM_L_WIDTH_MASK, 0) +#define SKL_DIMM_L_WIDTH_X16 REG_FIELD_PREP(SKL_DIMM_L_WIDTH_MASK, 1) +#define SKL_DIMM_L_WIDTH_X32 REG_FIELD_PREP(SKL_DIMM_L_WIDTH_MASK, 2) +#define SKL_DIMM_L_SIZE_MASK REG_GENMASK(5, 0) +#define ICL_DIMM_S_RANK_MASK REG_GENMASK(27, 26) +#define ICL_DIMM_S_RANK_1 REG_FIELD_PREP(ICL_DIMM_S_RANK_MASK, 0) +#define ICL_DIMM_S_RANK_2 REG_FIELD_PREP(ICL_DIMM_S_RANK_MASK, 1) +#define ICL_DIMM_S_WIDTH_MASK REG_GENMASK(25, 24) +#define ICL_DIMM_S_WIDTH_X8 REG_FIELD_PREP(ICL_DIMM_S_WIDTH_MASK, 0) +#define ICL_DIMM_S_WIDTH_X16 REG_FIELD_PREP(ICL_DIMM_S_WIDTH_MASK, 1) +#define ICL_DIMM_S_WIDTH_X32 REG_FIELD_PREP(ICL_DIMM_S_WIDTH_MASK, 2) +#define ICL_DIMM_S_SIZE_MASK REG_GENMASK(22, 16) +#define ICL_DIMM_L_RANK_MASK REG_GENMASK(10, 9) +#define ICL_DIMM_L_RANK_1 REG_FIELD_PREP(ICL_DIMM_L_RANK_MASK, 0) +#define ICL_DIMM_L_RANK_2 REG_FIELD_PREP(ICL_DIMM_L_RANK_MASK, 1) +#define ICL_DIMM_L_RANK_3 REG_FIELD_PREP(ICL_DIMM_L_RANK_MASK, 2) +#define ICL_DIMM_L_RANK_4 REG_FIELD_PREP(ICL_DIMM_L_RANK_MASK, 3) +#define ICL_DIMM_L_WIDTH_MASK REG_GENMASK(8, 7) +#define ICL_DIMM_L_WIDTH_X8 REG_FIELD_PREP(ICL_DIMM_L_WIDTH_MASK, 0) +#define ICL_DIMM_L_WIDTH_X16 REG_FIELD_PREP(ICL_DIMM_L_WIDTH_MASK, 1) +#define ICL_DIMM_L_WIDTH_X32 REG_FIELD_PREP(ICL_DIMM_L_WIDTH_MASK, 2) +#define ICL_DIMM_L_SIZE_MASK REG_GENMASK(6, 0) + +#define SA_PERF_STATUS_0_0_0_MCHBAR_PC _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5918) +#define DG1_QCLK_RATIO_MASK REG_GENMASK(9, 2) +#define DG1_QCLK_REFERENCE REG_BIT(10) + +/* + * *_PACKAGE_POWER_SKU - SKU power and timing parameters. + */ +#define PCU_PACKAGE_POWER_SKU _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5930) +#define PKG_PKG_TDP GENMASK_ULL(14, 0) +#define PKG_MIN_PWR GENMASK_ULL(30, 16) +#define PKG_MAX_PWR GENMASK_ULL(46, 32) +#define PKG_MAX_WIN GENMASK_ULL(54, 48) +#define PKG_MAX_WIN_X GENMASK_ULL(54, 53) +#define PKG_MAX_WIN_Y GENMASK_ULL(52, 48) + +#define PCU_PACKAGE_POWER_SKU_UNIT _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5938) +#define PKG_PWR_UNIT REG_GENMASK(3, 0) +#define PKG_ENERGY_UNIT REG_GENMASK(12, 8) +#define PKG_TIME_UNIT REG_GENMASK(19, 16) +#define PCU_PACKAGE_ENERGY_STATUS _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x593c) + +#define GEN6_GT_PERF_STATUS _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5948) + +#define PCU_PACKAGE_TEMPERATURE _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5978) +#define TEMP_MASK REG_GENMASK(7, 0) + +#define GEN6_RP_STATE_LIMITS _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5994) +#define GEN6_RP_STATE_CAP _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5998) +#define RP0_CAP_MASK REG_GENMASK(7, 0) +#define RP1_CAP_MASK REG_GENMASK(15, 8) +#define RPN_CAP_MASK REG_GENMASK(23, 16) + +#define GEN10_FREQ_INFO_REC _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5ef0) +#define RPE_MASK REG_GENMASK(15, 8) +#define PCU_PACKAGE_RAPL_LIMIT _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x59a0) +#define PKG_PWR_LIM_1 REG_GENMASK(14, 0) +#define PKG_PWR_LIM_1_EN REG_BIT(15) +#define PKG_PWR_LIM_1_TIME REG_GENMASK(23, 17) +#define PKG_PWR_LIM_1_TIME_X REG_GENMASK(23, 22) +#define PKG_PWR_LIM_1_TIME_Y REG_GENMASK(21, 17) + +/* snb MCH registers for priority tuning */ +#define MCH_SSKPD _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5d10) +#define SSKPD_NEW_WM0_MASK_HSW REG_GENMASK64(63, 56) +#define SSKPD_WM4_MASK_HSW REG_GENMASK64(40, 32) +#define SSKPD_WM3_MASK_HSW REG_GENMASK64(28, 20) +#define SSKPD_WM2_MASK_HSW REG_GENMASK64(19, 12) +#define SSKPD_WM1_MASK_HSW REG_GENMASK64(11, 4) +#define SSKPD_OLD_WM0_MASK_HSW REG_GENMASK64(3, 0) +#define SSKPD_WM3_MASK_SNB REG_GENMASK(29, 24) +#define SSKPD_WM2_MASK_SNB REG_GENMASK(21, 16) +#define SSKPD_WM1_MASK_SNB REG_GENMASK(13, 8) +#define SSKPD_WM0_MASK_SNB REG_GENMASK(5, 0) + +/* Memory controller frequency in MCHBAR for Haswell (possible SNB+) */ +#define DCLK _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5e04) +#define SKL_MC_BIOS_DATA_0_0_0_MCHBAR_PCU _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5e04) +#define DG1_GEAR_TYPE REG_BIT(16) + +/* + * Please see hsw_read_dcomp() and hsw_write_dcomp() before using this register, + * since on HSW we can't write to it using intel_uncore_write. + */ +#define D_COMP_HSW _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x5f0c) +#define D_COMP_RCOMP_IN_PROGRESS (1 << 9) +#define D_COMP_COMP_FORCE (1 << 8) +#define D_COMP_COMP_DISABLE (1 << 0) + +#define BXT_GT_PERF_STATUS _MMIO(MCHBAR_MIRROR_BASE_SNB + 0x7070) + +#endif /* __INTEL_MCHBAR_REGS */ -- cgit v1.2.3 From 8b1858aaaa20255a42d8eefe7e913c161331af0c Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Tue, 7 Apr 2026 22:36:30 +0300 Subject: drm/i915/pci: move intel_pci_config.h under include/drm/intel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since the PCI registers are used from both i915 display and core, move intel_pci_config.h to include/drm/intel/pci_config.h. Drop the intel_ prefix from the name to reduce tautology. With this, we can drop the corresponding xe display compat header. v2: Rebase Reviewed-by: Ville Syrjälä Link: https://patch.msgid.link/5aac6c711c3f0a09fc52f322455a4a4b35f80a82.1775590536.git.jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/intel/pci_config.h | 110 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) create mode 100644 include/drm/intel/pci_config.h (limited to 'include') diff --git a/include/drm/intel/pci_config.h b/include/drm/intel/pci_config.h new file mode 100644 index 000000000000..ebe040828e20 --- /dev/null +++ b/include/drm/intel/pci_config.h @@ -0,0 +1,110 @@ +/* SPDX-License-Identifier: MIT */ +/* + * Copyright © 2022 Intel Corporation + */ + +#ifndef __INTEL_PCI_CONFIG_H__ +#define __INTEL_PCI_CONFIG_H__ + +/* PCI BARs */ +#define GEN2_GMADR_BAR 0 +#define GEN2_MMADR_BAR 1 /* MMIO+GTT, despite the name */ +#define GEN2_IO_BAR 2 /* 85x/865 */ + +#define GEN3_MMADR_BAR 0 /* MMIO only */ +#define GEN3_IO_BAR 1 +#define GEN3_GMADR_BAR 2 +#define GEN3_GTTADR_BAR 3 /* GTT only */ + +#define GEN4_GTTMMADR_BAR 0 /* MMIO+GTT */ +#define GEN4_GMADR_BAR 2 +#define GEN4_IO_BAR 4 + +#define GEN12_LMEM_BAR 2 + +static inline int intel_mmio_bar(int graphics_ver) +{ + switch (graphics_ver) { + case 2: return GEN2_MMADR_BAR; + case 3: return GEN3_MMADR_BAR; + default: return GEN4_GTTMMADR_BAR; + } +} + +/* BSM in include/drm/intel/i915_drm.h */ + +#define MCHBAR_I915 0x44 +#define MCHBAR_I965 0x48 +#define MCHBAR_SIZE (4 * 4096) + +#define DEVEN 0x54 +#define DEVEN_MCHBAR_EN (1 << 28) + +#define HPLLCC 0xc0 /* 85x only */ +#define GC_CLOCK_CONTROL_MASK (0x7 << 0) +#define GC_CLOCK_133_200 (0 << 0) +#define GC_CLOCK_100_200 (1 << 0) +#define GC_CLOCK_100_133 (2 << 0) +#define GC_CLOCK_133_266 (3 << 0) +#define GC_CLOCK_133_200_2 (4 << 0) +#define GC_CLOCK_133_266_2 (5 << 0) +#define GC_CLOCK_166_266 (6 << 0) +#define GC_CLOCK_166_250 (7 << 0) + +#define I915_GDRST 0xc0 +#define GRDOM_FULL (0 << 2) +#define GRDOM_RENDER (1 << 2) +#define GRDOM_MEDIA (3 << 2) +#define GRDOM_MASK (3 << 2) +#define GRDOM_RESET_STATUS (1 << 1) +#define GRDOM_RESET_ENABLE (1 << 0) + +/* BSpec only has register offset, PCI device and bit found empirically */ +#define I830_CLOCK_GATE 0xc8 /* device 0 */ +#define I830_L2_CACHE_CLOCK_GATE_DISABLE (1 << 2) + +#define GCDGMBUS 0xcc + +#define GCFGC2 0xda +#define GCFGC 0xf0 /* 915+ only */ +#define GC_LOW_FREQUENCY_ENABLE (1 << 7) +#define GC_DISPLAY_CLOCK_190_200_MHZ (0 << 4) +#define GC_DISPLAY_CLOCK_333_320_MHZ (4 << 4) +#define GC_DISPLAY_CLOCK_267_MHZ_PNV (0 << 4) +#define GC_DISPLAY_CLOCK_333_MHZ_PNV (1 << 4) +#define GC_DISPLAY_CLOCK_444_MHZ_PNV (2 << 4) +#define GC_DISPLAY_CLOCK_200_MHZ_PNV (5 << 4) +#define GC_DISPLAY_CLOCK_133_MHZ_PNV (6 << 4) +#define GC_DISPLAY_CLOCK_167_MHZ_PNV (7 << 4) +#define GC_DISPLAY_CLOCK_MASK (7 << 4) +#define GM45_GC_RENDER_CLOCK_MASK (0xf << 0) +#define GM45_GC_RENDER_CLOCK_266_MHZ (8 << 0) +#define GM45_GC_RENDER_CLOCK_320_MHZ (9 << 0) +#define GM45_GC_RENDER_CLOCK_400_MHZ (0xb << 0) +#define GM45_GC_RENDER_CLOCK_533_MHZ (0xc << 0) +#define I965_GC_RENDER_CLOCK_MASK (0xf << 0) +#define I965_GC_RENDER_CLOCK_267_MHZ (2 << 0) +#define I965_GC_RENDER_CLOCK_333_MHZ (3 << 0) +#define I965_GC_RENDER_CLOCK_444_MHZ (4 << 0) +#define I965_GC_RENDER_CLOCK_533_MHZ (5 << 0) +#define I945_GC_RENDER_CLOCK_MASK (7 << 0) +#define I945_GC_RENDER_CLOCK_166_MHZ (0 << 0) +#define I945_GC_RENDER_CLOCK_200_MHZ (1 << 0) +#define I945_GC_RENDER_CLOCK_250_MHZ (3 << 0) +#define I945_GC_RENDER_CLOCK_400_MHZ (5 << 0) +#define I915_GC_RENDER_CLOCK_MASK (7 << 0) +#define I915_GC_RENDER_CLOCK_166_MHZ (0 << 0) +#define I915_GC_RENDER_CLOCK_200_MHZ (1 << 0) +#define I915_GC_RENDER_CLOCK_333_MHZ (4 << 0) + +#define ASLE 0xe4 +#define ASLS 0xfc + +#define SWSCI 0xe8 +#define SWSCI_SCISEL (1 << 15) +#define SWSCI_GSSCIE (1 << 0) + +/* legacy/combination backlight modes, also called LBB */ +#define LBPC 0xf4 + +#endif /* __INTEL_PCI_CONFIG_H__ */ -- cgit v1.2.3 From 3233db7682e759d101028285386ee7a11183fa2a Mon Sep 17 00:00:00 2001 From: Shuicheng Lin Date: Tue, 7 Apr 2026 03:00:41 +0000 Subject: drm/xe/uapi: Fix typos and spelling errors in xe_drm.h documentation Fix the following typos and spelling errors in doc comments: - creaed -> created (drm_xe_query_config) - mmaping -> mmapping (drm_xe_gem_create) - 0xdeadbeaf -> 0xdeadbeef (drm_xe_gem_mmap_offset) - x2 and xe3 platform -> Xe2 and Xe3 platforms - flat -> flag (drm_xe_wait_user_fence) - MONOTONIC_CLOCK -> CLOCK_MONOTONIC (correct POSIX name) - neverending -> never ending (drm_xe_wait_user_fence) Assisted-by: GitHub Copilot:claude-opus-4.6 Reviewed-by: Xin Wang Link: https://patch.msgid.link/20260407030046.3394004-2-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin --- include/uapi/drm/xe_drm.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h index ae2fda23ce7c..f17355684083 100644 --- a/include/uapi/drm/xe_drm.h +++ b/include/uapi/drm/xe_drm.h @@ -410,7 +410,7 @@ struct drm_xe_query_mem_regions { * device supports the userspace hint %DRM_XE_GEM_CREATE_FLAG_NO_COMPRESSION. * This is exposed only on Xe2+. * - %DRM_XE_QUERY_CONFIG_FLAG_HAS_DISABLE_STATE_CACHE_PERF_FIX - Flag is set - * if a queue can be creaed with + * if a queue can be created with * %DRM_XE_EXEC_QUEUE_SET_DISABLE_STATE_CACHE_PERF_FIX * - %DRM_XE_QUERY_CONFIG_MIN_ALIGNMENT - Minimal memory alignment * required by this device, typically SZ_4K or SZ_64K @@ -888,7 +888,7 @@ struct drm_xe_gem_create { #define DRM_XE_GEM_CPU_CACHING_WC 2 /** * @cpu_caching: The CPU caching mode to select for this object. If - * mmaping the object the mode selected here will also be used. The + * mmapping the object the mode selected here will also be used. The * exception is when mapping system memory (including data evicted * to system) on discrete GPUs. The caching mode selected will * then be overridden to DRM_XE_GEM_CPU_CACHING_WB, and coherency @@ -931,7 +931,7 @@ struct drm_xe_gem_create { * * err = ioctl(fd, DRM_IOCTL_XE_GEM_MMAP_OFFSET, &mmo); * map = mmap(NULL, size, PROT_WRITE, MAP_SHARED, fd, mmo.offset); - * map[i] = 0xdeadbeaf; // issue barrier + * map[i] = 0xdeadbeef; // issue barrier */ struct drm_xe_gem_mmap_offset { /** @extensions: Pointer to the first extension struct, if any */ @@ -958,8 +958,8 @@ struct drm_xe_gem_mmap_offset { * - %DRM_XE_VM_CREATE_FLAG_SCRATCH_PAGE - Map the whole virtual address * space of the VM to scratch page. A vm_bind would overwrite the scratch * page mapping. This flag is mutually exclusive with the - * %DRM_XE_VM_CREATE_FLAG_FAULT_MODE flag, with an exception of on x2 and - * xe3 platform. + * %DRM_XE_VM_CREATE_FLAG_FAULT_MODE flag, with an exception on Xe2 and + * Xe3 platforms. * - %DRM_XE_VM_CREATE_FLAG_LR_MODE - An LR, or Long Running VM accepts * exec submissions to its exec_queues that don't have an upper time * limit on the job execution time. But exec submissions to these @@ -1695,9 +1695,9 @@ struct drm_xe_wait_user_fence { * Without DRM_XE_UFENCE_WAIT_FLAG_ABSTIME flag set (relative timeout) * it contains timeout expressed in nanoseconds to wait (fence will * expire at now() + timeout). - * When DRM_XE_UFENCE_WAIT_FLAG_ABSTIME flat is set (absolute timeout) wait - * will end at timeout (uses system MONOTONIC_CLOCK). - * Passing negative timeout leads to neverending wait. + * When DRM_XE_UFENCE_WAIT_FLAG_ABSTIME flag is set (absolute timeout) wait + * will end at timeout (uses system CLOCK_MONOTONIC). + * Passing negative timeout leads to never ending wait. * * On relative timeout this value is updated with timeout left * (for restarting the call in case of signal delivery). -- cgit v1.2.3 From 65d53c13d43b8b5690c326807c1535b1d19138e8 Mon Sep 17 00:00:00 2001 From: Shuicheng Lin Date: Tue, 7 Apr 2026 03:00:42 +0000 Subject: drm/xe/uapi: Fix grammar errors in xe_drm.h documentation Fix various grammar issues in doc comments: - flag are only valid -> flag is only valid - should only ever used -> should only ever be used - if isn't already -> if it isn't already - Type of the this -> Type of this - When sync passed in -> When sync is passed in - the users responsibility -> the user's responsibility - must qword aligned -> must be qword aligned - for a observation -> for an observation - a memory ranges -> memory ranges - for each memory ranges -> for each memory range. - Second ioctl call -> second ioctl call Assisted-by: GitHub Copilot:claude-opus-4.6 Reviewed-by: Xin Wang Link: https://patch.msgid.link/20260407030046.3394004-3-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin --- include/uapi/drm/xe_drm.h | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h index f17355684083..1d3406416d8c 100644 --- a/include/uapi/drm/xe_drm.h +++ b/include/uapi/drm/xe_drm.h @@ -1045,7 +1045,7 @@ struct drm_xe_vm_destroy { * set, no mappings are created rather the range is reserved for CPU address * mirroring which will be populated on GPU page faults or prefetches. Only * valid on VMs with DRM_XE_VM_CREATE_FLAG_FAULT_MODE set. The CPU address - * mirror flag are only valid for DRM_XE_VM_BIND_OP_MAP operations, the BO + * mirror flag is only valid for DRM_XE_VM_BIND_OP_MAP operations, the BO * handle MBZ, and the BO offset MBZ. * - %DRM_XE_VM_BIND_FLAG_MADVISE_AUTORESET - Can be used in combination with * %DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR to reset madvises when the underlying @@ -1109,7 +1109,7 @@ struct drm_xe_vm_bind_op { * ppGTT WT -> COH_NONE * ppGTT WB -> COH_AT_LEAST_1WAY * - * In practice UC/WC/WT should only ever used for scanout surfaces on + * In practice UC/WC/WT should only ever be used for scanout surfaces on * such platforms (or perhaps in general for dma-buf if shared with * another device) since it is only the display engine that is actually * incoherent. Everything else should typically use WB given that we @@ -1366,7 +1366,7 @@ struct drm_xe_vm_get_property { * drm_xe_pxp_session_type. %DRM_XE_PXP_TYPE_NONE is the default behavior, so * there is no need to explicitly set that. When a queue of type * %DRM_XE_PXP_TYPE_HWDRM is created, the PXP default HWDRM session - * (%XE_PXP_HWDRM_DEFAULT_SESSION) will be started, if isn't already running. + * (%XE_PXP_HWDRM_DEFAULT_SESSION) will be started, if it isn't already running. * The user is expected to query the PXP status via the query ioctl (see * %DRM_XE_DEVICE_QUERY_PXP_STATUS) and to wait for PXP to be ready before * attempting to create a queue with this property. When a queue is created @@ -1546,7 +1546,7 @@ struct drm_xe_sync { #define DRM_XE_SYNC_TYPE_SYNCOBJ 0x0 #define DRM_XE_SYNC_TYPE_TIMELINE_SYNCOBJ 0x1 #define DRM_XE_SYNC_TYPE_USER_FENCE 0x2 - /** @type: Type of the this sync object */ + /** @type: Type of this sync object */ __u32 type; #define DRM_XE_SYNC_FLAG_SIGNAL (1 << 0) @@ -1559,9 +1559,9 @@ struct drm_xe_sync { /** * @addr: Address of user fence. When sync is passed in via exec - * IOCTL this is a GPU address in the VM. When sync passed in via + * IOCTL this is a GPU address in the VM. When sync is passed in via * VM bind IOCTL this is a user pointer. In either case, it is - * the users responsibility that this address is present and + * the user's responsibility that this address is present and * mapped when the user fence is signalled. Must be qword * aligned. */ @@ -1664,7 +1664,7 @@ struct drm_xe_wait_user_fence { __u64 extensions; /** - * @addr: user pointer address to wait on, must qword aligned + * @addr: user pointer address to wait on, must be qword aligned */ __u64 addr; @@ -1769,7 +1769,7 @@ enum drm_xe_observation_ioctls { /** @DRM_XE_OBSERVATION_IOCTL_ENABLE: Enable data capture for an observation stream */ DRM_XE_OBSERVATION_IOCTL_ENABLE = _IO('i', 0x0), - /** @DRM_XE_OBSERVATION_IOCTL_DISABLE: Disable data capture for a observation stream */ + /** @DRM_XE_OBSERVATION_IOCTL_DISABLE: Disable data capture for an observation stream */ DRM_XE_OBSERVATION_IOCTL_DISABLE = _IO('i', 0x1), /** @DRM_XE_OBSERVATION_IOCTL_CONFIG: Change observation stream configuration */ @@ -2373,12 +2373,12 @@ struct drm_xe_madvise { * * This structure is provided by userspace and filled by KMD in response to the * DRM_IOCTL_XE_VM_QUERY_MEM_RANGES_ATTRS ioctl. It describes memory attributes of - * a memory ranges within a user specified address range in a VM. + * memory ranges within a user specified address range in a VM. * * The structure includes information such as atomic access policy, * page attribute table (PAT) index, and preferred memory location. * Userspace allocates an array of these structures and passes a pointer to the - * ioctl to retrieve attributes for each memory ranges + * ioctl to retrieve attributes for each memory range. * * @extensions: Pointer to the first extension struct, if any * @start: Start address of the memory range @@ -2443,7 +2443,7 @@ struct drm_xe_mem_range_attr { * If second call fails with -ENOSPC, it means memory ranges changed between * first call and now, retry IOCTL again with @num_mem_ranges = 0, * @sizeof_mem_ranges_attr = 0 and @vector_of_vma_mem_attr = NULL followed by - * Second ioctl call. + * second ioctl call. * * Example: * -- cgit v1.2.3 From ea842c235828152258fc5197212e896bc59d7b83 Mon Sep 17 00:00:00 2001 From: Shuicheng Lin Date: Tue, 7 Apr 2026 03:00:43 +0000 Subject: drm/xe/uapi: Fix wrong names and references in xe_drm.h Fix incorrect field names, struct names, ioctl names, and descriptions in doc comments: - probed_size -> @cpu_visible_size (correct field name) - @flags description was copy of @placement -> fix to reference DRM_XE_GEM_CREATE_FLAG_* - %XE_PXP_HWDRM_DEFAULT_SESSION -> %DRM_XE_PXP_HWDRM_DEFAULT_SESSION (missing DRM_ prefix) - Remove undefined %DRM_XE_UFENCE_WAIT_FLAG_SOFT_OP - &DRM_XE_OBSERVATION -> &DRM_IOCTL_XE_OBSERVATION - id's/struct's -> IDs/structs (fix incorrect possessive forms) - drm_xe_query_oa_units -> drm_xe_oa_unit - DRM_IOCTL_XE_VM_QUERY_MEM_RANGES_ATTRS -> DRM_IOCTL_XE_VM_QUERY_MEM_RANGE_ATTRS - DRM_IOCTL_XE_VM_QUERY_MEM_ATTRIBUTES -> DRM_IOCTL_XE_VM_QUERY_MEM_RANGE_ATTRS - @sizeof_mem_ranges_attr -> @sizeof_mem_range_attr - @vector_of_vma_mem_attr -> @vector_of_mem_attr v3: id -> ID. (Xin) split cross-reference fix to seperate patch. Assisted-by: GitHub Copilot:claude-opus-4.6 Cc: Xin Wang Reviewed-by: Xin Wang Link: https://patch.msgid.link/20260407030046.3394004-4-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin --- include/uapi/drm/xe_drm.h | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) (limited to 'include') diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h index 1d3406416d8c..ad8e3b69a3d7 100644 --- a/include/uapi/drm/xe_drm.h +++ b/include/uapi/drm/xe_drm.h @@ -349,7 +349,7 @@ struct drm_xe_mem_region { * is smaller than @total_size then this is referred to as a * small BAR system. * - * On systems without small BAR (full BAR), the probed_size will + * On systems without small BAR (full BAR), the @cpu_visible_size will * always equal the @total_size, since all of it will be CPU * accessible. * @@ -862,8 +862,7 @@ struct drm_xe_gem_create { #define DRM_XE_GEM_CREATE_FLAG_NEEDS_VISIBLE_VRAM (1 << 2) #define DRM_XE_GEM_CREATE_FLAG_NO_COMPRESSION (1 << 3) /** - * @flags: Flags, currently a mask of memory instances of where BO can - * be placed + * @flags: Flags for the GEM object, see DRM_XE_GEM_CREATE_FLAG_* */ __u32 flags; @@ -1366,7 +1365,7 @@ struct drm_xe_vm_get_property { * drm_xe_pxp_session_type. %DRM_XE_PXP_TYPE_NONE is the default behavior, so * there is no need to explicitly set that. When a queue of type * %DRM_XE_PXP_TYPE_HWDRM is created, the PXP default HWDRM session - * (%XE_PXP_HWDRM_DEFAULT_SESSION) will be started, if it isn't already running. + * (%DRM_XE_PXP_HWDRM_DEFAULT_SESSION) will be started, if it isn't already running. * The user is expected to query the PXP status via the query ioctl (see * %DRM_XE_DEVICE_QUERY_PXP_STATUS) and to wait for PXP to be ready before * attempting to create a queue with this property. When a queue is created @@ -1651,7 +1650,6 @@ struct drm_xe_exec { * * and the @flags can be: * - %DRM_XE_UFENCE_WAIT_FLAG_ABSTIME - * - %DRM_XE_UFENCE_WAIT_FLAG_SOFT_OP * * The @mask values can be for example: * - 0xffu for u8 @@ -1741,7 +1739,7 @@ enum drm_xe_observation_op { }; /** - * struct drm_xe_observation_param - Input of &DRM_XE_OBSERVATION + * struct drm_xe_observation_param - Input of &DRM_IOCTL_XE_OBSERVATION * * The observation layer enables multiplexing observation streams of * multiple types. The actual params for a particular stream operation are @@ -1902,10 +1900,10 @@ enum drm_xe_oa_format_type { }; /** - * enum drm_xe_oa_property_id - OA stream property id's + * enum drm_xe_oa_property_id - OA stream property IDs * * Stream params are specified as a chain of @drm_xe_ext_set_property - * struct's, with @property values from enum @drm_xe_oa_property_id and + * structs, with @property values from enum @drm_xe_oa_property_id and * @drm_xe_user_extension base.name set to @DRM_XE_OA_EXTENSION_SET_PROPERTY. * @param field in struct @drm_xe_observation_param points to the first * @drm_xe_ext_set_property struct. @@ -1919,7 +1917,7 @@ enum drm_xe_oa_property_id { /** * @DRM_XE_OA_PROPERTY_OA_UNIT_ID: ID of the OA unit on which to open * the OA stream, see @oa_unit_id in 'struct - * drm_xe_query_oa_units'. Defaults to 0 if not provided. + * drm_xe_oa_unit'. Defaults to 0 if not provided. */ DRM_XE_OA_PROPERTY_OA_UNIT_ID = 1, @@ -2369,10 +2367,10 @@ struct drm_xe_madvise { }; /** - * struct drm_xe_mem_range_attr - Output of &DRM_IOCTL_XE_VM_QUERY_MEM_RANGES_ATTRS + * struct drm_xe_mem_range_attr - Output of &DRM_IOCTL_XE_VM_QUERY_MEM_RANGE_ATTRS * * This structure is provided by userspace and filled by KMD in response to the - * DRM_IOCTL_XE_VM_QUERY_MEM_RANGES_ATTRS ioctl. It describes memory attributes of + * DRM_IOCTL_XE_VM_QUERY_MEM_RANGE_ATTRS ioctl. It describes memory attributes of * memory ranges within a user specified address range in a VM. * * The structure includes information such as atomic access policy, @@ -2427,7 +2425,7 @@ struct drm_xe_mem_range_attr { }; /** - * struct drm_xe_vm_query_mem_range_attr - Input of &DRM_IOCTL_XE_VM_QUERY_MEM_ATTRIBUTES + * struct drm_xe_vm_query_mem_range_attr - Input of &DRM_IOCTL_XE_VM_QUERY_MEM_RANGE_ATTRS * * This structure is used to query memory attributes of memory regions * within a user specified address range in a VM. It provides detailed @@ -2435,14 +2433,14 @@ struct drm_xe_mem_range_attr { * page attribute table (PAT) index, and preferred memory location. * * Userspace first calls the ioctl with @num_mem_ranges = 0, - * @sizeof_mem_ranges_attr = 0 and @vector_of_vma_mem_attr = NULL to retrieve + * @sizeof_mem_range_attr = 0 and @vector_of_mem_attr = NULL to retrieve * the number of memory regions and size of each memory range attribute. * Then, it allocates a buffer of that size and calls the ioctl again to fill * the buffer with memory range attributes. * * If second call fails with -ENOSPC, it means memory ranges changed between * first call and now, retry IOCTL again with @num_mem_ranges = 0, - * @sizeof_mem_ranges_attr = 0 and @vector_of_vma_mem_attr = NULL followed by + * @sizeof_mem_range_attr = 0 and @vector_of_mem_attr = NULL followed by * second ioctl call. * * Example: -- cgit v1.2.3 From 4bd87e7c4d467ce1f9e3b56abebeffc2ba45a2fb Mon Sep 17 00:00:00 2001 From: Shuicheng Lin Date: Tue, 7 Apr 2026 03:00:44 +0000 Subject: drm/xe/uapi: Fix kernel-doc cross-reference syntax in xe_drm.h Fix incorrect kernel-doc cross-reference markup syntax throughout xe_drm.h: - @struct_name -> &struct name for cross-references to other structs (19 occurrences) - struct @name -> &struct name where struct keyword was mixed with @ syntax (8 occurrences) - enum @name -> &enum name for cross-references to other enums (5 occurrences) - &CONSTANT / @CONSTANT -> %CONSTANT for defines and enum values (15 occurrences) - @field references to members of other structs -> plain text, since @ only applies to the current struct's members (9 occurrences) Per kernel-doc conventions (Documentation/doc-guide/kernel-doc.rst): - '&struct name' creates hyperlinks to struct definitions - '&enum name' creates hyperlinks to enum definitions - '%NAME' references constants and defines - '@name' is only for parameters/members of the current context Assisted-by: GitHub Copilot:claude-opus-4.6 Suggested-by: Xin Wang Reviewed-by: Xin Wang Link: https://patch.msgid.link/20260407030046.3394004-5-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin --- include/uapi/drm/xe_drm.h | 106 +++++++++++++++++++++++----------------------- 1 file changed, 53 insertions(+), 53 deletions(-) (limited to 'include') diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h index ad8e3b69a3d7..8751ad7b845f 100644 --- a/include/uapi/drm/xe_drm.h +++ b/include/uapi/drm/xe_drm.h @@ -229,9 +229,9 @@ struct drm_xe_ext_set_property { /** * struct drm_xe_engine_class_instance - instance of an engine class * - * It is returned as part of the @drm_xe_engine, but it also is used as - * the input of engine selection for both @drm_xe_exec_queue_create and - * @drm_xe_query_engine_cycles + * It is returned as part of the &struct drm_xe_engine, but it also is used as + * the input of engine selection for both &struct drm_xe_exec_queue_create and + * &struct drm_xe_query_engine_cycles * * The @engine_class can be: * - %DRM_XE_ENGINE_CLASS_RENDER @@ -264,7 +264,7 @@ struct drm_xe_engine_class_instance { * struct drm_xe_engine - describe hardware engine */ struct drm_xe_engine { - /** @instance: The @drm_xe_engine_class_instance */ + /** @instance: The &struct drm_xe_engine_class_instance */ struct drm_xe_engine_class_instance instance; /** @reserved: Reserved */ @@ -274,9 +274,9 @@ struct drm_xe_engine { /** * struct drm_xe_query_engines - describe engines * - * If a query is made with a struct @drm_xe_device_query where .query + * If a query is made with a &struct drm_xe_device_query where .query * is equal to %DRM_XE_DEVICE_QUERY_ENGINES, then the reply uses an array of - * struct @drm_xe_query_engines in .data. + * &struct drm_xe_query_engines in .data. */ struct drm_xe_query_engines { /** @num_engines: number of engines returned in @engines */ @@ -825,7 +825,7 @@ struct drm_xe_device_query { * * This ioctl supports setting the following properties via the * %DRM_XE_GEM_CREATE_EXTENSION_SET_PROPERTY extension, which uses the - * generic @drm_xe_ext_set_property struct: + * generic &struct drm_xe_ext_set_property: * * - %DRM_XE_GEM_CREATE_SET_PROPERTY_PXP_TYPE - set the type of PXP session * this object will be used with. Valid values are listed in enum @@ -1198,10 +1198,10 @@ struct drm_xe_vm_bind_op { /** * struct drm_xe_vm_bind - Input of &DRM_IOCTL_XE_VM_BIND * - * Below is an example of a minimal use of @drm_xe_vm_bind to + * Below is an example of a minimal use of &struct drm_xe_vm_bind to * asynchronously bind the buffer `data` at address `BIND_ADDRESS` to * illustrate `userptr`. It can be synchronized by using the example - * provided for @drm_xe_sync. + * provided for &struct drm_xe_sync. * * .. code-block:: C * @@ -1354,7 +1354,7 @@ struct drm_xe_vm_get_property { * * This ioctl supports setting the following properties via the * %DRM_XE_EXEC_QUEUE_EXTENSION_SET_PROPERTY extension, which uses the - * generic @drm_xe_ext_set_property struct: + * generic &struct drm_xe_ext_set_property: * * - %DRM_XE_EXEC_QUEUE_SET_PROPERTY_PRIORITY - set the queue priority. * CAP_SYS_NICE is required to set a value above normal. @@ -1389,9 +1389,9 @@ struct drm_xe_vm_get_property { * enable render color cache keying on BTP+BTI instead of just BTI * (only valid for render queues). * - * The example below shows how to use @drm_xe_exec_queue_create to create + * The example below shows how to use &struct drm_xe_exec_queue_create to create * a simple exec_queue (no parallel submission) of class - * &DRM_XE_ENGINE_CLASS_RENDER. + * %DRM_XE_ENGINE_CLASS_RENDER. * * .. code-block:: C * @@ -1514,7 +1514,7 @@ struct drm_xe_exec_queue_get_property { * and the @flags can be: * - %DRM_XE_SYNC_FLAG_SIGNAL * - * A minimal use of @drm_xe_sync looks like this: + * A minimal use of &struct drm_xe_sync looks like this: * * .. code-block:: C * @@ -1580,10 +1580,10 @@ struct drm_xe_sync { /** * struct drm_xe_exec - Input of &DRM_IOCTL_XE_EXEC * - * This is an example to use @drm_xe_exec for execution of the object - * at BIND_ADDRESS (see example in @drm_xe_vm_bind) by an exec_queue - * (see example in @drm_xe_exec_queue_create). It can be synchronized - * by using the example provided for @drm_xe_sync. + * This is an example to use &struct drm_xe_exec for execution of the object + * at BIND_ADDRESS (see example in &struct drm_xe_vm_bind) by an exec_queue + * (see example in &struct drm_xe_exec_queue_create). It can be synchronized + * by using the example provided for &struct drm_xe_sync. * * .. code-block:: C * @@ -1749,9 +1749,9 @@ enum drm_xe_observation_op { struct drm_xe_observation_param { /** @extensions: Pointer to the first extension struct, if any */ __u64 extensions; - /** @observation_type: observation stream type, of enum @drm_xe_observation_type */ + /** @observation_type: observation stream type, of &enum drm_xe_observation_type */ __u64 observation_type; - /** @observation_op: observation stream op, of enum @drm_xe_observation_op */ + /** @observation_op: observation stream op, of &enum drm_xe_observation_op */ __u64 observation_op; /** @param: Pointer to actual stream params */ __u64 param; @@ -1810,7 +1810,7 @@ struct drm_xe_oa_unit { /** @oa_unit_id: OA unit ID */ __u32 oa_unit_id; - /** @oa_unit_type: OA unit type of @drm_xe_oa_unit_type */ + /** @oa_unit_type: OA unit type of &enum drm_xe_oa_unit_type */ __u32 oa_unit_type; /** @capabilities: OA capabilities bit-mask */ @@ -1873,7 +1873,7 @@ struct drm_xe_query_oa_units { /** @pad: MBZ */ __u32 pad; /** - * @oa_units: struct @drm_xe_oa_unit array returned for this device. + * @oa_units: &struct drm_xe_oa_unit array returned for this device. * Written below as a u64 array to avoid problems with nested flexible * arrays with some compilers */ @@ -1902,22 +1902,22 @@ enum drm_xe_oa_format_type { /** * enum drm_xe_oa_property_id - OA stream property IDs * - * Stream params are specified as a chain of @drm_xe_ext_set_property - * structs, with @property values from enum @drm_xe_oa_property_id and - * @drm_xe_user_extension base.name set to @DRM_XE_OA_EXTENSION_SET_PROPERTY. - * @param field in struct @drm_xe_observation_param points to the first - * @drm_xe_ext_set_property struct. + * Stream params are specified as a chain of &struct drm_xe_ext_set_property + * structs, with property values from &enum drm_xe_oa_property_id and + * &struct drm_xe_user_extension base.name set to %DRM_XE_OA_EXTENSION_SET_PROPERTY. + * The param field in &struct drm_xe_observation_param points to the first + * &struct drm_xe_ext_set_property struct. * * Exactly the same mechanism is also used for stream reconfiguration using the - * @DRM_XE_OBSERVATION_IOCTL_CONFIG observation stream fd ioctl, though only a + * %DRM_XE_OBSERVATION_IOCTL_CONFIG observation stream fd ioctl, though only a * subset of properties below can be specified for stream reconfiguration. */ enum drm_xe_oa_property_id { #define DRM_XE_OA_EXTENSION_SET_PROPERTY 0 /** * @DRM_XE_OA_PROPERTY_OA_UNIT_ID: ID of the OA unit on which to open - * the OA stream, see @oa_unit_id in 'struct - * drm_xe_oa_unit'. Defaults to 0 if not provided. + * the OA stream, see oa_unit_id in &struct drm_xe_oa_unit. + * Defaults to 0 if not provided. */ DRM_XE_OA_PROPERTY_OA_UNIT_ID = 1, @@ -1930,7 +1930,7 @@ enum drm_xe_oa_property_id { /** * @DRM_XE_OA_PROPERTY_OA_METRIC_SET: OA metrics defining contents of OA - * reports, previously added via @DRM_XE_OBSERVATION_OP_ADD_CONFIG. + * reports, previously added via %DRM_XE_OBSERVATION_OP_ADD_CONFIG. */ DRM_XE_OA_PROPERTY_OA_METRIC_SET, @@ -1938,7 +1938,7 @@ enum drm_xe_oa_property_id { DRM_XE_OA_PROPERTY_OA_FORMAT, /* * OA_FORMAT's are specified the same way as in PRM/Bspec 52198/60942, - * in terms of the following quantities: a. enum @drm_xe_oa_format_type + * in terms of the following quantities: a. &enum drm_xe_oa_format_type * b. Counter select c. Counter size and d. BC report. Also refer to the * oa_formats array in drivers/gpu/drm/xe/xe_oa.c. */ @@ -1955,19 +1955,19 @@ enum drm_xe_oa_property_id { /** * @DRM_XE_OA_PROPERTY_OA_DISABLED: A value of 1 will open the OA - * stream in a DISABLED state (see @DRM_XE_OBSERVATION_IOCTL_ENABLE). + * stream in a DISABLED state (see %DRM_XE_OBSERVATION_IOCTL_ENABLE). */ DRM_XE_OA_PROPERTY_OA_DISABLED, /** * @DRM_XE_OA_PROPERTY_EXEC_QUEUE_ID: Open the stream for a specific - * @exec_queue_id. OA queries can be executed on this exec queue. + * exec_queue_id. OA queries can be executed on this exec queue. */ DRM_XE_OA_PROPERTY_EXEC_QUEUE_ID, /** * @DRM_XE_OA_PROPERTY_OA_ENGINE_INSTANCE: Optional engine instance to - * pass along with @DRM_XE_OA_PROPERTY_EXEC_QUEUE_ID or will default to 0. + * pass along with %DRM_XE_OA_PROPERTY_EXEC_QUEUE_ID or will default to 0. */ DRM_XE_OA_PROPERTY_OA_ENGINE_INSTANCE, @@ -1979,16 +1979,16 @@ enum drm_xe_oa_property_id { /** * @DRM_XE_OA_PROPERTY_NUM_SYNCS: Number of syncs in the sync array - * specified in @DRM_XE_OA_PROPERTY_SYNCS + * specified in %DRM_XE_OA_PROPERTY_SYNCS */ DRM_XE_OA_PROPERTY_NUM_SYNCS, /** - * @DRM_XE_OA_PROPERTY_SYNCS: Pointer to struct @drm_xe_sync array - * with array size specified via @DRM_XE_OA_PROPERTY_NUM_SYNCS. OA + * @DRM_XE_OA_PROPERTY_SYNCS: Pointer to &struct drm_xe_sync array + * with array size specified via %DRM_XE_OA_PROPERTY_NUM_SYNCS. OA * configuration will wait till input fences signal. Output fences * will signal after the new OA configuration takes effect. For - * @DRM_XE_SYNC_TYPE_USER_FENCE, @addr is a user pointer, similar + * %DRM_XE_SYNC_TYPE_USER_FENCE, addr is a user pointer, similar * to the VM bind case. */ DRM_XE_OA_PROPERTY_SYNCS, @@ -2011,9 +2011,9 @@ enum drm_xe_oa_property_id { /** * struct drm_xe_oa_config - OA metric configuration * - * Multiple OA configs can be added using @DRM_XE_OBSERVATION_OP_ADD_CONFIG. A + * Multiple OA configs can be added using %DRM_XE_OBSERVATION_OP_ADD_CONFIG. A * particular config can be specified when opening an OA stream using - * @DRM_XE_OA_PROPERTY_OA_METRIC_SET property. + * %DRM_XE_OA_PROPERTY_OA_METRIC_SET property. */ struct drm_xe_oa_config { /** @extensions: Pointer to the first extension struct, if any */ @@ -2034,7 +2034,7 @@ struct drm_xe_oa_config { /** * struct drm_xe_oa_stream_status - OA stream status returned from - * @DRM_XE_OBSERVATION_IOCTL_STATUS observation stream fd ioctl. Userspace can + * %DRM_XE_OBSERVATION_IOCTL_STATUS observation stream fd ioctl. Userspace can * call the ioctl to query stream status in response to EIO errno from * observation fd read(). */ @@ -2055,7 +2055,7 @@ struct drm_xe_oa_stream_status { /** * struct drm_xe_oa_stream_info - OA stream info returned from - * @DRM_XE_OBSERVATION_IOCTL_INFO observation stream fd ioctl + * %DRM_XE_OBSERVATION_IOCTL_INFO observation stream fd ioctl */ struct drm_xe_oa_stream_info { /** @extensions: Pointer to the first extension struct, if any */ @@ -2092,27 +2092,27 @@ enum drm_xe_pxp_session_type { * enum drm_xe_eu_stall_property_id - EU stall sampling input property ids. * * These properties are passed to the driver at open as a chain of - * @drm_xe_ext_set_property structures with @property set to these - * properties' enums and @value set to the corresponding values of these - * properties. @drm_xe_user_extension base.name should be set to - * @DRM_XE_EU_STALL_EXTENSION_SET_PROPERTY. + * &struct drm_xe_ext_set_property structures with property set to these + * properties' enums and value set to the corresponding values of these + * properties. &struct drm_xe_user_extension base.name should be set to + * %DRM_XE_EU_STALL_EXTENSION_SET_PROPERTY. * * With the file descriptor obtained from open, user space must enable - * the EU stall stream fd with @DRM_XE_OBSERVATION_IOCTL_ENABLE before + * the EU stall stream fd with %DRM_XE_OBSERVATION_IOCTL_ENABLE before * calling read(). EIO errno from read() indicates HW dropped data * due to full buffer. */ enum drm_xe_eu_stall_property_id { #define DRM_XE_EU_STALL_EXTENSION_SET_PROPERTY 0 /** - * @DRM_XE_EU_STALL_PROP_GT_ID: @gt_id of the GT on which + * @DRM_XE_EU_STALL_PROP_GT_ID: gt_id of the GT on which * EU stall data will be captured. */ DRM_XE_EU_STALL_PROP_GT_ID = 1, /** * @DRM_XE_EU_STALL_PROP_SAMPLE_RATE: Sampling rate in - * GPU cycles from @sampling_rates in struct @drm_xe_query_eu_stall + * GPU cycles from sampling_rates in &struct drm_xe_query_eu_stall */ DRM_XE_EU_STALL_PROP_SAMPLE_RATE, @@ -2127,9 +2127,9 @@ enum drm_xe_eu_stall_property_id { /** * struct drm_xe_query_eu_stall - Information about EU stall sampling. * - * If a query is made with a struct @drm_xe_device_query where .query - * is equal to @DRM_XE_DEVICE_QUERY_EU_STALL, then the reply uses - * struct @drm_xe_query_eu_stall in .data. + * If a query is made with a &struct drm_xe_device_query where .query + * is equal to %DRM_XE_DEVICE_QUERY_EU_STALL, then the reply uses + * &struct drm_xe_query_eu_stall in .data. */ struct drm_xe_query_eu_stall { /** @extensions: Pointer to the first extension struct, if any */ @@ -2240,7 +2240,7 @@ struct drm_xe_madvise { /** * @preferred_mem_loc.region_instance : Region instance. - * MBZ if @devmem_fd <= &DRM_XE_PREFERRED_LOC_DEFAULT_DEVICE. + * MBZ if @devmem_fd <= %DRM_XE_PREFERRED_LOC_DEFAULT_DEVICE. * Otherwise should point to the desired device * VRAM instance of the device indicated by * @preferred_mem_loc.devmem_fd. -- cgit v1.2.3 From 96cc9d79df5f7092c3807fad0d2fc3415cbd66b2 Mon Sep 17 00:00:00 2001 From: Shuicheng Lin Date: Tue, 7 Apr 2026 03:00:45 +0000 Subject: drm/xe/uapi: Fix code examples in xe_drm.h documentation Fix incorrect field names and formatting in code examples: - .num_bb_per_exec -> .width (renamed struct field in exec_queue_create examples) - .num_eng_per_bb -> .num_placements (renamed struct field in exec_queue_create examples) - .atomic_val -> .atomic.val (correct nested struct field access in madvise example) - Remove unnecessary backslash escaping in UUID format string (%\08x -> %08x) - Fix descriptive text trapped inside code-block in exec_queue_create doc (split into two code blocks) v3: one more fix of split code-block in exec_queue_create doc. Assisted-by: GitHub Copilot:claude-opus-4.6 Cc: Xin Wang Reviewed-by: Xin Wang Link: https://patch.msgid.link/20260407030046.3394004-6-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin --- include/uapi/drm/xe_drm.h | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h index 8751ad7b845f..58614f62d65b 100644 --- a/include/uapi/drm/xe_drm.h +++ b/include/uapi/drm/xe_drm.h @@ -1401,23 +1401,25 @@ struct drm_xe_vm_get_property { * struct drm_xe_exec_queue_create exec_queue_create = { * .extensions = 0, * .vm_id = vm, - * .num_bb_per_exec = 1, - * .num_eng_per_bb = 1, + * .width = 1, + * .num_placements = 1, * .instances = to_user_pointer(&instance), * }; * ioctl(fd, DRM_IOCTL_XE_EXEC_QUEUE_CREATE, &exec_queue_create); * - * Allow users to provide a hint to kernel for cases demanding low latency - * profile. Please note it will have impact on power consumption. User can - * indicate low latency hint with flag while creating exec queue as - * mentioned below, + * Allow users to provide a hint to kernel for cases demanding low latency + * profile. Please note it will have impact on power consumption. User can + * indicate low latency hint with flag while creating exec queue as + * mentioned below: + * + * .. code-block:: C * * struct drm_xe_exec_queue_create exec_queue_create = { * .flags = DRM_XE_EXEC_QUEUE_LOW_LATENCY_HINT, * .extensions = 0, * .vm_id = vm, - * .num_bb_per_exec = 1, - * .num_eng_per_bb = 1, + * .width = 1, + * .num_placements = 1, * .instances = to_user_pointer(&instance), * }; * ioctl(fd, DRM_IOCTL_XE_EXEC_QUEUE_CREATE, &exec_queue_create); @@ -2019,7 +2021,7 @@ struct drm_xe_oa_config { /** @extensions: Pointer to the first extension struct, if any */ __u64 extensions; - /** @uuid: String formatted like "%\08x-%\04x-%\04x-%\04x-%\012x" */ + /** @uuid: String formatted like "%08x-%04x-%04x-%04x-%012x" */ char uuid[36]; /** @n_regs: Number of regs in @regs_ptr */ @@ -2181,7 +2183,7 @@ struct drm_xe_query_eu_stall { * .start = 0x100000, * .range = 0x2000, * .type = DRM_XE_MEM_RANGE_ATTR_ATOMIC, - * .atomic_val = DRM_XE_ATOMIC_DEVICE, + * .atomic.val = DRM_XE_ATOMIC_DEVICE, * }; * * ioctl(fd, DRM_IOCTL_XE_MADVISE, &madvise); -- cgit v1.2.3 From 5150b57dacf9563ab29661c8e8a37a73f5a9fc54 Mon Sep 17 00:00:00 2001 From: Shuicheng Lin Date: Tue, 7 Apr 2026 03:00:46 +0000 Subject: drm/xe/uapi: Fix doc formatting and completeness in xe_drm.h - Fix missing leading space before closing */ in comment block - Add DRM_IOCTL_XE_EXEC_QUEUE_SET_PROPERTY to the IOCTL overview list - Add missing query types to the device query doc list: DRM_XE_DEVICE_QUERY_UC_FW_VERSION, DRM_XE_DEVICE_QUERY_OA_UNITS, DRM_XE_DEVICE_QUERY_EU_STALL - Fix ioctl's -> ioctls (not possessive, 2 occurrences) - Remove duplicate parameter docs from drm_xe_mem_range_attr overview (already documented as inline member comments) - Fix extra whitespace before /** on 2 lines in drm_xe_mem_range_attr - Add missing blank line before DRM_XE_VM_BIND_FLAG_DECOMPRESS bullet to fix RST block quote warning v3: more fix (item 4 to 7). Assisted-by: GitHub Copilot:claude-opus-4.6 Cc: Xin Wang Reviewed-by: Xin Wang Link: https://patch.msgid.link/20260407030046.3394004-7-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin --- include/uapi/drm/xe_drm.h | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/uapi/drm/xe_drm.h b/include/uapi/drm/xe_drm.h index 58614f62d65b..48e9f1fdb78d 100644 --- a/include/uapi/drm/xe_drm.h +++ b/include/uapi/drm/xe_drm.h @@ -83,6 +83,7 @@ extern "C" { * - &DRM_IOCTL_XE_OBSERVATION * - &DRM_IOCTL_XE_MADVISE * - &DRM_IOCTL_XE_VM_QUERY_MEM_RANGE_ATTRS + * - &DRM_IOCTL_XE_EXEC_QUEUE_SET_PROPERTY * - &DRM_IOCTL_XE_VM_GET_PROPERTY */ @@ -167,7 +168,7 @@ extern "C" { * Typically the struct drm_xe_user_extension would be embedded in some uAPI * struct, and in this case we would feed it the head of the chain(i.e ext1), * which would then apply all of the above extensions. -*/ + */ /** * struct drm_xe_user_extension - Base class for defining a chain of extensions @@ -705,7 +706,10 @@ struct drm_xe_query_pxp_status { * attributes. * - %DRM_XE_DEVICE_QUERY_GT_TOPOLOGY * - %DRM_XE_DEVICE_QUERY_ENGINE_CYCLES + * - %DRM_XE_DEVICE_QUERY_UC_FW_VERSION + * - %DRM_XE_DEVICE_QUERY_OA_UNITS * - %DRM_XE_DEVICE_QUERY_PXP_STATUS + * - %DRM_XE_DEVICE_QUERY_EU_STALL * * If size is set to 0, the driver fills it with the required size for * the requested type of data to query. If size is equal to the required @@ -1060,6 +1064,7 @@ struct drm_xe_vm_destroy { * not invoke autoreset. Neither will stack variables going out of scope. * Therefore it's recommended to always explicitly reset the madvises when * freeing the memory backing a region used in a &DRM_IOCTL_XE_MADVISE call. + * * - %DRM_XE_VM_BIND_FLAG_DECOMPRESS - Request on-device decompression for a MAP. * When set on a MAP bind operation, request the driver schedule an on-device * in-place decompression (via the migrate/resolve path) for the GPU mapping @@ -1760,10 +1765,10 @@ struct drm_xe_observation_param { }; /** - * enum drm_xe_observation_ioctls - Observation stream fd ioctl's + * enum drm_xe_observation_ioctls - Observation stream fd ioctls * * Information exchanged between userspace and kernel for observation fd - * ioctl's is stream type specific + * ioctls is stream type specific */ enum drm_xe_observation_ioctls { /** @DRM_XE_OBSERVATION_IOCTL_ENABLE: Enable data capture for an observation stream */ @@ -2379,14 +2384,9 @@ struct drm_xe_madvise { * page attribute table (PAT) index, and preferred memory location. * Userspace allocates an array of these structures and passes a pointer to the * ioctl to retrieve attributes for each memory range. - * - * @extensions: Pointer to the first extension struct, if any - * @start: Start address of the memory range - * @end: End address of the virtual memory range - * */ struct drm_xe_mem_range_attr { - /** @extensions: Pointer to the first extension struct, if any */ + /** @extensions: Pointer to the first extension struct, if any */ __u64 extensions; /** @start: start of the memory range */ @@ -2413,7 +2413,7 @@ struct drm_xe_mem_range_attr { __u32 reserved; } atomic; - /** @pat_index: Page attribute table index */ + /** @pat_index: Page attribute table index */ struct { /** @pat_index.val: PAT index */ __u32 val; -- cgit v1.2.3 From d842ed8f3417d848046eea2c40de78a1993eb3df Mon Sep 17 00:00:00 2001 From: Damon Ding Date: Thu, 9 Apr 2026 14:52:45 +0800 Subject: drm/bridge: analogix_dp: Add &analogix_dp_plat_data.next_bridge In order to move the panel/bridge parsing and attachmenet to the Analogix side, add component struct drm_bridge *next_bridge to platform data struct analogix_dp_plat_data. The movement makes sense because the panel/bridge should logically be positioned behind the Analogix bridge in the display pipeline. Signed-off-by: Damon Ding Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Tested-by: Marek Szyprowski Tested-by: Heiko Stuebner # rk3588 Link: https://patch.msgid.link/20260409065301.446670-2-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli --- include/drm/bridge/analogix_dp.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/drm/bridge/analogix_dp.h b/include/drm/bridge/analogix_dp.h index cf17646c1310..582357c20640 100644 --- a/include/drm/bridge/analogix_dp.h +++ b/include/drm/bridge/analogix_dp.h @@ -27,6 +27,7 @@ static inline bool is_rockchip(enum analogix_dp_devtype type) struct analogix_dp_plat_data { enum analogix_dp_devtype dev_type; struct drm_panel *panel; + struct drm_bridge *next_bridge; struct drm_encoder *encoder; struct drm_connector *connector; bool skip_connector; -- cgit v1.2.3 From ba2db93cf3d569a4525a02cd0ed5ec5f979e3afd Mon Sep 17 00:00:00 2001 From: Damon Ding Date: Thu, 9 Apr 2026 14:52:46 +0800 Subject: drm/bridge: Move legacy bridge driver out of imx directory for multi-platform use As suggested by Dmitry, the DRM legacy bridge driver can be pulled out of imx/ subdir for multi-platform use. The driver is also renamed to make it more generic and suitable for platforms other than i.MX. Signed-off-by: Damon Ding Suggested-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Tested-by: Marek Szyprowski Tested-by: Heiko Stuebner # rk3588 Link: https://patch.msgid.link/20260409065301.446670-3-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli --- include/drm/bridge/imx.h | 17 ----------------- include/drm/bridge/of-display-mode-bridge.h | 17 +++++++++++++++++ 2 files changed, 17 insertions(+), 17 deletions(-) delete mode 100644 include/drm/bridge/imx.h create mode 100644 include/drm/bridge/of-display-mode-bridge.h (limited to 'include') diff --git a/include/drm/bridge/imx.h b/include/drm/bridge/imx.h deleted file mode 100644 index b93f719fe0e7..000000000000 --- a/include/drm/bridge/imx.h +++ /dev/null @@ -1,17 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0+ -/* - * Copyright (C) 2012 Sascha Hauer, Pengutronix - */ - -#ifndef DRM_IMX_BRIDGE_H -#define DRM_IMX_BRIDGE_H - -struct device; -struct device_node; -struct drm_bridge; - -struct drm_bridge *devm_imx_drm_legacy_bridge(struct device *dev, - struct device_node *np, - int type); - -#endif diff --git a/include/drm/bridge/of-display-mode-bridge.h b/include/drm/bridge/of-display-mode-bridge.h new file mode 100644 index 000000000000..89fcfedf68d8 --- /dev/null +++ b/include/drm/bridge/of-display-mode-bridge.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright (C) 2012 Sascha Hauer, Pengutronix + */ + +#ifndef DRM_OF_DISPLAY_MODE_BRIDGE_H +#define DRM_OF_DISPLAY_MODE_BRIDGE_H + +struct device; +struct device_node; +struct drm_bridge; + +struct drm_bridge *devm_drm_of_display_mode_bridge(struct device *dev, + struct device_node *np, + int type); + +#endif -- cgit v1.2.3 From 312a86806b742dfd6fc543d8ec02ab15ee68c1a2 Mon Sep 17 00:00:00 2001 From: Damon Ding Date: Thu, 9 Apr 2026 14:52:50 +0800 Subject: drm/bridge: analogix_dp: Remove redundant &analogix_dp_plat_data.skip_connector The &analogix_dp_plat_data.skip_connector related check can be replaced by &analogix_dp_plat_data.bridge. Signed-off-by: Damon Ding Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Tested-by: Marek Szyprowski Tested-by: Heiko Stuebner # rk3588 Link: https://patch.msgid.link/20260409065301.446670-7-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli --- include/drm/bridge/analogix_dp.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/drm/bridge/analogix_dp.h b/include/drm/bridge/analogix_dp.h index 582357c20640..f06da105d8f2 100644 --- a/include/drm/bridge/analogix_dp.h +++ b/include/drm/bridge/analogix_dp.h @@ -30,7 +30,6 @@ struct analogix_dp_plat_data { struct drm_bridge *next_bridge; struct drm_encoder *encoder; struct drm_connector *connector; - bool skip_connector; int (*power_on)(struct analogix_dp_plat_data *); int (*power_off)(struct analogix_dp_plat_data *); -- cgit v1.2.3 From 4226b19edf240b054fc979557533c4a8c47a5535 Mon Sep 17 00:00:00 2001 From: Damon Ding Date: Thu, 9 Apr 2026 14:52:52 +0800 Subject: drm/bridge: analogix_dp: Remove unused &analogix_dp_plat_data.get_modes() The callback &analogix_dp_plat_data.get_modes() is not implemented by either Rockchip side or Exynos side. Signed-off-by: Damon Ding Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Tested-by: Marek Szyprowski Tested-by: Heiko Stuebner # rk3588 Link: https://patch.msgid.link/20260409065301.446670-9-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli --- include/drm/bridge/analogix_dp.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/drm/bridge/analogix_dp.h b/include/drm/bridge/analogix_dp.h index f06da105d8f2..3301392eda5f 100644 --- a/include/drm/bridge/analogix_dp.h +++ b/include/drm/bridge/analogix_dp.h @@ -35,8 +35,6 @@ struct analogix_dp_plat_data { int (*power_off)(struct analogix_dp_plat_data *); int (*attach)(struct analogix_dp_plat_data *, struct drm_bridge *, struct drm_connector *); - int (*get_modes)(struct analogix_dp_plat_data *, - struct drm_connector *); }; int analogix_dp_resume(struct analogix_dp_device *dp); -- cgit v1.2.3 From b943aefce6ad0c6119cacd6adcc67225b2699e7f Mon Sep 17 00:00:00 2001 From: Damon Ding Date: Thu, 9 Apr 2026 14:52:53 +0800 Subject: drm/bridge: analogix_dp: Remove unused struct drm_connector* for &analogix_dp_plat_data.attach() For both Rockchip and Exynos sides, the struct drm_connector* is never used in callback &analogix_dp_plat_data.attach(). After applying drm_bridge_connector helper, this parameter will no longer be used at all. Signed-off-by: Damon Ding Reviewed-by: Luca Ceresoli Link: https://patch.msgid.link/20260409065301.446670-10-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli --- include/drm/bridge/analogix_dp.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/drm/bridge/analogix_dp.h b/include/drm/bridge/analogix_dp.h index 3301392eda5f..3428ffff24c5 100644 --- a/include/drm/bridge/analogix_dp.h +++ b/include/drm/bridge/analogix_dp.h @@ -33,8 +33,7 @@ struct analogix_dp_plat_data { int (*power_on)(struct analogix_dp_plat_data *); int (*power_off)(struct analogix_dp_plat_data *); - int (*attach)(struct analogix_dp_plat_data *, struct drm_bridge *, - struct drm_connector *); + int (*attach)(struct analogix_dp_plat_data *, struct drm_bridge *); }; int analogix_dp_resume(struct analogix_dp_device *dp); -- cgit v1.2.3 From df0d98475954d655571979aa061ecb07d7e00392 Mon Sep 17 00:00:00 2001 From: "Peter Zijlstra (Intel)" Date: Wed, 1 Apr 2026 14:52:13 -0700 Subject: sched/cache: Introduce infrastructure for cache-aware load balancing Adds infrastructure to enable cache-aware load balancing, which improves cache locality by grouping tasks that share resources within the same cache domain. This reduces cache misses and improves overall data access efficiency. In this initial implementation, threads belonging to the same process are treated as entities that likely share working sets. The mechanism tracks per-process CPU occupancy across cache domains and attempts to migrate threads toward cache-hot domains where their process already has active threads, thereby enhancing locality. This provides a basic model for cache affinity. While the current code targets the last-level cache (LLC), the approach could be extended to other domain types such as clusters (L2) or node-internal groupings. At present, the mechanism selects the CPU within an LLC that has the highest recent runtime. Subsequent patches in this series will use this information in the load-balancing path to guide task placement toward preferred LLCs. In the future, more advanced policies could be integrated through NUMA balancing-for example, migrating a task to its preferred LLC when spare capacity exists, or swapping tasks across LLCs to improve cache affinity. Grouping of tasks could also be generalized from that of a process to be that of a NUMA group, or be user configurable. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Chen Yu Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/6269a53221b9439b9ca00d18a9d1946fb64d8cff.1775065312.git.tim.c.chen@linux.intel.com --- include/linux/mm_types.h | 32 ++++++++++++++++++++++++++++++++ include/linux/sched.h | 24 ++++++++++++++++++++++++ 2 files changed, 56 insertions(+) (limited to 'include') diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 3cc8ae722886..67b2dfcc71ea 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -1173,6 +1173,8 @@ struct mm_struct { /* MM CID related storage */ struct mm_mm_cid mm_cid; + /* sched_cache related statistics */ + struct sched_cache_stat sc_stat; #ifdef CONFIG_MMU atomic_long_t pgtables_bytes; /* size of all page tables */ #endif @@ -1575,6 +1577,36 @@ static inline unsigned int mm_cid_size(void) # define MM_CID_STATIC_SIZE 0 #endif /* CONFIG_SCHED_MM_CID */ +#ifdef CONFIG_SCHED_CACHE +void mm_init_sched(struct mm_struct *mm, + struct sched_cache_time __percpu *pcpu_sched); + +static inline int mm_alloc_sched_noprof(struct mm_struct *mm) +{ + struct sched_cache_time __percpu *pcpu_sched = + alloc_percpu_noprof(struct sched_cache_time); + + if (!pcpu_sched) + return -ENOMEM; + + mm_init_sched(mm, pcpu_sched); + return 0; +} + +#define mm_alloc_sched(...) alloc_hooks(mm_alloc_sched_noprof(__VA_ARGS__)) + +static inline void mm_destroy_sched(struct mm_struct *mm) +{ + free_percpu(mm->sc_stat.pcpu_sched); + mm->sc_stat.pcpu_sched = NULL; +} +#else /* !CONFIG_SCHED_CACHE */ + +static inline int mm_alloc_sched(struct mm_struct *mm) { return 0; } +static inline void mm_destroy_sched(struct mm_struct *mm) { } + +#endif /* CONFIG_SCHED_CACHE */ + struct mmu_gather; extern void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm); extern void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm); diff --git a/include/linux/sched.h b/include/linux/sched.h index 8ec3b6d7d718..2bf261bcd7b6 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1407,6 +1407,10 @@ struct task_struct { unsigned long numa_pages_migrated; #endif /* CONFIG_NUMA_BALANCING */ +#ifdef CONFIG_SCHED_CACHE + struct callback_head cache_work; +#endif + struct rseq_data rseq; struct sched_mm_cid mm_cid; @@ -2407,6 +2411,26 @@ static __always_inline int task_mm_cid(struct task_struct *t) } #endif +#ifdef CONFIG_SCHED_CACHE + +struct sched_cache_time { + u64 runtime; + unsigned long epoch; +}; + +struct sched_cache_stat { + struct sched_cache_time __percpu *pcpu_sched; + raw_spinlock_t lock; + unsigned long epoch; + int cpu; +} ____cacheline_aligned_in_smp; + +#else + +struct sched_cache_stat { }; + +#endif + #ifndef MODULE #ifndef COMPILE_OFFSETS -- cgit v1.2.3 From f025ef275388742643a2c33f00a0d9c0af3112ee Mon Sep 17 00:00:00 2001 From: Chen Yu Date: Wed, 1 Apr 2026 14:52:15 -0700 Subject: sched/cache: Record per LLC utilization to guide cache aware scheduling decisions When a system becomes busy and a process's preferred LLC is saturated with too many threads, tasks within that LLC migrate frequently. These in LLC migrations introduce latency and degrade performance. To avoid this, task aggregation should be suppressed when the preferred LLC is overloaded, which requires a metric to indicate LLC utilization. Record per LLC utilization/cpu capacity during periodic load balancing. These statistics will be used in later patches to decide whether tasks should be aggregated into their preferred LLC. Signed-off-by: Chen Yu Co-developed-by: Tim Chen Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/a48151b3d57f2a42a5971aaead1b7f81e69229f4.1775065312.git.tim.c.chen@linux.intel.com --- include/linux/sched/topology.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index 36553e14866d..159716fa0d3a 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -68,6 +68,10 @@ struct sched_domain_shared { atomic_t nr_busy_cpus; int has_idle_cores; int nr_idle_scan; +#ifdef CONFIG_SCHED_CACHE + unsigned long util_avg; + unsigned long capacity; +#endif }; struct sched_domain { -- cgit v1.2.3 From 47d8696b95f7397fe7cad2d194d550ffe82efc15 Mon Sep 17 00:00:00 2001 From: Tim Chen Date: Wed, 1 Apr 2026 14:52:18 -0700 Subject: sched/cache: Assign preferred LLC ID to processes With cache-aware scheduling enabled, each task is assigned a preferred LLC ID. This allows quick identification of the LLC domain where the task prefers to run, similar to numa_preferred_nid in NUMA balancing. Co-developed-by: Chen Yu Signed-off-by: Chen Yu Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/f2ceecba5858680349ad4ce9303a2121f0bb7272.1775065312.git.tim.c.chen@linux.intel.com --- include/linux/sched.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index 2bf261bcd7b6..d2010483cd77 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1409,6 +1409,7 @@ struct task_struct { #ifdef CONFIG_SCHED_CACHE struct callback_head cache_work; + int preferred_llc; #endif struct rseq_data rseq; -- cgit v1.2.3 From a8d0ca0b7f2f7b53565d1e30e509d3d74d1f5460 Mon Sep 17 00:00:00 2001 From: Tim Chen Date: Wed, 1 Apr 2026 14:52:20 -0700 Subject: sched/cache: Introduce per CPU's tasks LLC preference counter The lowest level of sched domain for each CPU is assigned an array where each element tracks the number of tasks preferring a given LLC, indexed from 0 to max_lid. Since each CPU has its dedicated sd, this implies that each CPU will have a dedicated task LLC preference counter. For example, sd->llc_counts[3] = 2 signifies that there are 2 tasks on this runqueue which prefer to run within LLC3. The load balancer can use this information to identify busy runqueues and migrate tasks to their preferred LLC domains. This array will be reallocated at runtime during sched domain rebuild. Introduce the buffer allocation mechanism, and the statistics will be calculated in the subsequent patch. Note: the LLC preference statistics of each CPU are reset on sched domain rebuild and may under count temporarily, until the CPU becomes idle and the count is cleared. This is a trade off to avoid complex data synchronization across sched domain builds. Suggested-by: Peter Zijlstra (Intel) Suggested-by: K Prateek Nayak Co-developed-by: Chen Yu Signed-off-by: Chen Yu Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/42e79eceb8cd6be8a032401d481d101913bc5703.1775065312.git.tim.c.chen@linux.intel.com --- include/linux/sched/topology.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index 159716fa0d3a..0036d6b4bd67 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -103,6 +103,11 @@ struct sched_domain { u64 max_newidle_lb_cost; unsigned long last_decay_max_lb_cost; +#ifdef CONFIG_SCHED_CACHE + unsigned int llc_max; + unsigned int *llc_counts __counted_by_ptr(llc_max); +#endif + #ifdef CONFIG_SCHEDSTATS /* sched_balance_rq() stats */ unsigned int lb_count[CPU_MAX_IDLE_TYPES]; -- cgit v1.2.3 From efcd474ed273ae7da614b30e798651c6d57d3109 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ma=C3=ADra=20Canal?= Date: Mon, 30 Mar 2026 10:33:04 -0300 Subject: drm/connector: Make drm_connector_attach_hdr_output_metadata_property() return void MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit drm_connector_attach_hdr_output_metadata_property() always returns zero, since drm_object_attach_property() returns void. No caller checks the return value, so change the return type to void. Also fix a typo in the kerneldoc ("HDR_OUTPUT_METADA" -> "HDR_OUTPUT_METADATA"). Reviewed-by: Melissa Wen Link: https://patch.msgid.link/20260330133446.3265938-2-mcanal@igalia.com Signed-off-by: Maíra Canal --- include/drm/drm_connector.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index f83f28cae207..3e422a4f2e72 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -2556,7 +2556,7 @@ int drm_connector_attach_vrr_capable_property( void drm_connector_attach_panel_type_property(struct drm_connector *connector); int drm_connector_attach_broadcast_rgb_property(struct drm_connector *connector); int drm_connector_attach_colorspace_property(struct drm_connector *connector); -int drm_connector_attach_hdr_output_metadata_property(struct drm_connector *connector); +void drm_connector_attach_hdr_output_metadata_property(struct drm_connector *connector); bool drm_connector_atomic_hdr_metadata_equal(struct drm_connector_state *old_state, struct drm_connector_state *new_state); int drm_mode_create_aspect_ratio_property(struct drm_device *dev); -- cgit v1.2.3 From 37ad039fb3674a36dbf082fa5c864af1b791eccd Mon Sep 17 00:00:00 2001 From: Matthew Brost Date: Fri, 10 Apr 2026 13:59:25 -0700 Subject: drm/gpusvm: Use dma-map IOVA alloc, link, and sync API in GPU SVM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The dma-map IOVA alloc, link, and sync APIs perform significantly better than dma-map / dma-unmap, as they avoid costly IOMMU synchronizations. This difference is especially noticeable when mapping a 2MB region in 4KB pages. Use the IOVA alloc, link, and sync APIs for GPU SVM, which create DMA mappings between the CPU and GPU. Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260410205929.3914474-2-matthew.brost@intel.com --- include/drm/drm_gpusvm.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/drm/drm_gpusvm.h b/include/drm/drm_gpusvm.h index 2578ac92a8d4..cd94bb2ee6ee 100644 --- a/include/drm/drm_gpusvm.h +++ b/include/drm/drm_gpusvm.h @@ -6,6 +6,7 @@ #ifndef __DRM_GPUSVM_H__ #define __DRM_GPUSVM_H__ +#include #include #include #include @@ -136,6 +137,8 @@ struct drm_gpusvm_pages_flags { * @dma_addr: Device address array * @dpagemap: The struct drm_pagemap of the device pages we're dma-mapping. * Note this is assuming only one drm_pagemap per range is allowed. + * @state: DMA IOVA state for mapping. + * @state_offset: DMA IOVA offset for mapping. * @notifier_seq: Notifier sequence number of the range's pages * @flags: Flags for range * @flags.migrate_devmem: Flag indicating whether the range can be migrated to device memory @@ -147,6 +150,8 @@ struct drm_gpusvm_pages_flags { struct drm_gpusvm_pages { struct drm_pagemap_addr *dma_addr; struct drm_pagemap *dpagemap; + struct dma_iova_state state; + unsigned long state_offset; unsigned long notifier_seq; struct drm_gpusvm_pages_flags flags; }; -- cgit v1.2.3 From 667e95ce2816631fc196c8136122819f5b630a67 Mon Sep 17 00:00:00 2001 From: Matthew Brost Date: Fri, 10 Apr 2026 13:59:26 -0700 Subject: drm/pagemap: Drop source_peer_migrates flag and assume true All current users of DRM pagemap set source_peer_migrates to true during migration, and it is unclear whether any user would ever want to disable this for performance reasons or for features such as compression. It is also questionable whether this flag could be made to work with high-speed fabric mapping APIs. Drop the flag and make DRM pagemap unconditionally assume that source_peer_migrates is true. Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Link: https://patch.msgid.link/20260410205929.3914474-3-matthew.brost@intel.com --- include/drm/drm_pagemap.h | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/drm/drm_pagemap.h b/include/drm/drm_pagemap.h index 75e6ca58922d..95eb4b66b057 100644 --- a/include/drm/drm_pagemap.h +++ b/include/drm/drm_pagemap.h @@ -329,17 +329,12 @@ struct drm_pagemap_devmem { * struct drm_pagemap_migrate_details - Details to govern migration. * @timeslice_ms: The time requested for the migrated pagemap pages to * be present in @mm before being allowed to be migrated back. - * @can_migrate_same_pagemap: Whether the copy function as indicated by - * the @source_peer_migrates flag, can migrate device pages within a - * single drm_pagemap. - * @source_peer_migrates: Whether on p2p migration, The source drm_pagemap - * should use the copy_to_ram() callback rather than the destination - * drm_pagemap should use the copy_to_devmem() callback. + * @can_migrate_same_pagemap: Whether the copy function can migrate + * device pages within a single drm_pagemap. */ struct drm_pagemap_migrate_details { unsigned long timeslice_ms; u32 can_migrate_same_pagemap : 1; - u32 source_peer_migrates : 1; }; #if IS_ENABLED(CONFIG_ZONE_DEVICE) -- cgit v1.2.3 From e9c897c898f9ff32d93380ee4ebc778a6b787aaa Mon Sep 17 00:00:00 2001 From: Damon Ding Date: Mon, 13 Apr 2026 21:25:46 +0800 Subject: drm/bridge: analogix_dp: Add new API analogix_dp_finish_probe() Since the panel/bridge should logically be positioned behind the Analogix bridge in the display pipeline, it makes sense to handle the panel/bridge parsing on the Analogix side. Therefore, we add a new API analogix_dp_finish_probe(), which combines the panel/bridge parsing with component addition, to do it. In order to process component binding right after the probe completes, the &analogix_dp_plat_data.ops is newly added to pass &component_ops, for which the &dp_aux_ep_device_with_data.done_probing() of DP AUX bus only supports passing &drm_dp_aux. Signed-off-by: Damon Ding Reviewed-by: Dmitry Baryshkov Tested-by: Marek Szyprowski Tested-by: Heiko Stuebner # rk3588 Link: https://patch.msgid.link/20260413132551.1049307-4-damon.ding@rock-chips.com [Luca: propagate 'depends on OF' to DRM_ANALOGIX_DP and reverse dependencies] Signed-off-by: Luca Ceresoli --- include/drm/bridge/analogix_dp.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/drm/bridge/analogix_dp.h b/include/drm/bridge/analogix_dp.h index 3428ffff24c5..bae969dec63a 100644 --- a/include/drm/bridge/analogix_dp.h +++ b/include/drm/bridge/analogix_dp.h @@ -30,6 +30,7 @@ struct analogix_dp_plat_data { struct drm_bridge *next_bridge; struct drm_encoder *encoder; struct drm_connector *connector; + const struct component_ops *ops; int (*power_on)(struct analogix_dp_plat_data *); int (*power_off)(struct analogix_dp_plat_data *); @@ -49,5 +50,6 @@ int analogix_dp_stop_crc(struct drm_connector *connector); struct analogix_dp_plat_data *analogix_dp_aux_to_plat_data(struct drm_dp_aux *aux); struct drm_dp_aux *analogix_dp_get_aux(struct analogix_dp_device *dp); +int analogix_dp_finish_probe(struct analogix_dp_device *dp); #endif /* _ANALOGIX_DP_H_ */ -- cgit v1.2.3 From 3076510af7cd01a7fb0ae5103116a39ad35eb5cb Mon Sep 17 00:00:00 2001 From: Damon Ding Date: Mon, 13 Apr 2026 21:25:49 +0800 Subject: drm/bridge: analogix_dp: Attach the next bridge in analogix_dp_bridge_attach() Uniformly, move the next bridge attachment to the Analogix side rather than scattered on Rockchip and Exynos sides. It can also help get rid of the callback &analogix_dp_plat_data.attach() and make codes more concise. Signed-off-by: Damon Ding Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Ceresoli Tested-by: Marek Szyprowski Tested-by: Heiko Stuebner # rk3588 Link: https://patch.msgid.link/20260413132551.1049307-7-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli --- include/drm/bridge/analogix_dp.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/drm/bridge/analogix_dp.h b/include/drm/bridge/analogix_dp.h index bae969dec63a..854af692229b 100644 --- a/include/drm/bridge/analogix_dp.h +++ b/include/drm/bridge/analogix_dp.h @@ -34,7 +34,6 @@ struct analogix_dp_plat_data { int (*power_on)(struct analogix_dp_plat_data *); int (*power_off)(struct analogix_dp_plat_data *); - int (*attach)(struct analogix_dp_plat_data *, struct drm_bridge *); }; int analogix_dp_resume(struct analogix_dp_device *dp); -- cgit v1.2.3 From ec9dfa70c2915c2dd3676d674287ee56e52a7ef5 Mon Sep 17 00:00:00 2001 From: Luca Ceresoli Date: Tue, 7 Apr 2026 14:24:19 +0200 Subject: drm/bridge: dw-hdmi: document the output_port field The meaning of this flag may not be obvious at first sight. Reviewed-by: Liu Ying Tested-by: Martyn Welch Tested-by: Alexander Stein # TQMa8MPxL/MBa8MPxL Tested-by: Damon Ding # rk3399 Link: https://patch.msgid.link/20260407-drm-lcdif-dbanc-v4-5-247a16e61ef9@bootlin.com Signed-off-by: Luca Ceresoli --- include/drm/bridge/dw_hdmi.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/drm/bridge/dw_hdmi.h b/include/drm/bridge/dw_hdmi.h index 336f062e1f9d..8500dd4f99d8 100644 --- a/include/drm/bridge/dw_hdmi.h +++ b/include/drm/bridge/dw_hdmi.h @@ -126,6 +126,12 @@ struct dw_hdmi_phy_ops { struct dw_hdmi_plat_data { struct regmap *regm; + /* + * The HDMI output port number must be 1 if the port is described + * in the device tree. 0 if the device tree does not describe the + * next component (legacy mode, i.e. without + * DRM_BRIDGE_ATTACH_NO_CONNECTOR flag when attaching bridge). + */ unsigned int output_port; unsigned long input_bus_encoding; -- cgit v1.2.3 From 7f30fe4592f59aad5f8c9811496e5076ab11e310 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Fri, 10 Apr 2026 18:04:40 +0300 Subject: drm/i915: Introduce sanity to the plane_config pointer vs. array thing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "plane_config" vs. "plane_configs" naming difference is very subtle, making it far too easy to use the wrong thing by accident. Introduce a separate type for the array, making it impossible to pass in the wrong thing. And while at it name the variable "all_plane_configs" to help the poor reader make sense of things. The .config_fini() prototype also mistakenly used the plural form despite only taking in a singular plane_config. So fix that one up as well. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260410150449.9699-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula --- include/drm/intel/display_parent_interface.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/drm/intel/display_parent_interface.h b/include/drm/intel/display_parent_interface.h index 258e6388ef77..9041897c772e 100644 --- a/include/drm/intel/display_parent_interface.h +++ b/include/drm/intel/display_parent_interface.h @@ -91,7 +91,7 @@ struct intel_display_initial_plane_interface { struct drm_gem_object *(*alloc_obj)(struct drm_device *drm, struct intel_initial_plane_config *plane_config); int (*setup)(struct drm_plane_state *plane_state, struct intel_initial_plane_config *plane_config, struct drm_framebuffer *fb, struct i915_vma *vma); - void (*config_fini)(struct intel_initial_plane_config *plane_configs); + void (*config_fini)(struct intel_initial_plane_config *plane_config); }; struct intel_display_irq_interface { -- cgit v1.2.3 From 36f1cddea76d14d656a23eccf371247906ec8e4c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Fri, 10 Apr 2026 18:04:44 +0300 Subject: drm/i915: Move initial plane vblank wait into display code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The initial plane vblank wait operates on display registers, so it really belongs in the display code proper. Move it there. We can use intel_parent_irq_enabled() to determine if we can rely on interrupts or not. On average we should end up waiting half a frame here, so the polling interval can be fairly long. 1 ms (which actually makes poll_timeout_us() use ~250-1000 usec) seems good enough to me. Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260410150449.9699-6-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula --- include/drm/intel/display_parent_interface.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/drm/intel/display_parent_interface.h b/include/drm/intel/display_parent_interface.h index 9041897c772e..b513e3f9924d 100644 --- a/include/drm/intel/display_parent_interface.h +++ b/include/drm/intel/display_parent_interface.h @@ -8,7 +8,6 @@ enum vlv_iosf_sb_unit; struct dma_fence; -struct drm_crtc; struct drm_device; struct drm_file; struct drm_framebuffer; @@ -87,7 +86,6 @@ struct intel_display_hdcp_interface { }; struct intel_display_initial_plane_interface { - void (*vblank_wait)(struct drm_crtc *crtc); struct drm_gem_object *(*alloc_obj)(struct drm_device *drm, struct intel_initial_plane_config *plane_config); int (*setup)(struct drm_plane_state *plane_state, struct intel_initial_plane_config *plane_config, struct drm_framebuffer *fb, struct i915_vma *vma); -- cgit v1.2.3 From e94b9f01543cc6a83538c2c2cc645a424d3015ca Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Wed, 15 Apr 2026 09:32:07 +0100 Subject: dma-fence: Fix potential tracepoint null pointer dereferences MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trace_dma_fence_signaled, trace_dma_fence_wait_end and trace_dma_fence_destroy can all currently dereference a null fence->ops pointer after it has been reset on fence signalling. Lets use the safe string getters for most tracepoints to avoid this class of a problem, while for the signal tracepoint we move it to before ops are cleared to avoid losing the driver and timeline name information. Apart from moving it we also need to add a new tracepoint class to bypass the safe name getters since the signaled bit is already set. For dma_fence_init we also need to use the new tracepoint class since the rcu read lock is not held there, and we can do the same for the enable signaling since there we are certain the fence cannot be signaled while we are holding the lock and have even validated the fence->ops. Signed-off-by: Tvrtko Ursulin Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3") Cc: Christian König Cc: Philipp Stanner Cc: Boris Brezillon Cc: linux-media@vger.kernel.org Cc: linaro-mm-sig@lists.linaro.org Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260415083207.40513-2-tvrtko.ursulin@igalia.com --- include/trace/events/dma_fence.h | 40 ++++++++++++++++++++++++++++++++++------ 1 file changed, 34 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/trace/events/dma_fence.h b/include/trace/events/dma_fence.h index 3abba45c0601..5b10a9e06fb4 100644 --- a/include/trace/events/dma_fence.h +++ b/include/trace/events/dma_fence.h @@ -9,12 +9,40 @@ struct dma_fence; +DECLARE_EVENT_CLASS(dma_fence, + + TP_PROTO(struct dma_fence *fence), + + TP_ARGS(fence), + + TP_STRUCT__entry( + __string(driver, dma_fence_driver_name(fence)) + __string(timeline, dma_fence_timeline_name(fence)) + __field(unsigned int, context) + __field(unsigned int, seqno) + ), + + TP_fast_assign( + __assign_str(driver); + __assign_str(timeline); + __entry->context = fence->context; + __entry->seqno = fence->seqno; + ), + + TP_printk("driver=%s timeline=%s context=%u seqno=%u", + __get_str(driver), __get_str(timeline), __entry->context, + __entry->seqno) +); + /* * Safe only for call sites which are guaranteed to not race with fence - * signaling,holding the fence->lock and having checked for not signaled, or the - * signaling path itself. + * signaling, holding the fence->lock and having checked for not signaled, or + * the signaling path itself. + * + * TODO: Remove the need for this event class when drivers switch to independent + * fences. */ -DECLARE_EVENT_CLASS(dma_fence, +DECLARE_EVENT_CLASS(dma_fence_ops, TP_PROTO(struct dma_fence *fence), @@ -46,7 +74,7 @@ DEFINE_EVENT(dma_fence, dma_fence_emit, TP_ARGS(fence) ); -DEFINE_EVENT(dma_fence, dma_fence_init, +DEFINE_EVENT(dma_fence_ops, dma_fence_init, TP_PROTO(struct dma_fence *fence), @@ -60,14 +88,14 @@ DEFINE_EVENT(dma_fence, dma_fence_destroy, TP_ARGS(fence) ); -DEFINE_EVENT(dma_fence, dma_fence_enable_signal, +DEFINE_EVENT(dma_fence_ops, dma_fence_enable_signal, TP_PROTO(struct dma_fence *fence), TP_ARGS(fence) ); -DEFINE_EVENT(dma_fence, dma_fence_signaled, +DEFINE_EVENT(dma_fence_ops, dma_fence_signaled, TP_PROTO(struct dma_fence *fence), -- cgit v1.2.3 From 9fce8ff956cc3493b327f6928458e2278ef531a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Tue, 7 Apr 2026 20:09:42 +0300 Subject: drm/i915: Remove the vma parent interface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With the fb pinning stuff directly returning the fence_id there is no longer any need for the vma parent interface. Get rid of it. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260407170942.16515-2-ville.syrjala@linux.intel.com --- include/drm/intel/display_parent_interface.h | 7 ------- 1 file changed, 7 deletions(-) (limited to 'include') diff --git a/include/drm/intel/display_parent_interface.h b/include/drm/intel/display_parent_interface.h index b513e3f9924d..270dc028bec2 100644 --- a/include/drm/intel/display_parent_interface.h +++ b/include/drm/intel/display_parent_interface.h @@ -189,10 +189,6 @@ struct intel_display_vlv_iosf_interface { int (*write)(struct drm_device *drm, enum vlv_iosf_sb_unit unit, u32 addr, u32 val); }; -struct intel_display_vma_interface { - int (*fence_id)(const struct i915_vma *vma); -}; - /** * struct intel_display_parent_interface - services parent driver provides to display * @@ -251,9 +247,6 @@ struct intel_display_parent_interface { /** @vlv_iosf: VLV IOSF sideband. Optional. */ const struct intel_display_vlv_iosf_interface *vlv_iosf; - /** @vma: VMA interface. Optional. */ - const struct intel_display_vma_interface *vma; - /* Generic independent functions */ struct { /** @fence_priority_display: Set display priority. Optional. */ -- cgit v1.2.3 From 01b92f0d18214660d9978f0c4dd9507ee8d27d06 Mon Sep 17 00:00:00 2001 From: Luca Ceresoli Date: Tue, 24 Mar 2026 09:58:08 +0100 Subject: drm/encoder: add mutex to protect the bridge chain The per-encoder bridge chain is currently assumed to be static once it is fully initialized. Work is in progress to add hot-pluggable bridges, breaking that assumption. With bridge removal, the encoder chain can change without notice, removing tail bridges. This can be problematic while iterating over the chain. Add a mutex to be taken whenever looping or changing the encoder chain. Reviewed-by: Maxime Ripard Reviewed-by: Louis Chauvet Link: https://patch.msgid.link/20260324-drm-bridge-alloc-encoder-chain-mutex-v5-1-8bf786c5c7e6@bootlin.com Signed-off-by: Luca Ceresoli --- include/drm/drm_encoder.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/drm/drm_encoder.h b/include/drm/drm_encoder.h index 977a9381c8ba..eded7c34481a 100644 --- a/include/drm/drm_encoder.h +++ b/include/drm/drm_encoder.h @@ -25,6 +25,7 @@ #include #include +#include #include #include #include @@ -189,6 +190,9 @@ struct drm_encoder { */ struct list_head bridge_chain; + /** @bridge_chain_mutex: protect bridge_chain from changes while iterating */ + struct mutex bridge_chain_mutex; + const struct drm_encoder_funcs *funcs; const struct drm_encoder_helper_funcs *helper_private; -- cgit v1.2.3 From 46c1213a1b854eb4465c90a2da001310b72cc389 Mon Sep 17 00:00:00 2001 From: Luca Ceresoli Date: Tue, 24 Mar 2026 09:58:11 +0100 Subject: drm/bridge: lock the encoder chain in scoped for_each loops drm_for_each_bridge_in_chain_scoped() and drm_for_each_bridge_in_chain_from() currently get/put the bridge at each iteration. But they don't protect the encoder chain, so it could change (bridges added/removed) while some code is iterating over the list itself. Such code can then derail on incorrect pointers. To make iterations safe, augment these for_each macros to lock the encoder chain mutex at the beginning and unlock it at the end of the loop (be it at the end of the list, or earlier due to a 'break' or 'return' statement). This change requires more operations when starting and ending the loop. To avoid making the macros even more complex, move these operations to helper functions. Also remname some of the existing helper functions for consistency. Reviewed-by: Louis Chauvet Link: https://patch.msgid.link/20260324-drm-bridge-alloc-encoder-chain-mutex-v5-4-8bf786c5c7e6@bootlin.com Signed-off-by: Luca Ceresoli --- include/drm/drm_bridge.h | 73 +++++++++++++++++++++++++++++++----------------- 1 file changed, 47 insertions(+), 26 deletions(-) (limited to 'include') diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h index a8d67bd9ee50..d6cd0f5af045 100644 --- a/include/drm/drm_bridge.h +++ b/include/drm/drm_bridge.h @@ -1457,26 +1457,37 @@ drm_bridge_chain_get_last_bridge(struct drm_encoder *encoder) struct drm_bridge, chain_node)); } -/** - * drm_bridge_get_next_bridge_and_put - Get the next bridge in the chain - * and put the previous - * @bridge: bridge object - * - * Same as drm_bridge_get_next_bridge() but additionally puts the @bridge. - * - * RETURNS: - * the next bridge in the chain after @bridge, or NULL if @bridge is the last. - */ -static inline struct drm_bridge * -drm_bridge_get_next_bridge_and_put(struct drm_bridge *bridge) +/* Internal to drm_for_each_bridge_in_chain*() */ +static inline struct drm_bridge *__drm_for_each_bridge_in_chain_next(struct drm_bridge *bridge) { struct drm_bridge *next = drm_bridge_get_next_bridge(bridge); + if (!next) + mutex_unlock(&bridge->encoder->bridge_chain_mutex); + drm_bridge_put(bridge); return next; } +/* Internal to drm_for_each_bridge_in_chain*() */ +DEFINE_FREE(__drm_for_each_bridge_in_chain_cleanup, struct drm_bridge *, + if (_T) { mutex_unlock(&_T->encoder->bridge_chain_mutex); drm_bridge_put(_T); }) + +/* Internal to drm_for_each_bridge_in_chain_scoped() */ +static inline struct drm_bridge * +__drm_for_each_bridge_in_chain_scoped_start(struct drm_encoder *encoder) +{ + mutex_lock(&encoder->bridge_chain_mutex); + + struct drm_bridge *bridge = drm_bridge_chain_get_first_bridge(encoder); + + if (!bridge) + mutex_unlock(&encoder->bridge_chain_mutex); + + return bridge; +} + /** * drm_for_each_bridge_in_chain_scoped - iterate over all bridges attached * to an encoder @@ -1486,14 +1497,24 @@ drm_bridge_get_next_bridge_and_put(struct drm_bridge *bridge) * * Iterate over all bridges present in the bridge chain attached to @encoder. * - * Automatically gets/puts the bridge reference while iterating, and puts - * the reference even if returning or breaking in the middle of the loop. + * Automatically gets/puts the bridge reference while iterating and locks + * the encoder chain mutex to prevent chain modifications while iterating. */ -#define drm_for_each_bridge_in_chain_scoped(encoder, bridge) \ - for (struct drm_bridge *bridge __free(drm_bridge_put) = \ - drm_bridge_chain_get_first_bridge(encoder); \ - bridge; \ - bridge = drm_bridge_get_next_bridge_and_put(bridge)) +#define drm_for_each_bridge_in_chain_scoped(encoder, bridge) \ + for (struct drm_bridge *bridge __free(__drm_for_each_bridge_in_chain_cleanup) = \ + __drm_for_each_bridge_in_chain_scoped_start((encoder)); \ + bridge; \ + bridge = __drm_for_each_bridge_in_chain_next(bridge)) \ + +/* Internal to drm_for_each_bridge_in_chain_from() */ +static inline struct drm_bridge * +__drm_for_each_bridge_in_chain_from_start(struct drm_bridge *bridge) +{ + drm_bridge_get(bridge); + mutex_lock(&bridge->encoder->bridge_chain_mutex); + + return bridge; +} /** * drm_for_each_bridge_in_chain_from - iterate over all bridges starting @@ -1505,14 +1526,14 @@ drm_bridge_get_next_bridge_and_put(struct drm_bridge *bridge) * Iterate over all bridges in the encoder chain starting from * @first_bridge, included. * - * Automatically gets/puts the bridge reference while iterating, and puts - * the reference even if returning or breaking in the middle of the loop. + * Automatically gets/puts the bridge reference while iterating and locks + * the encoder chain mutex to prevent chain modifications while iterating. */ -#define drm_for_each_bridge_in_chain_from(first_bridge, bridge) \ - for (struct drm_bridge *bridge __free(drm_bridge_put) = \ - drm_bridge_get(first_bridge); \ - bridge; \ - bridge = drm_bridge_get_next_bridge_and_put(bridge)) +#define drm_for_each_bridge_in_chain_from(first_bridge, bridge) \ + for (struct drm_bridge *bridge __free(__drm_for_each_bridge_in_chain_cleanup) = \ + __drm_for_each_bridge_in_chain_from_start(first_bridge); \ + bridge; \ + bridge = __drm_for_each_bridge_in_chain_next(bridge)) \ enum drm_mode_status drm_bridge_chain_mode_valid(struct drm_bridge *bridge, -- cgit v1.2.3 From 2f5f05633e2229c8ec379e1d65151165c905671e Mon Sep 17 00:00:00 2001 From: Philipp Stanner Date: Wed, 15 Apr 2026 16:49:56 +0200 Subject: drm/sched: Make drm_sched_entity_kill() a public function Some drivers do not care on teardown whether the last jobs pending in an entity are actually executed before teardown completed. For such scenarios, drm_sched_entity_flush() is not the ideal function since it's intended to wait for jobs to complete. Make drm_sched_entity_kill() public for that use-case and update the documentation. Suggested-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260415144956.272506-2-phasta@kernel.org Signed-off-by: Danilo Krummrich --- include/drm/gpu_scheduler.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index 78e07c2507c7..609ebe389094 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -691,6 +691,7 @@ int drm_sched_entity_init(struct drm_sched_entity *entity, unsigned int num_sched_list, atomic_t *guilty); long drm_sched_entity_flush(struct drm_sched_entity *entity, long timeout); +void drm_sched_entity_kill(struct drm_sched_entity *entity); void drm_sched_entity_fini(struct drm_sched_entity *entity); void drm_sched_entity_destroy(struct drm_sched_entity *entity); void drm_sched_entity_set_priority(struct drm_sched_entity *entity, -- cgit v1.2.3 From 94e18404007d3d4c3438ca31d1430a7cf562bd59 Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Fri, 17 Apr 2026 11:37:21 +0100 Subject: drm/sched: Implement RR via FIFO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round-robin being the non-default policy and unclear how much it is used, we can notice that it can be implemented using the FIFO data structures if we only invent a fake submit timestamp which is monotonically increasing inside drm_sched_rq instances. So instead of remembering which was the last entity the scheduler worker picked we can simply bump the picked one to the bottom of the tree, which ensures round-robin behaviour between all active queued jobs. If the picked job was the last from a given entity, we remember the assigned fake timestamp and use it to re-insert the job once it re-joins the queue. This ensures the job neither overtakes all already queued jobs, neither it goes last. Instead it keeps the position after the currently queued jobs and before the ones which haven't yet been queued at the point the entity left the queue. Advantage is that we can consolidate to a single code path and remove a bunch of code. Downside is round-robin mode now needs to lock on the job pop path but that should not have a measurable performance impact. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Acked-by: Danilo Krummrich Tested-by: Vitaly Prosyak Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260417103744.76020-7-tvrtko.ursulin@igalia.com --- include/drm/gpu_scheduler.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index 609ebe389094..772331067cc2 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -94,7 +94,8 @@ struct drm_sched_entity { * @lock: * * Lock protecting the run-queue (@rq) to which this entity belongs, - * @priority and the list of schedulers (@sched_list, @num_sched_list). + * @priority, the list of schedulers (@sched_list, @num_sched_list) and + * the @rr_ts field. */ spinlock_t lock; @@ -142,6 +143,13 @@ struct drm_sched_entity { */ enum drm_sched_priority priority; + /** + * @rr_ts: + * + * Fake timestamp of the last popped job from the entity. + */ + ktime_t rr_ts; + /** * @job_queue: the list of jobs of this entity. */ @@ -239,8 +247,8 @@ struct drm_sched_entity { * struct drm_sched_rq - queue of entities to be scheduled. * * @sched: the scheduler to which this rq belongs to. - * @lock: protects @entities, @rb_tree_root and @current_entity. - * @current_entity: the entity which is to be scheduled. + * @lock: protects @entities, @rb_tree_root and @rr_ts. + * @rr_ts: monotonically incrementing fake timestamp for RR mode. * @entities: list of the entities to be scheduled. * @rb_tree_root: root of time based priority queue of entities for FIFO scheduling * @@ -253,7 +261,7 @@ struct drm_sched_rq { spinlock_t lock; /* Following members are protected by the @lock: */ - struct drm_sched_entity *current_entity; + ktime_t rr_ts; struct list_head entities; struct rb_root_cached rb_tree_root; }; -- cgit v1.2.3 From fd177135f0e62344f5d0ad3b12d40f8f7e5cdaab Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Fri, 17 Apr 2026 11:37:23 +0100 Subject: drm/sched: Account entity GPU time MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit To implement fair scheduling we need a view into the GPU time consumed by entities. Problem we have is that jobs and entities objects have decoupled lifetimes, where at the point we have a view into accurate GPU time, we cannot link back to the entity any longer. Solve this by adding a light weight entity stats object which is reference counted by both entity and the job and hence can safely be used from either side. With that, the only other thing we need is to add a helper for adding the job's GPU time into the respective entity stats object, and call it once the accurate GPU time has been calculated. The most convenient place to do that is the free job worker for several reasons. Doing the accounting from the job completion callback would mean a few locks would need to become irq safe and we would also need to worry about out of order completions (via dma_fence_is_signaled calls which we cannot control). In-order completions are critical for GPU time accuracy which is currently adjusted per fence in the free worker and requires looking at the next job in the scheduler pending list. We would also need to add a new lock to protect the scheduler average stats update. In contrast to those complications, having the accounting done from the free worker is serialized by definition and all the above complications are avoided. Downside is there is potential for a time lag between job completions and GPU time being accounted against the entity. Since that is partly alleviated by batch processing the completed job queue, and the scheduling algorithm does not attempt to be completely fair, which would even be rather impossible to achieve in the GPU world with the current DRM scheduler design and hardware with no or poor preemption support, this downside is not considered critical. Plus, in practice the scheduler is also affected by worker scheduling delays from other angles too. Not least being able to promptly feed the GPU with new work. We therefore choose the simple option and can later consider improving upon it if the need arises. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Acked-by: Danilo Krummrich Tested-by: Vitaly Prosyak Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260417103744.76020-9-tvrtko.ursulin@igalia.com --- include/drm/gpu_scheduler.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index 772331067cc2..c41a97a2c1ee 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -71,6 +71,8 @@ enum drm_sched_priority { DRM_SCHED_PRIORITY_COUNT }; +struct drm_sched_entity_stats; + /** * struct drm_sched_entity - A wrapper around a job queue (typically * attached to the DRM file_priv). @@ -110,6 +112,11 @@ struct drm_sched_entity { */ struct drm_sched_rq *rq; + /** + * @stats: Stats object reference held by the entity and jobs. + */ + struct drm_sched_entity_stats *stats; + /** * @sched_list: * @@ -365,6 +372,11 @@ struct drm_sched_job { struct drm_sched_fence *s_fence; struct drm_sched_entity *entity; + /** + * @entity_stats: Stats object reference held by the job and entity. + */ + struct drm_sched_entity_stats *entity_stats; + enum drm_sched_priority s_priority; u32 credits; /** @last_dependency: tracks @dependencies as they signal */ -- cgit v1.2.3 From 2fa4d8e2c1091189064c5b93222a23ded2d881ba Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Fri, 17 Apr 2026 11:37:25 +0100 Subject: drm/sched: Add fair scheduling policy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The FAIR scheduling policy is built upon the same concepts as the well known CFS CPU scheduler - entity run queue is sorted by the virtual GPU time consumed by entities in a way that the entity with least vruntime runs first. It is able to avoid total priority starvation, which is one of the problems with FIFO, and it also does not need for per priority run queues. As it scales the actual GPU runtime by an exponential factor as the priority decreases, the virtual runtime for low priority entities grows faster than for normal priority, pushing them further down the runqueue order for the same real GPU time spent. Apart from this fundamental fairness, fair policy is especially strong in oversubscription workloads where it is able to give more GPU time to short and bursty workloads when they are running in parallel with GPU heavy clients submitting deep job queues. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Cc: Pierre-Eric Pelloux-Prayer Acked-by: Danilo Krummrich Tested-by: Vitaly Prosyak Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260417103744.76020-11-tvrtko.ursulin@igalia.com --- include/drm/gpu_scheduler.h | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index c41a97a2c1ee..69c2097664fd 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -63,6 +63,7 @@ struct drm_file; * to an array, and as such should start at 0. */ enum drm_sched_priority { + DRM_SCHED_PRIORITY_INVALID = -1, /* Internal marker - do not use. */ DRM_SCHED_PRIORITY_KERNEL, DRM_SCHED_PRIORITY_HIGH, DRM_SCHED_PRIORITY_NORMAL, @@ -150,6 +151,11 @@ struct drm_sched_entity { */ enum drm_sched_priority priority; + /** + * @rq_priority: Run-queue priority + */ + enum drm_sched_priority rq_priority; + /** * @rr_ts: * @@ -254,10 +260,11 @@ struct drm_sched_entity { * struct drm_sched_rq - queue of entities to be scheduled. * * @sched: the scheduler to which this rq belongs to. - * @lock: protects @entities, @rb_tree_root and @rr_ts. + * @lock: protects @entities, @rb_tree_root, @rr_ts and @head_prio. * @rr_ts: monotonically incrementing fake timestamp for RR mode. * @entities: list of the entities to be scheduled. * @rb_tree_root: root of time based priority queue of entities for FIFO scheduling + * @head_prio: priority of the top tree element. * * Run queue is a set of entities scheduling command submissions for * one specific ring. It implements the scheduling policy that selects @@ -271,6 +278,7 @@ struct drm_sched_rq { ktime_t rr_ts; struct list_head entities; struct rb_root_cached rb_tree_root; + enum drm_sched_priority head_prio; }; /** @@ -563,8 +571,10 @@ struct drm_sched_backend_ops { * @credit_count: the current credit count of this scheduler * @timeout: the time after which a job is removed from the scheduler. * @name: name of the ring for which this scheduler is being used. - * @num_rqs: Number of run-queues. This is at most DRM_SCHED_PRIORITY_COUNT, - * as there's usually one run-queue per priority, but could be less. + * @num_user_rqs: Number of run-queues. This is at most + * DRM_SCHED_PRIORITY_COUNT, as there's usually one run-queue per + * priority, but could be less. + * @num_rqs: Equal to @num_user_rqs for FIFO and RR and 1 for the FAIR policy. * @sched_rq: An allocated array of run-queues of size @num_rqs; * @job_scheduled: once drm_sched_entity_flush() is called the scheduler * waits on this wait queue until all the scheduled jobs are @@ -597,6 +607,7 @@ struct drm_gpu_scheduler { long timeout; const char *name; u32 num_rqs; + u32 num_user_rqs; struct drm_sched_rq **sched_rq; wait_queue_head_t job_scheduled; atomic64_t job_id_count; -- cgit v1.2.3 From af85fa14ad7c4adf4276c65bb640843c6d210927 Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Fri, 17 Apr 2026 11:37:26 +0100 Subject: drm/sched: Favour interactive clients slightly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GPUs do not always implement preemption and DRM scheduler definitely does not support it at the front end scheduling level. This means execution quanta can be quite long and is controlled by userspace, consequence of which is picking the "wrong" entity to run can have a larger negative effect than it would have with a virtual runtime based CPU scheduler. Another important consideration is that rendering clients often have shallow submission queues, meaning they will be entering and exiting the scheduler's runnable queue often. Relevant scenario here is what happens when an entity re-joins the runnable queue with other entities already present. One cornerstone of the virtual runtime algorithm is to let it re-join at the head and rely on the virtual runtime accounting and timeslicing to sort it out. However, as explained above, this may not work perfectly in the GPU world. Entity could always get to overtake the existing entities, or not, depending on the submission order and rbtree equal key insertion behaviour. Allow interactive jobs to overtake entities already queued up for the limited case when interactive entity is re-joining the queue after being idle. This gives more opportunity for the compositors to have their rendering executed before the GPU hogs even if they have been configured with the same scheduling priority. To classify a client as interactive we look at its average job duration versus the average for the whole scheduler. We can track this easily by plugging into the existing job runtime tracking and applying the exponential moving average window on the past submissions. Then, all other things being equal, we let the more interactive jobs go first. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Cc: Pierre-Eric Pelloux-Prayer Acked-by: Danilo Krummrich Tested-by: Vitaly Prosyak Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260417103744.76020-12-tvrtko.ursulin@igalia.com --- include/drm/gpu_scheduler.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index 69c2097664fd..790f7ecb6b85 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -25,11 +25,14 @@ #define _DRM_GPU_SCHEDULER_H_ #include +#include #include #include #include #include +DECLARE_EWMA(drm_sched_avgtime, 6, 4); + #define MAX_WAIT_SCHED_ENTITY_Q_EMPTY msecs_to_jiffies(1000) /** @@ -582,6 +585,7 @@ struct drm_sched_backend_ops { * @job_id_count: used to assign unique id to the each job. * @submit_wq: workqueue used to queue @work_run_job and @work_free_job * @timeout_wq: workqueue used to queue @work_tdr + * @avg_job_us: Average job duration. * @work_run_job: work which calls run_job op of each scheduler. * @work_free_job: work which calls free_job op of each scheduler. * @work_tdr: schedules a delayed call to @drm_sched_job_timedout after the @@ -613,6 +617,7 @@ struct drm_gpu_scheduler { atomic64_t job_id_count; struct workqueue_struct *submit_wq; struct workqueue_struct *timeout_wq; + struct ewma_drm_sched_avgtime avg_job_us; struct work_struct work_run_job; struct work_struct work_free_job; struct delayed_work work_tdr; -- cgit v1.2.3 From 77a6809f1dc39376116f8d769a0d2630dc95ad79 Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Fri, 17 Apr 2026 11:37:28 +0100 Subject: drm/sched: Remove FIFO and RR and simplify to a single run queue MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since the new FAIR policy is in general better than FIFO and almost as good as round-robin in interactive use cases, plus the latter has not been the default policy in a long time, we can afford to remove both and leave just FAIR. By doing so we can simplify the scheduler code by making the scheduler to run queue relationship always 1:1 and remove some code. Also, now that the FIFO policy is gone the tree of entities is not a FIFO tree any more so rename it to just the tree. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Acked-by: Danilo Krummrich Tested-by: Vitaly Prosyak Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260417103744.76020-14-tvrtko.ursulin@igalia.com --- include/drm/gpu_scheduler.h | 36 ++++-------------------------------- 1 file changed, 4 insertions(+), 32 deletions(-) (limited to 'include') diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index 790f7ecb6b85..80e5ae2d61ec 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -100,8 +100,7 @@ struct drm_sched_entity { * @lock: * * Lock protecting the run-queue (@rq) to which this entity belongs, - * @priority, the list of schedulers (@sched_list, @num_sched_list) and - * the @rr_ts field. + * @priority and the list of schedulers (@sched_list, @num_sched_list). */ spinlock_t lock; @@ -154,18 +153,6 @@ struct drm_sched_entity { */ enum drm_sched_priority priority; - /** - * @rq_priority: Run-queue priority - */ - enum drm_sched_priority rq_priority; - - /** - * @rr_ts: - * - * Fake timestamp of the last popped job from the entity. - */ - ktime_t rr_ts; - /** * @job_queue: the list of jobs of this entity. */ @@ -263,8 +250,7 @@ struct drm_sched_entity { * struct drm_sched_rq - queue of entities to be scheduled. * * @sched: the scheduler to which this rq belongs to. - * @lock: protects @entities, @rb_tree_root, @rr_ts and @head_prio. - * @rr_ts: monotonically incrementing fake timestamp for RR mode. + * @lock: protects @entities, @rb_tree_root and @head_prio. * @entities: list of the entities to be scheduled. * @rb_tree_root: root of time based priority queue of entities for FIFO scheduling * @head_prio: priority of the top tree element. @@ -278,7 +264,6 @@ struct drm_sched_rq { spinlock_t lock; /* Following members are protected by the @lock: */ - ktime_t rr_ts; struct list_head entities; struct rb_root_cached rb_tree_root; enum drm_sched_priority head_prio; @@ -364,13 +349,6 @@ struct drm_sched_fence *to_drm_sched_fence(struct dma_fence *f); * to schedule the job. */ struct drm_sched_job { - /** - * @submit_ts: - * - * When the job was pushed into the entity queue. - */ - ktime_t submit_ts; - /** * @sched: * @@ -574,11 +552,7 @@ struct drm_sched_backend_ops { * @credit_count: the current credit count of this scheduler * @timeout: the time after which a job is removed from the scheduler. * @name: name of the ring for which this scheduler is being used. - * @num_user_rqs: Number of run-queues. This is at most - * DRM_SCHED_PRIORITY_COUNT, as there's usually one run-queue per - * priority, but could be less. - * @num_rqs: Equal to @num_user_rqs for FIFO and RR and 1 for the FAIR policy. - * @sched_rq: An allocated array of run-queues of size @num_rqs; + * @rq: Scheduler run queue. * @job_scheduled: once drm_sched_entity_flush() is called the scheduler * waits on this wait queue until all the scheduled jobs are * finished. @@ -610,9 +584,7 @@ struct drm_gpu_scheduler { atomic_t credit_count; long timeout; const char *name; - u32 num_rqs; - u32 num_user_rqs; - struct drm_sched_rq **sched_rq; + struct drm_sched_rq *rq; wait_queue_head_t job_scheduled; atomic64_t job_id_count; struct workqueue_struct *submit_wq; -- cgit v1.2.3 From 16e7698bc04d3dd19d95a688e4b0297a0e28a93b Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Fri, 17 Apr 2026 11:37:29 +0100 Subject: drm/sched: Embed run queue singleton into the scheduler MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Now that the run queue to scheduler relationship is always 1:1 we can embed it (the run queue) directly in the scheduler struct and save on some allocation error handling code and such. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Acked-by: Danilo Krummrich Tested-by: Vitaly Prosyak Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260417103744.76020-15-tvrtko.ursulin@igalia.com --- include/drm/gpu_scheduler.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) (limited to 'include') diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index 80e5ae2d61ec..f1e15a80c844 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -249,7 +249,6 @@ struct drm_sched_entity { /** * struct drm_sched_rq - queue of entities to be scheduled. * - * @sched: the scheduler to which this rq belongs to. * @lock: protects @entities, @rb_tree_root and @head_prio. * @entities: list of the entities to be scheduled. * @rb_tree_root: root of time based priority queue of entities for FIFO scheduling @@ -260,8 +259,6 @@ struct drm_sched_entity { * the next entity to emit commands from. */ struct drm_sched_rq { - struct drm_gpu_scheduler *sched; - spinlock_t lock; /* Following members are protected by the @lock: */ struct list_head entities; @@ -584,7 +581,7 @@ struct drm_gpu_scheduler { atomic_t credit_count; long timeout; const char *name; - struct drm_sched_rq *rq; + struct drm_sched_rq rq; wait_queue_head_t job_scheduled; atomic64_t job_id_count; struct workqueue_struct *submit_wq; -- cgit v1.2.3 From d09339388b778f04dd9e638befa2594c9cb4290b Mon Sep 17 00:00:00 2001 From: Tvrtko Ursulin Date: Fri, 17 Apr 2026 11:37:44 +0100 Subject: drm/sched: Remove drm_sched_init_args->num_rqs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove member no longer used by the scheduler core and the drivers. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Acked-by: Danilo Krummrich Tested-by: Vitaly Prosyak Signed-off-by: Philipp Stanner Link: https://patch.msgid.link/20260417103744.76020-30-tvrtko.ursulin@igalia.com --- include/drm/gpu_scheduler.h | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h index f1e15a80c844..d61c19e78182 100644 --- a/include/drm/gpu_scheduler.h +++ b/include/drm/gpu_scheduler.h @@ -608,8 +608,6 @@ struct drm_gpu_scheduler { * @ops: backend operations provided by the driver * @submit_wq: workqueue to use for submission. If NULL, an ordered wq is * allocated and used. - * @num_rqs: Number of run-queues. This may be at most DRM_SCHED_PRIORITY_COUNT, - * as there's usually one run-queue per priority, but may be less. * @credit_limit: the number of credits this scheduler can hold from all jobs * @hang_limit: number of times to allow a job to hang before dropping it. * This mechanism is DEPRECATED. Set it to 0. @@ -623,7 +621,6 @@ struct drm_sched_init_args { const struct drm_sched_backend_ops *ops; struct workqueue_struct *submit_wq; struct workqueue_struct *timeout_wq; - u32 num_rqs; u32 credit_limit; unsigned int hang_limit; long timeout; -- cgit v1.2.3 From a8c56e00c608d5c70eb89464676ea0b3cdcb1ce6 Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov Date: Mon, 13 Apr 2026 17:05:29 +0300 Subject: drm/of: add helper to count data-lanes on a remote endpoint If the DSI panel supports versatile lanes configuration, its driver might require determining the number of DSI data lanes, which is usually specified on the DSI host side of the OF graph. Add new helper as a pair to drm_of_get_data_lanes_count_ep() that lets callers determine number of data-lanes on the remote side of the OF graph. Reviewed-by: Javier Martinez Canillas Link: https://patch.msgid.link/20260413-waveshare-dsi-touch-v3-6-3aeb53022c32@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov --- include/drm/drm_of.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'include') diff --git a/include/drm/drm_of.h b/include/drm/drm_of.h index f2f2bf82eff9..7bcc0ccfe0f4 100644 --- a/include/drm/drm_of.h +++ b/include/drm/drm_of.h @@ -62,6 +62,10 @@ int drm_of_get_data_lanes_count_ep(const struct device_node *port, int port_reg, int reg, const unsigned int min, const unsigned int max); +int drm_of_get_data_lanes_count_remote(const struct device_node *port, + int port_reg, int reg, + const unsigned int min, + const unsigned int max); #else static inline uint32_t drm_of_crtc_port_mask(struct drm_device *dev, struct device_node *port) @@ -140,6 +144,15 @@ drm_of_get_data_lanes_count_ep(const struct device_node *port, { return -EINVAL; } + +static inline int +drm_of_get_data_lanes_count_remote(const struct device_node *port, + int port_reg, int reg, + const unsigned int min, + const unsigned int max) +{ + return -EINVAL; +} #endif #if IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_DRM_MIPI_DSI) -- cgit v1.2.3 From e43a8e3ad8fa3c2c2220a06fa46545c7ff82a9b7 Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov Date: Mon, 13 Apr 2026 17:05:41 +0300 Subject: drm/panel: add devm_drm_panel_add() helper Add devm_drm_panel_add(), devres-managed version of drm_panel_add(). It's not uncommon for the panel drivers to use devres functions for most of the resources. Provide corresponding replacement for drm_panel_add(). Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260413-waveshare-dsi-touch-v3-18-3aeb53022c32@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov --- include/drm/drm_panel.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h index 2407bfa60236..1fb9148dd095 100644 --- a/include/drm/drm_panel.h +++ b/include/drm/drm_panel.h @@ -329,6 +329,7 @@ void drm_panel_put(struct drm_panel *panel); void drm_panel_add(struct drm_panel *panel); void drm_panel_remove(struct drm_panel *panel); +int devm_drm_panel_add(struct device *dev, struct drm_panel *panel); void drm_panel_prepare(struct drm_panel *panel); void drm_panel_unprepare(struct drm_panel *panel); -- cgit v1.2.3 From 31f61ac33032ee87ea404d6d996ba2c386502a36 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Tue, 14 Apr 2026 12:10:14 -0700 Subject: bpf: Refactor dynptr mutability tracking Redefine dynptr mutability and fix inconsistency in the verifier and kfunc signatures. Dynptr mutability is at two levels. The first is the bpf_dynptr structure and the second is the memory the dynptr points to. The verifer currently tracks the mutability of the bpf_dynptr struct through helper and kfunc prototypes, where "const struct bpf_dynptr *" means the structure itself is immutable. The second level is tracked in upper bit of bpf_dynptr->size in runtime and is not changed in this patch. There are two type of inconsistency in the verfier regarding the mutability of the bpf_dynptr struct. First, there are many existing kfuncs whose prototypes are wrong. For example, bpf_dynptr_adjust() mutates a dynptr's start and offset but marks the argument as a const pointer. At the same time many other kfuncs that does not mutate the dynptr but mark themselves as mutable. Second, the verifier currently does not honor the const qualifier in kfunc prototypes as it determines whether tagging the arg_type with MEM_RDONLY or not based on the register state. Since all the verifier care is to prevent CONST_PTR_TO_DYNPTR from being destroyed in callback and global subprogram, redefine the mutability at the bpf_dynptr level to just bpf_dynptr_kern->data. Then, explicitly prohibit passing CONST_PTR_TO_DYNPTR to an argument tagged with MEM_UNINIT or OBJ_RELEASE. The mutability of a dynptr's view is not really interesting so drop MEM_RDONLY annotation for dynptr from the helpers and kfuncs. Plus, if the mutability of the entire bpf_dynptr were to be done correctly, it would kill the bpf_dynptr_adjust() usage in callback and global subporgram. Implementation wise - First, make sure all kfunc arg are correctly tagged: Tag the dynptr argument of bpf_dynptr_file_discard() with OBJ_RELEASE. - Then, in process_dynptr_func(), make sure CONST_PTR_TO_DYNPTR cannot be passed to argument tagged with MEM_UNINIT or OBJ_RELEASE. For MEM_UNINIT, it is already checked by is_dynptr_reg_valid_uninit(). For OBJ_RELEASE, check against OBJ_RELEASE instead of MEM_RDONLY and drop a now identical check in unmark_stack_slots_dynptr(). - Remove the mutual exclusive check between MEM_UNINIT and MEM_RDONLY, but don't add a MEM_UNINIT and OBJ_RELEASE version as it is obviously wrong. Note that while this patch stops following the C semantic for the mutability of bpf_dynptr, the prototype of kfuncs are still fixed to maintain the correct C semantics in the implementation. Adding or removing the const qualifier does not break backward compatibility. In addition, fix kfuncs dropping the const qualifier when casting the opaque bpf_dynptr to bpf_dynptr_kern. In test_kfunc_dynptr_param.c, initialize dynptr to 0 to avoid -Wuninitialized-const-pointer warning. Signed-off-by: Amery Hung Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/bpf/20260414191014.1218567-1-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi --- include/linux/bpf.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index b4b703c90ca9..3cb6b9e70080 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -3622,8 +3622,8 @@ static inline int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, struct bpf_key *bpf_lookup_user_key(s32 serial, u64 flags); struct bpf_key *bpf_lookup_system_key(u64 id); void bpf_key_put(struct bpf_key *bkey); -int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p, - struct bpf_dynptr *sig_p, +int bpf_verify_pkcs7_signature(const struct bpf_dynptr *data_p, + const struct bpf_dynptr *sig_p, struct bpf_key *trusted_keyring); #else @@ -3641,8 +3641,8 @@ static inline void bpf_key_put(struct bpf_key *bkey) { } -static inline int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_p, - struct bpf_dynptr *sig_p, +static inline int bpf_verify_pkcs7_signature(const struct bpf_dynptr *data_p, + const struct bpf_dynptr *sig_p, struct bpf_key *trusted_keyring) { return -EOPNOTSUPP; -- cgit v1.2.3 From 41e3312861eafba171d9620150aaf2e99165d044 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Sun, 19 Apr 2026 08:36:45 -1000 Subject: sched_ext: add p->scx.tid and SCX_OPS_TID_TO_TASK lookup BPF schedulers that can't hold task_struct pointers (arena-backed ones in particular) key tasks by pid. During exit, pid is released before the task finishes passing through scheduler callbacks, so a dying task becomes invisible to the BPF side mid-schedule. scx_qmap hits this: an exiting task's dispatch callback can't recover its queue entry, stalling dispatch until SCX_EXIT_ERROR_STALL. Add a unique non-zero u64 p->scx.tid assigned at fork that survives the full task lifetime including exit. scx_bpf_tid_to_task() looks up the task; unlike bpf_task_from_pid(), it handles exiting tasks. The lookup costs an rhashtable insert/remove under scx_tasks_lock, so root schedulers opt in via SCX_OPS_TID_TO_TASK. Sub-schedulers that set the flag to declare a dependency are rejected at attach if root didn't opt in. scx_qmap converted: keys tasks by tid and enables SCX_OPS_ENQ_EXITING. Pre-patch it stalls within seconds under a non-leader-exec workload; with the patch it runs cleanly. v3: Warn on rhashtable_lookup_insert_fast() failure via new scx_tid_hash_insert() helper (Cheng-Yang Chou). v2: Guard scx_root deref in scx_bpf_tid_to_task() error path. The kfunc is registered via scx_kfunc_set_any and reachable from tracing and syscall programs when no scheduler is attached (Cheng-Yang Chou). Signed-off-by: Tejun Heo Reviewed-by: Cheng-Yang Chou Reviewed-by: Andrea Righi --- include/linux/sched/ext.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/linux/sched/ext.h b/include/linux/sched/ext.h index 1a3af2ea2a79..d05efcac794d 100644 --- a/include/linux/sched/ext.h +++ b/include/linux/sched/ext.h @@ -203,6 +203,15 @@ struct sched_ext_entity { u64 core_sched_at; /* see scx_prio_less() */ #endif + /* + * Unique non-zero task ID assigned at fork. Persists across exec and + * is never reused. Lets BPF schedulers identify tasks without storing + * kernel pointers - arena-backed schedulers being one example. See + * scx_bpf_tid_to_task(). + */ + u64 tid; + struct rhash_head tid_hash_node; /* see SCX_OPS_TID_TO_TASK */ + /* BPF scheduler modifiable fields */ /* -- cgit v1.2.3 From f7a6b9eaff3e6693ba3b19c5812e28538049bbf2 Mon Sep 17 00:00:00 2001 From: Alan Maguire Date: Fri, 17 Apr 2026 15:30:18 +0100 Subject: bpf: Extend BTF UAPI vlen, kinds to use unused bits BTF maximum vlen is encoded using 16 bits with a maximum vlen of 65535. This has sufficed for structs, function parameters and enumerated type values. However, with upcoming BTF location information - in particular information about inline sites - this limit is surpassed. Use bits 16-23 - currently unused in BTF info - to extend to 24 bits, giving a max vlen of (2^24 - 1), or 16 million. Also extend BTF kind encoding from 5 to 7 bits, giving a maximum available number of kinds of 128. Since with the BTF location work we use another 3 kinds, we are fast approaching the current limit of 32. Convert BTF_MAX_* values to enums to allow them to be encoded in kernel BTF; this will allow us to detect if the running kernel supports a 24-bit vlen or not. Add one for max _possible_ (not used) kind. Fix up a few places in the kernel where a 16-bit vlen is assumed; remove BTF_INFO_MASK as now all bits are used. The vlen expansion was suggested by Andrii in [1]; the kind expansion is tackled here too as it may be needed also to support new kinds in BTF. [1] https://lore.kernel.org/bpf/CAEf4BzZx=X6vGqcA8SPU6D+v6k+TR=ZewebXMuXtpmML058piw@mail.gmail.com/ Suggested-by: Andrii Nakryiko Signed-off-by: Alan Maguire Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260417143023.1551481-2-alan.maguire@oracle.com Signed-off-by: Alexei Starovoitov --- include/linux/btf.h | 4 ++-- include/uapi/linux/btf.h | 26 ++++++++++++++------------ 2 files changed, 16 insertions(+), 14 deletions(-) (limited to 'include') diff --git a/include/linux/btf.h b/include/linux/btf.h index 48108471c5b1..c82d0d689059 100644 --- a/include/linux/btf.h +++ b/include/linux/btf.h @@ -415,12 +415,12 @@ static inline bool btf_type_is_array(const struct btf_type *t) return BTF_INFO_KIND(t->info) == BTF_KIND_ARRAY; } -static inline u16 btf_type_vlen(const struct btf_type *t) +static inline u32 btf_type_vlen(const struct btf_type *t) { return BTF_INFO_VLEN(t->info); } -static inline u16 btf_vlen(const struct btf_type *t) +static inline u32 btf_vlen(const struct btf_type *t) { return btf_type_vlen(t); } diff --git a/include/uapi/linux/btf.h b/include/uapi/linux/btf.h index 638615ebddc2..618167cab4e6 100644 --- a/include/uapi/linux/btf.h +++ b/include/uapi/linux/btf.h @@ -33,20 +33,22 @@ struct btf_header { __u32 layout_len; /* length of layout section */ }; -/* Max # of type identifier */ -#define BTF_MAX_TYPE 0x000fffff -/* Max offset into the string section */ -#define BTF_MAX_NAME_OFFSET 0x00ffffff -/* Max # of struct/union/enum members or func args */ -#define BTF_MAX_VLEN 0xffff +enum btf_max { + /* Max possible kind */ + BTF_MAX_KIND = 0x0000007f, + /* Max # of type identifier */ + BTF_MAX_TYPE = 0x000fffff, + /* Max offset into the string section */ + BTF_MAX_NAME_OFFSET = 0x00ffffff, + /* Max # of struct/union/enum members or func args */ + BTF_MAX_VLEN = 0x00ffffff, +}; struct btf_type { __u32 name_off; /* "info" bits arrangement - * bits 0-15: vlen (e.g. # of struct's members) - * bits 16-23: unused - * bits 24-28: kind (e.g. int, ptr, array...etc) - * bits 29-30: unused + * bits 0-23: vlen (e.g. # of struct's members) + * bits 24-30: kind (e.g. int, ptr, array...etc) * bit 31: kind_flag, currently used by * struct, union, enum, fwd, enum64, * decl_tag and type_tag @@ -65,8 +67,8 @@ struct btf_type { }; }; -#define BTF_INFO_KIND(info) (((info) >> 24) & 0x1f) -#define BTF_INFO_VLEN(info) ((info) & 0xffff) +#define BTF_INFO_KIND(info) (((info) >> 24) & 0x7f) +#define BTF_INFO_VLEN(info) ((info) & 0xffffff) #define BTF_INFO_KFLAG(info) ((info) >> 31) enum { -- cgit v1.2.3 From 8711eb2dde2ed44c98714b875dcf7329950c71ba Mon Sep 17 00:00:00 2001 From: Max Zhen Date: Tue, 21 Apr 2026 11:15:02 -0700 Subject: accel/amdxdna: Improve tracing for job lifecycle and mailbox RX worker Add more trace coverage to amdxdna job handling and mailbox receive processing to make driver execution easier to debug. Extend the xdna_job trace event to record the command opcode in addition to the job sequence number. Use the enhanced tracepoint in the job run, sent-to-device, signaled-fence, and job-free paths so that trace output can be correlated with the command being executed. Also add debug-point tracing when a command is received through the submit ioctl path, and add a trace event when the mailbox RX worker runs. These changes improve visibility into job lifetime transitions and mailbox activity, which helps debug command flow and scheduler issues. Signed-off-by: Max Zhen Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260421181502.1970263-1-lizhi.hou@amd.com --- include/trace/events/amdxdna.h | 42 ++++++++++++++++++++++++++++-------------- 1 file changed, 28 insertions(+), 14 deletions(-) (limited to 'include') diff --git a/include/trace/events/amdxdna.h b/include/trace/events/amdxdna.h index c6cb2da7b706..71da24267e52 100644 --- a/include/trace/events/amdxdna.h +++ b/include/trace/events/amdxdna.h @@ -30,26 +30,30 @@ TRACE_EVENT(amdxdna_debug_point, ); TRACE_EVENT(xdna_job, - TP_PROTO(struct drm_sched_job *sched_job, const char *name, const char *str, u64 seq), + TP_PROTO(struct drm_sched_job *sched_job, const char *name, + const char *str, u64 seq, u32 op), - TP_ARGS(sched_job, name, str, seq), + TP_ARGS(sched_job, name, str, seq, op), TP_STRUCT__entry(__string(name, name) __string(str, str) __field(u64, fence_context) __field(u64, fence_seqno) - __field(u64, seq)), + __field(u64, seq) + __field(u32, op)), TP_fast_assign(__assign_str(name); __assign_str(str); __entry->fence_context = sched_job->s_fence->finished.context; __entry->fence_seqno = sched_job->s_fence->finished.seqno; - __entry->seq = seq;), + __entry->seq = seq; + __entry->op = op;), - TP_printk("fence=(context:%llu, seqno:%lld), %s seq#:%lld %s", + TP_printk("fence=(context:%llu, seqno:%llu), %s seq#:%llu %s, op=%u", __entry->fence_context, __entry->fence_seqno, __get_str(name), __entry->seq, - __get_str(str)) + __get_str(str), + __entry->op) ); DECLARE_EVENT_CLASS(xdna_mbox_msg, @@ -81,18 +85,28 @@ DEFINE_EVENT(xdna_mbox_msg, mbox_set_head, TP_ARGS(name, chann_id, opcode, id) ); -TRACE_EVENT(mbox_irq_handle, - TP_PROTO(char *name, int irq), +DECLARE_EVENT_CLASS(xdna_mbox_name_id, + TP_PROTO(char *name, int irq), - TP_ARGS(name, irq), + TP_ARGS(name, irq), - TP_STRUCT__entry(__string(name, name) - __field(int, irq)), + TP_STRUCT__entry(__string(name, name) + __field(int, irq)), - TP_fast_assign(__assign_str(name); - __entry->irq = irq;), + TP_fast_assign(__assign_str(name); + __entry->irq = irq;), + + TP_printk("%s.%d", __get_str(name), __entry->irq) +); + +DEFINE_EVENT(xdna_mbox_name_id, mbox_irq_handle, + TP_PROTO(char *name, int irq), + TP_ARGS(name, irq) +); - TP_printk("%s.%d", __get_str(name), __entry->irq) +DEFINE_EVENT(xdna_mbox_name_id, mbox_rx_worker, + TP_PROTO(char *name, int irq), + TP_ARGS(name, irq) ); #endif /* !defined(_TRACE_AMDXDNA_H) || defined(TRACE_HEADER_MULTI_READ) */ -- cgit v1.2.3 From 439ebd5b5708f236f7a4a9784194f7ecb77cd814 Mon Sep 17 00:00:00 2001 From: Mykyta Yatsenko Date: Wed, 22 Apr 2026 12:41:06 -0700 Subject: bpf: Add sleepable support for raw tracepoint programs Rework __bpf_trace_run() to support sleepable BPF programs by using explicit RCU flavor selection, following the uprobe_prog_run() pattern. For sleepable programs, use rcu_read_lock_tasks_trace() for lifetime protection with migrate_disable(). For non-sleepable programs, use the regular rcu_read_lock_dont_migrate(). Remove the preempt_disable_notrace/preempt_enable_notrace pair from the faultable tracepoint BPF probe wrapper in bpf_probe.h, since migration protection and RCU locking are now handled per-program inside __bpf_trace_run(). Adapt bpf_prog_test_run_raw_tp() for sleepable programs: reject BPF_F_TEST_RUN_ON_CPU since sleepable programs cannot run in hardirq or preempt-disabled context, and call __bpf_prog_test_run_raw_tp() directly instead of via smp_call_function_single(). Rework __bpf_prog_test_run_raw_tp() to select RCU flavor per-program and add per-program recursion context guard for private stack safety. Signed-off-by: Mykyta Yatsenko Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-1-99005dff21ef@meta.com Signed-off-by: Kumar Kartikeya Dwivedi --- include/trace/bpf_probe.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/trace/bpf_probe.h b/include/trace/bpf_probe.h index 9391d54d3f12..d1de8f9aa07f 100644 --- a/include/trace/bpf_probe.h +++ b/include/trace/bpf_probe.h @@ -58,9 +58,7 @@ static notrace void \ __bpf_trace_##call(void *__data, proto) \ { \ might_fault(); \ - preempt_disable_notrace(); \ CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(__data, CAST_TO_U64(args)); \ - preempt_enable_notrace(); \ } #undef DECLARE_EVENT_SYSCALL_CLASS -- cgit v1.2.3 From 12628ffaf98b708a80857a462613119b9e16de4c Mon Sep 17 00:00:00 2001 From: Mykyta Yatsenko Date: Wed, 22 Apr 2026 12:41:07 -0700 Subject: bpf: Add bpf_prog_run_array_sleepable() Add bpf_prog_run_array_sleepable() for running BPF program arrays on faultable tracepoints. Unlike bpf_prog_run_array_uprobe(), it includes per-program recursion checking for private stack safety and hardcodes is_uprobe to false. Skip dummy_bpf_prog at the top of the loop. When bpf_prog_array_delete_safe() replaces a detached program with dummy_bpf_prog on allocation failure, the dummy is statically allocated and has NULL active, stats, and aux fields. Identify it by prog->len == 0, since every real program has at least one instruction. Keep bpf_prog_run_array_uprobe() unchanged for uprobe callers. Signed-off-by: Mykyta Yatsenko Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-2-99005dff21ef@meta.com Signed-off-by: Kumar Kartikeya Dwivedi --- include/linux/bpf.h | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 3cb6b9e70080..d3aea3931b85 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -3079,6 +3079,56 @@ void bpf_dynptr_set_null(struct bpf_dynptr_kern *ptr); void bpf_dynptr_set_rdonly(struct bpf_dynptr_kern *ptr); void bpf_prog_report_arena_violation(bool write, unsigned long addr, unsigned long fault_ip); +static __always_inline u32 +bpf_prog_run_array_sleepable(const struct bpf_prog_array *array, + const void *ctx, bpf_prog_run_fn run_prog) +{ + const struct bpf_prog_array_item *item; + struct bpf_prog *prog; + struct bpf_run_ctx *old_run_ctx; + struct bpf_trace_run_ctx run_ctx; + u32 ret = 1; + + if (unlikely(!array)) + return ret; + + migrate_disable(); + + run_ctx.is_uprobe = false; + + old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); + item = &array->items[0]; + while ((prog = READ_ONCE(item->prog))) { + /* Skip dummy_bpf_prog placeholder (len == 0) */ + if (unlikely(!prog->len)) { + item++; + continue; + } + + if (unlikely(!bpf_prog_get_recursion_context(prog))) { + bpf_prog_inc_misses_counter(prog); + bpf_prog_put_recursion_context(prog); + item++; + continue; + } + + run_ctx.bpf_cookie = item->bpf_cookie; + + if (!prog->sleepable) { + guard(rcu)(); + ret &= run_prog(prog, ctx); + } else { + ret &= run_prog(prog, ctx); + } + + bpf_prog_put_recursion_context(prog); + item++; + } + bpf_reset_run_ctx(old_run_ctx); + migrate_enable(); + return ret; +} + #else /* !CONFIG_BPF_SYSCALL */ static inline struct bpf_prog *bpf_prog_get(u32 ufd) { -- cgit v1.2.3 From 57918341dd19e5ca8a77622ffae3db19e5ba4cc7 Mon Sep 17 00:00:00 2001 From: Mykyta Yatsenko Date: Wed, 22 Apr 2026 12:41:08 -0700 Subject: bpf: Add sleepable support for classic tracepoint programs Add trace_call_bpf_faultable(), a variant of trace_call_bpf() for faultable tracepoints that supports sleepable BPF programs. It uses rcu_tasks_trace for lifetime protection and bpf_prog_run_array_sleepable() for per-program RCU flavor selection, following the uprobe_prog_run() pattern. Restructure perf_syscall_enter() and perf_syscall_exit() to run BPF programs before perf event processing. Previously, BPF ran after the per-cpu perf trace buffer was allocated under preempt_disable, requiring cleanup via perf_swevent_put_recursion_context() on filter. Now BPF runs in faultable context before preempt_disable, reading syscall arguments from local variables instead of the per-cpu trace record, removing the dependency on buffer allocation. This allows sleepable BPF programs to execute and avoids unnecessary buffer allocation when BPF filters the event. The perf event submission path (buffer allocation, fill, submit) remains under preempt_disable as before. Since BPF no longer runs within the buffer allocation context, the fake_regs output parameter to perf_trace_buf_alloc() is no longer needed and is replaced with NULL. Add an attach-time check in __perf_event_set_bpf_prog() to reject sleepable BPF_PROG_TYPE_TRACEPOINT programs on non-syscall tracepoints, since only syscall tracepoints run in faultable context. This prepares the classic tracepoint runtime and attach paths for sleepable programs. The verifier changes to allow loading sleepable BPF_PROG_TYPE_TRACEPOINT programs are in a subsequent patch. To: Peter Zijlstra To: Steven Rostedt Signed-off-by: Mykyta Yatsenko Acked-by: Kumar Kartikeya Dwivedi # for BPF bits Acked-by: Steven Rostedt Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-3-99005dff21ef@meta.com Signed-off-by: Kumar Kartikeya Dwivedi --- include/linux/trace_events.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h index 40a43a4c7caf..d49338c44014 100644 --- a/include/linux/trace_events.h +++ b/include/linux/trace_events.h @@ -770,6 +770,7 @@ trace_trigger_soft_disabled(struct trace_event_file *file) #ifdef CONFIG_BPF_EVENTS unsigned int trace_call_bpf(struct trace_event_call *call, void *ctx); +unsigned int trace_call_bpf_faultable(struct trace_event_call *call, void *ctx); int perf_event_attach_bpf_prog(struct perf_event *event, struct bpf_prog *prog, u64 bpf_cookie); void perf_event_detach_bpf_prog(struct perf_event *event); int perf_event_query_prog_array(struct perf_event *event, void __user *info); @@ -792,6 +793,11 @@ static inline unsigned int trace_call_bpf(struct trace_event_call *call, void *c return 1; } +static inline unsigned int trace_call_bpf_faultable(struct trace_event_call *call, void *ctx) +{ + return 1; +} + static inline int perf_event_attach_bpf_prog(struct perf_event *event, struct bpf_prog *prog, u64 bpf_cookie) { -- cgit v1.2.3 From 9b9f0b42703ceb88332bcb19453c4288c2683e34 Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Wed, 22 Apr 2026 20:35:01 -0700 Subject: bpf: Prepare verifier logs for upcoming kfunc stack arguments This change prepares verifier log reporting for upcoming kfunc stack argument support. Currently verifier log code mostly assumes that an argument can be described directly by a register number. That works for arguments passed in `R1` to `R5`, but it does not work once kfunc arguments can also be passed on the stack. Introduce an opaque `argno_t` type that encodes both register-based and arg-based references. Four helpers form the interface: - argno_from_reg(regno): create from a register number - argno_from_arg(arg): create from a 1-based arg number - reg_from_argno(a): extract register number, or -1 - arg_from_argno(a): extract arg number, or -1 reg_arg_name() converts an argno_t to a human-readable string for verifier logs: "R%d" for register arguments, or "*(R11-off)" for stack arguments beyond R5. Update selftests accordingly. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260423033501.2539667-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index b148f816f25b..d5b4303315dd 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -913,6 +913,7 @@ struct bpf_verifier_env { * e.g., in reg_type_str() to generate reg_type string */ char tmp_str_buf[TMP_STR_BUF_LEN]; + char tmp_arg_name[32]; struct bpf_insn insn_buf[INSN_BUF_SIZE]; struct bpf_insn epilogue_buf[INSN_BUF_SIZE]; struct bpf_scc_callchain callchain_buf; -- cgit v1.2.3 From 246ad6e5ee259669692bdb7fb353e8c5d5bba628 Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Wed, 22 Apr 2026 20:35:06 -0700 Subject: bpf: Introduce bpf register BPF_REG_PARAMS Introduce BPF_REG_PARAMS as a dedicated BPF register for stack argument accesses. It occupies the BPF register number 11 (R11), which is used as the base pointer for the stack argument area, keeping it separate from the R10-based (BPF_REG_FP) program stack. The kernel-internal hidden register BPF_REG_AX previously occupied slot 11 (MAX_BPF_REG). With BPF_REG_PARAMS taking that slot, BPF_REG_AX moves to slot 12 and MAX_BPF_EXT_REG increases accordingly. Acked-by: Puranjay Mohan Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260423033506.2542005-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/filter.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/filter.h b/include/linux/filter.h index 1ec6d5ba64cc..b77d0b06db6e 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -58,8 +58,9 @@ struct ctl_table_header; #define BPF_REG_H BPF_REG_9 /* hlen, callee-saved */ /* Kernel hidden auxiliary/helper register. */ -#define BPF_REG_AX MAX_BPF_REG -#define MAX_BPF_EXT_REG (MAX_BPF_REG + 1) +#define BPF_REG_PARAMS MAX_BPF_REG +#define BPF_REG_AX (MAX_BPF_REG + 1) +#define MAX_BPF_EXT_REG (MAX_BPF_REG + 2) #define MAX_BPF_JIT_REG MAX_BPF_EXT_REG /* unused opcode to mark special call to bpf_tail_call() helper */ -- cgit v1.2.3 From 4439328d3878c97fdf5ddec828a43ea07c388452 Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Wed, 22 Apr 2026 20:35:11 -0700 Subject: bpf: Reuse MAX_BPF_FUNC_ARGS for maximum number of arguments Currently, MAX_BPF_FUNC_ARGS is used for tracepoint related progs where the number of parameters cannot exceed MAX_BPF_FUNC_ARGS. Here, MAX_BPF_FUNC_ARGS is reused to set a limit of the number of arguments for bpf functions and kfuncs. The current value for MAX_BPF_FUNC_ARGS is 12 which should be sufficient for majority of bpf functions and kfuncs. Acked-by: Puranjay Mohan Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260423033511.2542870-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index d3aea3931b85..715b6df9c403 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1151,6 +1151,11 @@ struct bpf_prog_offload { /* The longest tracepoint has 12 args. * See include/trace/bpf_probe.h + * + * Also reuse this macro for maximum number of arguments a BPF function + * or a kfunc can have. Args 1-5 are passed in registers, args 6-12 via + * stack arg slots. The JIT may map some stack arg slots to registers based + * on the native calling convention (e.g., arg 6 to R9 on x86-64). */ #define MAX_BPF_FUNC_ARGS 12 -- cgit v1.2.3 From ee18d39a087792d7c11e6e87b546aff435a3cc58 Mon Sep 17 00:00:00 2001 From: Riana Tauro Date: Thu, 9 Apr 2026 13:03:19 +0530 Subject: drm/drm_ras: Add clear-error-counter netlink command to drm_ras Introduce a new 'clear-error-counter' drm_ras command to reset the counter value for a specific error counter of a given node. The command is a 'do' netlink request with 'node-id' and 'error-id' as parameters with no response payload. Usage: $ sudo ynl --family drm_ras --do clear-error-counter --json \ '{"node-id":1, "error-id":1}' None Cc: Jakub Kicinski Cc: Zack McKevitt Cc: Lijo Lazar Cc: Hawking Zhang Cc: David S. Miller Cc: Paolo Abeni Cc: Eric Dumazet Signed-off-by: Riana Tauro Reviewed-by: Jakub Kicinski Reviewed-by: Raag Jadav Link: https://patch.msgid.link/20260409073318.2909379-5-riana.tauro@intel.com Signed-off-by: Rodrigo Vivi Acked-by: Maxime Ripard --- include/drm/drm_ras.h | 11 +++++++++++ include/uapi/drm/drm_ras.h | 1 + 2 files changed, 12 insertions(+) (limited to 'include') diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h index 5d50209e51db..f2a787bc4f64 100644 --- a/include/drm/drm_ras.h +++ b/include/drm/drm_ras.h @@ -58,6 +58,17 @@ struct drm_ras_node { int (*query_error_counter)(struct drm_ras_node *node, u32 error_id, const char **name, u32 *val); + /** + * @clear_error_counter: + * + * This callback is used by drm_ras to clear a specific error counter. + * Driver should implement this callback to support clearing error counters + * of a node. + * + * Returns: 0 on success, negative error code on failure. + */ + int (*clear_error_counter)(struct drm_ras_node *node, u32 error_id); + /** @priv: Driver private data */ void *priv; }; diff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h index 5f40fa5b869d..218a3ee86805 100644 --- a/include/uapi/drm/drm_ras.h +++ b/include/uapi/drm/drm_ras.h @@ -41,6 +41,7 @@ enum { enum { DRM_RAS_CMD_LIST_NODES = 1, DRM_RAS_CMD_GET_ERROR_COUNTER, + DRM_RAS_CMD_CLEAR_ERROR_COUNTER, __DRM_RAS_CMD_MAX, DRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1) -- cgit v1.2.3 From ac7e1a9819d6ada9a9800d6d26256e5258711b99 Mon Sep 17 00:00:00 2001 From: Avinal Kumar Date: Fri, 17 Apr 2026 11:48:41 +0530 Subject: drm/mipi-dsi: add mipi_dsi_shutdown_peripheral_multi Add mipi_dsi_shutdown_peripheral_multi function and mark mipi_dsi_shutdown_peripheral function as deprecated. Signed-off-by: Avinal Kumar Reviewed-by: Neil Armstrong Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260417061842.66631-2-avinal.xlvii@gmail.com --- include/drm/drm_mipi_dsi.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h index 2ab651a36115..b429acde4f71 100644 --- a/include/drm/drm_mipi_dsi.h +++ b/include/drm/drm_mipi_dsi.h @@ -393,6 +393,7 @@ void mipi_dsi_dcs_set_page_address_multi(struct mipi_dsi_multi_context *ctx, void mipi_dsi_dcs_set_tear_scanline_multi(struct mipi_dsi_multi_context *ctx, u16 scanline); void mipi_dsi_dcs_set_tear_off_multi(struct mipi_dsi_multi_context *ctx); +void mipi_dsi_shutdown_peripheral_multi(struct mipi_dsi_multi_context *ctx); /** * mipi_dsi_generic_write_seq_multi - transmit data using a generic write packet -- cgit v1.2.3 From 256f0071f9b61ae5028f749449fd3fdad015889d Mon Sep 17 00:00:00 2001 From: Eduard Zingerman Date: Fri, 24 Apr 2026 15:52:42 -0700 Subject: bpf: representation and basic operations on circular numbers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit adds basic definitions for cnum32/cnum64. This is a unified numeric range representation for signed and unsigned domains. Inspired by an old post from Shung-Hsi Yu [1] and paper [2]. Operations correctness is verified using cbmc model checker, tests source code can be found in a separate repo [3]. The cnum64_cnum32_intersect() function is notable, because it handled several cases verifier.c:deduce_bounds_64_from_32() does not. Given: - a is a 64-bit range - b is a 32-bit range - t is a refined 64-bit range, such that ∀ v ∈ a, (u32)v ∈ b: v ∈ t. cnum64_cnum32_intersect() makes the following deductions: (A): 'b' is a sub-range of the first or the last 32-bit sub-range of 'a': 64-bit number axis ---> N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32 ||------|---|=====|-------||----------|=====|-------||----------|=====|----|--|| | |< b >| |< b >| |< b >| | | | | | |<--+--------------------------- a ---------------------------+--->| | | |<-------------------------- t -------------------------->| (B) 'b' does not intersect with the first of the last 32-bit sub-range of 'a': N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32 ||--|=====|----|----------||--|=====|---------------||--|=====|------------|--|| |< b >| | |< b >| |< b >| | | | | | |<-------------+--------- a -------------------|----------->| | | |<-------- t ------------------>| (C) 'b' crosses 0/U32_MAX boundary: N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32 ||===|---------|------|===||===|----------------|===||===|---------|------|===|| |b >| | |< b||b >| |< b||b >| | |< b| | | | | |<-----+----------------- a --------------+-------->| | | |<---------------- t ------------->| Current implementation of deduce_bounds_64_from_32() only handles case (A). [1] https://lore.kernel.org/all/ZTZxoDJJbX9mrQ9w@u94a/ [2] https://jorgenavas.github.io/papers/ACM-TOPLAS-wrapped.pdf [3] https://github.com/eddyz87/cnum-verif/tree/master Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-1-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/cnum.h | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 include/linux/cnum.h (limited to 'include') diff --git a/include/linux/cnum.h b/include/linux/cnum.h new file mode 100644 index 000000000000..a7259b105b45 --- /dev/null +++ b/include/linux/cnum.h @@ -0,0 +1,80 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */ + +#ifndef _LINUX_CNUM_H +#define _LINUX_CNUM_H + +#include + +/* + * cnum32: a circular number. + * A unified representation for signed and unsigned ranges. + * + * Assume that a 32-bit range is a circle, with 0 being in the 12 o'clock + * position, numbers placed sequentially in clockwise order and U32_MAX + * in the 11 o'clock position. Signed values map onto the same circle: + * S32_MAX sits at 5 o'clock, S32_MIN sits at 6 o'clock (opposite 0), + * negative values occupy the left half and positive values the right half. + * + * @cnum32 represents an arc on this circle drawn clockwise. + * @base corresponds to the first value of the range. + * @size corresponds to the number of integers in the range excluding @base. + * (The @base is excluded to avoid integer overflow when representing the full + * 0..U32_MAX range, which corresponds to 2^32, which can't be stored in u32). + * + * For example: {U32_MAX, 1} corresponds to signed range [-1, 0], + * {S32_MAX, 1} corresponds to unsigned range [S32_MAX, S32_MIN]. + */ +struct cnum32 { + u32 base; + u32 size; +}; + +#define CNUM32_UNBOUNDED ((struct cnum32){ .base = 0, .size = U32_MAX }) +#define CNUM32_EMPTY ((struct cnum32){ .base = U32_MAX, .size = U32_MAX }) + +struct cnum32 cnum32_from_urange(u32 min, u32 max); +struct cnum32 cnum32_from_srange(s32 min, s32 max); +u32 cnum32_umin(struct cnum32 cnum); +u32 cnum32_umax(struct cnum32 cnum); +s32 cnum32_smin(struct cnum32 cnum); +s32 cnum32_smax(struct cnum32 cnum); +struct cnum32 cnum32_intersect(struct cnum32 a, struct cnum32 b); +void cnum32_intersect_with(struct cnum32 *dst, struct cnum32 src); +void cnum32_intersect_with_urange(struct cnum32 *dst, u32 min, u32 max); +void cnum32_intersect_with_srange(struct cnum32 *dst, s32 min, s32 max); +bool cnum32_contains(struct cnum32 cnum, u32 v); +bool cnum32_is_const(struct cnum32 cnum); +bool cnum32_is_empty(struct cnum32 cnum); +struct cnum32 cnum32_add(struct cnum32 a, struct cnum32 b); +struct cnum32 cnum32_negate(struct cnum32 a); + +/* Same as cnum32 but for 64-bit ranges */ +struct cnum64 { + u64 base; + u64 size; +}; + +#define CNUM64_UNBOUNDED ((struct cnum64){ .base = 0, .size = U64_MAX }) +#define CNUM64_EMPTY ((struct cnum64){ .base = U64_MAX, .size = U64_MAX }) + +struct cnum64 cnum64_from_urange(u64 min, u64 max); +struct cnum64 cnum64_from_srange(s64 min, s64 max); +u64 cnum64_umin(struct cnum64 cnum); +u64 cnum64_umax(struct cnum64 cnum); +s64 cnum64_smin(struct cnum64 cnum); +s64 cnum64_smax(struct cnum64 cnum); +struct cnum64 cnum64_intersect(struct cnum64 a, struct cnum64 b); +void cnum64_intersect_with(struct cnum64 *dst, struct cnum64 src); +void cnum64_intersect_with_urange(struct cnum64 *dst, u64 min, u64 max); +void cnum64_intersect_with_srange(struct cnum64 *dst, s64 min, s64 max); +bool cnum64_contains(struct cnum64 cnum, u64 v); +bool cnum64_is_const(struct cnum64 cnum); +bool cnum64_is_empty(struct cnum64 cnum); +struct cnum64 cnum64_add(struct cnum64 a, struct cnum64 b); +struct cnum64 cnum64_negate(struct cnum64 a); + +struct cnum32 cnum32_from_cnum64(struct cnum64 cnum); +struct cnum64 cnum64_cnum32_intersect(struct cnum64 a, struct cnum32 b); + +#endif /* _LINUX_CNUM_H */ -- cgit v1.2.3 From b93f7180f0bc37336cb26b43aa4796973d84852e Mon Sep 17 00:00:00 2001 From: Eduard Zingerman Date: Fri, 24 Apr 2026 15:52:43 -0700 Subject: bpf: use accessor functions for bpf_reg_state min/max fields Replace direct access to bpf_reg_state->{smin,smax,umin,umax, s32_min,s32_max,u32_min,u32_max}_value with getter/setter inline functions, preparing for future switch to cnum-based internal representation. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-2-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 64 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index d5b4303315dd..bf3ffa56bbe5 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -209,6 +209,70 @@ struct bpf_reg_state { bool precise; }; +static inline s64 reg_smin(const struct bpf_reg_state *reg) +{ + return reg->smin_value; +} + +static inline s64 reg_smax(const struct bpf_reg_state *reg) +{ + return reg->smax_value; +} + +static inline u64 reg_umin(const struct bpf_reg_state *reg) +{ + return reg->umin_value; +} + +static inline u64 reg_umax(const struct bpf_reg_state *reg) +{ + return reg->umax_value; +} + +static inline s32 reg_s32_min(const struct bpf_reg_state *reg) +{ + return reg->s32_min_value; +} + +static inline s32 reg_s32_max(const struct bpf_reg_state *reg) +{ + return reg->s32_max_value; +} + +static inline u32 reg_u32_min(const struct bpf_reg_state *reg) +{ + return reg->u32_min_value; +} + +static inline u32 reg_u32_max(const struct bpf_reg_state *reg) +{ + return reg->u32_max_value; +} + +static inline void reg_set_srange32(struct bpf_reg_state *reg, s32 smin, s32 smax) +{ + reg->s32_min_value = smin; + reg->s32_max_value = smax; +} + +static inline void reg_set_urange32(struct bpf_reg_state *reg, u32 umin, u32 umax) +{ + reg->u32_min_value = umin; + reg->u32_max_value = umax; +} + +static inline void reg_set_srange64(struct bpf_reg_state *reg, s64 smin, s64 smax) +{ + reg->smin_value = smin; + reg->smax_value = smax; +} + +static inline void reg_set_urange64(struct bpf_reg_state *reg, u64 umin, u64 umax) +{ + reg->umin_value = umin; + reg->umax_value = umax; +} + enum bpf_stack_slot_type { STACK_INVALID, /* nothing was stored in this stack slot */ STACK_SPILL, /* register spilled into stack */ -- cgit v1.2.3 From bbc631085503a7fde9617be18b0657cc9a83910a Mon Sep 17 00:00:00 2001 From: Eduard Zingerman Date: Fri, 24 Apr 2026 15:52:44 -0700 Subject: bpf: replace min/max fields with struct cnum{32,64} Replace eight independent s64, u64, s32, u32 min/max fields in bpf_reg_state with two circular number fields: - cnum64 for a unified signed/unsigned 64-bit range tracking; - cnum32 for a unified signed/unsigned 32-bit range tracking. Each cnum represents a range as a single arc on the circular number line (base + size), from which signed and unsigned bounds are derived on demand via accessor functions introduced in the preceding commit. Notable changes: - Signed<->unsigned deductions in __reg_deduce_bounds() are removed. - 64<->32 bit deductions are replaced with: - reg->r32 = cnum32_intersect(reg->r32, cnum32_from_cnum64(reg->r64)); this is functionally equivalent to the old code. - reg->r64 = cnum64_cnum32_intersect(reg->r64, reg->r32); this handles a few additional cases, see commit message for "bpf: representation and basic operations on circular numbers". - regs_refine_cond_op() now computes results in terms of operations on sets, e.g. for JNE: /* Complement of the range [val, val] as cnum64. */ lo = (struct cnum64){ val + 1, U64_MAX - 1 }; reg1->r64 = cnum64_intersect(reg1->r64, lo); - For add, sub operations on scalars replace explicit bounds computations with cnum{32,64}_{add,negate}. - For add, sub operations on pointers deduplicate with arithmetic operations on scalars and use cnum{32,64}_{add,negate}. - For and, or, xor operations on scalars remove explicit signed bounds computations. - range_bounds_violation() reduces to checking cnum_is_empty(). - const_tnum_range_mismatch() reduces to checking cnum_is_const(). Selftest adjustments: a few existing tests are updated because a single cnum arc cannot always represent what the old system expressed as the intersection of independent signed and unsigned ranges. For example, if the old system tracked u64=[0, U64_MAX-U32_MAX+2] and s64=[S64_MIN+2, 2] independently, their intersection is a tight two-point set. A single cnum must pick the shorter arc, losing the other constraint. These cases are documented with comments in the adjusted tests. reg_bounds.c is updated with logic similar to cnum64_cnum32_intersect(). Instead of using cnums it inspects intersection between 'b' and first / last / next-after-first / previous-before-last sub-ranges of 'a'. reg_bounds.c is also updated to skip test cases that rely in signed and unsigned ranges intersecting in two intervals, as such cases are not representable by a single cnum. The following "crafted" test cases are affected: - reg_bounds_crafted/(s64)[0xffffffffffff8000; 0x7fff] (u32) [0; 0x1f] - reg_bounds_crafted/(s64)[0; 0x1f] (u32) [0xffffffffffffff80; 0x7f] - reg_bounds_crafted/(s64)[0xffffffffffffff80; 0x7f] (u32) [0; 0x1f] - reg_bounds_crafted/(u64)[0; 1] (s32) [1; 2147483648] - reg_bounds_crafted/(u64)[1; 2147483648] (s32) [0; 1] - reg_bounds_crafted/(u64)[0; 0xffffffff00000000] (s64) 0 - reg_bounds_crafted/(u64)0 (s64) [0; 0xffffffff00000000] - reg_bounds_crafted/(u64)[0; 0xffffffff00000000] (s32) 0 - reg_bounds_crafted/(u64)0 (s32) [0; 0xffffffff00000000] - reg_bounds_crafted/(s64)[S64_MIN; 0] (u64) S64_MIN - reg_bounds_crafted/(s64)S64_MIN (u64) [S64_MIN; 0] - reg_bounds_crafted/(s32)[S32_MIN; 0] (u32) S32_MIN - reg_bounds_crafted/(s32)S32_MIN (u32) [S32_MIN; 0] - reg_bounds_crafted/(s64)[0; 0x1f] (u32) [0xffffffff80000000; 0x7fffffff] - reg_bounds_crafted/(s64)[0xffffffff80000000; 0x7fffffff] (u32) [0; 0x1f] - reg_bounds_crafted/(s64)[0; 0x1f] (u32) [0xffffffffffff8000; 0x7fff] As well as some reg_bounds_roand_{consts,ranges}_A_B, where A and B differ in sign domain. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-3-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 39 +++++++++++++++------------------------ 1 file changed, 15 insertions(+), 24 deletions(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index bf3ffa56bbe5..101ca6cc5424 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -8,6 +8,7 @@ #include /* for struct btf and btf_id() */ #include /* for MAX_BPF_STACK */ #include +#include /* Maximum variable offset umax_value permitted when resolving memory accesses. * In practice this is far bigger than any realistic pointer offset; this limit @@ -120,14 +121,8 @@ struct bpf_reg_state { * These refer to the same value as var_off, not necessarily the actual * contents of the register. */ - s64 smin_value; /* minimum possible (s64)value */ - s64 smax_value; /* maximum possible (s64)value */ - u64 umin_value; /* minimum possible (u64)value */ - u64 umax_value; /* maximum possible (u64)value */ - s32 s32_min_value; /* minimum possible (s32)value */ - s32 s32_max_value; /* maximum possible (s32)value */ - u32 u32_min_value; /* minimum possible (u32)value */ - u32 u32_max_value; /* maximum possible (u32)value */ + struct cnum64 r64; /* 64-bit range as circular number */ + struct cnum32 r32; /* 32-bit range as circular number */ /* For PTR_TO_PACKET, used to find other pointers with the same variable * offset, so they can share range knowledge. * For PTR_TO_MAP_VALUE_OR_NULL this is used to share which map value we @@ -211,66 +206,62 @@ struct bpf_reg_state { static inline s64 reg_smin(const struct bpf_reg_state *reg) { - return reg->smin_value; + return cnum64_smin(reg->r64); } static inline s64 reg_smax(const struct bpf_reg_state *reg) { - return reg->smax_value; + return cnum64_smax(reg->r64); } static inline u64 reg_umin(const struct bpf_reg_state *reg) { - return reg->umin_value; + return cnum64_umin(reg->r64); } static inline u64 reg_umax(const struct bpf_reg_state *reg) { - return reg->umax_value; + return cnum64_umax(reg->r64); } static inline s32 reg_s32_min(const struct bpf_reg_state *reg) { - return reg->s32_min_value; + return cnum32_smin(reg->r32); } static inline s32 reg_s32_max(const struct bpf_reg_state *reg) { - return reg->s32_max_value; + return cnum32_smax(reg->r32); } static inline u32 reg_u32_min(const struct bpf_reg_state *reg) { - return reg->u32_min_value; + return cnum32_umin(reg->r32); } static inline u32 reg_u32_max(const struct bpf_reg_state *reg) { - return reg->u32_max_value; + return cnum32_umax(reg->r32); } static inline void reg_set_srange32(struct bpf_reg_state *reg, s32 smin, s32 smax) { - reg->s32_min_value = smin; - reg->s32_max_value = smax; + reg->r32 = cnum32_from_srange(smin, smax); } static inline void reg_set_urange32(struct bpf_reg_state *reg, u32 umin, u32 umax) { - reg->u32_min_value = umin; - reg->u32_max_value = umax; + reg->r32 = cnum32_from_urange(umin, umax); } static inline void reg_set_srange64(struct bpf_reg_state *reg, s64 smin, s64 smax) { - reg->smin_value = smin; - reg->smax_value = smax; + reg->r64 = cnum64_from_srange(smin, smax); } static inline void reg_set_urange64(struct bpf_reg_state *reg, u64 umin, u64 umax) { - reg->umin_value = umin; - reg->umax_value = umax; + reg->r64 = cnum64_from_urange(umin, umax); } enum bpf_stack_slot_type { -- cgit v1.2.3 From e3953ff665742c15c002af9e176bd24d5cd9ec61 Mon Sep 17 00:00:00 2001 From: Hamza Mahfooz Date: Wed, 25 Feb 2026 12:57:08 -0500 Subject: drm/edid: add CTA Video Format Data Block support Video Format Data Blocks (VFDBs) contain the necessary information that needs to be fed to the Optimized Video Timings (OVT) Algorithm. Also, we require OVT support to cover modes that aren't supported by earlier standards (e.g. CVT). So, parse all of the relevant VFDB data and feed it to the OVT Algorithm, to extract all of the missing OVT modes. Suggested-by: Karol Herbst Signed-off-by: Hamza Mahfooz Link: https://patch.msgid.link/20260225175709.408010-1-someguy@effective-light.com --- include/drm/drm_edid.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h index 04f7a7f1f108..272506331634 100644 --- a/include/drm/drm_edid.h +++ b/include/drm/drm_edid.h @@ -463,6 +463,9 @@ struct drm_display_mode * drm_display_mode_from_cea_vic(struct drm_device *dev, u8 video_code); +struct drm_display_mode *drm_ovt_mode(struct drm_device *dev, int rid, + int vrefresh); + /* Interface based on struct drm_edid */ const struct drm_edid *drm_edid_alloc(const void *edid, size_t size); const struct drm_edid *drm_edid_dup(const struct drm_edid *drm_edid); -- cgit v1.2.3 From f2648bb3150a71241a2254aa4ac10680d7f9fb16 Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Mon, 6 Apr 2026 16:22:55 -0700 Subject: driver core: Replace dev->can_match with dev_can_match() In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "can_match" over to the "flags" field so modifications are safe. Cc: Saravana Kannan Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260406162231.v5.2.I54b3ae6311ff34ad30227659d91bb109911a4aea@changeid Signed-off-by: Danilo Krummrich --- include/linux/device.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index 9c8fde6a3d86..00113821ebe9 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -512,10 +512,14 @@ struct device_physical_location { * * @DEV_FLAG_READY_TO_PROBE: If set then device_add() has finished enough * initialization that probe could be called. + * @DEV_FLAG_CAN_MATCH: The device has matched with a driver at least once or it + * is in a bus (like AMBA) which can't check for matching drivers + * until other devices probe successfully. * @DEV_FLAG_COUNT: Number of defined struct_device_flags. */ enum struct_device_flags { DEV_FLAG_READY_TO_PROBE = 0, + DEV_FLAG_CAN_MATCH = 1, DEV_FLAG_COUNT }; @@ -602,9 +606,6 @@ enum struct_device_flags { * @state_synced: The hardware state of this device has been synced to match * the software state of this device by calling the driver/bus * sync_state() callback. - * @can_match: The device has matched with a driver at least once or it is in - * a bus (like AMBA) which can't check for matching drivers until - * other devices probe successfully. * @dma_coherent: this particular device is dma coherent, even if the * architecture supports non-coherent devices. * @dma_ops_bypass: If set to %true then the dma_ops are bypassed for the @@ -723,7 +724,6 @@ struct device { bool offline:1; bool of_node_reused:1; bool state_synced:1; - bool can_match:1; #if defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE) || \ defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU) || \ defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU_ALL) @@ -765,6 +765,7 @@ static inline bool dev_test_and_set_##accessor_name(struct device *dev) \ } __create_dev_flag_accessors(ready_to_probe, DEV_FLAG_READY_TO_PROBE); +__create_dev_flag_accessors(can_match, DEV_FLAG_CAN_MATCH); #undef __create_dev_flag_accessors -- cgit v1.2.3 From 7fa1e85cfe6844cd7b09cb8288e5fb68952c88f7 Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Mon, 6 Apr 2026 16:22:56 -0700 Subject: driver core: Replace dev->dma_iommu with dev_dma_iommu() In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_iommu" over to the "flags" field so modifications are safe. Cc: Leon Romanovsky Cc: Robin Murphy Cc: Christoph Hellwig Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260406162231.v5.3.Id20d5973cbff542fea290e13177e9423f5d81342@changeid Signed-off-by: Danilo Krummrich --- include/linux/device.h | 9 ++++----- include/linux/iommu-dma.h | 3 ++- 2 files changed, 6 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index 00113821ebe9..bb02afb00f05 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -515,11 +515,14 @@ struct device_physical_location { * @DEV_FLAG_CAN_MATCH: The device has matched with a driver at least once or it * is in a bus (like AMBA) which can't check for matching drivers * until other devices probe successfully. + * @DEV_FLAG_DMA_IOMMU: Device is using default IOMMU implementation for DMA and + * doesn't rely on dma_ops structure. * @DEV_FLAG_COUNT: Number of defined struct_device_flags. */ enum struct_device_flags { DEV_FLAG_READY_TO_PROBE = 0, DEV_FLAG_CAN_MATCH = 1, + DEV_FLAG_DMA_IOMMU = 2, DEV_FLAG_COUNT }; @@ -614,8 +617,6 @@ enum struct_device_flags { * for dma allocations. This flag is managed by the dma ops * instance from ->dma_supported. * @dma_skip_sync: DMA sync operations can be skipped for coherent buffers. - * @dma_iommu: Device is using default IOMMU implementation for DMA and - * doesn't rely on dma_ops structure. * @flags: DEV_FLAG_XXX flags. Use atomic bitfield operations to modify. * * At the lowest level, every device in a Linux system is represented by an @@ -735,9 +736,6 @@ struct device { #ifdef CONFIG_DMA_NEED_SYNC bool dma_skip_sync:1; #endif -#ifdef CONFIG_IOMMU_DMA - bool dma_iommu:1; -#endif DECLARE_BITMAP(flags, DEV_FLAG_COUNT); }; @@ -766,6 +764,7 @@ static inline bool dev_test_and_set_##accessor_name(struct device *dev) \ __create_dev_flag_accessors(ready_to_probe, DEV_FLAG_READY_TO_PROBE); __create_dev_flag_accessors(can_match, DEV_FLAG_CAN_MATCH); +__create_dev_flag_accessors(dma_iommu, DEV_FLAG_DMA_IOMMU); #undef __create_dev_flag_accessors diff --git a/include/linux/iommu-dma.h b/include/linux/iommu-dma.h index a92b3ff9b934..060f6e23ab3c 100644 --- a/include/linux/iommu-dma.h +++ b/include/linux/iommu-dma.h @@ -7,12 +7,13 @@ #ifndef _LINUX_IOMMU_DMA_H #define _LINUX_IOMMU_DMA_H +#include #include #ifdef CONFIG_IOMMU_DMA static inline bool use_dma_iommu(struct device *dev) { - return dev->dma_iommu; + return dev_dma_iommu(dev); } #else static inline bool use_dma_iommu(struct device *dev) -- cgit v1.2.3 From d99167df047a12cac636188f994a9e8f1f9779ab Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Mon, 6 Apr 2026 16:22:57 -0700 Subject: driver core: Replace dev->dma_skip_sync with dev_dma_skip_sync() In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_skip_sync" over to the "flags" field so modifications are safe. Cc: Alexander Lobakin Cc: Eric Dumazet Cc: Christoph Hellwig Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260406162231.v5.4.Icf072aa4184dd86a88fa8ca195b09d1651984000@changeid Signed-off-by: Danilo Krummrich --- include/linux/device.h | 8 ++++---- include/linux/dma-map-ops.h | 4 ++-- include/linux/dma-mapping.h | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index bb02afb00f05..cc93a5e1e5d2 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -517,12 +517,15 @@ struct device_physical_location { * until other devices probe successfully. * @DEV_FLAG_DMA_IOMMU: Device is using default IOMMU implementation for DMA and * doesn't rely on dma_ops structure. + * @DEV_FLAG_DMA_SKIP_SYNC: DMA sync operations can be skipped for coherent + * buffers. * @DEV_FLAG_COUNT: Number of defined struct_device_flags. */ enum struct_device_flags { DEV_FLAG_READY_TO_PROBE = 0, DEV_FLAG_CAN_MATCH = 1, DEV_FLAG_DMA_IOMMU = 2, + DEV_FLAG_DMA_SKIP_SYNC = 3, DEV_FLAG_COUNT }; @@ -616,7 +619,6 @@ enum struct_device_flags { * and optionall (if the coherent mask is large enough) also * for dma allocations. This flag is managed by the dma ops * instance from ->dma_supported. - * @dma_skip_sync: DMA sync operations can be skipped for coherent buffers. * @flags: DEV_FLAG_XXX flags. Use atomic bitfield operations to modify. * * At the lowest level, every device in a Linux system is represented by an @@ -733,9 +735,6 @@ struct device { #ifdef CONFIG_DMA_OPS_BYPASS bool dma_ops_bypass : 1; #endif -#ifdef CONFIG_DMA_NEED_SYNC - bool dma_skip_sync:1; -#endif DECLARE_BITMAP(flags, DEV_FLAG_COUNT); }; @@ -765,6 +764,7 @@ static inline bool dev_test_and_set_##accessor_name(struct device *dev) \ __create_dev_flag_accessors(ready_to_probe, DEV_FLAG_READY_TO_PROBE); __create_dev_flag_accessors(can_match, DEV_FLAG_CAN_MATCH); __create_dev_flag_accessors(dma_iommu, DEV_FLAG_DMA_IOMMU); +__create_dev_flag_accessors(dma_skip_sync, DEV_FLAG_DMA_SKIP_SYNC); #undef __create_dev_flag_accessors diff --git a/include/linux/dma-map-ops.h b/include/linux/dma-map-ops.h index 6a1832a73cad..9e677a79f3a8 100644 --- a/include/linux/dma-map-ops.h +++ b/include/linux/dma-map-ops.h @@ -240,8 +240,8 @@ static inline void dma_reset_need_sync(struct device *dev) { #ifdef CONFIG_DMA_NEED_SYNC /* Reset it only once so that the function can be called on hotpath */ - if (unlikely(dev->dma_skip_sync)) - dev->dma_skip_sync = false; + if (unlikely(dev_dma_skip_sync(dev))) + dev_clear_dma_skip_sync(dev); #endif } diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h index db8ab24a54f4..cc0823a99cfd 100644 --- a/include/linux/dma-mapping.h +++ b/include/linux/dma-mapping.h @@ -429,7 +429,7 @@ bool __dma_need_sync(struct device *dev, dma_addr_t dma_addr); static inline bool dma_dev_need_sync(const struct device *dev) { /* Always call DMA sync operations when debugging is enabled */ - return !dev->dma_skip_sync || IS_ENABLED(CONFIG_DMA_API_DEBUG); + return !dev_dma_skip_sync(dev) || IS_ENABLED(CONFIG_DMA_API_DEBUG); } static inline void dma_sync_single_for_cpu(struct device *dev, dma_addr_t addr, -- cgit v1.2.3 From 9ad67f494ba6bdb4e7bb612640158f645932dca3 Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Mon, 6 Apr 2026 16:22:58 -0700 Subject: driver core: Replace dev->dma_ops_bypass with dev_dma_ops_bypass() In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_ops_bypass" over to the "flags" field so modifications are safe. Cc: Christoph Hellwig Cc: Alexey Kardashevskiy Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260406162231.v5.5.If62b84471ef2c85e7ad250f0468867d6dba965ab@changeid Signed-off-by: Danilo Krummrich --- include/linux/device.h | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index cc93a5e1e5d2..099533cbdd2f 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -519,6 +519,11 @@ struct device_physical_location { * doesn't rely on dma_ops structure. * @DEV_FLAG_DMA_SKIP_SYNC: DMA sync operations can be skipped for coherent * buffers. + * @DEV_FLAG_DMA_OPS_BYPASS: If set then the dma_ops are bypassed for the + * streaming DMA operations (->map_* / ->unmap_* / ->sync_*), and + * optional (if the coherent mask is large enough) also for dma + * allocations. This flag is managed by the dma ops instance from + * ->dma_supported. * @DEV_FLAG_COUNT: Number of defined struct_device_flags. */ enum struct_device_flags { @@ -526,6 +531,7 @@ enum struct_device_flags { DEV_FLAG_CAN_MATCH = 1, DEV_FLAG_DMA_IOMMU = 2, DEV_FLAG_DMA_SKIP_SYNC = 3, + DEV_FLAG_DMA_OPS_BYPASS = 4, DEV_FLAG_COUNT }; @@ -614,11 +620,6 @@ enum struct_device_flags { * sync_state() callback. * @dma_coherent: this particular device is dma coherent, even if the * architecture supports non-coherent devices. - * @dma_ops_bypass: If set to %true then the dma_ops are bypassed for the - * streaming DMA operations (->map_* / ->unmap_* / ->sync_*), - * and optionall (if the coherent mask is large enough) also - * for dma allocations. This flag is managed by the dma ops - * instance from ->dma_supported. * @flags: DEV_FLAG_XXX flags. Use atomic bitfield operations to modify. * * At the lowest level, every device in a Linux system is represented by an @@ -732,9 +733,6 @@ struct device { defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU_ALL) bool dma_coherent:1; #endif -#ifdef CONFIG_DMA_OPS_BYPASS - bool dma_ops_bypass : 1; -#endif DECLARE_BITMAP(flags, DEV_FLAG_COUNT); }; @@ -765,6 +763,7 @@ __create_dev_flag_accessors(ready_to_probe, DEV_FLAG_READY_TO_PROBE); __create_dev_flag_accessors(can_match, DEV_FLAG_CAN_MATCH); __create_dev_flag_accessors(dma_iommu, DEV_FLAG_DMA_IOMMU); __create_dev_flag_accessors(dma_skip_sync, DEV_FLAG_DMA_SKIP_SYNC); +__create_dev_flag_accessors(dma_ops_bypass, DEV_FLAG_DMA_OPS_BYPASS); #undef __create_dev_flag_accessors -- cgit v1.2.3 From 7befbf1281290876734046996ee861d7539532c1 Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Mon, 6 Apr 2026 16:22:59 -0700 Subject: driver core: Replace dev->state_synced with dev_state_synced() In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "state_synced" over to the "flags" field so modifications are safe. Cc: Saravana Kannan Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260406162231.v5.6.Idb4818e1159fef104c7756bfd6e7ba8f374bebcd@changeid Signed-off-by: Danilo Krummrich --- include/linux/device.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index 099533cbdd2f..fc4334ff3351 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -524,6 +524,9 @@ struct device_physical_location { * optional (if the coherent mask is large enough) also for dma * allocations. This flag is managed by the dma ops instance from * ->dma_supported. + * @DEV_FLAG_STATE_SYNCED: The hardware state of this device has been synced to + * match the software state of this device by calling the + * driver/bus sync_state() callback. * @DEV_FLAG_COUNT: Number of defined struct_device_flags. */ enum struct_device_flags { @@ -532,6 +535,7 @@ enum struct_device_flags { DEV_FLAG_DMA_IOMMU = 2, DEV_FLAG_DMA_SKIP_SYNC = 3, DEV_FLAG_DMA_OPS_BYPASS = 4, + DEV_FLAG_STATE_SYNCED = 5, DEV_FLAG_COUNT }; @@ -615,9 +619,6 @@ enum struct_device_flags { * @offline: Set after successful invocation of bus type's .offline(). * @of_node_reused: Set if the device-tree node is shared with an ancestor * device. - * @state_synced: The hardware state of this device has been synced to match - * the software state of this device by calling the driver/bus - * sync_state() callback. * @dma_coherent: this particular device is dma coherent, even if the * architecture supports non-coherent devices. * @flags: DEV_FLAG_XXX flags. Use atomic bitfield operations to modify. @@ -727,7 +728,6 @@ struct device { bool offline_disabled:1; bool offline:1; bool of_node_reused:1; - bool state_synced:1; #if defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE) || \ defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU) || \ defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU_ALL) @@ -764,6 +764,7 @@ __create_dev_flag_accessors(can_match, DEV_FLAG_CAN_MATCH); __create_dev_flag_accessors(dma_iommu, DEV_FLAG_DMA_IOMMU); __create_dev_flag_accessors(dma_skip_sync, DEV_FLAG_DMA_SKIP_SYNC); __create_dev_flag_accessors(dma_ops_bypass, DEV_FLAG_DMA_OPS_BYPASS); +__create_dev_flag_accessors(state_synced, DEV_FLAG_STATE_SYNCED); #undef __create_dev_flag_accessors -- cgit v1.2.3 From 3e2c1e213ac2bfc9068a2686ef380ee0d8bef949 Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Mon, 6 Apr 2026 16:23:00 -0700 Subject: driver core: Replace dev->dma_coherent with dev_dma_coherent() In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_coherent" over to the "flags" field so modifications are safe. Cc: Christoph Hellwig Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Acked-by: Vinod Koul Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260406162231.v5.7.If839f6dde98979fce177f70c6c74689a1904ee76@changeid [ Since all DEV_FLAG_DMA_COHERENT accessors are exposed unconditionally, also drop the CONFIG guards around dev_assign_dma_coherent() in device_initialize() to ensure a correct default value. - Danilo ] Signed-off-by: Danilo Krummrich --- include/linux/device.h | 11 ++++------- include/linux/dma-map-ops.h | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index fc4334ff3351..bab4315f4f61 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -527,6 +527,8 @@ struct device_physical_location { * @DEV_FLAG_STATE_SYNCED: The hardware state of this device has been synced to * match the software state of this device by calling the * driver/bus sync_state() callback. + * @DEV_FLAG_DMA_COHERENT: This particular device is dma coherent, even if the + * architecture supports non-coherent devices. * @DEV_FLAG_COUNT: Number of defined struct_device_flags. */ enum struct_device_flags { @@ -536,6 +538,7 @@ enum struct_device_flags { DEV_FLAG_DMA_SKIP_SYNC = 3, DEV_FLAG_DMA_OPS_BYPASS = 4, DEV_FLAG_STATE_SYNCED = 5, + DEV_FLAG_DMA_COHERENT = 6, DEV_FLAG_COUNT }; @@ -619,8 +622,6 @@ enum struct_device_flags { * @offline: Set after successful invocation of bus type's .offline(). * @of_node_reused: Set if the device-tree node is shared with an ancestor * device. - * @dma_coherent: this particular device is dma coherent, even if the - * architecture supports non-coherent devices. * @flags: DEV_FLAG_XXX flags. Use atomic bitfield operations to modify. * * At the lowest level, every device in a Linux system is represented by an @@ -728,11 +729,6 @@ struct device { bool offline_disabled:1; bool offline:1; bool of_node_reused:1; -#if defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE) || \ - defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU) || \ - defined(CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU_ALL) - bool dma_coherent:1; -#endif DECLARE_BITMAP(flags, DEV_FLAG_COUNT); }; @@ -765,6 +761,7 @@ __create_dev_flag_accessors(dma_iommu, DEV_FLAG_DMA_IOMMU); __create_dev_flag_accessors(dma_skip_sync, DEV_FLAG_DMA_SKIP_SYNC); __create_dev_flag_accessors(dma_ops_bypass, DEV_FLAG_DMA_OPS_BYPASS); __create_dev_flag_accessors(state_synced, DEV_FLAG_STATE_SYNCED); +__create_dev_flag_accessors(dma_coherent, DEV_FLAG_DMA_COHERENT); #undef __create_dev_flag_accessors diff --git a/include/linux/dma-map-ops.h b/include/linux/dma-map-ops.h index 9e677a79f3a8..bcb5b5428aea 100644 --- a/include/linux/dma-map-ops.h +++ b/include/linux/dma-map-ops.h @@ -225,7 +225,7 @@ int dma_direct_set_offset(struct device *dev, phys_addr_t cpu_start, extern bool dma_default_coherent; static inline bool dev_is_dma_coherent(struct device *dev) { - return dev->dma_coherent; + return dev_dma_coherent(dev); } #else #define dma_default_coherent true -- cgit v1.2.3 From 4aca5e62f37dd10cc771d5489900f927d133a9f1 Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Mon, 6 Apr 2026 16:23:01 -0700 Subject: driver core: Replace dev->of_node_reused with dev_of_node_reused() In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "of_node_reused" over to the "flags" field so modifications are safe. Cc: Johan Hovold Acked-by: Mark Brown Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Signed-off-by: Douglas Anderson Reviewed-by: Johan Hovold Acked-by: Manivannan Sadhasivam # PCI_PWRCTRL Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Link: https://patch.msgid.link/20260406162231.v5.8.I806b8636cd3724f6cd1f5e199318ab8694472d90@changeid Signed-off-by: Danilo Krummrich --- include/linux/device.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index bab4315f4f61..cc6ef0ca0d25 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -529,6 +529,8 @@ struct device_physical_location { * driver/bus sync_state() callback. * @DEV_FLAG_DMA_COHERENT: This particular device is dma coherent, even if the * architecture supports non-coherent devices. + * @DEV_FLAG_OF_NODE_REUSED: Set if the device-tree node is shared with an + * ancestor device. * @DEV_FLAG_COUNT: Number of defined struct_device_flags. */ enum struct_device_flags { @@ -539,6 +541,7 @@ enum struct_device_flags { DEV_FLAG_DMA_OPS_BYPASS = 4, DEV_FLAG_STATE_SYNCED = 5, DEV_FLAG_DMA_COHERENT = 6, + DEV_FLAG_OF_NODE_REUSED = 7, DEV_FLAG_COUNT }; @@ -620,8 +623,6 @@ enum struct_device_flags { * * @offline_disabled: If set, the device is permanently online. * @offline: Set after successful invocation of bus type's .offline(). - * @of_node_reused: Set if the device-tree node is shared with an ancestor - * device. * @flags: DEV_FLAG_XXX flags. Use atomic bitfield operations to modify. * * At the lowest level, every device in a Linux system is represented by an @@ -728,7 +729,6 @@ struct device { bool offline_disabled:1; bool offline:1; - bool of_node_reused:1; DECLARE_BITMAP(flags, DEV_FLAG_COUNT); }; @@ -762,6 +762,7 @@ __create_dev_flag_accessors(dma_skip_sync, DEV_FLAG_DMA_SKIP_SYNC); __create_dev_flag_accessors(dma_ops_bypass, DEV_FLAG_DMA_OPS_BYPASS); __create_dev_flag_accessors(state_synced, DEV_FLAG_STATE_SYNCED); __create_dev_flag_accessors(dma_coherent, DEV_FLAG_DMA_COHERENT); +__create_dev_flag_accessors(of_node_reused, DEV_FLAG_OF_NODE_REUSED); #undef __create_dev_flag_accessors -- cgit v1.2.3 From a7cc262a11354ab104b8e55c21200d099d141bc7 Mon Sep 17 00:00:00 2001 From: Douglas Anderson Date: Mon, 6 Apr 2026 16:23:02 -0700 Subject: driver core: Replace dev->offline + ->offline_disabled with accessors In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "offline" and "offline_disabled" over to the "flags" field so modifications are safe. Cc: Rafael J. Wysocki Acked-by: Mark Brown Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Danilo Krummrich Acked-by: Greg Kroah-Hartman Acked-by: Marek Szyprowski Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260406162231.v5.9.I897d478b4a9361d79cd5073207c1062fd4d0d0e4@changeid Signed-off-by: Danilo Krummrich --- include/linux/device.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index cc6ef0ca0d25..3bf86d2f9544 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -531,6 +531,8 @@ struct device_physical_location { * architecture supports non-coherent devices. * @DEV_FLAG_OF_NODE_REUSED: Set if the device-tree node is shared with an * ancestor device. + * @DEV_FLAG_OFFLINE_DISABLED: If set, the device is permanently online. + * @DEV_FLAG_OFFLINE: Set after successful invocation of bus type's .offline(). * @DEV_FLAG_COUNT: Number of defined struct_device_flags. */ enum struct_device_flags { @@ -542,6 +544,8 @@ enum struct_device_flags { DEV_FLAG_STATE_SYNCED = 5, DEV_FLAG_DMA_COHERENT = 6, DEV_FLAG_OF_NODE_REUSED = 7, + DEV_FLAG_OFFLINE_DISABLED = 8, + DEV_FLAG_OFFLINE = 9, DEV_FLAG_COUNT }; @@ -620,9 +624,6 @@ enum struct_device_flags { * @removable: Whether the device can be removed from the system. This * should be set by the subsystem / bus driver that discovered * the device. - * - * @offline_disabled: If set, the device is permanently online. - * @offline: Set after successful invocation of bus type's .offline(). * @flags: DEV_FLAG_XXX flags. Use atomic bitfield operations to modify. * * At the lowest level, every device in a Linux system is represented by an @@ -727,9 +728,6 @@ struct device { enum device_removable removable; - bool offline_disabled:1; - bool offline:1; - DECLARE_BITMAP(flags, DEV_FLAG_COUNT); }; @@ -763,6 +761,8 @@ __create_dev_flag_accessors(dma_ops_bypass, DEV_FLAG_DMA_OPS_BYPASS); __create_dev_flag_accessors(state_synced, DEV_FLAG_STATE_SYNCED); __create_dev_flag_accessors(dma_coherent, DEV_FLAG_DMA_COHERENT); __create_dev_flag_accessors(of_node_reused, DEV_FLAG_OF_NODE_REUSED); +__create_dev_flag_accessors(offline_disabled, DEV_FLAG_OFFLINE_DISABLED); +__create_dev_flag_accessors(offline, DEV_FLAG_OFFLINE); #undef __create_dev_flag_accessors -- cgit v1.2.3 From cb27d8c18fa311ad87fca4c2e7f1d73ec0cb440d Mon Sep 17 00:00:00 2001 From: David Lechner Date: Sat, 7 Mar 2026 19:44:11 -0600 Subject: iio: buffer: cache timestamp offset in scan buffer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cache the offset (in bytes) for the timestamp element in a scan buffer. This will be used later to ensure proper alignment of the timestamp element in the scan buffer. The new field could not be placed in struct iio_dev_opaque because we will need to access it in a static inline function later, so we make it __private instead. It is only intended to be used by core IIO code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron --- include/linux/iio/iio.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h index 2c91b7659ce9..ecbaeecbe0ac 100644 --- a/include/linux/iio/iio.h +++ b/include/linux/iio/iio.h @@ -584,6 +584,8 @@ struct iio_buffer_setup_ops { * and owner * @buffer: [DRIVER] any buffer present * @scan_bytes: [INTERN] num bytes captured to be fed to buffer demux + * @scan_timestamp_offset: [INTERN] cache of the offset (in bytes) for the + * timestamp in the scan buffer * @available_scan_masks: [DRIVER] optional array of allowed bitmasks. Sort the * array in order of preference, the most preferred * masks first. @@ -610,6 +612,7 @@ struct iio_dev { struct iio_buffer *buffer; int scan_bytes; + unsigned int __private scan_timestamp_offset; const unsigned long *available_scan_masks; unsigned int __private masklength; -- cgit v1.2.3 From d05e3c1460e47aa61e58cc6947cf7c9fc1371d7e Mon Sep 17 00:00:00 2001 From: David Lechner Date: Sat, 7 Mar 2026 19:44:13 -0600 Subject: iio: buffer: fix timestamp alignment when quaternion in scan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix timestamp alignment when a scan buffer contains an element larger than sizeof(int64_t). Currently s32 quaternions are the only such element, and the one driver that has this (hid-sensor-rotation) has a workaround in place already so this change does not affect it. Previously, we assumed that the timestamp would always be 8-byte aligned relative to the end of the scan buffer, but in the case of a scan buffer a 16-byte quaternion vector, scan_bytes == 32, but the timestamp needs to be placed at offset 16, not 24. ts_offset is now a value in bytes so we have to change how the array access is done. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Jonathan Cameron --- include/linux/iio/buffer.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/iio/buffer.h b/include/linux/iio/buffer.h index d37f82678f71..8fd0d57d238f 100644 --- a/include/linux/iio/buffer.h +++ b/include/linux/iio/buffer.h @@ -34,8 +34,16 @@ static inline int iio_push_to_buffers_with_timestamp(struct iio_dev *indio_dev, void *data, int64_t timestamp) { if (ACCESS_PRIVATE(indio_dev, scan_timestamp)) { - size_t ts_offset = indio_dev->scan_bytes / sizeof(int64_t) - 1; - ((int64_t *)data)[ts_offset] = timestamp; + size_t ts_offset = ACCESS_PRIVATE(indio_dev, scan_timestamp_offset); + + /* + * The size of indio_dev->scan_bytes is always aligned to the + * largest scan element's alignment (see iio_compute_scan_bytes()). + * So there may be padding after the timestamp. ts_offset contains + * the offset in bytes that was already computed for correctly + * aligning the timestamp. + */ + *(int64_t *)(data + ts_offset) = timestamp; } return iio_push_to_buffers(indio_dev, data); -- cgit v1.2.3 From fda05af070e7bc0403a487fc87378d2e1323f529 Mon Sep 17 00:00:00 2001 From: Francesco Lavra Date: Tue, 24 Mar 2026 09:47:40 +0100 Subject: iio: Replace 'sign' field with union in struct iio_scan_type This field is used to differentiate between signed and unsigned integers. A following commit will extend its use in order to add support for non- integer scan elements; therefore, replace it with a union that contains a more generic 'format' field. This union will be dropped when all drivers are changed to use the format field. Opportunistically replace character literals with symbolic constants that represent the set of allowed values for the format field. Signed-off-by: Francesco Lavra Signed-off-by: Jonathan Cameron --- include/linux/iio/iio.h | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h index ecbaeecbe0ac..e03b7e912d7d 100644 --- a/include/linux/iio/iio.h +++ b/include/linux/iio/iio.h @@ -176,9 +176,25 @@ struct iio_event_spec { unsigned long mask_shared_by_all; }; +/** + * define IIO_SCAN_FORMAT_SIGNED_INT - signed integer data format + * + * &iio_scan_type.format value for signed integers (two's complement). + */ +#define IIO_SCAN_FORMAT_SIGNED_INT 's' + +/** + * define IIO_SCAN_FORMAT_UNSIGNED_INT - unsigned integer data format + * + * &iio_scan_type.format value for unsigned integers. + */ +#define IIO_SCAN_FORMAT_UNSIGNED_INT 'u' + /** * struct iio_scan_type - specification for channel data format in buffer - * @sign: 's' or 'u' to specify signed or unsigned + * @sign: Deprecated, use @format instead. + * @format: Data format, can have any of the IIO_SCAN_FORMAT_* + * values. * @realbits: Number of valid bits of data * @storagebits: Realbits + padding * @shift: Shift right by this before masking out realbits. @@ -189,7 +205,10 @@ struct iio_event_spec { * @endianness: little or big endian */ struct iio_scan_type { - char sign; + union { + char sign; + char format; + }; u8 realbits; u8 storagebits; u8 shift; -- cgit v1.2.3 From b29f00ef08a7afdedc0b36cc0bead579d6977ced Mon Sep 17 00:00:00 2001 From: Francesco Lavra Date: Tue, 24 Mar 2026 09:47:53 +0100 Subject: iio: ABI: Add support for floating-point numbers in buffer scan elements In the data storage description of a scan element, the first character after the colon can have the values 's' and 'u' to specify signed and unsigned integers, respectively. Add 'f' as an allowed value to specify floating-point numbers formatted according to the IEEE 754 standard. Signed-off-by: Francesco Lavra Signed-off-by: Jonathan Cameron --- include/linux/iio/iio.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h index e03b7e912d7d..96b05c86c325 100644 --- a/include/linux/iio/iio.h +++ b/include/linux/iio/iio.h @@ -190,6 +190,13 @@ struct iio_event_spec { */ #define IIO_SCAN_FORMAT_UNSIGNED_INT 'u' +/** + * define IIO_SCAN_FORMAT_FLOAT - floating-point data format + * + * &iio_scan_type.format value for IEEE 754 floating-point numbers. + */ +#define IIO_SCAN_FORMAT_FLOAT 'f' + /** * struct iio_scan_type - specification for channel data format in buffer * @sign: Deprecated, use @format instead. -- cgit v1.2.3 From dd59392a3ec23dbe3a3fabadcf3bb847e9592ccd Mon Sep 17 00:00:00 2001 From: Francesco Lavra Date: Tue, 24 Mar 2026 09:47:59 +0100 Subject: iio: ABI: Add quaternion axis modifier This modifier applies to the IIO_ROT channel type, and indicates a data representation that specifies the {x, y, z} components of the normalized quaternion vector. Signed-off-by: Francesco Lavra Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron --- include/uapi/linux/iio/types.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/iio/types.h b/include/uapi/linux/iio/types.h index 6d269b844271..d7c2bb223651 100644 --- a/include/uapi/linux/iio/types.h +++ b/include/uapi/linux/iio/types.h @@ -113,6 +113,7 @@ enum iio_modifier { IIO_MOD_ACTIVE, IIO_MOD_REACTIVE, IIO_MOD_APPARENT, + IIO_MOD_QUATERNION_AXIS, }; enum iio_event_type { -- cgit v1.2.3 From 9c482946235362f81bf20da94e1c1f467a03c08f Mon Sep 17 00:00:00 2001 From: Svyatoslav Ryhel Date: Sat, 25 Apr 2026 15:54:29 +0300 Subject: misc: Remove old APDS990x driver The APDS990x driver in misc lacks DeviceTree support, and no mainline pre-DT board files configured this device using apds990x_platform_data. This driver belongs to a legacy group of ambient light sensor drivers in drivers/misc/ that predates the migration to DT and the standard IIO ABI. Since the Avago APDS9900/9901 ALS/Proximity sensor is now supported by the tsl2772 IIO driver and there are no active users in the kernel tree, remove this old implementation. Acked-by: Greg Kroah-Hartman Signed-off-by: Svyatoslav Ryhel Signed-off-by: Jonathan Cameron --- include/linux/platform_data/apds990x.h | 65 ---------------------------------- 1 file changed, 65 deletions(-) delete mode 100644 include/linux/platform_data/apds990x.h (limited to 'include') diff --git a/include/linux/platform_data/apds990x.h b/include/linux/platform_data/apds990x.h deleted file mode 100644 index 37684f68c04f..000000000000 --- a/include/linux/platform_data/apds990x.h +++ /dev/null @@ -1,65 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * This file is part of the APDS990x sensor driver. - * Chip is combined proximity and ambient light sensor. - * - * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies). - * - * Contact: Samu Onkalo - */ - -#ifndef __APDS990X_H__ -#define __APDS990X_H__ - - -#define APDS_IRLED_CURR_12mA 0x3 -#define APDS_IRLED_CURR_25mA 0x2 -#define APDS_IRLED_CURR_50mA 0x1 -#define APDS_IRLED_CURR_100mA 0x0 - -/** - * struct apds990x_chip_factors - defines effect of the cover window - * @ga: Total glass attenuation - * @cf1: clear channel factor 1 for raw to lux conversion - * @irf1: IR channel factor 1 for raw to lux conversion - * @cf2: clear channel factor 2 for raw to lux conversion - * @irf2: IR channel factor 2 for raw to lux conversion - * @df: device factor for conversion formulas - * - * Structure for tuning ALS calculation to match with environment. - * Values depend on the material above the sensor and the sensor - * itself. If the GA is zero, driver will use uncovered sensor default values - * format: decimal value * APDS_PARAM_SCALE except df which is plain integer. - */ -struct apds990x_chip_factors { - int ga; - int cf1; - int irf1; - int cf2; - int irf2; - int df; -}; -#define APDS_PARAM_SCALE 4096 - -/** - * struct apds990x_platform_data - platform data for apsd990x.c driver - * @cf: chip factor data - * @pdrive: IR-led driving current - * @ppcount: number of IR pulses used for proximity estimation - * @setup_resources: interrupt line setup call back function - * @release_resources: interrupt line release call back function - * - * Proximity detection result depends heavily on correct ppcount, pdrive - * and cover window. - * - */ - -struct apds990x_platform_data { - struct apds990x_chip_factors cf; - u8 pdrive; - u8 ppcount; - int (*setup_resources)(void); - int (*release_resources)(void); -}; - -#endif -- cgit v1.2.3 From c9c008754abd66d48cb04a9045cc12714ce2d720 Mon Sep 17 00:00:00 2001 From: Marek Vasut Date: Thu, 23 Apr 2026 01:36:27 +0200 Subject: dt-bindings: clock: renesas,cpg-clocks: Document ZT/ZTR trace clock on R-Mobile A1 Document the ZT trace bus and ZTR trace clocks on R-Mobile A1. These clocks supply the coresight tracing modules, PTM, TPIU, ETB and replicator. Without these clocks, coresight tracing can not be operated. While this does change the ABI, it does so by extending the existing clock-output-names, therefore if old software is used with new DT, the coresight tracing parts will likely fail to probe, otherwise if new software is used with an old DT, there is no impact. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260422233744.149872-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven --- include/dt-bindings/clock/r8a7740-clock.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/clock/r8a7740-clock.h b/include/dt-bindings/clock/r8a7740-clock.h index 1b3fdb39cc42..8a8816b2ff6a 100644 --- a/include/dt-bindings/clock/r8a7740-clock.h +++ b/include/dt-bindings/clock/r8a7740-clock.h @@ -24,6 +24,8 @@ #define R8A7740_CLK_ZB 14 #define R8A7740_CLK_M3 15 #define R8A7740_CLK_CP 16 +#define R8A7740_CLK_ZTR 17 +#define R8A7740_CLK_ZT 18 /* MSTP1 */ #define R8A7740_CLK_CEU21 28 -- cgit v1.2.3 From 56c2ca0ae7cb9254c4c2b82baa0afe29feaa274e Mon Sep 17 00:00:00 2001 From: Daniele Briguglio Date: Sun, 19 Apr 2026 13:43:06 +0200 Subject: dt-bindings: clock: rockchip,rk3588-cru: add I2S MCLK output to IO clock IDs Add clock identifiers for the four I2S MCLK output to IO gate clocks on RK3588, needed by board DTS files where the codec requires MCLK from the SoC on an external IO pin. Acked-by: Krzysztof Kozlowski Signed-off-by: Daniele Briguglio Tested-by: Ricardo Pardini Link: https://patch.msgid.link/20260419-rk3588-mclk-gate-grf-v4-1-513a42dd1dcc@superkali.me Signed-off-by: Heiko Stuebner --- include/dt-bindings/clock/rockchip,rk3588-cru.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/clock/rockchip,rk3588-cru.h b/include/dt-bindings/clock/rockchip,rk3588-cru.h index 0c7d3ca2d5bc..7528034cff56 100644 --- a/include/dt-bindings/clock/rockchip,rk3588-cru.h +++ b/include/dt-bindings/clock/rockchip,rk3588-cru.h @@ -734,6 +734,10 @@ #define PCLK_AV1_PRE 719 #define HCLK_SDIO_PRE 720 #define PCLK_VO1GRF 721 +#define I2S0_8CH_MCLKOUT_TO_IO 722 +#define I2S1_8CH_MCLKOUT_TO_IO 723 +#define I2S2_2CH_MCLKOUT_TO_IO 724 +#define I2S3_2CH_MCLKOUT_TO_IO 725 /* scmi-clocks indices */ -- cgit v1.2.3 From 06c990bffdbea7cf655e728f4423ecd13fb030f6 Mon Sep 17 00:00:00 2001 From: Daniele Briguglio Date: Sun, 19 Apr 2026 13:43:09 +0200 Subject: soc: rockchip: rk3588: add SYS_GRF SOC_CON6 register offset Add the RK3588_SYSGRF_SOC_CON6 register offset to the RK3588 GRF header. This register contains the I2S MCLK output to IO gate bits, needed by the clock driver. Signed-off-by: Daniele Briguglio Reviewed-by: Nicolas Frattaroli Link: https://patch.msgid.link/20260419-rk3588-mclk-gate-grf-v4-4-513a42dd1dcc@superkali.me Signed-off-by: Heiko Stuebner --- include/soc/rockchip/rk3588_grf.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/soc/rockchip/rk3588_grf.h b/include/soc/rockchip/rk3588_grf.h index 02a7b2432d99..db0092fc66ad 100644 --- a/include/soc/rockchip/rk3588_grf.h +++ b/include/soc/rockchip/rk3588_grf.h @@ -19,4 +19,6 @@ /* Whether the LPDDR5 is in 2:1 (= 0) or 4:1 (= 1) CKR a.k.a. DQS mode */ #define RK3588_PMUGRF_OS_REG6_LP5_CKR BIT(0) +#define RK3588_SYSGRF_SOC_CON6 0x0318 + #endif /* __SOC_RK3588_GRF_H */ -- cgit v1.2.3 From 951ebc18d181af1d90deddbc0ef3269061d6e03c Mon Sep 17 00:00:00 2001 From: Matt Evans Date: Thu, 23 Apr 2026 10:30:51 -0700 Subject: PCI/P2PDMA: Avoid returning a provider for non_mappable_bars Extend the checks in pcim_p2pdma_init() and pcim_p2pdma_provider() to exclude functions that have pdev->non_mappable_bars set. Consumers such as VFIO were previously able to map these for access by the CPU or P2P. Update the comment on non_mappable_bars to show it refers to any access, not just userspace CPU access. Fixes: 372d6d1b8ae3c ("PCI/P2PDMA: Refactor to separate core P2P functionality from memory allocation") Suggested-by: Alex Williamson Signed-off-by: Matt Evans Signed-off-by: Bjorn Helgaas Reviewed-by: Niklas Schnelle Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20260423173051.1999679-1-mattev@meta.com --- include/linux/pci.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index 2c4454583c11..1e6802017d6b 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -508,7 +508,7 @@ struct pci_dev { unsigned int no_command_memory:1; /* No PCI_COMMAND_MEMORY */ unsigned int rom_bar_overlap:1; /* ROM BAR disable broken */ unsigned int rom_attr_enabled:1; /* Display of ROM attribute enabled? */ - unsigned int non_mappable_bars:1; /* BARs can't be mapped to user-space */ + unsigned int non_mappable_bars:1; /* BARs can't be mapped by CPU or peers */ pci_dev_flags_t dev_flags; atomic_t enable_cnt; /* pci_enable_device has been called */ -- cgit v1.2.3 From 25bd55f46032656012eecdc6eabd62f2685a2ccc Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Mon, 27 Apr 2026 16:32:10 +0200 Subject: usb: udc: pxa: remove unused platform_data None of the remaining boards put useful data into the platform_data structures, so effectively this only works with DT based probing. Remove all code that references this data, to stop using the legacy gpiolib interfaces. The pxa27x version already supports gpio descriptors, while the pxa25x version now does it the same way. Reviewed-by: Andy Shevchenko Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260427143300.2887692-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman --- include/linux/platform_data/pxa2xx_udc.h | 15 --------------- 1 file changed, 15 deletions(-) (limited to 'include') diff --git a/include/linux/platform_data/pxa2xx_udc.h b/include/linux/platform_data/pxa2xx_udc.h index bc99cc6a3c5f..c1e4d03bae2c 100644 --- a/include/linux/platform_data/pxa2xx_udc.h +++ b/include/linux/platform_data/pxa2xx_udc.h @@ -10,21 +10,6 @@ #ifndef PXA2XX_UDC_H #define PXA2XX_UDC_H -struct pxa2xx_udc_mach_info { - int (*udc_is_connected)(void); /* do we see host? */ - void (*udc_command)(int cmd); -#define PXA2XX_UDC_CMD_CONNECT 0 /* let host see us */ -#define PXA2XX_UDC_CMD_DISCONNECT 1 /* so host won't see us */ - - /* Boards following the design guidelines in the developer's manual, - * with on-chip GPIOs not Lubbock's weird hardware, can have a sane - * VBUS IRQ and omit the methods above. Store the GPIO number - * here. Note that sometimes the signals go through inverters... - */ - bool gpio_pullup_inverted; - int gpio_pullup; /* high == pullup activated */ -}; - #ifdef CONFIG_PXA27x extern void pxa27x_clear_otgph(void); #else -- cgit v1.2.3 From cd5b460ed1eca9e48f3eb07db1ee0a522c0eaa23 Mon Sep 17 00:00:00 2001 From: Eduard Zingerman Date: Sat, 25 Apr 2026 15:48:23 -0700 Subject: bpf: range_within() must check cnum ranges instead of min/max pairs states.c:range_within() must be updated to properly check if cnum-based range in an old state is a superset of a range in the cur state. Currently it makes the decision using min/max accessors: reg_umin(old) <= reg_umin(cur) <= reg_umax(old) This is wrong for cnums that cross both UT_MAX/0 and ST_MAX/ST_MIN boundaries. Consider cnum32{base=0x7FFFFFF0, size=0x80000020}, which represents values [0x7FFFFFF0, ..., U32_MAX, 0, ..., 0x10]. Its projections are u32_min/max=0/U32_MAX, s32_min/max=S32_MIN/MAX. A register with range [0x100, 0x200] (which lies entirely in the gap of the wrapping range) would pass the min/max check despite having no overlap with the actual cnum arc. This commit replaces min/max comparison with cnum{32,64}_is_subset() operation. The operation implementation is verified using cbmc model checker in [1]. [1] https://github.com/eddyz87/cnum-verif/ Fixes: bbc631085503 ("bpf: replace min/max fields with struct cnum{32,64}") Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260425-cnum-range-within-v1-1-2fdca70cb09d@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/cnum.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/cnum.h b/include/linux/cnum.h index a7259b105b45..49b7d0c7645d 100644 --- a/include/linux/cnum.h +++ b/include/linux/cnum.h @@ -48,6 +48,7 @@ bool cnum32_is_const(struct cnum32 cnum); bool cnum32_is_empty(struct cnum32 cnum); struct cnum32 cnum32_add(struct cnum32 a, struct cnum32 b); struct cnum32 cnum32_negate(struct cnum32 a); +bool cnum32_is_subset(struct cnum32 outer, struct cnum32 inner); /* Same as cnum32 but for 64-bit ranges */ struct cnum64 { @@ -73,6 +74,7 @@ bool cnum64_is_const(struct cnum64 cnum); bool cnum64_is_empty(struct cnum64 cnum); struct cnum64 cnum64_add(struct cnum64 a, struct cnum64 b); struct cnum64 cnum64_negate(struct cnum64 a); +bool cnum64_is_subset(struct cnum64 outer, struct cnum64 inner); struct cnum32 cnum32_from_cnum64(struct cnum64 cnum); struct cnum64 cnum64_cnum32_intersect(struct cnum64 a, struct cnum32 b); -- cgit v1.2.3 From 3f95e2661574ff13f099dd13456751933c280628 Mon Sep 17 00:00:00 2001 From: Edward Adam Davis Date: Fri, 17 Apr 2026 07:44:02 +0800 Subject: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted node_size value of 1 caused the rec_off argument passed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively large. Consequently, the function failed to return a valid value to initialize the off variable, triggering the bug [1]. Every node starts from BTree node descriptor: struct hfs_bnode_desc. So, the size of node cannot be lesser than that. However, technical specification declares that: "The node size (which is expressed in bytes) must be power of two, from 512 through 32,768, inclusive." Add a check for btree node size base on technical specification. [1] BUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382 hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694 get_tree_bdev+0x38/0x50 fs/super.c:1717 hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709 vfs_get_tree+0xb3/0x5d0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline] Fixes: 8ad2c6a36ac4 ("hfsplus: validate b-tree node 0 bitmap at mount time") Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb Signed-off-by: Edward Adam Davis Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/tencent_5ED373437A697F83A4A446B771577626CD05@qq.com Signed-off-by: Viacheslav Dubeyko --- include/linux/hfs_common.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/hfs_common.h b/include/linux/hfs_common.h index 07dfc39630ab..45fb4c9ff9f5 100644 --- a/include/linux/hfs_common.h +++ b/include/linux/hfs_common.h @@ -513,6 +513,7 @@ struct hfs_btree_header_rec { /* HFS+ BTree misc info */ #define HFSPLUS_TREE_HEAD 0 #define HFSPLUS_NODE_MXSZ 32768 +#define HFSPLUS_NODE_MINSZ 512 #define HFSPLUS_ATTR_TREE_NODE_SIZE 8192 #define HFSPLUS_BTREE_HDR_NODE_RECS_COUNT 3 #define HFSPLUS_BTREE_HDR_MAP_REC_INDEX 2 /* Map (bitmap) record in Header node */ -- cgit v1.2.3 From ed02757f7c56bdd831d2244825400e33be776765 Mon Sep 17 00:00:00 2001 From: Pablo Martin-Gomez Date: Fri, 10 Apr 2026 19:04:23 +0200 Subject: wifi: Remove invalid 128TU transition timeout constant In Table 9-417m of 802.11be-2024, Transition Timeout is defined up to value 10 for a Transition Timeout of 64TUs. The value 11 is reserved and does not correspond to a Transition Timeout of 128TUs. Signed-off-by: Pablo Martin-Gomez Link: https://patch.msgid.link/20260410170429.343617-2-pmartin-gomez@freebox.fr Signed-off-by: Johannes Berg --- include/linux/ieee80211-eht.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index a97b1d01f3ac..bbff10a05b48 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -517,7 +517,6 @@ struct ieee80211_multi_link_elem { #define IEEE80211_EML_CAP_TRANSITION_TIMEOUT_16TU 8 #define IEEE80211_EML_CAP_TRANSITION_TIMEOUT_32TU 9 #define IEEE80211_EML_CAP_TRANSITION_TIMEOUT_64TU 10 -#define IEEE80211_EML_CAP_TRANSITION_TIMEOUT_128TU 11 #define IEEE80211_MLD_CAP_OP_MAX_SIMUL_LINKS 0x000f #define IEEE80211_MLD_CAP_OP_SRS_SUPPORT 0x0010 @@ -1178,7 +1177,7 @@ static inline u32 ieee80211_eml_trans_timeout_in_us(u16 eml_cap) IEEE80211_EML_CAP_TRANSITION_TIMEOUT); /* invalid values also just use 0 */ - if (!timeout || timeout > IEEE80211_EML_CAP_TRANSITION_TIMEOUT_128TU) + if (!timeout || timeout > IEEE80211_EML_CAP_TRANSITION_TIMEOUT_64TU) return 0; return 128 * (1 << (timeout - 1)); -- cgit v1.2.3 From 53f24921d81c97152c086ab2765969fcaa6173cc Mon Sep 17 00:00:00 2001 From: Pablo Martin-Gomez Date: Fri, 10 Apr 2026 19:04:24 +0200 Subject: wifi: Remove EMLMR Delay subfield definitions In the finalized version of 802.11be-2024, the EMLMR delay values have been merged in the EMLSR Padding/Transition Delay subfields and therefore the subfield EMLMR Delay has been converted to a reserved field. Signed-off-by: Pablo Martin-Gomez Link: https://patch.msgid.link/20260410170429.343617-3-pmartin-gomez@freebox.fr Signed-off-by: Johannes Berg --- include/linux/ieee80211-eht.h | 6 ------ 1 file changed, 6 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index bbff10a05b48..6324d888073b 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -499,12 +499,6 @@ struct ieee80211_multi_link_elem { #define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_128US 4 #define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_256US 5 #define IEEE80211_EML_CAP_EMLMR_SUPPORT 0x0080 -#define IEEE80211_EML_CAP_EMLMR_DELAY 0x0700 -#define IEEE80211_EML_CAP_EMLMR_DELAY_0US 0 -#define IEEE80211_EML_CAP_EMLMR_DELAY_32US 1 -#define IEEE80211_EML_CAP_EMLMR_DELAY_64US 2 -#define IEEE80211_EML_CAP_EMLMR_DELAY_128US 3 -#define IEEE80211_EML_CAP_EMLMR_DELAY_256US 4 #define IEEE80211_EML_CAP_TRANSITION_TIMEOUT 0x7800 #define IEEE80211_EML_CAP_TRANSITION_TIMEOUT_0 0 #define IEEE80211_EML_CAP_TRANSITION_TIMEOUT_128US 1 -- cgit v1.2.3 From 5858f5e1588fab66573d50c06dbcdd12830044ca Mon Sep 17 00:00:00 2001 From: Pablo Martin-Gomez Date: Fri, 10 Apr 2026 19:04:25 +0200 Subject: wifi: Rename EMLSR delay constants and add EMLMR helpers and definitions In the final version of 802.11be-2024, Transition Delay and Padding Delay subfield are for both EMLSR and EMLMR. Depending if the mode is EMLSR or EMLMR, the interpretation of the encoded value might change. Define all the constants and helpers to interpret delay subfields both in EMLSR and EMLMR mode. Signed-off-by: Pablo Martin-Gomez Link: https://patch.msgid.link/20260410170429.343617-4-pmartin-gomez@freebox.fr Signed-off-by: Johannes Berg --- include/linux/ieee80211-eht.h | 102 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 92 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index 6324d888073b..e24f95db6087 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -485,19 +485,27 @@ struct ieee80211_multi_link_elem { #define IEEE80211_MED_SYNC_DELAY_DEFAULT 0x10ac #define IEEE80211_EML_CAP_EMLSR_SUPP 0x0001 -#define IEEE80211_EML_CAP_EMLSR_PADDING_DELAY 0x000e -#define IEEE80211_EML_CAP_EMLSR_PADDING_DELAY_0US 0 -#define IEEE80211_EML_CAP_EMLSR_PADDING_DELAY_32US 1 -#define IEEE80211_EML_CAP_EMLSR_PADDING_DELAY_64US 2 -#define IEEE80211_EML_CAP_EMLSR_PADDING_DELAY_128US 3 -#define IEEE80211_EML_CAP_EMLSR_PADDING_DELAY_256US 4 -#define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY 0x0070 +#define IEEE80211_EML_CAP_EML_PADDING_DELAY 0x000e +/* Described Tables 9-417i & 9-417k in 802.11be-2024, which have the same values */ +#define IEEE80211_EML_CAP_EML_PADDING_DELAY_0US 0 +#define IEEE80211_EML_CAP_EML_PADDING_DELAY_32US 1 +#define IEEE80211_EML_CAP_EML_PADDING_DELAY_64US 2 +#define IEEE80211_EML_CAP_EML_PADDING_DELAY_128US 3 +#define IEEE80211_EML_CAP_EML_PADDING_DELAY_256US 4 +#define IEEE80211_EML_CAP_EML_TRANSITION_DELAY 0x0070 +/* Described in Table 9-417j in 802.11be-2024 */ #define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_0US 0 #define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_16US 1 #define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_32US 2 #define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_64US 3 #define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_128US 4 #define IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY_256US 5 +/* Described in Table 9-417l in 802.11be-2024 */ +#define IEEE80211_EML_CAP_EMLMR_TRANSITION_DELAY_0US 0 +#define IEEE80211_EML_CAP_EMLMR_TRANSITION_DELAY_32US 1 +#define IEEE80211_EML_CAP_EMLMR_TRANSITION_DELAY_64US 2 +#define IEEE80211_EML_CAP_EMLMR_TRANSITION_DELAY_128US 3 +#define IEEE80211_EML_CAP_EMLMR_TRANSITION_DELAY_256US 4 #define IEEE80211_EML_CAP_EMLMR_SUPPORT 0x0080 #define IEEE80211_EML_CAP_TRANSITION_TIMEOUT 0x7800 #define IEEE80211_EML_CAP_TRANSITION_TIMEOUT_0 0 @@ -1114,14 +1122,20 @@ static inline bool ieee80211_tid_to_link_map_size_ok(const u8 *data, size_t len) static inline u32 ieee80211_emlsr_pad_delay_in_us(u16 eml_cap) { + u32 emlsr_supp = + u16_get_bits(eml_cap, IEEE80211_EML_CAP_EMLSR_SUPP); + + if (!emlsr_supp) + return 0; + /* IEEE Std 802.11be-2024 Table 9-417i—Encoding of the EMLSR * Padding Delay subfield. */ u32 pad_delay = u16_get_bits(eml_cap, - IEEE80211_EML_CAP_EMLSR_PADDING_DELAY); + IEEE80211_EML_CAP_EML_PADDING_DELAY); if (!pad_delay || - pad_delay > IEEE80211_EML_CAP_EMLSR_PADDING_DELAY_256US) + pad_delay > IEEE80211_EML_CAP_EML_PADDING_DELAY_256US) return 0; return 32 * (1 << (pad_delay - 1)); @@ -1138,12 +1152,18 @@ static inline u32 ieee80211_emlsr_pad_delay_in_us(u16 eml_cap) static inline u32 ieee80211_emlsr_trans_delay_in_us(u16 eml_cap) { + u32 emlsr_supp = + u16_get_bits(eml_cap, IEEE80211_EML_CAP_EMLSR_SUPP); + + if (!emlsr_supp) + return 0; + /* IEEE Std 802.11be-2024 Table 9-417j—Encoding of the EMLSR * Transition Delay subfield. */ u32 trans_delay = u16_get_bits(eml_cap, - IEEE80211_EML_CAP_EMLSR_TRANSITION_DELAY); + IEEE80211_EML_CAP_EML_TRANSITION_DELAY); /* invalid values also just use 0 */ if (!trans_delay || @@ -1153,6 +1173,68 @@ static inline u32 ieee80211_emlsr_trans_delay_in_us(u16 eml_cap) return 16 * (1 << (trans_delay - 1)); } +/** + * ieee80211_emlmr_pad_delay_in_us - Fetch the EMLMR Padding delay + * in microseconds + * @eml_cap: EML capabilities field value from common info field of + * the Multi-link element + * Return: the EMLMR Padding delay (in microseconds) encoded in the + * EML Capabilities field + */ + +static inline u32 ieee80211_emlmr_pad_delay_in_us(u16 eml_cap) +{ + u32 emlmr_supp = + u16_get_bits(eml_cap, IEEE80211_EML_CAP_EMLMR_SUPPORT); + + if (!emlmr_supp) + return 0; + + /* IEEE Std 802.11be-2024 Table 9-417k—Encoding of the EMLMR + * Padding Delay subfield. + */ + u32 pad_delay = u16_get_bits(eml_cap, + IEEE80211_EML_CAP_EML_PADDING_DELAY); + + if (!pad_delay || + pad_delay > IEEE80211_EML_CAP_EML_PADDING_DELAY_256US) + return 0; + + return 32 * (1 << (pad_delay - 1)); +} + +/** + * ieee80211_emlmr_trans_delay_in_us - Fetch the EMLMR Transition + * delay in microseconds + * @eml_cap: EML capabilities field value from common info field of + * the Multi-link element + * Return: the EMLMR Transition delay (in microseconds) encoded in the + * EML Capabilities field + */ + +static inline u32 ieee80211_emlmr_trans_delay_in_us(u16 eml_cap) +{ + u32 emlmr_supp = + u16_get_bits(eml_cap, IEEE80211_EML_CAP_EMLMR_SUPPORT); + + if (!emlmr_supp) + return 0; + + /* IEEE Std 802.11be-2024 Table 9-417l—Encoding of the EMLMR + * Transition Delay subfield. + */ + u32 trans_delay = + u16_get_bits(eml_cap, + IEEE80211_EML_CAP_EML_TRANSITION_DELAY); + + /* invalid values also just use 0 */ + if (!trans_delay || + trans_delay > IEEE80211_EML_CAP_EMLMR_TRANSITION_DELAY_256US) + return 0; + + return 32 * (1 << (trans_delay - 1)); +} + /** * ieee80211_eml_trans_timeout_in_us - Fetch the EMLSR Transition * timeout value in microseconds -- cgit v1.2.3 From 37f3787636434593833a6d03de861af4ec09cb88 Mon Sep 17 00:00:00 2001 From: Pablo Martin-Gomez Date: Fri, 10 Apr 2026 19:04:26 +0200 Subject: wifi: Update EML function documentation to remove EMLSR-specific references Transition Timeout is not specific to EMLSR, and is used by both EMLSR and EMLMR mode. Signed-off-by: Pablo Martin-Gomez Link: https://patch.msgid.link/20260410170429.343617-5-pmartin-gomez@freebox.fr Signed-off-by: Johannes Berg --- include/linux/ieee80211-eht.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index e24f95db6087..335e78bd4b5d 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -1236,11 +1236,11 @@ static inline u32 ieee80211_emlmr_trans_delay_in_us(u16 eml_cap) } /** - * ieee80211_eml_trans_timeout_in_us - Fetch the EMLSR Transition + * ieee80211_eml_trans_timeout_in_us - Fetch the EML Transition * timeout value in microseconds * @eml_cap: EML capabilities field value from common info field of * the Multi-link element - * Return: the EMLSR Transition timeout (in microseconds) encoded in + * Return: the EML Transition timeout (in microseconds) encoded in * the EML Capabilities field */ -- cgit v1.2.3 From ed1e31d784cbb8db9082d553641cbb0cd2b49989 Mon Sep 17 00:00:00 2001 From: Ping-Ke Shih Date: Sat, 11 Apr 2026 15:25:09 +0800 Subject: wifi: mac80211: add __packed to union members of struct ieee80211_rx_status The arm-linux-gnueabi-gcc compiler, align the field followed by union members, causing size of struct ieee80211_rx_status over skb->cb (48 bytes). By investigation, the union member starts at offset 32, and the offset of next field rate_idx is 36 instead of expected 33, and the total size is (unexpected) 52. When compiling rtw88 driver, it throws: In file included from /work/linux-src/linux-stable/include/linux/string.h:386, from /work/linux-src/linux-stable/include/linux/bitmap.h:13, from /work/linux-src/linux-stable/include/linux/cpumask.h:11, from /work/linux-src/linux-stable/include/linux/smp.h:13, from /work/linux-src/linux-stable/include/linux/lockdep.h:14, from /work/linux-src/linux-stable/include/linux/mutex.h:17, from /work/linux-src/linux-stable/include/linux/kernfs.h:11, from /work/linux-src/linux-stable/include/linux/sysfs.h:16, from /work/linux-src/linux-stable/include/linux/kobject.h:20, from /work/linux-src/linux-stable/include/linux/dmi.h:6, from pci.c:5: In function 'fortify_memcpy_chk', inlined from 'rtw_pci_rx_napi.constprop' at pci.c:1095:4: /work/linux-src/linux-stable/include/linux/fortify-string.h:569:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] 569 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ After this patch, the size of struct ieee80211_rx_status is 48. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260411072509.1556635-1-pkshih@realtek.com Signed-off-by: Johannes Berg --- include/net/mac80211.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/net/mac80211.h b/include/net/mac80211.h index 40cb20d9309c..02318a4be0e1 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -1747,18 +1747,18 @@ struct ieee80211_rx_status { u8 he_ru:3; u8 he_gi:2; u8 he_dcm:1; - }; + } __packed; struct { u8 ru:4; u8 gi:2; - } eht; + } __packed eht; struct { u8 ru:4; u8 gi:2; u8 elr:1; u8 im:1; - } uhr; - }; + } __packed uhr; + } __packed; u8 rate_idx; u8 nss; u8 rx_flags; @@ -1771,6 +1771,8 @@ struct ieee80211_rx_status { u8 link_valid:1, link_id:4; }; +static_assert(sizeof(struct ieee80211_rx_status) <= sizeof_field(struct sk_buff, cb)); + static inline u32 ieee80211_rx_status_to_khz(struct ieee80211_rx_status *rx_status) { -- cgit v1.2.3 From 032d1a3fc0e95ca804213df65ef57f5ced2a867b Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 15 Apr 2026 14:42:05 +0200 Subject: wifi: nl80211: document channel opmode change channel width The opmode change notification is entirely unused by existing userspace except for printing out the values. As such, there's no need to keep it perfectly accurate, and the implementation in mac80211 doesn't report it correctly today. Add a note in the documentation that it may not differentiate 80+80 and 160. Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260415144514.87d5b1ce688f.Ia9a0769d52dcfe56f7b0dff903ed14db3ef04920@changeid Signed-off-by: Johannes Berg --- include/uapi/linux/nl80211.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 3d55bf4be36f..072b383d7d3c 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -1204,10 +1204,12 @@ * user space through the connect result as the user space would have * initiated the connection through the connect request. * - * @NL80211_CMD_STA_OPMODE_CHANGED: An event that notify station's - * ht opmode or vht opmode changes using any of %NL80211_ATTR_SMPS_MODE, - * %NL80211_ATTR_CHANNEL_WIDTH,%NL80211_ATTR_NSS attributes with its - * address(specified in %NL80211_ATTR_MAC). + * @NL80211_CMD_STA_OPMODE_CHANGED: An event that notifies that a station's + * HT opmode or VHT opmode changed using any of %NL80211_ATTR_SMPS_MODE, + * %NL80211_ATTR_CHANNEL_WIDTH, %NL80211_ATTR_NSS attributes with its + * address (specified in %NL80211_ATTR_MAC). + * Note that 80+80 and 160 MHz might not be differentiated, i.e. may + * report %NL80211_CHAN_WIDTH_160 instead of %NL80211_CHAN_WIDTH_80P80. * * @NL80211_CMD_GET_FTM_RESPONDER_STATS: Retrieve FTM responder statistics, in * the %NL80211_ATTR_FTM_RESPONDER_STATS attribute. -- cgit v1.2.3 From e12e20650f64d109971f27a30260f1012b7d26fe Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 15 Apr 2026 14:42:11 +0200 Subject: wifi: cfg80211: remove HE/SAE H2E required fields These are not used by any drivers, even the HT/VHT ones are only used by the qtnfmac driver. Remove the fields. Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260415144514.a4a3ebb0f95a.Ifadd953e13133e7a45ee3318fb04b2ff9dde62e4@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 9d3639ff9c28..8bebf45af95d 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -1529,8 +1529,6 @@ struct cfg80211_s1g_short_beacon { * @ht_required: stations must support HT * @vht_required: stations must support VHT * @twt_responder: Enable Target Wait Time - * @he_required: stations must support HE - * @sae_h2e_required: stations must support direct H2E technique in SAE * @flags: flags, as defined in &enum nl80211_ap_settings_flags * @he_obss_pd: OBSS Packet Detection settings * @he_oper: HE operation IE (or %NULL if HE isn't enabled) @@ -1566,7 +1564,7 @@ struct cfg80211_ap_settings { const struct ieee80211_eht_cap_elem *eht_cap; const struct ieee80211_eht_operation *eht_oper; const struct ieee80211_uhr_operation *uhr_oper; - bool ht_required, vht_required, he_required, sae_h2e_required; + bool ht_required, vht_required; bool twt_responder; u32 flags; struct ieee80211_he_obss_pd he_obss_pd; -- cgit v1.2.3 From a384ae96990250eaa676e3ff78e5ab2cd00565dd Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 15 Apr 2026 14:42:13 +0200 Subject: wifi: cfg80211: move AP HT/VHT/... operation to beacon info The HT/VHT/HE/EHT/UHR operation can change, and might thus be updated on each beacon update. Move them to the beacon struct and parse them out of the beacon also on updates, not just on starting the AP. This also fixes checks in two ways: - Regulatory checks in nl80211_validate_ap_phy_operation() are now done also on updates, disallowing enabling HE/EHT/UHR on channels that don't allow that after start. This checks only operation now, but clients can't use it without operation. - NL80211_ATTR_UHR_OPERATION is now required whenever UHR is present in the beacon, and rejected otherwise. Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260415144514.f70758a46904.I0d21120b41eed661eefc61d5417dadaae7145845@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 8bebf45af95d..7070e577342b 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -1396,6 +1396,11 @@ struct cfg80211_rnr_elems { * @he_bss_color: BSS Color settings * @he_bss_color_valid: indicates whether bss color * attribute is present in beacon data or not. + * @ht_required: stations must support HT + * @vht_required: stations must support VHT + * @he_oper: HE operation IE (or %NULL if HE isn't enabled) + * @eht_oper: EHT operation IE (or %NULL if EHT isn't enabled) + * @uhr_oper: UHR operation (or %NULL if UHR isn't enabled) */ struct cfg80211_beacon_data { unsigned int link_id; @@ -1420,6 +1425,11 @@ struct cfg80211_beacon_data { size_t civicloc_len; struct cfg80211_he_bss_color he_bss_color; bool he_bss_color_valid; + + bool ht_required, vht_required; + const struct ieee80211_he_operation *he_oper; + const struct ieee80211_eht_operation *eht_oper; + const struct ieee80211_uhr_operation *uhr_oper; }; struct mac_address { @@ -1524,14 +1534,9 @@ struct cfg80211_s1g_short_beacon { * @vht_cap: VHT capabilities (or %NULL if VHT isn't enabled) * @he_cap: HE capabilities (or %NULL if HE isn't enabled) * @eht_cap: EHT capabilities (or %NULL if EHT isn't enabled) - * @eht_oper: EHT operation IE (or %NULL if EHT isn't enabled) - * @uhr_oper: UHR operation (or %NULL if UHR isn't enabled) - * @ht_required: stations must support HT - * @vht_required: stations must support VHT * @twt_responder: Enable Target Wait Time * @flags: flags, as defined in &enum nl80211_ap_settings_flags * @he_obss_pd: OBSS Packet Detection settings - * @he_oper: HE operation IE (or %NULL if HE isn't enabled) * @fils_discovery: FILS discovery transmission parameters * @unsol_bcast_probe_resp: Unsolicited broadcast probe response parameters * @mbssid_config: AP settings for multiple bssid @@ -1560,11 +1565,7 @@ struct cfg80211_ap_settings { const struct ieee80211_ht_cap *ht_cap; const struct ieee80211_vht_cap *vht_cap; const struct ieee80211_he_cap_elem *he_cap; - const struct ieee80211_he_operation *he_oper; const struct ieee80211_eht_cap_elem *eht_cap; - const struct ieee80211_eht_operation *eht_oper; - const struct ieee80211_uhr_operation *uhr_oper; - bool ht_required, vht_required; bool twt_responder; u32 flags; struct ieee80211_he_obss_pd he_obss_pd; -- cgit v1.2.3 From 0b8201bc23425104cf1ca4de9470bad2456bd2be Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 15 Apr 2026 14:42:15 +0200 Subject: wifi: cfg80211: provide HT/VHT operation for AP beacon In addition to providing HE/EHT/UHR operation, also check and provide HT/VHT operation, so that drivers have it and can use it, e.g. to correctly calculate station bandwidth. Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260415144514.32ad98454543.Ia9692671b699164edcc0bdaf4fdbdbefc50b18f8@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 7070e577342b..a40ab36b8edb 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -1398,6 +1398,8 @@ struct cfg80211_rnr_elems { * attribute is present in beacon data or not. * @ht_required: stations must support HT * @vht_required: stations must support VHT + * @ht_oper: HT operation element (or %NULL if HT isn't enabled) + * @vht_oper: VHT operation element (or %NULL if VHT isn't enabled) * @he_oper: HE operation IE (or %NULL if HE isn't enabled) * @eht_oper: EHT operation IE (or %NULL if EHT isn't enabled) * @uhr_oper: UHR operation (or %NULL if UHR isn't enabled) @@ -1427,6 +1429,8 @@ struct cfg80211_beacon_data { bool he_bss_color_valid; bool ht_required, vht_required; + const struct ieee80211_ht_operation *ht_oper; + const struct ieee80211_vht_operation *vht_oper; const struct ieee80211_he_operation *he_oper; const struct ieee80211_eht_operation *eht_oper; const struct ieee80211_uhr_operation *uhr_oper; -- cgit v1.2.3 From 2690d071584ed8f488f2336f93272817b6999484 Mon Sep 17 00:00:00 2001 From: Markus Probst Date: Mon, 27 Apr 2026 17:55:57 +0000 Subject: rust: ACPI: fix missing match data for PRP0001 Export `acpi_of_match_device` function and use it to match the of device table against ACPI PRP0001 in Rust. This fixes id_info being None on ACPI PRP0001 devices. Using `device_get_match_data` is not possible, because Rust stores an index in the of device id instead of a data pointer. This was done this way to provide a convenient and obvious API for drivers, which can be evaluated in const context without the use of any unstable language features. Fixes: 7a718a1f26d1 ("rust: driver: implement `Adapter`") Signed-off-by: Markus Probst Acked-by: Rafael J. Wysocki (Intel) # ACPI Link: https://patch.msgid.link/20260427-rust_acpi_prp0001-v6-1-6119b2a66183@posteo.de Signed-off-by: Danilo Krummrich --- include/acpi/acpi_bus.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include') diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h index b701b5f972cb..c85f7d8f1632 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h @@ -187,6 +187,10 @@ struct acpi_driver { * ----------- */ +bool acpi_of_match_device(const struct acpi_device *adev, + const struct of_device_id *of_match_table, + const struct of_device_id **of_id); + /* Status (_STA) */ struct acpi_device_status { @@ -992,6 +996,13 @@ int acpi_scan_add_dep(acpi_handle handle, struct acpi_handle_list *dep_devices); u32 arch_acpi_add_auto_dep(acpi_handle handle); #else /* CONFIG_ACPI */ +static inline bool acpi_of_match_device(const struct acpi_device *adev, + const struct of_device_id *of_match_table, + const struct of_device_id **of_id) +{ + return false; +} + static inline int register_acpi_bus_type(void *bus) { return 0; } static inline int unregister_acpi_bus_type(void *bus) { return 0; } -- cgit v1.2.3 From e9506871a8ea304cde48ff4a57226df2aadddae3 Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Sat, 18 Apr 2026 18:22:18 +0200 Subject: driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() dev_has_sync_state() reads dev->driver twice without holding device_lock() -- once for the NULL check and once to dereference ->sync_state. Some callers only hold device_links_write_lock, which doesn't prevent a concurrent unbind from clearing dev->driver via device_unbind_cleanup(). Fix it by reading dev->driver exactly once with READ_ONCE(), pairing with the WRITE_ONCE() in device_set_driver(). Link: https://lore.kernel.org/driver-core/DHW8QPU1VU1F.3P6PH69HLFBYC@kernel.org/ Fixes: ac338acf514e ("driver core: Add dev_has_sync_state()") Reviewed-by: Rafael J. Wysocki (Intel) Acked-by: Greg Kroah-Hartman Reviewed-by: Saravana Kannan Link: https://patch.msgid.link/20260418162221.1121873-1-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/device.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index 3bf86d2f9544..56a96e41d2c9 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -1063,9 +1063,12 @@ static inline void device_lock_assert(struct device *dev) static inline bool dev_has_sync_state(struct device *dev) { + struct device_driver *drv; + if (!dev) return false; - if (dev->driver && dev->driver->sync_state) + drv = READ_ONCE(dev->driver); + if (drv && drv->sync_state) return true; if (dev->bus && dev->bus->sync_state) return true; -- cgit v1.2.3 From 9db268212e0d7c7e3c4aef3494e55afbc1695b1f Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Tue, 21 Apr 2026 01:40:44 +0200 Subject: driver core: move dev_has_sync_state() to drivers/base/base.h All callers of dev_has_sync_state() are in drivers/base/ and any attempt to use it outside of driver-core should require good justification, so there is no need to have it defined in include/linux/device.h. Thus, move it to drivers/base/base.h. Suggested-by: Rafael J. Wysocki (Intel) Link: https://lore.kernel.org/driver-core/CAJZ5v0jkm9K9=-U_51FMsyxN2msdouRnz4sEjmxG0Btd6Hmw0w@mail.gmail.com/ Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260420234153.2898532-1-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/device.h | 14 -------------- 1 file changed, 14 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index 56a96e41d2c9..d54c86d77764 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -1061,20 +1061,6 @@ static inline void device_lock_assert(struct device *dev) lockdep_assert_held(&dev->mutex); } -static inline bool dev_has_sync_state(struct device *dev) -{ - struct device_driver *drv; - - if (!dev) - return false; - drv = READ_ONCE(dev->driver); - if (drv && drv->sync_state) - return true; - if (dev->bus && dev->bus->sync_state) - return true; - return false; -} - static inline int dev_set_drv_sync_state(struct device *dev, void (*fn)(struct device *dev)) { -- cgit v1.2.3 From 0aef2f0db6db22c2a441e067d8e8458106fb0483 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nuno=20S=C3=A1?= Date: Fri, 24 Apr 2026 18:29:04 +0100 Subject: clk: clk-axi-clkgen: Add support versal timings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add proper VCO and PFD limits for versal based platforms. For that we need to add new Technology and Speed grade defines. Signed-off-by: Nuno Sá Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd --- include/linux/adi-axi-common.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/adi-axi-common.h b/include/linux/adi-axi-common.h index 37962ba530df..e7ba393061ee 100644 --- a/include/linux/adi-axi-common.h +++ b/include/linux/adi-axi-common.h @@ -51,6 +51,7 @@ enum adi_axi_fpga_technology { ADI_AXI_FPGA_TECH_SERIES7, ADI_AXI_FPGA_TECH_ULTRASCALE, ADI_AXI_FPGA_TECH_ULTRASCALE_PLUS, + ADI_AXI_FPGA_TECH_VERSAL, }; enum adi_axi_fpga_family { @@ -71,6 +72,7 @@ enum adi_axi_fpga_speed_grade { ADI_AXI_FPGA_SPEED_2 = 20, ADI_AXI_FPGA_SPEED_2L = 21, ADI_AXI_FPGA_SPEED_2LV = 22, + ADI_AXI_FPGA_SPEED_2MP = 23, ADI_AXI_FPGA_SPEED_3 = 30, }; -- cgit v1.2.3 From ed060707d4bac8f1a2fcf83af4e1f01d3337893c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= Date: Mon, 27 Apr 2026 12:36:49 -0300 Subject: ALSA: wavefront: add suspend and resume support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The WaveFront driver still lacks support for suspend and resume in both the ISA and PnP driver tables. Wire the driver into ALSA PM by storing the WSS codec pointer in the card private data and adding shared suspend/resume callbacks. Resume cannot simply rerun snd_wavefront_start(), because with the default fx_raw=1 setting that would reset the synth on every resume and discard uploaded WaveFront RAM contents. Cache wavefront.os for PM, probe the ICS2115 after resume and only run the full reset/bootstrap path when the board comes back raw. When the firmware is still running, refresh the software slot bookkeeping and restore the MIDI routing state without forcing a synth reset. Also quiesce and restart the WaveFront MIDI output timer across suspend and resume so active rawmidi output does not race the PM transition. This restores the card to a usable baseline after resume while preserving uploaded samples and programs when the hardware state survives suspend. If the board resumes raw, userspace still needs to reload custom synth contents. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260427-wavefront-pm-v1-1-9c1b6a898673@gmail.com Signed-off-by: Takashi Iwai --- include/sound/snd_wavefront.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/sound/snd_wavefront.h b/include/sound/snd_wavefront.h index 30f508a56766..ac749bb2b836 100644 --- a/include/sound/snd_wavefront.h +++ b/include/sound/snd_wavefront.h @@ -12,6 +12,7 @@ struct _snd_wavefront_midi; struct _snd_wavefront_card; struct _snd_wavefront; +struct snd_wss; typedef struct _snd_wavefront_midi snd_wavefront_midi_t; typedef struct _snd_wavefront_card snd_wavefront_card_t; @@ -46,6 +47,8 @@ extern void snd_wavefront_midi_enable_virtual (snd_wavefront_card_t *); extern void snd_wavefront_midi_disable_virtual (snd_wavefront_card_t *); extern void snd_wavefront_midi_interrupt (snd_wavefront_card_t *); extern int snd_wavefront_midi_start (snd_wavefront_card_t *); +void snd_wavefront_midi_suspend(snd_wavefront_card_t *card); +void snd_wavefront_midi_resume(snd_wavefront_card_t *card); struct _snd_wavefront { unsigned long irq; /* "you were one, one of the few ..." */ @@ -93,6 +96,7 @@ struct _snd_wavefront { int samples_used; /* how many */ char interrupts_are_midi; /* h/w MPU interrupts enabled ? */ char rom_samples_rdonly; /* can we write on ROM samples */ + char midi_in_to_synth; /* route external MIDI to synth */ spinlock_t irq_lock; wait_queue_head_t interrupt_sleeper; snd_wavefront_midi_t midi; /* ICS2115 MIDI interface */ @@ -101,6 +105,7 @@ struct _snd_wavefront { struct _snd_wavefront_card { snd_wavefront_t wavefront; + struct snd_wss *chip; #ifdef CONFIG_PNP struct pnp_dev *wss; struct pnp_dev *ctrl; @@ -110,8 +115,10 @@ struct _snd_wavefront_card { }; extern void snd_wavefront_internal_interrupt (snd_wavefront_card_t *card); +void snd_wavefront_cache_firmware(snd_wavefront_t *dev); extern int snd_wavefront_start (snd_wavefront_t *dev); extern int snd_wavefront_detect (snd_wavefront_card_t *card); +int snd_wavefront_resume_synth(snd_wavefront_card_t *card); extern int snd_wavefront_cmd (snd_wavefront_t *, int, unsigned char *, unsigned char *); -- cgit v1.2.3 From 5ffd937ea4050e995bd1fabc54a2534bb7bfa0d9 Mon Sep 17 00:00:00 2001 From: Moshe Shemesh Date: Tue, 28 Apr 2026 08:38:48 +0300 Subject: mlx5: Rename the vport number enums for host PF and VF Rename the vport number enums MLX5_VPORT_PF to MLX5_VPORT_HOST_PF and MLX5_VPORT_FIRST_VF to MLX5_VPORT_FIRST_HOST_VF to indicate that these vport indices represent the host PF and its VFs. This prepares the code for upcoming support of an additional PF type. Signed-off-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260428053851.220089-2-tariqt@nvidia.com Signed-off-by: Leon Romanovsky --- include/linux/mlx5/eswitch.h | 2 +- include/linux/mlx5/vport.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/mlx5/eswitch.h b/include/linux/mlx5/eswitch.h index 67256e776566..3b29a3c6794d 100644 --- a/include/linux/mlx5/eswitch.h +++ b/include/linux/mlx5/eswitch.h @@ -217,7 +217,7 @@ static inline bool is_mdev_switchdev_mode(struct mlx5_core_dev *dev) static inline u16 mlx5_eswitch_manager_vport(struct mlx5_core_dev *dev) { return mlx5_core_is_ecpf_esw_manager(dev) ? - MLX5_VPORT_ECPF : MLX5_VPORT_PF; + MLX5_VPORT_ECPF : MLX5_VPORT_HOST_PF; } #endif diff --git a/include/linux/mlx5/vport.h b/include/linux/mlx5/vport.h index dfa2fe32217a..90641f67da46 100644 --- a/include/linux/mlx5/vport.h +++ b/include/linux/mlx5/vport.h @@ -51,8 +51,8 @@ enum { /* Vport number for each function must keep unchanged */ enum { - MLX5_VPORT_PF = 0x0, - MLX5_VPORT_FIRST_VF = 0x1, + MLX5_VPORT_HOST_PF = 0x0, + MLX5_VPORT_FIRST_HOST_VF = 0x1, MLX5_VPORT_ECPF = 0xfffe, MLX5_VPORT_UPLINK = 0xffff }; -- cgit v1.2.3 From a750f4674a63382a57561257877754ff0b4b2ca6 Mon Sep 17 00:00:00 2001 From: Moshe Shemesh Date: Tue, 28 Apr 2026 08:38:49 +0300 Subject: net/mlx5: Add function_id_type for enable/disable_hca cmds Add a function_id_type field to the enable_hca and disable_hca command input layouts in mlx5_ifc.h to allow using vhca_id as the function index instead of function_id. The new field support by firmware is indicated by the function_id_type_vhca_id capability bit, which is already exposed in hca caps. Signed-off-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260428053851.220089-3-tariqt@nvidia.com Signed-off-by: Leon Romanovsky --- include/linux/mlx5/mlx5_ifc.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h index 49f3ad4b1a7c..06ec1f5d2c6c 100644 --- a/include/linux/mlx5/mlx5_ifc.h +++ b/include/linux/mlx5/mlx5_ifc.h @@ -8452,7 +8452,9 @@ struct mlx5_ifc_enable_hca_in_bits { u8 op_mod[0x10]; u8 embedded_cpu_function[0x1]; - u8 reserved_at_41[0xf]; + u8 reserved_at_41[0x2]; + u8 function_id_type[0x1]; + u8 reserved_at_44[0xc]; u8 function_id[0x10]; u8 reserved_at_60[0x20]; @@ -8497,7 +8499,9 @@ struct mlx5_ifc_disable_hca_in_bits { u8 op_mod[0x10]; u8 embedded_cpu_function[0x1]; - u8 reserved_at_41[0xf]; + u8 reserved_at_41[0x2]; + u8 function_id_type[0x1]; + u8 reserved_at_44[0xc]; u8 function_id[0x10]; u8 reserved_at_60[0x20]; -- cgit v1.2.3 From e2337517e127b7064d1cb1d49fc2d1e0e134690c Mon Sep 17 00:00:00 2001 From: Moshe Shemesh Date: Tue, 28 Apr 2026 08:38:50 +0300 Subject: net/mlx5: Remove unused host_sf_enable field Drop the unused host_sf_enable array from mlx5_ifc_query_esw_functions_out_bits layout. This field has been deprecated in firmware and is not referenced by the mlx5 driver, so it can be safely removed. Signed-off-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260428053851.220089-4-tariqt@nvidia.com Signed-off-by: Leon Romanovsky --- include/linux/mlx5/mlx5_ifc.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h index 06ec1f5d2c6c..02b57b2286da 100644 --- a/include/linux/mlx5/mlx5_ifc.h +++ b/include/linux/mlx5/mlx5_ifc.h @@ -12725,7 +12725,6 @@ struct mlx5_ifc_query_esw_functions_out_bits { struct mlx5_ifc_host_params_context_bits host_params_context; u8 reserved_at_280[0x180]; - u8 host_sf_enable[][0x40]; }; struct mlx5_ifc_sf_partition_bits { -- cgit v1.2.3 From 02c54621e81ccdc1907e2d735bcda751f2caade1 Mon Sep 17 00:00:00 2001 From: Moshe Shemesh Date: Tue, 28 Apr 2026 08:38:51 +0300 Subject: net/mlx5: Extend query_esw_functions output for multi-function support Update the query_esw_functions command to support a new response layout that can report data for multiple network functions. Setting bit 14 of the op_mod field selects the v1 layout with network_function_params entries instead of the legacy host_params_context. The query_host_net_function_v1 read-only capability indicates firmware support for layout version 1, and query_host_net_function_num_max advertises the maximum number of network function entries. Define a new network_function_params layout and a net_function_params union that groups host_params_context and network_function_params. Rework the query_esw_functions output to use a flexible array of this union, and adjust existing driver callers to use it. Signed-off-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260428053851.220089-5-tariqt@nvidia.com Signed-off-by: Leon Romanovsky --- include/linux/mlx5/mlx5_ifc.h | 64 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 59 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h index 02b57b2286da..6a675f918c40 100644 --- a/include/linux/mlx5/mlx5_ifc.h +++ b/include/linux/mlx5/mlx5_ifc.h @@ -1935,7 +1935,8 @@ struct mlx5_ifc_cmd_hca_cap_bits { u8 max_flow_counter_31_16[0x10]; u8 max_wqe_sz_sq_dc[0x10]; - u8 reserved_at_2e0[0x7]; + u8 query_host_net_function_num_max[0x5]; + u8 reserved_at_2e5[0x2]; u8 max_qp_mcg[0x19]; u8 reserved_at_300[0x10]; @@ -2027,7 +2028,7 @@ struct mlx5_ifc_cmd_hca_cap_bits { u8 log_max_current_mc_list[0x5]; u8 reserved_at_3f8[0x1]; u8 silent_mode_query[0x1]; - u8 reserved_at_3fa[0x1]; + u8 query_host_net_function_v1[0x1]; u8 log_max_current_uc_list[0x5]; u8 general_obj_types[0x40]; @@ -12704,6 +12705,54 @@ struct mlx5_ifc_host_params_context_bits { u8 reserved_at_80[0x180]; }; +enum mlx5_ifc_vhca_state { + MLX5_VHCA_STATE_INVALID = 0x0, + MLX5_VHCA_STATE_ALLOCATED = 0x1, + MLX5_VHCA_STATE_ACTIVE = 0x2, + MLX5_VHCA_STATE_IN_USE = 0x3, + MLX5_VHCA_STATE_TEARDOWN_REQUEST = 0x4, +}; + +enum { + MLX5_PCI_PF_TYPE_EXTERNAL_HOST_PF = 0x0, + MLX5_PCI_PF_TYPE_SATELLITE_PF = 0x1, +}; + +struct mlx5_ifc_network_function_params_bits { + u8 host_number[0x8]; + u8 pci_pf_type[0x4]; + u8 reserved_at_c[0x4]; + u8 pci_num_vfs[0x10]; + + u8 pci_total_vfs[0x10]; + u8 pci_bus[0x8]; + u8 pci_device_function[0x8]; + + u8 vhca_id[0x10]; + u8 vhca_state[0x4]; + u8 reserved_at_54[0xc]; + + u8 reserved_at_60[0xa]; + u8 esw_vport_manual[0x1]; + u8 pci_bus_assigned[0x1]; + u8 pci_vf_info_valid[0x1]; + u8 reserved_at_6d[0x13]; + + u8 pci_vf_stride[0x10]; + u8 pci_first_vf_offset[0x10]; + + u8 reserved_at_a0[0x160]; +}; + +union mlx5_ifc_net_function_params_bits { + struct mlx5_ifc_host_params_context_bits host_params_context; + struct mlx5_ifc_network_function_params_bits network_function_params; +}; + +enum { + MLX5_QUERY_ESW_FUNC_OP_MOD_LAYOUT_V1 = BIT(14), +}; + struct mlx5_ifc_query_esw_functions_in_bits { u8 opcode[0x10]; u8 reserved_at_10[0x10]; @@ -12720,11 +12769,16 @@ struct mlx5_ifc_query_esw_functions_out_bits { u8 syndrome[0x20]; - u8 reserved_at_40[0x40]; + u8 reserved_at_40[0x20]; - struct mlx5_ifc_host_params_context_bits host_params_context; + u8 net_function_num[0x8]; + u8 reserved_at_68[0x18]; - u8 reserved_at_280[0x180]; + union { + u8 reserved_at_80[0x380]; + DECLARE_FLEX_ARRAY(union mlx5_ifc_net_function_params_bits, + net_function_params); + }; }; struct mlx5_ifc_sf_partition_bits { -- cgit v1.2.3 From 48fcc895403cc97aa6c776cb65e6aa11290c0b44 Mon Sep 17 00:00:00 2001 From: Wei Liu Date: Thu, 23 Apr 2026 17:26:26 +0000 Subject: mshv: add a missing padding field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit That was missed when importing the header. Reported-by: Doru Blânzeanu Reported-by: Magnus Kulke Fixes: e68bda71a2384 ("hyperv: Add new Hyper-V headers in include/hyperv") Cc: stable@kernel.org Reviewed-by: Easwar Hariharan Signed-off-by: Wei Liu --- include/hyperv/hvhdk.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/hyperv/hvhdk.h b/include/hyperv/hvhdk.h index 5e83d3714966..0c89c62c9706 100644 --- a/include/hyperv/hvhdk.h +++ b/include/hyperv/hvhdk.h @@ -79,6 +79,7 @@ struct hv_vp_register_page { u64 registers[18]; }; + u8 reserved[8]; /* Volatile XMM registers (HV_X64_REGISTER_CLASS_XMM) */ union { struct { -- cgit v1.2.3 From 52472519ef61c62bdac8f0ffa10268b5bf123cc4 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 28 Apr 2026 07:09:19 +0000 Subject: net/sched: rename qstats_overlimit_inc() to qstats_cpu_overlimit_inc() qstats_overlimit_inc() is only used to increment per cpu overlimits. It can use this_cpu_inc() to avoid this_cpu_ptr() extra cost and avoid potential store tearing. Change qstats_overlimit_inc() name and its argument type. Also add a WRITE_ONCE() in qdisc_qstats_overlimit() to prevent store tearing. $ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1 add/remove: 0/0 grow/shrink: 0/7 up/down: 0/-91 (-91) Function old new delta tcf_skbmod_act 772 764 -8 tcf_police_act 733 725 -8 tcf_gate_act 318 310 -8 tcf_pedit_act 1295 1284 -11 tcf_mirred_to_dev 1126 1114 -12 tcf_ife_act 1077 1061 -16 tcf_mirred_act 1324 1296 -28 Total: Before=24274627, After=24274536, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260428070919.3109557-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/act_api.h | 2 +- include/net/sch_generic.h | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/net/act_api.h b/include/net/act_api.h index d11b79107930..2ec4ef9a5d0c 100644 --- a/include/net/act_api.h +++ b/include/net/act_api.h @@ -250,7 +250,7 @@ static inline void tcf_action_inc_drop_qstats(struct tc_action *a) static inline void tcf_action_inc_overlimit_qstats(struct tc_action *a) { if (likely(a->cpu_qstats)) { - qstats_overlimit_inc(this_cpu_ptr(a->cpu_qstats)); + qstats_cpu_overlimit_inc(a->cpu_qstats); return; } atomic_inc(&a->tcfa_overlimits); diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index 11159a50d6a1..cbfe9ed435fd 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -1004,9 +1004,9 @@ static inline void qstats_drop_inc(struct gnet_stats_queue *qstats) qstats->drops++; } -static inline void qstats_overlimit_inc(struct gnet_stats_queue *qstats) +static inline void qstats_cpu_overlimit_inc(struct gnet_stats_queue __percpu *qstats) { - qstats->overlimits++; + this_cpu_inc(qstats->overlimits); } static inline void qdisc_qstats_drop(struct Qdisc *sch) @@ -1021,7 +1021,7 @@ static inline void qdisc_qstats_cpu_drop(struct Qdisc *sch) static inline void qdisc_qstats_overlimit(struct Qdisc *sch) { - sch->qstats.overlimits++; + WRITE_ONCE(sch->qstats.overlimits, sch->qstats.overlimits + 1); } static inline int qdisc_qstats_copy(struct gnet_dump *d, struct Qdisc *sch) -- cgit v1.2.3 From 28df22acc2751abf6e6316a9f1f9cd422741bd03 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 29 Apr 2026 01:08:09 +0000 Subject: tcp: add tcp_mstamp_refresh_inline() We want to inline tcp_mstamp_refresh() in fast path only: - tcp_rcv_established() - tcp_write_xmit() Add tcp_mstamp_refresh_inline() for this purpose. Add noinline qualifier on tcp_mstamp_refresh() for the other paths, to reduce bloat. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 1/4 up/down: 26/-123 (-97) Function old new delta tcp_rcv_established 2238 2264 +26 tcp_connect 4027 4003 -24 tcp_tsq_write 152 120 -32 tcp_send_active_reset 476 444 -32 tcp_send_window_probe 235 200 -35 Total: Before=25316710, After=25316613, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20260429010809.784315-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/tcp.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'include') diff --git a/include/net/tcp.h b/include/net/tcp.h index ecbadcb3a744..fb2bc9edc7de 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1015,6 +1015,16 @@ static inline u32 tcp_time_stamp_ts(const struct tcp_sock *tp) return tcp_time_stamp_ms(tp); } +/* Refresh clocks of a TCP socket, + * ensuring monotically increasing values. + */ +static inline void tcp_mstamp_refresh_inline(struct tcp_sock *tp) +{ + u64 val = tcp_clock_ns(); + + tp->tcp_clock_cache = val; + tp->tcp_mstamp = div_u64(val, NSEC_PER_USEC); +} void tcp_mstamp_refresh(struct tcp_sock *tp); static inline u32 tcp_stamp_us_delta(u64 t1, u64 t0) -- cgit v1.2.3 From 068f5a00955675f10348986d4809edc4dbc0cae0 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Mon, 27 Apr 2026 10:27:24 -0700 Subject: net/tcp-ao: Use crypto library API instead of crypto_ahash Currently the kernel's TCP-AO implementation does the MAC and KDF computations using the crypto_ahash API. This API is inefficient and difficult to use, and it has required extensive workarounds in the form of per-CPU preallocated objects (tcp_sigpool) to work at all. Let's use lib/crypto/ instead. This means switching to straightforward stack-allocated structures, virtually addressed buffers, and direct function calls. It also means removing quite a bit of error handling. This makes TCP-AO quite a bit faster. This also enables many additional cleanups, which later commits will handle: removing tcp-sigpool, removing support for crypto_tfm cloning, removing more error handling, and replacing more dynamically-allocated buffers with stack buffers based on the now-statically-known limits. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260427172727.9310-3-ebiggers@kernel.org Signed-off-by: Paolo Abeni --- include/net/tcp_ao.h | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h index 1e9e27d6e06b..20997aef3b0d 100644 --- a/include/net/tcp_ao.h +++ b/include/net/tcp_ao.h @@ -2,8 +2,7 @@ #ifndef _TCP_AO_H #define _TCP_AO_H -#define TCP_AO_KEY_ALIGN 1 -#define __tcp_ao_key_align __aligned(TCP_AO_KEY_ALIGN) +#include /* for SHA256_DIGEST_SIZE */ union tcp_ao_addr { struct in_addr a4; @@ -32,11 +31,27 @@ struct tcp_ao_counters { atomic64_t dropped_icmp; }; +enum tcp_ao_algo_id { + TCP_AO_ALGO_HMAC_SHA1 = 1, /* specified by RFC 5926 */ + TCP_AO_ALGO_HMAC_SHA256, /* Linux extension */ + TCP_AO_ALGO_AES_128_CMAC, /* specified by RFC 5926 */ +}; + +/* + * This is the maximum untruncated MAC length, in bytes. Note that the MACs + * actually get truncated to 20 or fewer bytes to fit in the TCP options space. + */ +#define TCP_AO_MAX_MAC_LEN SHA256_DIGEST_SIZE + +#define TCP_AO_MAX_TRAFFIC_KEY_LEN SHA256_DIGEST_SIZE + +struct tcp_ao_mac_ctx; + struct tcp_ao_key { struct hlist_node node; union tcp_ao_addr addr; - u8 key[TCP_AO_MAXKEYLEN] __tcp_ao_key_align; - unsigned int tcp_sigpool_id; + u8 key[TCP_AO_MAXKEYLEN]; + enum tcp_ao_algo_id algo; unsigned int digest_size; int l3index; u8 prefixlen; @@ -168,7 +183,6 @@ struct tcp6_ao_context { __be32 disn; }; -struct tcp_sigpool; /* Established states are fast-path and there always is current_key/rnext_key */ #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \ TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING) @@ -176,6 +190,8 @@ struct tcp_sigpool; int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, struct tcp_ao_key *key, struct tcphdr *th, __u8 *hash_location); +void tcp_ao_mac_update(struct tcp_ao_mac_ctx *mac_ctx, const void *data, + size_t data_len); int tcp_ao_hash_skb(unsigned short int family, char *ao_hash, struct tcp_ao_key *key, const struct sock *sk, const struct sk_buff *skb, @@ -188,8 +204,8 @@ struct tcp_ao_key *tcp_ao_established_key(const struct sock *sk, int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk, struct request_sock *req, struct sk_buff *skb, int family); -int tcp_ao_calc_traffic_key(struct tcp_ao_key *mkt, u8 *key, void *ctx, - unsigned int len, struct tcp_sigpool *hp); +void tcp_ao_calc_traffic_key(const struct tcp_ao_key *mkt, u8 *traffic_key, + const void *input, unsigned int input_len); void tcp_ao_destroy_sock(struct sock *sk, bool twsk); void tcp_ao_time_wait(struct tcp_timewait_sock *tcptw, struct tcp_sock *tp); bool tcp_ao_ignore_icmp(const struct sock *sk, int family, int type, int code); @@ -234,7 +250,7 @@ int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key, const struct sock *sk, const struct sk_buff *skb, const u8 *tkey, int hash_offset, u32 sne); /* ipv6 specific functions */ -int tcp_v6_ao_hash_pseudoheader(struct tcp_sigpool *hp, +int tcp_v6_ao_hash_pseudoheader(struct tcp_ao_mac_ctx *mac_ctx, const struct in6_addr *daddr, const struct in6_addr *saddr, int nbytes); int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key, -- cgit v1.2.3 From 8e4f61e431634730af2244312c783f746575905d Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Mon, 27 Apr 2026 10:27:26 -0700 Subject: net/tcp-ao: Return void from functions that can no longer fail Since tcp-ao now uses the crypto library API instead of crypto_ahash, and MACs and keys now have a statically-known maximum size, many tcp-ao functions can no longer fail. Propagate this change up into the return types of various functions. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260427172727.9310-5-ebiggers@kernel.org Signed-off-by: Paolo Abeni --- include/net/tcp.h | 8 ++++---- include/net/tcp_ao.h | 44 ++++++++++++++++++++++---------------------- 2 files changed, 26 insertions(+), 26 deletions(-) (limited to 'include') diff --git a/include/net/tcp.h b/include/net/tcp.h index fb2bc9edc7de..35fc6b35b216 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -2520,9 +2520,9 @@ struct tcp_sock_af_ops { struct tcp_ao_key *(*ao_lookup)(const struct sock *sk, struct sock *addr_sk, int sndid, int rcvid); - int (*ao_calc_key_sk)(struct tcp_ao_key *mkt, u8 *key, - const struct sock *sk, - __be32 sisn, __be32 disn, bool send); + void (*ao_calc_key_sk)(struct tcp_ao_key *mkt, u8 *key, + const struct sock *sk, + __be32 sisn, __be32 disn, bool send); int (*calc_ao_hash)(char *location, struct tcp_ao_key *ao, const struct sock *sk, const struct sk_buff *skb, const u8 *tkey, int hash_offset, u32 sne); @@ -2543,7 +2543,7 @@ struct tcp_request_sock_ops { struct tcp_ao_key *(*ao_lookup)(const struct sock *sk, struct request_sock *req, int sndid, int rcvid); - int (*ao_calc_key)(struct tcp_ao_key *mkt, u8 *key, struct request_sock *sk); + void (*ao_calc_key)(struct tcp_ao_key *mkt, u8 *key, struct request_sock *sk); int (*ao_synack_hash)(char *ao_hash, struct tcp_ao_key *mkt, struct request_sock *req, const struct sk_buff *skb, int hash_offset, u32 sne); diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h index 20997aef3b0d..29fd7b735afa 100644 --- a/include/net/tcp_ao.h +++ b/include/net/tcp_ao.h @@ -187,9 +187,9 @@ struct tcp6_ao_context { #define TCP_AO_ESTABLISHED (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | \ TCPF_CLOSE_WAIT | TCPF_LAST_ACK | TCPF_CLOSING) -int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, - struct tcp_ao_key *key, struct tcphdr *th, - __u8 *hash_location); +void tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, + struct tcp_ao_key *key, struct tcphdr *th, + __u8 *hash_location); void tcp_ao_mac_update(struct tcp_ao_mac_ctx *mac_ctx, const void *data, size_t data_len); int tcp_ao_hash_skb(unsigned short int family, @@ -238,11 +238,11 @@ struct tcp_ao_key *tcp_v4_ao_lookup(const struct sock *sk, struct sock *addr_sk, int tcp_v4_ao_synack_hash(char *ao_hash, struct tcp_ao_key *mkt, struct request_sock *req, const struct sk_buff *skb, int hash_offset, u32 sne); -int tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, - const struct sock *sk, - __be32 sisn, __be32 disn, bool send); -int tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, - struct request_sock *req); +void tcp_v4_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, + const struct sock *sk, + __be32 sisn, __be32 disn, bool send); +void tcp_v4_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, + struct request_sock *req); struct tcp_ao_key *tcp_v4_ao_lookup_rsk(const struct sock *sk, struct request_sock *req, int sndid, int rcvid); @@ -250,16 +250,17 @@ int tcp_v4_ao_hash_skb(char *ao_hash, struct tcp_ao_key *key, const struct sock *sk, const struct sk_buff *skb, const u8 *tkey, int hash_offset, u32 sne); /* ipv6 specific functions */ -int tcp_v6_ao_hash_pseudoheader(struct tcp_ao_mac_ctx *mac_ctx, - const struct in6_addr *daddr, - const struct in6_addr *saddr, int nbytes); -int tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key, - const struct sk_buff *skb, __be32 sisn, __be32 disn); -int tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, - const struct sock *sk, __be32 sisn, - __be32 disn, bool send); -int tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, - struct request_sock *req); +void tcp_v6_ao_hash_pseudoheader(struct tcp_ao_mac_ctx *mac_ctx, + const struct in6_addr *daddr, + const struct in6_addr *saddr, int nbytes); +void tcp_v6_ao_calc_key_skb(struct tcp_ao_key *mkt, u8 *key, + const struct sk_buff *skb, __be32 sisn, + __be32 disn); +void tcp_v6_ao_calc_key_sk(struct tcp_ao_key *mkt, u8 *key, + const struct sock *sk, __be32 sisn, + __be32 disn, bool send); +void tcp_v6_ao_calc_key_rsk(struct tcp_ao_key *mkt, u8 *key, + struct request_sock *req); struct tcp_ao_key *tcp_v6_ao_lookup(const struct sock *sk, struct sock *addr_sk, int sndid, int rcvid); struct tcp_ao_key *tcp_v6_ao_lookup_rsk(const struct sock *sk, @@ -279,11 +280,10 @@ void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, struct request_sock *req, unsigned short int family); #else /* CONFIG_TCP_AO */ -static inline int tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, - struct tcp_ao_key *key, struct tcphdr *th, - __u8 *hash_location) +static inline void tcp_ao_transmit_skb(struct sock *sk, struct sk_buff *skb, + struct tcp_ao_key *key, + struct tcphdr *th, __u8 *hash_location) { - return 0; } static inline void tcp_ao_syncookie(struct sock *sk, const struct sk_buff *skb, -- cgit v1.2.3 From 4baf2415992e3051cb39b831191d12cb7e85ab60 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Mon, 27 Apr 2026 10:27:27 -0700 Subject: net/tcp: Remove tcp_sigpool tcp_sigpool is no longer used. It existed only as a workaround for issues in the design of the crypto_ahash API, which have been avoided by switching to the much easier-to-use library APIs instead. Remove it. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Link: https://patch.msgid.link/20260427172727.9310-6-ebiggers@kernel.org Signed-off-by: Paolo Abeni --- include/net/tcp.h | 34 ---------------------------------- 1 file changed, 34 deletions(-) (limited to 'include') diff --git a/include/net/tcp.h b/include/net/tcp.h index 35fc6b35b216..3c4e6adb0dbd 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -2027,40 +2027,6 @@ struct tcp6_pseudohdr { __be32 protocol; /* including padding */ }; -/* - * struct tcp_sigpool - per-CPU pool of ahash_requests - * @scratch: per-CPU temporary area, that can be used between - * tcp_sigpool_start() and tcp_sigpool_end() to perform - * crypto request - * @req: pre-allocated ahash request - */ -struct tcp_sigpool { - void *scratch; - struct ahash_request *req; -}; - -int tcp_sigpool_alloc_ahash(const char *alg, size_t scratch_size); -void tcp_sigpool_get(unsigned int id); -void tcp_sigpool_release(unsigned int id); -int tcp_sigpool_hash_skb_data(struct tcp_sigpool *hp, - const struct sk_buff *skb, - unsigned int header_len); - -/** - * tcp_sigpool_start - disable bh and start using tcp_sigpool_ahash - * @id: tcp_sigpool that was previously allocated by tcp_sigpool_alloc_ahash() - * @c: returned tcp_sigpool for usage (uninitialized on failure) - * - * Returns: 0 on success, error otherwise. - */ -int tcp_sigpool_start(unsigned int id, struct tcp_sigpool *c); -/** - * tcp_sigpool_end - enable bh and stop using tcp_sigpool - * @c: tcp_sigpool context that was returned by tcp_sigpool_start() - */ -void tcp_sigpool_end(struct tcp_sigpool *c); -size_t tcp_sigpool_algo(unsigned int id, char *buf, size_t buf_len); -/* - functions */ void tcp_v4_md5_hash_skb(char *md5_hash, const struct tcp_md5sig_key *key, const struct sock *sk, const struct sk_buff *skb); int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr, -- cgit v1.2.3 From 5a59e82f95d3521fa64f24b6450417ee098d8546 Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Tue, 21 Apr 2026 13:30:12 +0200 Subject: irqchip/gic: Replace __ASSEMBLY__ with __ASSEMBLER__ While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. Standardize now on the __ASSEMBLER__ macro that is provided by the compilers. Signed-off-by: Thomas Huth Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260421113012.146528-1-thuth@redhat.com --- include/linux/irqchip/arm-gic-v3.h | 2 +- include/linux/irqchip/arm-gic.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h index 0225121f3013..ea5fd2374ebe 100644 --- a/include/linux/irqchip/arm-gic-v3.h +++ b/include/linux/irqchip/arm-gic-v3.h @@ -604,7 +604,7 @@ #include -#ifndef __ASSEMBLY__ +#ifndef __ASSEMBLER__ /* * We need a value to serve as a irq-type for LPIs. Choose one that will diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h index d45fa19f9e47..849386dc5ec8 100644 --- a/include/linux/irqchip/arm-gic.h +++ b/include/linux/irqchip/arm-gic.h @@ -131,7 +131,7 @@ #define GICV_PMR_PRIORITY_SHIFT 3 #define GICV_PMR_PRIORITY_MASK (0x1f << GICV_PMR_PRIORITY_SHIFT) -#ifndef __ASSEMBLY__ +#ifndef __ASSEMBLER__ #include @@ -162,5 +162,5 @@ int gic_get_cpu_id(unsigned int cpu); void gic_migrate_target(unsigned int new_cpu_id); unsigned long gic_get_sgir_physaddr(void); -#endif /* __ASSEMBLY */ +#endif /* __ASSEMBLER__ */ #endif -- cgit v1.2.3 From f603e84ab7918db6470c0b06b46ece7fbdb71e9a Mon Sep 17 00:00:00 2001 From: Paul Chaignon Date: Thu, 30 Apr 2026 10:44:28 +0200 Subject: bpf: Print breakdown of insns processed by subprogs When using global functions (i.e. subprogs), the verifier performs function-by-function verification. In that case, the sum of the instructions processed in each global function and in the main program counts towards the 1 million instructions limit. Only that sum is reported in the verifier logs. While starting to use global functions in Cilium (finally!), we found it can be useful to have the breakdown per global function, to understand exactly where the budget is currently spent. This patch implements this breakdown, under BPF_LOG_STATS, as done for the stack depths. When iterating over subprogs, we need to skip the hidden subprogs at the end because they don't have a corresponding func_info_aux entry and calling bpf_subprog_is_global() would result in an OOB access. Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/bpf/5590f9c67e614ec9054d0c7e74e87cc690a52c56.1777538384.git.paul.chaignon@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi --- include/linux/bpf_verifier.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 101ca6cc5424..976e2b2f40e8 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -779,6 +779,7 @@ struct bpf_subprog_info { u32 exit_idx; /* Index of one of the BPF_EXIT instructions in this subprogram */ u16 stack_depth; /* max. stack depth used by this function */ u16 stack_extra; + u32 insn_processed; /* offsets in range [stack_depth .. fastcall_stack_off) * are used for bpf_fastcall spills and fills. */ -- cgit v1.2.3 From 07a1a6562ce29e2e0c134a57882d6e52e8758492 Mon Sep 17 00:00:00 2001 From: Marco Elver Date: Wed, 22 Apr 2026 13:59:45 +0200 Subject: kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() Some subsystems enable -Wmaybe-uninitialized [1], which can trigger false positives when KCSAN is enabled. Specifically, passing an uninitialized variable to functions that instrument accesses (e.g., copy_from_user()) results in calls to __kcsan_check_access(). Because __kcsan_check_access() takes a `const volatile void *ptr`, GCC infers that the function may only read the memory location, and thus warns if the passed variable is uninitialized. However, KCSAN is a dynamic analysis tool for data race detection; while it does read the memory location to detect concurrent modifications, the "initialized'ness" of the memory location is irrelevant for its analysis. Use absolute_pointer() in __kcsan_check_write(), kcsan_check_write(), and kcsan_check_atomic_write() to hide the pointer from the compiler, preventing it from concluding that the pointer passed points to uninitialized memory. This fixes warnings like: | CC fs/ntfs3/file.o | In file included from include/asm-generic/rwonce.h:27, | from arch/arm64/include/asm/rwonce.h:81, | from include/linux/compiler.h:369, | from include/linux/array_size.h:5, | from include/linux/kernel.h:16, | from include/linux/backing-dev.h:12, | from fs/ntfs3/file.c:10: | In function 'instrument_copy_from_user_before', | inlined from '_inline_copy_from_user' at include/linux/uaccess.h:184:2, | inlined from 'copy_from_user' at include/linux/uaccess.h:221:9, | inlined from 'ntfs_ioctl_fitrim' at fs/ntfs3/file.c:77:6, | inlined from 'ntfs_ioctl' at fs/ntfs3/file.c:164:10: | include/linux/kcsan-checks.h:220:28: error: 'range' may be used uninitialized [-Werror=maybe-uninitialized] | 220 | #define kcsan_check_access __kcsan_check_access | | ^ | include/linux/kcsan-checks.h:311:9: note: in expansion of macro 'kcsan_check_access' | 311 | kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE) | | ^~~~~~~~~~~~~~~~~~ | include/linux/instrumented.h:147:9: note: in expansion of macro 'kcsan_check_write' | 147 | kcsan_check_write(to, n); | | ^~~~~~~~~~~~~~~~~ | include/linux/kcsan-checks.h: In function 'ntfs_ioctl': | include/linux/kcsan-checks.h:37:6: note: by argument 1 of type 'const volatile void *' to '__kcsan_check_access' declared here | 37 | void __kcsan_check_access(const volatile void *ptr, size_t size, int type); | | ^~~~~~~~~~~~~~~~~~~~ | fs/ntfs3/file.c:65:29: note: 'range' declared here | 65 | struct fstrim_range range; | | ^~~~~ Link: https://lore.kernel.org/all/5da10cca-875b-418d-b54e-6be3ea32c266@app.fastmail.com/ [1] Reported-by: Arnd Bergmann Reviewed-by: Arnd Bergmann Tested-by: Arnd Bergmann Signed-off-by: Marco Elver --- include/linux/kcsan-checks.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/kcsan-checks.h b/include/linux/kcsan-checks.h index 92f3843d9ebb..e135dacaa90f 100644 --- a/include/linux/kcsan-checks.h +++ b/include/linux/kcsan-checks.h @@ -282,7 +282,7 @@ static inline void __kcsan_disable_current(void) { } * @size: size of access */ #define __kcsan_check_write(ptr, size) \ - __kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE) + __kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE) /** * __kcsan_check_read_write - check regular read-write access for races @@ -308,7 +308,7 @@ static inline void __kcsan_disable_current(void) { } * @size: size of access */ #define kcsan_check_write(ptr, size) \ - kcsan_check_access(ptr, size, KCSAN_ACCESS_WRITE) + kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_WRITE) /** * kcsan_check_read_write - check regular read-write access for races @@ -331,7 +331,7 @@ static inline void __kcsan_disable_current(void) { } #define kcsan_check_atomic_read(ptr, size) \ kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC) #define kcsan_check_atomic_write(ptr, size) \ - kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE) + kcsan_check_access(absolute_pointer(ptr), size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE) #define kcsan_check_atomic_read_write(ptr, size) \ kcsan_check_access(ptr, size, KCSAN_ACCESS_ATOMIC | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_COMPOUND) #endif -- cgit v1.2.3 From 781c8893a5da8522ae4ded93e5ef3adbe9559300 Mon Sep 17 00:00:00 2001 From: Ivan Vecera Date: Tue, 28 Apr 2026 17:49:06 +0200 Subject: dpll: add pin operational state Add pin-operstate enum and operstate_on_dpll_get callback to report the actual hardware status of a pin with respect to its parent DPLL device. Unlike pin-state (which reflects administrative intent set by the user), operstate reflects what the hardware is actually doing. Defined operational states: - active: pin is qualified and actively used by the DPLL - standby: pin is qualified but not actively used by the DPLL - no-signal: pin does not have a valid signal - qual-failed: pin signal failed qualification The operstate is reported inside the pin-parent-device nested attribute alongside the existing state and phase-offset attributes. Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Reviewed-by: Vadim Fedorenko Reviewed-by: Petr Oros Link: https://patch.msgid.link/20260428154907.2820654-2-ivecera@redhat.com Signed-off-by: Paolo Abeni --- include/linux/dpll.h | 6 ++++++ include/uapi/linux/dpll.h | 23 +++++++++++++++++++++++ 2 files changed, 29 insertions(+) (limited to 'include') diff --git a/include/linux/dpll.h b/include/linux/dpll.h index b7277a8b484d..b6f16c884b99 100644 --- a/include/linux/dpll.h +++ b/include/linux/dpll.h @@ -85,6 +85,12 @@ struct dpll_pin_ops { const struct dpll_device *dpll, void *dpll_priv, enum dpll_pin_state *state, struct netlink_ext_ack *extack); + int (*operstate_on_dpll_get)(const struct dpll_pin *pin, + void *pin_priv, + const struct dpll_device *dpll, + void *dpll_priv, + enum dpll_pin_operstate *operstate, + struct netlink_ext_ack *extack); int (*state_on_pin_set)(const struct dpll_pin *pin, void *pin_priv, const struct dpll_pin *parent_pin, void *parent_pin_priv, diff --git a/include/uapi/linux/dpll.h b/include/uapi/linux/dpll.h index 871685f7c353..cb363cccf2e2 100644 --- a/include/uapi/linux/dpll.h +++ b/include/uapi/linux/dpll.h @@ -178,6 +178,28 @@ enum dpll_pin_state { DPLL_PIN_STATE_MAX = (__DPLL_PIN_STATE_MAX - 1) }; +/** + * enum dpll_pin_operstate - defines possible operational states of a pin with + * respect to its parent DPLL device, valid values for DPLL_A_PIN_OPERSTATE + * attribute + * @DPLL_PIN_OPERSTATE_ACTIVE: pin is qualified and actively used by the DPLL + * @DPLL_PIN_OPERSTATE_STANDBY: pin is qualified but not actively used by the + * DPLL + * @DPLL_PIN_OPERSTATE_NO_SIGNAL: pin does not have a valid signal + * @DPLL_PIN_OPERSTATE_QUAL_FAILED: pin signal failed qualification (e.g. + * frequency or phase monitor) + */ +enum dpll_pin_operstate { + DPLL_PIN_OPERSTATE_ACTIVE = 1, + DPLL_PIN_OPERSTATE_STANDBY, + DPLL_PIN_OPERSTATE_NO_SIGNAL, + DPLL_PIN_OPERSTATE_QUAL_FAILED, + + /* private: */ + __DPLL_PIN_OPERSTATE_MAX, + DPLL_PIN_OPERSTATE_MAX = (__DPLL_PIN_OPERSTATE_MAX - 1) +}; + /** * enum dpll_pin_capabilities - defines possible capabilities of a pin, valid * flags on DPLL_A_PIN_CAPABILITIES attribute @@ -257,6 +279,7 @@ enum dpll_a_pin { DPLL_A_PIN_PHASE_ADJUST_GRAN, DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, DPLL_A_PIN_MEASURED_FREQUENCY, + DPLL_A_PIN_OPERSTATE, __DPLL_A_PIN_MAX, DPLL_A_PIN_MAX = (__DPLL_A_PIN_MAX - 1) -- cgit v1.2.3 From cc07b903a646bf6592182b27c63457d92f128125 Mon Sep 17 00:00:00 2001 From: Koichiro Den Date: Tue, 14 Apr 2026 23:15:08 +0900 Subject: PCI: endpoint: Add auxiliary resource query API Endpoint controller drivers may integrate auxiliary blocks (e.g. DMA engines) whose register windows and descriptor memories metadata need to be exposed to a remote peer. Endpoint function drivers need a generic way to discover such resources without hard-coding controller-specific helpers. Add pci_epc_get_aux_resources_count() / pci_epc_get_aux_resources() and the corresponding pci_epc_ops callbacks. The count helper returns the number of available resources, while the get helper fills a caller-provided array of resources described by type, physical address and size, plus type-specific metadata. Suggested-by: Manivannan Sadhasivam Suggested-by: Frank Li Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260414141514.1341429-2-den@valinux.co.jp --- include/linux/pci-epc.h | 54 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) (limited to 'include') diff --git a/include/linux/pci-epc.h b/include/linux/pci-epc.h index 1eca1264815b..f247cf9bcf1a 100644 --- a/include/linux/pci-epc.h +++ b/include/linux/pci-epc.h @@ -61,6 +61,47 @@ struct pci_epc_map { void __iomem *virt_addr; }; +/** + * enum pci_epc_aux_resource_type - auxiliary resource type identifiers + * @PCI_EPC_AUX_DOORBELL_MMIO: Doorbell MMIO, that might be outside the DMA + * controller register window + * + * EPC backends may expose auxiliary blocks (e.g. DMA engines) by mapping their + * register windows and descriptor memories into BAR space. This enum + * identifies the type of each exposable resource. + */ +enum pci_epc_aux_resource_type { + PCI_EPC_AUX_DOORBELL_MMIO, +}; + +/** + * struct pci_epc_aux_resource - a physical auxiliary resource that may be + * exposed for peer use + * @type: resource type, see enum pci_epc_aux_resource_type + * @phys_addr: physical base address of the resource + * @size: size of the resource in bytes + * @bar: BAR number where this resource is already exposed to the RC + * (NO_BAR if not) + * @bar_offset: offset within @bar where the resource starts (valid iff + * @bar != NO_BAR) + * @u: type-specific metadata + */ +struct pci_epc_aux_resource { + enum pci_epc_aux_resource_type type; + phys_addr_t phys_addr; + resource_size_t size; + enum pci_barno bar; + resource_size_t bar_offset; + + union { + /* PCI_EPC_AUX_DOORBELL_MMIO */ + struct { + int irq; /* IRQ number for the doorbell handler */ + u32 data; /* write value to ring the doorbell */ + } db_mmio; + } u; +}; + /** * struct pci_epc_ops - set of function pointers for performing EPC operations * @write_header: ops to populate configuration space header @@ -84,6 +125,9 @@ struct pci_epc_map { * @start: ops to start the PCI link * @stop: ops to stop the PCI link * @get_features: ops to get the features supported by the EPC + * @get_aux_resources_count: ops to get the number of controller-owned + * auxiliary resources + * @get_aux_resources: ops to retrieve controller-owned auxiliary resources * @owner: the module owner containing the ops */ struct pci_epc_ops { @@ -115,6 +159,11 @@ struct pci_epc_ops { void (*stop)(struct pci_epc *epc); const struct pci_epc_features* (*get_features)(struct pci_epc *epc, u8 func_no, u8 vfunc_no); + int (*get_aux_resources_count)(struct pci_epc *epc, u8 func_no, + u8 vfunc_no); + int (*get_aux_resources)(struct pci_epc *epc, u8 func_no, u8 vfunc_no, + struct pci_epc_aux_resource *resources, + int num_resources); struct module *owner; }; @@ -343,6 +392,11 @@ int pci_epc_start(struct pci_epc *epc); void pci_epc_stop(struct pci_epc *epc); const struct pci_epc_features *pci_epc_get_features(struct pci_epc *epc, u8 func_no, u8 vfunc_no); +int pci_epc_get_aux_resources_count(struct pci_epc *epc, u8 func_no, + u8 vfunc_no); +int pci_epc_get_aux_resources(struct pci_epc *epc, u8 func_no, u8 vfunc_no, + struct pci_epc_aux_resource *resources, + int num_resources); enum pci_barno pci_epc_get_first_free_bar(const struct pci_epc_features *epc_features); enum pci_barno pci_epc_get_next_free_bar(const struct pci_epc_features -- cgit v1.2.3 From a3a079e5c5b7748f206c4baeb92593f9eca3184a Mon Sep 17 00:00:00 2001 From: Koichiro Den Date: Tue, 14 Apr 2026 23:15:11 +0900 Subject: PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends Prepare pci-ep-msi for non-MSI doorbell backends. Factor MSI doorbell allocation into a helper and extend struct pci_epf_doorbell_msg with: - irq_flags: required IRQ request flags (e.g. IRQF_SHARED for some backends) - type: doorbell backend type - bar/offset: pre-exposed doorbell target location, if any Initialize these fields for the existing MSI-backed doorbell implementation. Also add PCI_EPF_DOORBELL_EMBEDDED type, which is to be implemented in a follow-up patch. No functional changes. Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Tested-by: Niklas Cassel Reviewed-by: Frank Li Link: https://patch.msgid.link/20260414141514.1341429-5-den@valinux.co.jp --- include/linux/pci-epf.h | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/pci-epf.h b/include/linux/pci-epf.h index 7737a7c03260..cd747447a1ea 100644 --- a/include/linux/pci-epf.h +++ b/include/linux/pci-epf.h @@ -152,14 +152,33 @@ struct pci_epf_bar { struct pci_epf_bar_submap *submap; }; +enum pci_epf_doorbell_type { + PCI_EPF_DOORBELL_MSI = 0, + PCI_EPF_DOORBELL_EMBEDDED, +}; + /** * struct pci_epf_doorbell_msg - represents doorbell message - * @msg: MSI message - * @virq: IRQ number of this doorbell MSI message + * @msg: Doorbell address/data pair to be mapped into BAR space. + * For MSI-backed doorbells this is the MSI message, while for + * "embedded" doorbells this represents an MMIO write that asserts + * an interrupt on the EP side. + * @virq: IRQ number of this doorbell message + * @irq_flags: Required flags for request_irq()/request_threaded_irq(). + * Callers may OR-in additional flags (e.g. IRQF_ONESHOT). + * @type: Doorbell type. + * @bar: BAR number where the doorbell target is already exposed to the RC + * (NO_BAR if not) + * @offset: offset within @bar for the doorbell target (valid iff + * @bar != NO_BAR) */ struct pci_epf_doorbell_msg { struct msi_msg msg; int virq; + unsigned long irq_flags; + enum pci_epf_doorbell_type type; + enum pci_barno bar; + resource_size_t offset; }; /** -- cgit v1.2.3 From a48df51d23138388900995add2854cda4aa68e55 Mon Sep 17 00:00:00 2001 From: Tanmay Shah Date: Tue, 28 Apr 2026 15:18:56 -0700 Subject: remoteproc: xlnx: Check remote core state The remote state is set to RPROC_DETACHED if the resource table is found in the memory. However, this can be wrong if the remote is not started, but firmware is still loaded in the memory. Use PM_GET_NODE_STATUS call to the firmware to request the state of the RPU node. If the RPU is actually out of reset and running, only then move the remote state to RPROC_DETACHED, otherwise keep the remote state to RPROC_OFFLINE. Signed-off-by: Tanmay Shah Fixes: bca4b02ef92e ("remoteproc: xlnx: Add attach detach support") Reviewed-by: Beleswar Padhi Acked-by: Michal Simek Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260428221855.313752-1-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier --- include/linux/firmware/xlnx-zynqmp.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'include') diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h index d70dcd462b44..7e27b0f7bf7e 100644 --- a/include/linux/firmware/xlnx-zynqmp.h +++ b/include/linux/firmware/xlnx-zynqmp.h @@ -542,6 +542,18 @@ enum pm_gem_config_type { GEM_CONFIG_FIXED = 2, }; +/** + * enum pm_node_status - Device node status provided by xilpm fw + * @PM_NODE_UNUSED: Device is not used + * @PM_NODE_RUNNING: Device is power-on and out of reset + * @PM_NODE_HALT: Device is power-on but in the reset state + */ +enum pm_node_status { + PM_NODE_UNUSED = 0, + PM_NODE_RUNNING = 1, + PM_NODE_HALT = 12, +}; + /** * struct zynqmp_pm_query_data - PM query data * @qid: query ID @@ -630,6 +642,8 @@ int zynqmp_pm_set_rpu_mode(u32 node_id, enum rpu_oper_mode rpu_mode); int zynqmp_pm_set_tcm_config(u32 node_id, enum rpu_tcm_comb tcm_mode); int zynqmp_pm_get_node_status(const u32 node, u32 *const status, u32 *const requirements, u32 *const usage); +int zynqmp_pm_get_rpu_node_status(const u32 node, u32 *const status, + u32 *const requirements, u32 *const usage); int zynqmp_pm_set_sd_config(u32 node, enum pm_sd_config_type config, u32 value); int zynqmp_pm_set_gem_config(u32 node, enum pm_gem_config_type config, u32 value); @@ -939,6 +953,13 @@ static inline int zynqmp_pm_get_node_status(const u32 node, u32 *const status, return -ENODEV; } +static inline int zynqmp_pm_get_rpu_node_status(const u32 node, u32 *const status, + u32 *const requirements, + u32 *const usage) +{ + return -ENODEV; +} + static inline int zynqmp_pm_set_sd_config(u32 node, enum pm_sd_config_type config, u32 value) -- cgit v1.2.3 From 4b0a32016347bfd6ae9849f21b1b767905f68d14 Mon Sep 17 00:00:00 2001 From: Siew Chin Lim Date: Mon, 6 Sep 2021 09:46:21 +0800 Subject: firmware: stratix10-svc: change get provision data to async SMC call Change INTEL_SIP_SMC_FCS_GET_PROVISION_DATA's SMC call to async from sync to avoid long runtime which may cause the watchdog timeout issue. Signed-off-by: Richard Gong Signed-off-by: Siew Chin Lim Signed-off-by: Dinh Nguyen --- include/linux/firmware/intel/stratix10-smc.h | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/firmware/intel/stratix10-smc.h b/include/linux/firmware/intel/stratix10-smc.h index 935dba3633b5..36ea619ea2ad 100644 --- a/include/linux/firmware/intel/stratix10-smc.h +++ b/include/linux/firmware/intel/stratix10-smc.h @@ -605,25 +605,21 @@ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE) /** * Request INTEL_SIP_SMC_FCS_GET_PROVISION_DATA - * Sync call to dump all the fuses and key hashes + * Async call to dump all the fuses and key hashes * * Call register usage: * a0 INTEL_SIP_SMC_FCS_GET_PROVISION_DATA - * a1 the physical address for firmware to write structure of fuse and - * key hashes - * a2-a7 not used + * a1-a7 not used * * Return status: * a0 INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FCS_ERROR or * INTEL_SIP_SMC_FCS_REJECTED - * a1 mailbox error - * a2 physical address for the structure of fuse and key hashes - * a3 the size of structure + * a1-a3 not used * */ #define INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA 94 #define INTEL_SIP_SMC_FCS_GET_PROVISION_DATA \ - INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA) + INTEL_SIP_SMC_STD_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA) /** * Request INTEL_SIP_SMC_HWMON_READTEMP -- cgit v1.2.3 From f71ece9712b7712df98871eea9aeb60e49ca5239 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Mon, 28 Apr 2025 15:50:19 -0400 Subject: security,fs,nfs,net: update security_inode_listsecurity() interface Update the security_inode_listsecurity() interface to allow use of the xattr_list_one() helper and update the hook implementations. Link: https://lore.kernel.org/selinux/20250424152822.2719-1-stephen.smalley.work@gmail.com Signed-off-by: Stephen Smalley [PM: forward porting to bring this patch up to v7.1-rc1+] Signed-off-by: Paul Moore --- include/linux/lsm_hook_defs.h | 4 ++-- include/linux/security.h | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 2b8dfb35caed..65c9609ec207 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -176,8 +176,8 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_getsecurity, struct mnt_idmap *idmap, struct inode *inode, const char *name, void **buffer, bool alloc) LSM_HOOK(int, -EOPNOTSUPP, inode_setsecurity, struct inode *inode, const char *name, const void *value, size_t size, int flags) -LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, - size_t buffer_size) +LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char **buffer, + ssize_t *remaining_size) LSM_HOOK(void, LSM_RET_VOID, inode_getlsmprop, struct inode *inode, struct lsm_prop *prop) LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) diff --git a/include/linux/security.h b/include/linux/security.h index 41d7367cf403..153e9043058f 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -459,7 +459,7 @@ int security_inode_getsecurity(struct mnt_idmap *idmap, struct inode *inode, const char *name, void **buffer, bool alloc); int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags); -int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size); +int security_inode_listsecurity(struct inode *inode, char **buffer, ssize_t *remaining_size); void security_inode_getlsmprop(struct inode *inode, struct lsm_prop *prop); int security_inode_copy_up(struct dentry *src, struct cred **new); int security_inode_copy_up_xattr(struct dentry *src, const char *name); @@ -1097,7 +1097,8 @@ static inline int security_inode_setsecurity(struct inode *inode, const char *na return -EOPNOTSUPP; } -static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) +static inline int security_inode_listsecurity(struct inode *inode, + char **buffer, ssize_t *remaining_size) { return 0; } -- cgit v1.2.3 From bd5956166d20adbde3af0f6f265dc2f0ce5f4df9 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Wed, 8 Apr 2026 13:53:46 +0200 Subject: hrtimer: Provide hrtimer_start_range_ns_user() Calvin reported an odd NMI watchdog lockup which claims that the CPU locked up in user space. He provided a reproducer, which set's up a timerfd based timer and then rearms it in a loop with an absolute expiry time of 1ns. As the expiry time is in the past, the timer ends up as the first expiring timer in the per CPU hrtimer base and the clockevent device is programmed with the minimum delta value. If the machine is fast enough, this ends up in a endless loop of programming the delta value to the minimum value defined by the clock event device, before the timer interrupt can fire, which starves the interrupt and consequently triggers the lockup detector because the hrtimer callback of the lockup mechanism is never invoked. The clockevents code already has a last resort mechanism to prevent that, but it's sensible to catch such issues before trying to reprogram the clock event device. Provide a variant of hrtimer_start_range_ns(), which sanity checks the timer after queueing it. It does not so before because the timer might be armed and therefore needs to be dequeued. also we optimize for the latest possible point to check, so that the clock event prevention is avoided as much as possible. If the timer is already expired _before_ the clock event is reprogrammed, remove the timer from the queue and signal to the caller that the operation failed by returning false. That allows the caller to take immediate action without going through the loops and hoops of the hrtimer interrupt. The queueing code can't invoke the timer callback as the caller might hold a lock which is taken in the callback. Add a tracepoint which allows to analyze the expired at start situation. Reported-by: Calvin Owens Signed-off-by: Thomas Gleixner Tested-by: Calvin Owens Reviewed-by: Frederic Weisbecker Acked-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260408114951.995031895@kernel.org --- include/linux/hrtimer.h | 20 +++++++++++++++++--- include/trace/events/timer.h | 13 +++++++++++++ 2 files changed, 30 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 9ced498fefaa..66cc98c773cf 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -206,6 +206,9 @@ static inline void destroy_hrtimer_on_stack(struct hrtimer *timer) { } extern void hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, u64 range_ns, const enum hrtimer_mode mode); +extern bool hrtimer_start_range_ns_user(struct hrtimer *timer, ktime_t tim, + u64 range_ns, const enum hrtimer_mode mode); + /** * hrtimer_start - (re)start an hrtimer * @timer: the timer to be added @@ -223,17 +226,28 @@ static inline void hrtimer_start(struct hrtimer *timer, ktime_t tim, extern int hrtimer_cancel(struct hrtimer *timer); extern int hrtimer_try_to_cancel(struct hrtimer *timer); -static inline void hrtimer_start_expires(struct hrtimer *timer, - enum hrtimer_mode mode) +static inline void hrtimer_start_expires(struct hrtimer *timer, enum hrtimer_mode mode) { - u64 delta; ktime_t soft, hard; + u64 delta; + soft = hrtimer_get_softexpires(timer); hard = hrtimer_get_expires(timer); delta = ktime_to_ns(ktime_sub(hard, soft)); hrtimer_start_range_ns(timer, soft, delta, mode); } +static inline bool hrtimer_start_expires_user(struct hrtimer *timer, enum hrtimer_mode mode) +{ + ktime_t soft, hard; + u64 delta; + + soft = hrtimer_get_softexpires(timer); + hard = hrtimer_get_expires(timer); + delta = ktime_to_ns(ktime_sub(hard, soft)); + return hrtimer_start_range_ns_user(timer, soft, delta, mode); +} + void hrtimer_sleeper_start_expires(struct hrtimer_sleeper *sl, enum hrtimer_mode mode); diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h index 07cbb9836b91..ca82fd62dc30 100644 --- a/include/trace/events/timer.h +++ b/include/trace/events/timer.h @@ -298,6 +298,19 @@ DECLARE_EVENT_CLASS(hrtimer_class, TP_printk("hrtimer=%p", __entry->hrtimer) ); +/** + * hrtimer_start_expired - Invoked when a expired timer was started + * @hrtimer: pointer to struct hrtimer + * + * Preceeded by a hrtimer_start tracepoint. + */ +DEFINE_EVENT(hrtimer_class, hrtimer_start_expired, + + TP_PROTO(struct hrtimer *hrtimer), + + TP_ARGS(hrtimer) +); + /** * hrtimer_expire_exit - called immediately after the hrtimer callback returns * @hrtimer: pointer to struct hrtimer -- cgit v1.2.3 From 183d00b727139cf3b4be78d66a5602ce71a3acec Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Wed, 8 Apr 2026 13:54:11 +0200 Subject: alarmtimer: Provide alarm_start_timer() Alarm timers utilize hrtimers for normal operation and only switch to the RTC on suspend. In order to catch already expired timers early and without going through a timer interrupt cycle, provide a new start function which internally uses hrtimer_start_range_ns_user(). If hrtimer_start_range_ns_user() detects an already expired timer, it does not queue it. In that case remove the timer from the alarm base as well. Return the status queued or not back to the caller to handle the early expiry. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Acked-by: John Stultz Link: https://patch.msgid.link/20260408114952.332822525@kernel.org --- include/linux/alarmtimer.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/alarmtimer.h b/include/linux/alarmtimer.h index 3ffa5341dce2..14d729fe0fd6 100644 --- a/include/linux/alarmtimer.h +++ b/include/linux/alarmtimer.h @@ -42,8 +42,14 @@ struct alarm { void *data; }; +static __always_inline ktime_t alarm_get_expires(struct alarm *alarm) +{ + return alarm->node.expires; +} + void alarm_init(struct alarm *alarm, enum alarmtimer_type type, void (*function)(struct alarm *, ktime_t)); +bool alarm_start_timer(struct alarm *alarm, ktime_t expires, bool relative); void alarm_start(struct alarm *alarm, ktime_t start); void alarm_start_relative(struct alarm *alarm, ktime_t start); void alarm_restart(struct alarm *alarm); -- cgit v1.2.3 From ed78a701941999635389c41ddd638e8e7ea2470f Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Wed, 8 Apr 2026 13:54:33 +0200 Subject: alarmtimer: Remove unused interfaces All alarmtimer users are converted to alarm_start_timer(). Remove the now unused interfaces. Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://patch.msgid.link/20260408114952.670899355@kernel.org --- include/linux/alarmtimer.h | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/linux/alarmtimer.h b/include/linux/alarmtimer.h index 14d729fe0fd6..2014288ca2f4 100644 --- a/include/linux/alarmtimer.h +++ b/include/linux/alarmtimer.h @@ -50,9 +50,6 @@ static __always_inline ktime_t alarm_get_expires(struct alarm *alarm) void alarm_init(struct alarm *alarm, enum alarmtimer_type type, void (*function)(struct alarm *, ktime_t)); bool alarm_start_timer(struct alarm *alarm, ktime_t expires, bool relative); -void alarm_start(struct alarm *alarm, ktime_t start); -void alarm_start_relative(struct alarm *alarm, ktime_t start); -void alarm_restart(struct alarm *alarm); int alarm_try_to_cancel(struct alarm *alarm); int alarm_cancel(struct alarm *alarm); -- cgit v1.2.3 From 93cda0c120acdfd717a66edfaf031942450d4908 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Wed, 29 Apr 2026 16:55:45 +0200 Subject: net: cs89x0: remove ISA bus probing The cs89x0 driver is really two in one, and they are mutually exclusive: - the ISA driver was used on 486-era PCs. It likely has no remaining users, like the other ethernet drivers that got removed in linux-7.1. The DMA support in here is the last device driver use of the deprecated isa_bus_to_virt() interface, all other users are either x86 specific or or got converted to the normal dma-mapping interface. The driver was maintained by Andrew Morton at the time, based on the linux-2.2 vendor driver from Cirrus Logic. - the platform_driver instance was used on some embedded Arm boards around the same time, such as the EP7211 Development Kit. This is the same chip, but uses modern devicetree based probing and no DMA. This was added by Alexander Shiyan. Remove the ISA driver as a cleanup, including all of the outdated documentation referring to its configuration. Cc: Andrew Morton Signed-off-by: Arnd Bergmann Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260429145624.2948432-1-arnd@kernel.org Signed-off-by: Jakub Kicinski --- include/net/Space.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/net/Space.h b/include/net/Space.h index 6a0b6674d930..1b9ab0da5a03 100644 --- a/include/net/Space.h +++ b/include/net/Space.h @@ -4,4 +4,3 @@ */ struct net_device *ne_probe(int unit); -struct net_device *cs89x0_probe(int unit); -- cgit v1.2.3 From 4fe18ddd17d842f140312b55d3a0753601613cb8 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Wed, 29 Apr 2026 16:55:46 +0200 Subject: ne2k: fold drivers/net/Space.c into ne.c drivers/net/Space.c is the last remnant of the linux-2.4.x driver model that required each subsystem and device driver init function to be called from init/main.c explicitly, before the introduction of initcall levels. In linux-7.0, this was only used for a handful of ISA network drivers, with the ne2000 driver being the last one. Fold the code into ne.c directly, with minimal changes to preserve the existing command line parsing. Signed-off-by: Arnd Bergmann Acked-by: Geert Uytterhoeven # m68k Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260429145624.2948432-2-arnd@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 1 - include/net/Space.h | 6 ------ 2 files changed, 7 deletions(-) delete mode 100644 include/net/Space.h (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 0e1e581efc5a..744ffa243501 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -3378,7 +3378,6 @@ static inline struct net_device *first_net_device(struct net *net) net_device_entry(net->dev_base_head.next); } -int netdev_boot_setup_check(struct net_device *dev); struct net_device *dev_getbyhwaddr(struct net *net, unsigned short type, const char *hwaddr); struct net_device *dev_getbyhwaddr_rcu(struct net *net, unsigned short type, diff --git a/include/net/Space.h b/include/net/Space.h deleted file mode 100644 index 1b9ab0da5a03..000000000000 --- a/include/net/Space.h +++ /dev/null @@ -1,6 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* A unified ethernet device probe. This is the easiest way to have every - * ethernet adaptor have the name "eth[0123...]". - */ - -struct net_device *ne_probe(int unit); -- cgit v1.2.3 From 9f810527a343fd72671fe7661ebb3694396f45ed Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 30 Apr 2026 10:00:17 +0000 Subject: tcp: move tp->delivered and tp->delivered_ce to tcp_sock_write_tx group These counters are changed whenever sent data is acknowleged. They do not belong to tcp_sock_write_txrx group, because TCP receivers do not touch them. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260430100021.211139-2-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/tcp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/tcp.h b/include/linux/tcp.h index 6982f10e826b..3e20bffd6ae9 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -259,6 +259,8 @@ struct tcp_sock { u32 data_segs_out; /* RFC4898 tcpEStatsPerfDataSegsOut * total number of data segments sent. */ + u32 delivered; /* Total data packets delivered incl. rexmits */ + u32 delivered_ce; /* Like the above but only ECE marked packets */ u64 bytes_sent; /* RFC4898 tcpEStatsPerfHCDataOctetsOut * total number of data bytes sent. */ @@ -307,8 +309,6 @@ struct tcp_sock { u32 srtt_us; /* smoothed round trip time << 3 in usecs */ u32 packets_out; /* Packets which are "in flight" */ u32 snd_up; /* Urgent pointer */ - u32 delivered; /* Total data packets delivered incl. rexmits */ - u32 delivered_ce; /* Like the above but only ECE marked packets */ u32 received_ce; /* Like the above but for rcvd CE marked pkts */ u32 received_ecn_bytes[3]; /* received byte counters for three ECN * types: INET_ECN_ECT_1, INET_ECN_ECT_0, -- cgit v1.2.3 From 2b28dd212a8ad67b100137626a3d008b1e40a740 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 30 Apr 2026 10:00:18 +0000 Subject: tcp: move tp->segs_in and tp->segs_out to tcp_sock_write_txrx group segs_in is changed for each incoming packet, including ACK packets. segs_out is changed for each outgoing packet, including ACK packets. They belong to tcp_sock_write_txrx group. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260430100021.211139-3-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/tcp.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/linux/tcp.h b/include/linux/tcp.h index 3e20bffd6ae9..89013be1519a 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -253,17 +253,14 @@ struct tcp_sock { /* TX read-write hotpath cache lines */ __cacheline_group_begin(tcp_sock_write_tx) ____cacheline_aligned; - u32 segs_out; /* RFC4898 tcpEStatsPerfSegsOut - * The total number of segments sent. - */ - u32 data_segs_out; /* RFC4898 tcpEStatsPerfDataSegsOut - * total number of data segments sent. - */ u32 delivered; /* Total data packets delivered incl. rexmits */ u32 delivered_ce; /* Like the above but only ECE marked packets */ u64 bytes_sent; /* RFC4898 tcpEStatsPerfHCDataOctetsOut * total number of data bytes sent. */ + u32 data_segs_out; /* RFC4898 tcpEStatsPerfDataSegsOut + * total number of data segments sent. + */ u32 snd_sml; /* Last byte of the most recently transmitted small packet */ u8 chrono_type; /* current chronograph type */ u32 chrono_start; /* Start time in jiffies of a TCP chrono */ @@ -324,6 +321,12 @@ struct tcp_sock { * Options received (usually on last packet, some only on SYN packets). */ struct tcp_options_received rx_opt; + u32 segs_in; /* RFC4898 tcpEStatsPerfSegsIn + * total number of segments in. + */ + u32 segs_out; /* RFC4898 tcpEStatsPerfSegsOut + * The total number of segments sent. + */ __cacheline_group_end(tcp_sock_write_txrx); /* RX read-write hotpath cache lines */ @@ -333,9 +336,6 @@ struct tcp_sock { * sum(delta(rcv_nxt)), or how many bytes * were acked. */ - u32 segs_in; /* RFC4898 tcpEStatsPerfSegsIn - * total number of segments in. - */ u32 data_segs_in; /* RFC4898 tcpEStatsPerfDataSegsIn * total number of data segments in. */ -- cgit v1.2.3 From 07db42c4b3eb60a21645ad88211b69933eab0a03 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 30 Apr 2026 10:00:19 +0000 Subject: tcp: move tp->first_tx_mstamp and tp->delivered_mstamp to tcp_sock_write_tx These fields are touched in when payload is sent. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260430100021.211139-4-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/tcp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/tcp.h b/include/linux/tcp.h index 89013be1519a..e9adc88b73b4 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -258,6 +258,8 @@ struct tcp_sock { u64 bytes_sent; /* RFC4898 tcpEStatsPerfHCDataOctetsOut * total number of data bytes sent. */ + u64 first_tx_mstamp; /* start of window send phase */ + u64 delivered_mstamp; /* time we reached "delivered" */ u32 data_segs_out; /* RFC4898 tcpEStatsPerfDataSegsOut * total number of data segments sent. */ @@ -347,8 +349,6 @@ struct tcp_sock { u32 rcv_rtt_last_tsecr; u32 delivered_ecn_bytes[3]; u16 pkts_acked_ewma;/* Pkts acked EWMA for AccECN cep heuristic */ - u64 first_tx_mstamp; /* start of window send phase */ - u64 delivered_mstamp; /* time we reached "delivered" */ u64 bytes_acked; /* RFC4898 tcpEStatsAppHCThruOctetsAcked * sum(delta(snd_una)), or how many bytes * were acked. -- cgit v1.2.3 From dd033ec406b4d9eade3e0fd998ec9bfa50db42ba Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 30 Apr 2026 10:00:20 +0000 Subject: tcp: move tp->bytes_acked to tcp_sock_write_tx group tp->bytes_acked is touched in TX path only. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260430100021.211139-5-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/tcp.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/tcp.h b/include/linux/tcp.h index e9adc88b73b4..d3650f04d942 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -255,6 +255,10 @@ struct tcp_sock { __cacheline_group_begin(tcp_sock_write_tx) ____cacheline_aligned; u32 delivered; /* Total data packets delivered incl. rexmits */ u32 delivered_ce; /* Like the above but only ECE marked packets */ + u64 bytes_acked; /* RFC4898 tcpEStatsAppHCThruOctetsAcked + * sum(delta(snd_una)), or how many bytes + * were acked. + */ u64 bytes_sent; /* RFC4898 tcpEStatsPerfHCDataOctetsOut * total number of data bytes sent. */ @@ -349,10 +353,6 @@ struct tcp_sock { u32 rcv_rtt_last_tsecr; u32 delivered_ecn_bytes[3]; u16 pkts_acked_ewma;/* Pkts acked EWMA for AccECN cep heuristic */ - u64 bytes_acked; /* RFC4898 tcpEStatsAppHCThruOctetsAcked - * sum(delta(snd_una)), or how many bytes - * were acked. - */ struct { u32 rtt_us; u32 seq; -- cgit v1.2.3 From affe6c27651a359cf69c15b33b86e4d3f226010e Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 30 Apr 2026 10:00:21 +0000 Subject: tcp: move max_packets_out, cwnd_usage_seq, rate_delivered and rate_interval_us to tcp_sock_write_tx group These fields are used in TX path. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260430100021.211139-6-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/tcp.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/tcp.h b/include/linux/tcp.h index d3650f04d942..8a6807082672 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -276,6 +276,10 @@ struct tcp_sock { u32 lsndtime; /* timestamp of last sent data packet (for restart window) */ u32 mdev_us; /* medium deviation */ u32 rtt_seq; /* sequence number to update rttvar */ + u32 max_packets_out; /* max packets_out in last window */ + u32 cwnd_usage_seq; /* right edge of cwnd usage tracking flight */ + u32 rate_delivered; /* saved rate sample: packets delivered */ + u32 rate_interval_us; /* saved rate sample: time elapsed */ u64 tcp_wstamp_ns; /* departure time for next sent data packet */ u64 accecn_opt_tstamp; /* Last AccECN option sent timestamp */ struct list_head tsorted_sent_queue; /* time-sorted sent but un-SACKed skbs */ @@ -346,10 +350,6 @@ struct tcp_sock { * total number of data segments in. */ u32 rcv_wup; /* rcv_nxt on last window update sent */ - u32 max_packets_out; /* max packets_out in last window */ - u32 cwnd_usage_seq; /* right edge of cwnd usage tracking flight */ - u32 rate_delivered; /* saved rate sample: packets delivered */ - u32 rate_interval_us; /* saved rate sample: time elapsed */ u32 rcv_rtt_last_tsecr; u32 delivered_ecn_bytes[3]; u16 pkts_acked_ewma;/* Pkts acked EWMA for AccECN cep heuristic */ -- cgit v1.2.3 From 3b16155425af46ac89c6cc676db0ca1ec4c4ab85 Mon Sep 17 00:00:00 2001 From: Nimrod Oren Date: Wed, 29 Apr 2026 23:14:28 +0300 Subject: net/mlx5: add frag buf pools create/destroy paths Introduce mlx5 DMA pool and pool-page data structures, and add the creation and teardown paths. Each NUMA node owns a set of mlx5_dma_pool instances, each one with a different block size. The sizes are defined as all powers of two starting from MLX5_ADAPTER_PAGE_SHIFT and up to PAGE_SHIFT. Since mlx5_frag_bufs are used to back objects whose sizes are encoded relative to MLX5_ADAPTER_PAGE_SHIFT, a smaller block_shift value cannot be used. Requests larger than PAGE_SIZE continue to be handled as page-sized fragments, as in the existing frag-buf allocation model. Signed-off-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260429201429.223809-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski --- include/linux/mlx5/driver.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index 04b96c5abb57..71f7615ab553 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -558,6 +558,7 @@ enum mlx5_func_type { MLX5_FUNC_TYPE_NUM, }; +struct mlx5_frag_buf_node_pools; struct mlx5_ft_pool; struct mlx5_priv { /* IRQ table valid only for real pci devices PF or VF */ @@ -581,14 +582,16 @@ struct mlx5_priv { struct mlx5_debugfs_entries dbg; - /* start: alloc staff */ + /* start: alloc stuff */ /* protect buffer allocation according to numa node */ struct mutex alloc_mutex; int numa_node; struct mutex pgdir_mutex; struct list_head pgdir_list; - /* end: alloc staff */ + + struct mlx5_frag_buf_node_pools **frag_buf_node_pools; + /* end: alloc stuff */ struct mlx5_adev **adev; int adev_idx; -- cgit v1.2.3 From fbf6f64a4322cfeb0d98f39baf8ce18246dd12c0 Mon Sep 17 00:00:00 2001 From: Nimrod Oren Date: Wed, 29 Apr 2026 23:14:29 +0300 Subject: net/mlx5: use internal dma pools for frag buf alloc Add mlx5_dma_pool alloc/free paths, and wire mlx5_frag_buf allocation and free paths to use them. mlx5_frag_buf_alloc_node() now selects an mlx5_dma_pool to allocate fragments from, instead of directly allocating full coherent pages. mlx5_frag_buf_free() frees from the respective pool. mlx5_dma_pool_alloc() keeps allocation fast by maintaining pages with available indexes at the head of the list, so the common allocation path can take a free index immediately. New backing pages are allocated only when no free index is available. mlx5_dma_pool_free() returns released indexes to the pool and frees a backing page once all of its indexes become free. This avoids keeping fully free pages for the lifetime of the pool and reduces coherent DMA memory footprint. Signed-off-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260429201429.223809-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski --- include/linux/mlx5/driver.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index 71f7615ab553..531ce66fc8ef 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -343,9 +343,11 @@ struct mlx5_cmd_mailbox { struct mlx5_cmd_mailbox *next; }; +struct mlx5_dma_pool_page; struct mlx5_buf_list { void *buf; dma_addr_t map; + struct mlx5_dma_pool_page *frag_page; }; struct mlx5_frag_buf { -- cgit v1.2.3 From 09e4d1298b367051b60d9b0a13b22e7d78e61803 Mon Sep 17 00:00:00 2001 From: David Yang Date: Thu, 30 Apr 2026 19:45:24 +0800 Subject: net: dsa: pass extack to dsa_switch_ops :: port_policer_add() Drivers might have error messages to propagate to user space. Propagate the netlink extack so that they can inform user space in a verbal way of their limitations. Make the according transformations to the two users (sja1105 and felix). Signed-off-by: David Yang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20260430114529.3536911-2-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski --- include/net/dsa.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/dsa.h b/include/net/dsa.h index 8b6d34e8a6f0..4cc67469cf2e 100644 --- a/include/net/dsa.h +++ b/include/net/dsa.h @@ -1122,7 +1122,8 @@ struct dsa_switch_ops { void (*port_mirror_del)(struct dsa_switch *ds, int port, struct dsa_mall_mirror_tc_entry *mirror); int (*port_policer_add)(struct dsa_switch *ds, int port, - const struct flow_action_police *policer); + const struct flow_action_police *policer, + struct netlink_ext_ack *extack); void (*port_policer_del)(struct dsa_switch *ds, int port); int (*port_setup_tc)(struct dsa_switch *ds, int port, enum tc_setup_type type, void *type_data); -- cgit v1.2.3 From 54f63d24ce2025db818dc4bcf602593f0cf81d5d Mon Sep 17 00:00:00 2001 From: Jedrzej Jagielski Date: Thu, 30 Apr 2026 23:37:12 -0700 Subject: ixgbe: E610: add discovering EEE capability Add detecting and parsing EEE device capability. Recently EEE functionality support has been introduced to E610 FW. Currently ixgbe driver has no possibility to detect whether NVM loaded on given adapter supports EEE. There's dedicated device capability element reflecting FW support for given EEE link speed. Reviewed-by: Aleksandr Loktionov Signed-off-by: Jedrzej Jagielski Tested-by: Rinitha S Signed-off-by: Jacob Keller Link: https://patch.msgid.link/20260430-jk-iwl-net-next-2026-04-30-v1-1-6f27ae1cd073@intel.com Signed-off-by: Jakub Kicinski --- include/linux/net/intel/libie/adminq.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/net/intel/libie/adminq.h b/include/linux/net/intel/libie/adminq.h index ab13bd777a28..839114d8975a 100644 --- a/include/linux/net/intel/libie/adminq.h +++ b/include/linux/net/intel/libie/adminq.h @@ -196,6 +196,7 @@ LIBIE_CHECK_STRUCT_LEN(16, libie_aqc_list_caps); #define LIBIE_AQC_BIT_ROCEV2_LAG BIT(0) #define LIBIE_AQC_BIT_SRIOV_LAG BIT(1) #define LIBIE_AQC_BIT_SRIOV_AA_LAG BIT(2) +#define LIBIE_AQC_CAPS_EEE 0x009B #define LIBIE_AQC_CAPS_FLEX10 0x00F1 #define LIBIE_AQC_CAPS_CEM 0x00F2 -- cgit v1.2.3 From 5164f7e7ff8ec7d41065d3862630c2ba09854328 Mon Sep 17 00:00:00 2001 From: Maxime Ripard Date: Mon, 27 Apr 2026 09:02:57 +0200 Subject: drm: Rename struct drm_atomic_state to drm_atomic_commit The KMS framework uses two slightly different definitions for the state concept. For a given object (plane, CRTC, encoder, etc., so drm_$OBJECT_state), the state is the entire state of that object. However, at the device level, drm_atomic_state refers to a state update for a limited number of objects. Thus, drm_atomic_state isn't the entire device state, but only the full state of some objects in that device. This has been an endless source of confusion and thus bugs. We can rename the drm_atomic_state structure to drm_atomic_commit to make it less confusing. This patch was created using: rg -l drm_atomic_state | \ xargs sed -i 's/drm_atomic_state/drm_atomic_commit/g; s/drm_atomic_commit_helper/drm_atomic_state_helper/g' mv drivers/gpu/drm/tests/drm_atomic_state_test.c drivers/gpu/drm/tests/drm_atomic_commit_test.c Acked-by: Simona Vetter Acked-by: Thomas Zimmermann Acked-by: Jani Nikula Reviewed-by: Luca Ceresoli Tested-by: Luca Ceresoli Signed-off-by: Maxime Ripard Signed-off-by: Dave Airlie Link: https://patch.msgid.link/20260427-drm-drm-atomic-update-v4-1-c0e713bfdf25@kernel.org --- include/drm/display/drm_dp_mst_helper.h | 32 +++--- include/drm/display/drm_dp_tunnel.h | 24 ++--- include/drm/display/drm_hdmi_state_helper.h | 6 +- include/drm/drm_atomic.h | 158 ++++++++++++++-------------- include/drm/drm_atomic_helper.h | 78 +++++++------- include/drm/drm_atomic_state_helper.h | 4 +- include/drm/drm_blend.h | 4 +- include/drm/drm_bridge.h | 16 +-- include/drm/drm_colorop.h | 4 +- include/drm/drm_connector.h | 6 +- include/drm/drm_crtc.h | 10 +- include/drm/drm_crtc_helper.h | 4 +- include/drm/drm_damage_helper.h | 2 +- include/drm/drm_kunit_helpers.h | 2 +- include/drm/drm_mipi_dbi.h | 8 +- include/drm/drm_mode_config.h | 38 +++---- include/drm/drm_modeset_helper_vtables.h | 44 ++++---- include/drm/drm_plane.h | 6 +- include/drm/drm_self_refresh_helper.h | 6 +- include/drm/drm_vblank_helper.h | 8 +- 20 files changed, 230 insertions(+), 230 deletions(-) (limited to 'include') diff --git a/include/drm/display/drm_dp_mst_helper.h b/include/drm/display/drm_dp_mst_helper.h index 2cfe1d4bfc96..27658bfb5001 100644 --- a/include/drm/display/drm_dp_mst_helper.h +++ b/include/drm/display/drm_dp_mst_helper.h @@ -916,13 +916,13 @@ void drm_dp_mst_connector_early_unregister(struct drm_connector *connector, struct drm_dp_mst_port *port); struct drm_dp_mst_topology_state * -drm_atomic_get_mst_topology_state(struct drm_atomic_state *state, +drm_atomic_get_mst_topology_state(struct drm_atomic_commit *state, struct drm_dp_mst_topology_mgr *mgr); struct drm_dp_mst_topology_state * -drm_atomic_get_old_mst_topology_state(struct drm_atomic_state *state, +drm_atomic_get_old_mst_topology_state(struct drm_atomic_commit *state, struct drm_dp_mst_topology_mgr *mgr); struct drm_dp_mst_topology_state * -drm_atomic_get_new_mst_topology_state(struct drm_atomic_state *state, +drm_atomic_get_new_mst_topology_state(struct drm_atomic_commit *state, struct drm_dp_mst_topology_mgr *mgr); struct drm_dp_mst_atomic_payload * drm_atomic_get_mst_payload_state(struct drm_dp_mst_topology_state *state, @@ -931,31 +931,31 @@ bool drm_dp_mst_port_downstream_of_parent(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port, struct drm_dp_mst_port *parent); int __must_check -drm_dp_atomic_find_time_slots(struct drm_atomic_state *state, +drm_dp_atomic_find_time_slots(struct drm_atomic_commit *state, struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port, int pbn); -int drm_dp_mst_atomic_enable_dsc(struct drm_atomic_state *state, +int drm_dp_mst_atomic_enable_dsc(struct drm_atomic_commit *state, struct drm_dp_mst_port *port, int pbn, bool enable); int __must_check -drm_dp_mst_add_affected_dsc_crtcs(struct drm_atomic_state *state, +drm_dp_mst_add_affected_dsc_crtcs(struct drm_atomic_commit *state, struct drm_dp_mst_topology_mgr *mgr); int __must_check -drm_dp_atomic_release_time_slots(struct drm_atomic_state *state, +drm_dp_atomic_release_time_slots(struct drm_atomic_commit *state, struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port); -void drm_dp_mst_atomic_wait_for_dependencies(struct drm_atomic_state *state); -int __must_check drm_dp_mst_atomic_setup_commit(struct drm_atomic_state *state); +void drm_dp_mst_atomic_wait_for_dependencies(struct drm_atomic_commit *state); +int __must_check drm_dp_mst_atomic_setup_commit(struct drm_atomic_commit *state); int drm_dp_send_power_updown_phy(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port, bool power_up); int drm_dp_send_query_stream_enc_status(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port, struct drm_dp_query_stream_enc_status_ack_reply *status); -int __must_check drm_dp_mst_atomic_check_mgr(struct drm_atomic_state *state, +int __must_check drm_dp_mst_atomic_check_mgr(struct drm_atomic_commit *state, struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_topology_state *mst_state, struct drm_dp_mst_port **failing_port); -int __must_check drm_dp_mst_atomic_check(struct drm_atomic_state *state); +int __must_check drm_dp_mst_atomic_check(struct drm_atomic_commit *state); int __must_check drm_dp_mst_root_conn_atomic_check(struct drm_connector_state *new_conn_state, struct drm_dp_mst_topology_mgr *mgr); @@ -982,7 +982,7 @@ extern const struct drm_private_state_funcs drm_dp_mst_topology_state_funcs; /** * __drm_dp_mst_state_iter_get - private atomic state iterator function for * macro-internal use - * @state: &struct drm_atomic_state pointer + * @state: &struct drm_atomic_commit pointer * @mgr: pointer to the &struct drm_dp_mst_topology_mgr iteration cursor * @old_state: optional pointer to the old &struct drm_dp_mst_topology_state * iteration cursor @@ -999,7 +999,7 @@ extern const struct drm_private_state_funcs drm_dp_mst_topology_state_funcs; * drm_dp_mst_topology_mgr, false otherwise. */ static inline bool -__drm_dp_mst_state_iter_get(struct drm_atomic_state *state, +__drm_dp_mst_state_iter_get(struct drm_atomic_commit *state, struct drm_dp_mst_topology_mgr **mgr, struct drm_dp_mst_topology_state **old_state, struct drm_dp_mst_topology_state **new_state, @@ -1022,7 +1022,7 @@ __drm_dp_mst_state_iter_get(struct drm_atomic_state *state, /** * for_each_oldnew_mst_mgr_in_state - iterate over all DP MST topology * managers in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @mgr: &struct drm_dp_mst_topology_mgr iteration cursor * @old_state: &struct drm_dp_mst_topology_state iteration cursor for the old * state @@ -1041,7 +1041,7 @@ __drm_dp_mst_state_iter_get(struct drm_atomic_state *state, /** * for_each_old_mst_mgr_in_state - iterate over all DP MST topology managers * in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @mgr: &struct drm_dp_mst_topology_mgr iteration cursor * @old_state: &struct drm_dp_mst_topology_state iteration cursor for the old * state @@ -1058,7 +1058,7 @@ __drm_dp_mst_state_iter_get(struct drm_atomic_state *state, /** * for_each_new_mst_mgr_in_state - iterate over all DP MST topology managers * in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @mgr: &struct drm_dp_mst_topology_mgr iteration cursor * @new_state: &struct drm_dp_mst_topology_state iteration cursor for the new * state diff --git a/include/drm/display/drm_dp_tunnel.h b/include/drm/display/drm_dp_tunnel.h index 87212c847915..6c565c5e66a8 100644 --- a/include/drm/display/drm_dp_tunnel.h +++ b/include/drm/display/drm_dp_tunnel.h @@ -14,7 +14,7 @@ struct drm_dp_aux; struct drm_device; -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_dp_tunnel_mgr; struct drm_dp_tunnel_state; @@ -69,25 +69,25 @@ int drm_dp_tunnel_available_bw(const struct drm_dp_tunnel *tunnel); const char *drm_dp_tunnel_name(const struct drm_dp_tunnel *tunnel); struct drm_dp_tunnel_state * -drm_dp_tunnel_atomic_get_state(struct drm_atomic_state *state, +drm_dp_tunnel_atomic_get_state(struct drm_atomic_commit *state, struct drm_dp_tunnel *tunnel); struct drm_dp_tunnel_state * -drm_dp_tunnel_atomic_get_old_state(struct drm_atomic_state *state, +drm_dp_tunnel_atomic_get_old_state(struct drm_atomic_commit *state, const struct drm_dp_tunnel *tunnel); struct drm_dp_tunnel_state * -drm_dp_tunnel_atomic_get_new_state(struct drm_atomic_state *state, +drm_dp_tunnel_atomic_get_new_state(struct drm_atomic_commit *state, const struct drm_dp_tunnel *tunnel); -int drm_dp_tunnel_atomic_set_stream_bw(struct drm_atomic_state *state, +int drm_dp_tunnel_atomic_set_stream_bw(struct drm_atomic_commit *state, struct drm_dp_tunnel *tunnel, u8 stream_id, int bw); -int drm_dp_tunnel_atomic_get_group_streams_in_state(struct drm_atomic_state *state, +int drm_dp_tunnel_atomic_get_group_streams_in_state(struct drm_atomic_commit *state, const struct drm_dp_tunnel *tunnel, u32 *stream_mask); -int drm_dp_tunnel_atomic_check_stream_bws(struct drm_atomic_state *state, +int drm_dp_tunnel_atomic_check_stream_bws(struct drm_atomic_commit *state, u32 *failed_stream_mask); int drm_dp_tunnel_atomic_get_required_bw(const struct drm_dp_tunnel_state *tunnel_state); @@ -192,21 +192,21 @@ drm_dp_tunnel_name(const struct drm_dp_tunnel *tunnel) } static inline struct drm_dp_tunnel_state * -drm_dp_tunnel_atomic_get_state(struct drm_atomic_state *state, +drm_dp_tunnel_atomic_get_state(struct drm_atomic_commit *state, struct drm_dp_tunnel *tunnel) { return ERR_PTR(-EOPNOTSUPP); } static inline struct drm_dp_tunnel_state * -drm_dp_tunnel_atomic_get_new_state(struct drm_atomic_state *state, +drm_dp_tunnel_atomic_get_new_state(struct drm_atomic_commit *state, const struct drm_dp_tunnel *tunnel) { return ERR_PTR(-EOPNOTSUPP); } static inline int -drm_dp_tunnel_atomic_set_stream_bw(struct drm_atomic_state *state, +drm_dp_tunnel_atomic_set_stream_bw(struct drm_atomic_commit *state, struct drm_dp_tunnel *tunnel, u8 stream_id, int bw) { @@ -214,7 +214,7 @@ drm_dp_tunnel_atomic_set_stream_bw(struct drm_atomic_state *state, } static inline int -drm_dp_tunnel_atomic_get_group_streams_in_state(struct drm_atomic_state *state, +drm_dp_tunnel_atomic_get_group_streams_in_state(struct drm_atomic_commit *state, const struct drm_dp_tunnel *tunnel, u32 *stream_mask) { @@ -222,7 +222,7 @@ drm_dp_tunnel_atomic_get_group_streams_in_state(struct drm_atomic_state *state, } static inline int -drm_dp_tunnel_atomic_check_stream_bws(struct drm_atomic_state *state, +drm_dp_tunnel_atomic_check_stream_bws(struct drm_atomic_commit *state, u32 *failed_stream_mask) { return -EOPNOTSUPP; diff --git a/include/drm/display/drm_hdmi_state_helper.h b/include/drm/display/drm_hdmi_state_helper.h index 2349c0d0f00f..0adc30c55ec9 100644 --- a/include/drm/display/drm_hdmi_state_helper.h +++ b/include/drm/display/drm_hdmi_state_helper.h @@ -3,7 +3,7 @@ #ifndef DRM_HDMI_STATE_HELPER_H_ #define DRM_HDMI_STATE_HELPER_H_ -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_connector; struct drm_connector_state; struct drm_display_mode; @@ -15,13 +15,13 @@ void __drm_atomic_helper_connector_hdmi_reset(struct drm_connector *connector, struct drm_connector_state *new_conn_state); int drm_atomic_helper_connector_hdmi_check(struct drm_connector *connector, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); int drm_atomic_helper_connector_hdmi_update_audio_infoframe(struct drm_connector *connector, struct hdmi_audio_infoframe *frame); int drm_atomic_helper_connector_hdmi_clear_audio_infoframe(struct drm_connector *connector); int drm_atomic_helper_connector_hdmi_update_infoframes(struct drm_connector *connector, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_connector_hdmi_hotplug(struct drm_connector *connector, enum drm_connector_status status); void drm_atomic_helper_connector_hdmi_force(struct drm_connector *connector); diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h index 8883290cd014..1a80a8cdf269 100644 --- a/include/drm/drm_atomic.h +++ b/include/drm/drm_atomic.h @@ -169,9 +169,9 @@ struct __drm_planes_state { * @state_to_destroy: * * Used to track the @drm_plane_state we will need to free when - * tearing down the associated &drm_atomic_state in + * tearing down the associated &drm_atomic_commit in * $drm_mode_config_funcs.atomic_state_clear or - * drm_atomic_state_default_clear(). + * drm_atomic_commit_default_clear(). * * Before a commit, and the call to * drm_atomic_helper_swap_state() in particular, it points to @@ -190,9 +190,9 @@ struct __drm_crtcs_state { * @state_to_destroy: * * Used to track the @drm_crtc_state we will need to free when - * tearing down the associated &drm_atomic_state in + * tearing down the associated &drm_atomic_commit in * $drm_mode_config_funcs.atomic_state_clear or - * drm_atomic_state_default_clear(). + * drm_atomic_commit_default_clear(). * * Before a commit, and the call to * drm_atomic_helper_swap_state() in particular, it points to @@ -224,9 +224,9 @@ struct __drm_connnectors_state { * @state_to_destroy: * * Used to track the @drm_connector_state we will need to free - * when tearing down the associated &drm_atomic_state in + * when tearing down the associated &drm_atomic_commit in * $drm_mode_config_funcs.atomic_state_clear or - * drm_atomic_state_default_clear(). + * drm_atomic_commit_default_clear(). * * Before a commit, and the call to * drm_atomic_helper_swap_state() in particular, it points to @@ -402,9 +402,9 @@ struct drm_private_obj { */ struct drm_private_state { /** - * @state: backpointer to global drm_atomic_state + * @state: backpointer to global drm_atomic_commit */ - struct drm_atomic_state *state; + struct drm_atomic_commit *state; /** * @obj: backpointer to the private object @@ -419,9 +419,9 @@ struct __drm_private_objs_state { * @state_to_destroy: * * Used to track the @drm_private_state we will need to free - * when tearing down the associated &drm_atomic_state in + * when tearing down the associated &drm_atomic_commit in * $drm_mode_config_funcs.atomic_state_clear or - * drm_atomic_state_default_clear(). + * drm_atomic_commit_default_clear(). * * Before a commit, and the call to * drm_atomic_helper_swap_state() in particular, it points to @@ -434,7 +434,7 @@ struct __drm_private_objs_state { }; /** - * struct drm_atomic_state - Atomic commit structure + * struct drm_atomic_commit - Atomic commit structure * * This structure is the kernel counterpart of @drm_mode_atomic and represents * an atomic commit that transitions from an old to a new display state. It @@ -446,25 +446,25 @@ struct __drm_private_objs_state { * drm_atomic_get_plane_state(), drm_atomic_get_connector_state(), or for * private state structures, drm_atomic_get_private_obj_state(). * - * NOTE: struct drm_atomic_state first started as a single collection of + * NOTE: struct drm_atomic_commit first started as a single collection of * entities state pointers (drm_plane_state, drm_crtc_state, etc.). * * At atomic_check time, you could get the state about to be committed - * from drm_atomic_state, and the one currently running from the + * from drm_atomic_commit, and the one currently running from the * entities state pointer (drm_crtc.state, for example). After the call * to drm_atomic_helper_swap_state(), the entities state pointer would - * contain the state previously checked, and the drm_atomic_state + * contain the state previously checked, and the drm_atomic_commit * structure the old state. * - * Over time, and in order to avoid confusion, drm_atomic_state has + * Over time, and in order to avoid confusion, drm_atomic_commit has * grown to have both the old state (ie, the state we replace) and the * new state (ie, the state we want to apply). Those names are stable * during the commit process, which makes it easier to reason about. * * You can still find some traces of that evolution through some hooks - * or callbacks taking a drm_atomic_state parameter called names like + * or callbacks taking a drm_atomic_commit parameter called names like * "old_state". This doesn't necessarily mean that the previous - * drm_atomic_state is passed, but rather that this used to be the state + * drm_atomic_commit is passed, but rather that this used to be the state * collection we were replacing after drm_atomic_helper_swap_state(), * but the variable name was never updated. * @@ -472,12 +472,12 @@ struct __drm_private_objs_state { * first started to pass the entity state only. However, it was pretty * cumbersome for drivers, and especially CRTCs, to retrieve the states * of other components. Thus, we switched to passing the whole - * drm_atomic_state as a parameter to those operations. Similarly, the + * drm_atomic_commit as a parameter to those operations. Similarly, the * transition isn't complete yet, and one might still find atomic - * operations taking a drm_atomic_state pointer, or a component state + * operations taking a drm_atomic_commit pointer, or a component state * pointer. The former is the preferred form. */ -struct drm_atomic_state { +struct drm_atomic_commit { /** * @ref: * @@ -679,61 +679,61 @@ static inline void drm_crtc_commit_put(struct drm_crtc_commit *commit) int drm_crtc_commit_wait(struct drm_crtc_commit *commit); -struct drm_atomic_state * __must_check -drm_atomic_state_alloc(struct drm_device *dev); -void drm_atomic_state_clear(struct drm_atomic_state *state); +struct drm_atomic_commit * __must_check +drm_atomic_commit_alloc(struct drm_device *dev); +void drm_atomic_commit_clear(struct drm_atomic_commit *state); /** - * drm_atomic_state_get - acquire a reference to the atomic state + * drm_atomic_commit_get - acquire a reference to the atomic state * @state: The atomic state * * Returns a new reference to the @state */ -static inline struct drm_atomic_state * -drm_atomic_state_get(struct drm_atomic_state *state) +static inline struct drm_atomic_commit * +drm_atomic_commit_get(struct drm_atomic_commit *state) { kref_get(&state->ref); return state; } -void __drm_atomic_state_free(struct kref *ref); +void __drm_atomic_commit_free(struct kref *ref); /** - * drm_atomic_state_put - release a reference to the atomic state + * drm_atomic_commit_put - release a reference to the atomic state * @state: The atomic state * * This releases a reference to @state which is freed after removing the * final reference. No locking required and callable from any context. */ -static inline void drm_atomic_state_put(struct drm_atomic_state *state) +static inline void drm_atomic_commit_put(struct drm_atomic_commit *state) { - kref_put(&state->ref, __drm_atomic_state_free); + kref_put(&state->ref, __drm_atomic_commit_free); } int __must_check -drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state); -void drm_atomic_state_default_clear(struct drm_atomic_state *state); -void drm_atomic_state_default_release(struct drm_atomic_state *state); +drm_atomic_commit_init(struct drm_device *dev, struct drm_atomic_commit *state); +void drm_atomic_commit_default_clear(struct drm_atomic_commit *state); +void drm_atomic_commit_default_release(struct drm_atomic_commit *state); struct drm_crtc_state * __must_check -drm_atomic_get_crtc_state(struct drm_atomic_state *state, +drm_atomic_get_crtc_state(struct drm_atomic_commit *state, struct drm_crtc *crtc); struct drm_plane_state * __must_check -drm_atomic_get_plane_state(struct drm_atomic_state *state, +drm_atomic_get_plane_state(struct drm_atomic_commit *state, struct drm_plane *plane); struct drm_colorop_state * -drm_atomic_get_colorop_state(struct drm_atomic_state *state, +drm_atomic_get_colorop_state(struct drm_atomic_commit *state, struct drm_colorop *colorop); struct drm_colorop_state * -drm_atomic_get_old_colorop_state(struct drm_atomic_state *state, +drm_atomic_get_old_colorop_state(struct drm_atomic_commit *state, struct drm_colorop *colorop); struct drm_colorop_state * -drm_atomic_get_new_colorop_state(struct drm_atomic_state *state, +drm_atomic_get_new_colorop_state(struct drm_atomic_commit *state, struct drm_colorop *colorop); struct drm_connector_state * __must_check -drm_atomic_get_connector_state(struct drm_atomic_state *state, +drm_atomic_get_connector_state(struct drm_atomic_commit *state, struct drm_connector *connector); int drm_atomic_private_obj_init(struct drm_device *dev, @@ -742,30 +742,30 @@ int drm_atomic_private_obj_init(struct drm_device *dev, void drm_atomic_private_obj_fini(struct drm_private_obj *obj); struct drm_private_state * __must_check -drm_atomic_get_private_obj_state(struct drm_atomic_state *state, +drm_atomic_get_private_obj_state(struct drm_atomic_commit *state, struct drm_private_obj *obj); struct drm_private_state * -drm_atomic_get_old_private_obj_state(const struct drm_atomic_state *state, +drm_atomic_get_old_private_obj_state(const struct drm_atomic_commit *state, struct drm_private_obj *obj); struct drm_private_state * -drm_atomic_get_new_private_obj_state(const struct drm_atomic_state *state, +drm_atomic_get_new_private_obj_state(const struct drm_atomic_commit *state, struct drm_private_obj *obj); struct drm_connector * -drm_atomic_get_old_connector_for_encoder(const struct drm_atomic_state *state, +drm_atomic_get_old_connector_for_encoder(const struct drm_atomic_commit *state, struct drm_encoder *encoder); struct drm_connector * -drm_atomic_get_new_connector_for_encoder(const struct drm_atomic_state *state, +drm_atomic_get_new_connector_for_encoder(const struct drm_atomic_commit *state, struct drm_encoder *encoder); struct drm_connector * drm_atomic_get_connector_for_encoder(const struct drm_encoder *encoder, struct drm_modeset_acquire_ctx *ctx); struct drm_crtc * -drm_atomic_get_old_crtc_for_encoder(struct drm_atomic_state *state, +drm_atomic_get_old_crtc_for_encoder(struct drm_atomic_commit *state, struct drm_encoder *encoder); struct drm_crtc * -drm_atomic_get_new_crtc_for_encoder(struct drm_atomic_state *state, +drm_atomic_get_new_crtc_for_encoder(struct drm_atomic_commit *state, struct drm_encoder *encoder); /** @@ -777,7 +777,7 @@ drm_atomic_get_new_crtc_for_encoder(struct drm_atomic_state *state, * NULL if the CRTC is not part of the global atomic state. */ static inline struct drm_crtc_state * -drm_atomic_get_old_crtc_state(const struct drm_atomic_state *state, +drm_atomic_get_old_crtc_state(const struct drm_atomic_commit *state, struct drm_crtc *crtc) { return state->crtcs[drm_crtc_index(crtc)].old_state; @@ -791,7 +791,7 @@ drm_atomic_get_old_crtc_state(const struct drm_atomic_state *state, * NULL if the CRTC is not part of the global atomic state. */ static inline struct drm_crtc_state * -drm_atomic_get_new_crtc_state(const struct drm_atomic_state *state, +drm_atomic_get_new_crtc_state(const struct drm_atomic_commit *state, struct drm_crtc *crtc) { return state->crtcs[drm_crtc_index(crtc)].new_state; @@ -806,7 +806,7 @@ drm_atomic_get_new_crtc_state(const struct drm_atomic_state *state, * NULL if the plane is not part of the global atomic state. */ static inline struct drm_plane_state * -drm_atomic_get_old_plane_state(const struct drm_atomic_state *state, +drm_atomic_get_old_plane_state(const struct drm_atomic_commit *state, struct drm_plane *plane) { return state->planes[drm_plane_index(plane)].old_state; @@ -821,7 +821,7 @@ drm_atomic_get_old_plane_state(const struct drm_atomic_state *state, * NULL if the plane is not part of the global atomic state. */ static inline struct drm_plane_state * -drm_atomic_get_new_plane_state(const struct drm_atomic_state *state, +drm_atomic_get_new_plane_state(const struct drm_atomic_commit *state, struct drm_plane *plane) { return state->planes[drm_plane_index(plane)].new_state; @@ -836,7 +836,7 @@ drm_atomic_get_new_plane_state(const struct drm_atomic_state *state, * or NULL if the connector is not part of the global atomic state. */ static inline struct drm_connector_state * -drm_atomic_get_old_connector_state(const struct drm_atomic_state *state, +drm_atomic_get_old_connector_state(const struct drm_atomic_commit *state, struct drm_connector *connector) { int index = drm_connector_index(connector); @@ -856,7 +856,7 @@ drm_atomic_get_old_connector_state(const struct drm_atomic_state *state, * or NULL if the connector is not part of the global atomic state. */ static inline struct drm_connector_state * -drm_atomic_get_new_connector_state(const struct drm_atomic_state *state, +drm_atomic_get_new_connector_state(const struct drm_atomic_commit *state, struct drm_connector *connector) { int index = drm_connector_index(connector); @@ -894,7 +894,7 @@ drm_atomic_get_new_connector_state(const struct drm_atomic_state *state, * Read-only pointer to the current plane state. */ static inline const struct drm_plane_state * -__drm_atomic_get_current_plane_state(const struct drm_atomic_state *state, +__drm_atomic_get_current_plane_state(const struct drm_atomic_commit *state, struct drm_plane *plane) { struct drm_plane_state *plane_state; @@ -910,27 +910,27 @@ __drm_atomic_get_current_plane_state(const struct drm_atomic_state *state, } int __must_check -drm_atomic_add_encoder_bridges(struct drm_atomic_state *state, +drm_atomic_add_encoder_bridges(struct drm_atomic_commit *state, struct drm_encoder *encoder); int __must_check -drm_atomic_add_affected_connectors(struct drm_atomic_state *state, +drm_atomic_add_affected_connectors(struct drm_atomic_commit *state, struct drm_crtc *crtc); int __must_check -drm_atomic_add_affected_planes(struct drm_atomic_state *state, +drm_atomic_add_affected_planes(struct drm_atomic_commit *state, struct drm_crtc *crtc); int __must_check -drm_atomic_add_affected_colorops(struct drm_atomic_state *state, +drm_atomic_add_affected_colorops(struct drm_atomic_commit *state, struct drm_plane *plane); -int __must_check drm_atomic_check_only(struct drm_atomic_state *state); -int __must_check drm_atomic_commit(struct drm_atomic_state *state); -int __must_check drm_atomic_nonblocking_commit(struct drm_atomic_state *state); +int __must_check drm_atomic_check_only(struct drm_atomic_commit *state); +int __must_check drm_atomic_commit(struct drm_atomic_commit *state); +int __must_check drm_atomic_nonblocking_commit(struct drm_atomic_commit *state); void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_oldnew_connector_in_state - iterate over all connectors in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @connector: &struct drm_connector iteration cursor * @old_connector_state: &struct drm_connector_state iteration cursor for the * old state @@ -954,7 +954,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_old_connector_in_state - iterate over all connectors in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @connector: &struct drm_connector iteration cursor * @old_connector_state: &struct drm_connector_state iteration cursor for the * old state @@ -975,7 +975,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_new_connector_in_state - iterate over all connectors in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @connector: &struct drm_connector iteration cursor * @new_connector_state: &struct drm_connector_state iteration cursor for the * new state @@ -997,7 +997,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_oldnew_crtc_in_state - iterate over all CRTCs in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @crtc: &struct drm_crtc iteration cursor * @old_crtc_state: &struct drm_crtc_state iteration cursor for the old state * @new_crtc_state: &struct drm_crtc_state iteration cursor for the new state @@ -1021,7 +1021,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_old_crtc_in_state - iterate over all CRTCs in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @crtc: &struct drm_crtc iteration cursor * @old_crtc_state: &struct drm_crtc_state iteration cursor for the old state * @__i: int iteration cursor, for macro-internal use @@ -1041,7 +1041,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_new_crtc_in_state - iterate over all CRTCs in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @crtc: &struct drm_crtc iteration cursor * @new_crtc_state: &struct drm_crtc_state iteration cursor for the new state * @__i: int iteration cursor, for macro-internal use @@ -1062,7 +1062,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_oldnew_colorop_in_state - iterate over all colorops in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @colorop: &struct drm_colorop iteration cursor * @old_colorop_state: &struct drm_colorop_state iteration cursor for the old state * @new_colorop_state: &struct drm_colorop_state iteration cursor for the new state @@ -1085,7 +1085,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_new_colorop_in_state - iterate over all colorops in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @colorop: &struct drm_colorop iteration cursor * @new_colorop_state: &struct drm_colorop_state iteration cursor for the new state * @__i: int iteration cursor, for macro-internal use @@ -1106,7 +1106,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_oldnew_plane_in_state - iterate over all planes in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @plane: &struct drm_plane iteration cursor * @old_plane_state: &struct drm_plane_state iteration cursor for the old state * @new_plane_state: &struct drm_plane_state iteration cursor for the new state @@ -1129,7 +1129,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_oldnew_plane_in_state_reverse - iterate over all planes in an atomic * update in reverse order - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @plane: &struct drm_plane iteration cursor * @old_plane_state: &struct drm_plane_state iteration cursor for the old state * @new_plane_state: &struct drm_plane_state iteration cursor for the new state @@ -1151,7 +1151,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_new_plane_in_state_reverse - other than only tracking new state, * it's the same as for_each_oldnew_plane_in_state_reverse - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @plane: &struct drm_plane iteration cursor * @new_plane_state: &struct drm_plane_state iteration cursor for the new state * @__i: int iteration cursor, for macro-internal use @@ -1166,7 +1166,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_old_plane_in_state - iterate over all planes in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @plane: &struct drm_plane iteration cursor * @old_plane_state: &struct drm_plane_state iteration cursor for the old state * @__i: int iteration cursor, for macro-internal use @@ -1184,7 +1184,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); (old_plane_state) = (__state)->planes[__i].old_state, 1)) /** * for_each_new_plane_in_state - iterate over all planes in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @plane: &struct drm_plane iteration cursor * @new_plane_state: &struct drm_plane_state iteration cursor for the new state * @__i: int iteration cursor, for macro-internal use @@ -1205,7 +1205,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_oldnew_private_obj_in_state - iterate over all private objects in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @obj: &struct drm_private_obj iteration cursor * @old_obj_state: &struct drm_private_state iteration cursor for the old state * @new_obj_state: &struct drm_private_state iteration cursor for the new state @@ -1225,7 +1225,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_old_private_obj_in_state - iterate over all private objects in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @obj: &struct drm_private_obj iteration cursor * @old_obj_state: &struct drm_private_state iteration cursor for the old state * @__i: int iteration cursor, for macro-internal use @@ -1243,7 +1243,7 @@ void drm_state_dump(struct drm_device *dev, struct drm_printer *p); /** * for_each_new_private_obj_in_state - iterate over all private objects in an atomic update - * @__state: &struct drm_atomic_state pointer + * @__state: &struct drm_atomic_commit pointer * @obj: &struct drm_private_obj iteration cursor * @new_obj_state: &struct drm_private_state iteration cursor for the new state * @__i: int iteration cursor, for macro-internal use @@ -1365,13 +1365,13 @@ drm_priv_to_bridge_state(struct drm_private_state *priv) } struct drm_bridge_state * -drm_atomic_get_bridge_state(struct drm_atomic_state *state, +drm_atomic_get_bridge_state(struct drm_atomic_commit *state, struct drm_bridge *bridge); struct drm_bridge_state * -drm_atomic_get_old_bridge_state(const struct drm_atomic_state *state, +drm_atomic_get_old_bridge_state(const struct drm_atomic_commit *state, struct drm_bridge *bridge); struct drm_bridge_state * -drm_atomic_get_new_bridge_state(const struct drm_atomic_state *state, +drm_atomic_get_new_bridge_state(const struct drm_atomic_commit *state, struct drm_bridge *bridge); #endif /* DRM_ATOMIC_H_ */ diff --git a/include/drm/drm_atomic_helper.h b/include/drm/drm_atomic_helper.h index e154ee4f0696..b84152810abb 100644 --- a/include/drm/drm_atomic_helper.h +++ b/include/drm/drm_atomic_helper.h @@ -43,14 +43,14 @@ */ #define DRM_PLANE_NO_SCALING (1<<16) -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_private_obj; struct drm_private_state; int drm_atomic_helper_check_modeset(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); int drm_atomic_helper_check_wb_connector_state(struct drm_connector *connector, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); int drm_atomic_helper_check_plane_state(struct drm_plane_state *plane_state, const struct drm_crtc_state *crtc_state, int min_scale, @@ -58,92 +58,92 @@ int drm_atomic_helper_check_plane_state(struct drm_plane_state *plane_state, bool can_position, bool can_update_disabled); int drm_atomic_helper_check_planes(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); int drm_atomic_helper_check_crtc_primary_plane(struct drm_crtc_state *crtc_state); void drm_atomic_helper_commit_encoder_bridge_disable(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_commit_crtc_disable(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_commit_encoder_bridge_post_disable(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); int drm_atomic_helper_check(struct drm_device *dev, - struct drm_atomic_state *state); -void drm_atomic_helper_commit_tail(struct drm_atomic_state *state); -void drm_atomic_helper_commit_tail_rpm(struct drm_atomic_state *state); + struct drm_atomic_commit *state); +void drm_atomic_helper_commit_tail(struct drm_atomic_commit *state); +void drm_atomic_helper_commit_tail_rpm(struct drm_atomic_commit *state); int drm_atomic_helper_commit(struct drm_device *dev, - struct drm_atomic_state *state, + struct drm_atomic_commit *state, bool nonblock); int drm_atomic_helper_async_check(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_async_commit(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); int drm_atomic_helper_wait_for_fences(struct drm_device *dev, - struct drm_atomic_state *state, + struct drm_atomic_commit *state, bool pre_swap); void drm_atomic_helper_wait_for_vblanks(struct drm_device *dev, - struct drm_atomic_state *old_state); + struct drm_atomic_commit *old_state); void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev, - struct drm_atomic_state *old_state); + struct drm_atomic_commit *old_state); void drm_atomic_helper_update_legacy_modeset_state(struct drm_device *dev, - struct drm_atomic_state *old_state); + struct drm_atomic_commit *old_state); void -drm_atomic_helper_calc_timestamping_constants(struct drm_atomic_state *state); +drm_atomic_helper_calc_timestamping_constants(struct drm_atomic_commit *state); void drm_atomic_helper_commit_crtc_set_mode(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_commit_modeset_disables(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_commit_writebacks(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_commit_encoder_bridge_pre_enable(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_commit_crtc_enable(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_commit_encoder_bridge_enable(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_commit_modeset_enables(struct drm_device *dev, - struct drm_atomic_state *old_state); + struct drm_atomic_commit *old_state); int drm_atomic_helper_prepare_planes(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_unprepare_planes(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); #define DRM_PLANE_COMMIT_ACTIVE_ONLY BIT(0) #define DRM_PLANE_COMMIT_NO_DISABLE_AFTER_MODESET BIT(1) void drm_atomic_helper_commit_planes(struct drm_device *dev, - struct drm_atomic_state *state, + struct drm_atomic_commit *state, uint32_t flags); void drm_atomic_helper_cleanup_planes(struct drm_device *dev, - struct drm_atomic_state *old_state); + struct drm_atomic_commit *old_state); void drm_atomic_helper_commit_planes_on_crtc(struct drm_crtc_state *old_crtc_state); void drm_atomic_helper_disable_planes_on_crtc(struct drm_crtc_state *old_crtc_state, bool atomic); -int __must_check drm_atomic_helper_swap_state(struct drm_atomic_state *state, +int __must_check drm_atomic_helper_swap_state(struct drm_atomic_commit *state, bool stall); /* nonblocking commit helpers */ -int drm_atomic_helper_setup_commit(struct drm_atomic_state *state, +int drm_atomic_helper_setup_commit(struct drm_atomic_commit *state, bool nonblock); -void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_state *state); -void drm_atomic_helper_fake_vblank(struct drm_atomic_state *state); -void drm_atomic_helper_commit_hw_done(struct drm_atomic_state *state); -void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_state *state); +void drm_atomic_helper_wait_for_dependencies(struct drm_atomic_commit *state); +void drm_atomic_helper_fake_vblank(struct drm_atomic_commit *state); +void drm_atomic_helper_commit_hw_done(struct drm_atomic_commit *state); +void drm_atomic_helper_commit_cleanup_done(struct drm_atomic_commit *state); /* implementations for legacy interfaces */ int drm_atomic_helper_update_plane(struct drm_plane *plane, @@ -164,14 +164,14 @@ int drm_atomic_helper_disable_all(struct drm_device *dev, int drm_atomic_helper_reset_crtc(struct drm_crtc *crtc, struct drm_modeset_acquire_ctx *ctx); void drm_atomic_helper_shutdown(struct drm_device *dev); -struct drm_atomic_state * +struct drm_atomic_commit * drm_atomic_helper_duplicate_state(struct drm_device *dev, struct drm_modeset_acquire_ctx *ctx); -struct drm_atomic_state *drm_atomic_helper_suspend(struct drm_device *dev); -int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state, +struct drm_atomic_commit *drm_atomic_helper_suspend(struct drm_device *dev); +int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_commit *state, struct drm_modeset_acquire_ctx *ctx); int drm_atomic_helper_resume(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); int drm_atomic_helper_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb, diff --git a/include/drm/drm_atomic_state_helper.h b/include/drm/drm_atomic_state_helper.h index 900672c6ea90..61a3b38ad49f 100644 --- a/include/drm/drm_atomic_state_helper.h +++ b/include/drm/drm_atomic_state_helper.h @@ -26,7 +26,7 @@ #include -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_bridge; struct drm_bridge_state; struct drm_crtc; @@ -73,7 +73,7 @@ void __drm_atomic_helper_connector_reset(struct drm_connector *connector, void drm_atomic_helper_connector_reset(struct drm_connector *connector); void drm_atomic_helper_connector_tv_reset(struct drm_connector *connector); int drm_atomic_helper_connector_tv_check(struct drm_connector *connector, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_helper_connector_tv_margins_reset(struct drm_connector *connector); void __drm_atomic_helper_connector_duplicate_state(struct drm_connector *connector, diff --git a/include/drm/drm_blend.h b/include/drm/drm_blend.h index c7e888767c81..bebbb77a8f21 100644 --- a/include/drm/drm_blend.h +++ b/include/drm/drm_blend.h @@ -31,7 +31,7 @@ #define DRM_MODE_BLEND_COVERAGE 1 #define DRM_MODE_BLEND_PIXEL_NONE 2 -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_crtc; struct drm_device; struct drm_plane; @@ -56,7 +56,7 @@ int drm_plane_create_zpos_property(struct drm_plane *plane, int drm_plane_create_zpos_immutable_property(struct drm_plane *plane, unsigned int zpos); int drm_atomic_normalize_zpos(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); int drm_plane_create_blend_mode_property(struct drm_plane *plane, unsigned int supported_modes); void drm_crtc_attach_background_color_property(struct drm_crtc *crtc); diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h index a8d67bd9ee50..1ea13fa273c4 100644 --- a/include/drm/drm_bridge.h +++ b/include/drm/drm_bridge.h @@ -317,7 +317,7 @@ struct drm_bridge_funcs { * The @atomic_pre_enable callback is optional. */ void (*atomic_pre_enable)(struct drm_bridge *bridge, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_enable: @@ -337,7 +337,7 @@ struct drm_bridge_funcs { * The @atomic_enable callback is optional. */ void (*atomic_enable)(struct drm_bridge *bridge, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_disable: * @@ -354,7 +354,7 @@ struct drm_bridge_funcs { * The @atomic_disable callback is optional. */ void (*atomic_disable)(struct drm_bridge *bridge, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_post_disable: @@ -373,7 +373,7 @@ struct drm_bridge_funcs { * The @atomic_post_disable callback is optional. */ void (*atomic_post_disable)(struct drm_bridge *bridge, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_duplicate_state: @@ -1526,13 +1526,13 @@ int drm_atomic_bridge_chain_check(struct drm_bridge *bridge, struct drm_crtc_state *crtc_state, struct drm_connector_state *conn_state); void drm_atomic_bridge_chain_disable(struct drm_bridge *bridge, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_bridge_chain_post_disable(struct drm_bridge *bridge, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_bridge_chain_pre_enable(struct drm_bridge *bridge, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_atomic_bridge_chain_enable(struct drm_bridge *bridge, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); u32 * drm_atomic_helper_bridge_propagate_bus_fmt(struct drm_bridge *bridge, diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h index bd082854ca74..c873199c60da 100644 --- a/include/drm/drm_colorop.h +++ b/include/drm/drm_colorop.h @@ -183,8 +183,8 @@ struct drm_colorop_state { */ struct drm_property_blob *data; - /** @state: backpointer to global drm_atomic_state */ - struct drm_atomic_state *state; + /** @state: backpointer to global drm_atomic_commit */ + struct drm_atomic_commit *state; }; /** diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index f83f28cae207..6c910a5aff3c 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -1098,8 +1098,8 @@ struct drm_connector_state { */ enum drm_link_status link_status; - /** @state: backpointer to global drm_atomic_state */ - struct drm_atomic_state *state; + /** @state: backpointer to global drm_atomic_commit */ + struct drm_atomic_commit *state; /** * @commit: Tracks the pending commit to prevent use-after-free conditions. @@ -2344,7 +2344,7 @@ struct drm_connector { * * This is protected by &drm_mode_config.connection_mutex. Note that * nonblocking atomic commits access the current connector state without - * taking locks. Either by going through the &struct drm_atomic_state + * taking locks. Either by going through the &struct drm_atomic_commit * pointers, see for_each_oldnew_connector_in_state(), * for_each_old_connector_in_state() and * for_each_new_connector_in_state(). Or through careful ordering of diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h index 312fc1e745d2..c6dbe8b7db9e 100644 --- a/include/drm/drm_crtc.h +++ b/include/drm/drm_crtc.h @@ -58,7 +58,7 @@ struct drm_crtc; struct drm_pending_vblank_event; struct drm_plane; struct drm_bridge; -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_crtc_helper_funcs; struct drm_plane_helper_funcs; @@ -406,8 +406,8 @@ struct drm_crtc_state { */ struct drm_crtc_commit *commit; - /** @state: backpointer to global drm_atomic_state */ - struct drm_atomic_state *state; + /** @state: backpointer to global drm_atomic_commit */ + struct drm_atomic_commit *state; }; /** @@ -1124,7 +1124,7 @@ struct drm_crtc { * * This is protected by @mutex. Note that nonblocking atomic commits * access the current CRTC state without taking locks. Either by going - * through the &struct drm_atomic_state pointers, see + * through the &struct drm_atomic_commit pointers, see * for_each_oldnew_crtc_in_state(), for_each_old_crtc_in_state() and * for_each_new_crtc_in_state(). Or through careful ordering of atomic * commit operations as implemented in the atomic helpers, see @@ -1217,7 +1217,7 @@ struct drm_crtc { * @num_connectors: size of @connectors array * * This represents a modeset configuration for the legacy SETCRTC ioctl and is - * also used internally. Atomic drivers instead use &drm_atomic_state. + * also used internally. Atomic drivers instead use &drm_atomic_commit. */ struct drm_mode_set { struct drm_framebuffer *fb; diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h index 8c886fc46ef2..855da5733c47 100644 --- a/include/drm/drm_crtc_helper.h +++ b/include/drm/drm_crtc_helper.h @@ -35,7 +35,7 @@ #include -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_connector; struct drm_crtc; struct drm_device; @@ -53,7 +53,7 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc, int x, int y, struct drm_framebuffer *old_fb); int drm_crtc_helper_atomic_check(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); bool drm_helper_crtc_in_use(struct drm_crtc *crtc); bool drm_helper_encoder_in_use(struct drm_encoder *encoder); diff --git a/include/drm/drm_damage_helper.h b/include/drm/drm_damage_helper.h index a58cbcd11276..3661aeab2cd3 100644 --- a/include/drm/drm_damage_helper.h +++ b/include/drm/drm_damage_helper.h @@ -64,7 +64,7 @@ struct drm_atomic_helper_damage_iter { bool full_update; }; -void drm_atomic_helper_check_plane_damage(struct drm_atomic_state *state, +void drm_atomic_helper_check_plane_damage(struct drm_atomic_commit *state, struct drm_plane_state *plane_state); int drm_atomic_helper_dirtyfb(struct drm_framebuffer *fb, struct drm_file *file_priv, unsigned int flags, diff --git a/include/drm/drm_kunit_helpers.h b/include/drm/drm_kunit_helpers.h index 4948379237e9..e653bc7b1e40 100644 --- a/include/drm/drm_kunit_helpers.h +++ b/include/drm/drm_kunit_helpers.h @@ -97,7 +97,7 @@ __drm_kunit_helper_alloc_drm_device(struct kunit *test, offsetof(_type, _member), \ _feat)) -struct drm_atomic_state * +struct drm_atomic_commit * drm_kunit_helper_atomic_state_alloc(struct kunit *test, struct drm_device *drm, struct drm_modeset_acquire_ctx *ctx); diff --git a/include/drm/drm_mipi_dbi.h b/include/drm/drm_mipi_dbi.h index 07374eb5d88e..78ab23d844ce 100644 --- a/include/drm/drm_mipi_dbi.h +++ b/include/drm/drm_mipi_dbi.h @@ -220,9 +220,9 @@ int mipi_dbi_buf_copy(void *dst, struct iosys_map *src, struct drm_framebuffer * .disable_plane = drm_atomic_helper_disable_plane int drm_mipi_dbi_plane_helper_atomic_check(struct drm_plane *plane, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_mipi_dbi_plane_helper_atomic_update(struct drm_plane *plane, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); #define DRM_MIPI_DBI_PLANE_HELPER_FUNCS \ DRM_GEM_SHADOW_PLANE_HELPER_FUNCS, \ @@ -243,9 +243,9 @@ void drm_mipi_dbi_plane_helper_atomic_update(struct drm_plane *plane, enum drm_mode_status drm_mipi_dbi_crtc_helper_mode_valid(struct drm_crtc *crtc, const struct drm_display_mode *mode); int drm_mipi_dbi_crtc_helper_atomic_check(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_mipi_dbi_crtc_helper_atomic_disable(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); #define DRM_MIPI_DBI_CRTC_HELPER_FUNCS \ .mode_valid = drm_mipi_dbi_crtc_helper_mode_valid, \ diff --git a/include/drm/drm_mode_config.h b/include/drm/drm_mode_config.h index 687c0ee163d2..e584652ddf67 100644 --- a/include/drm/drm_mode_config.h +++ b/include/drm/drm_mode_config.h @@ -33,7 +33,7 @@ struct drm_file; struct drm_device; -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_mode_fb_cmd2; struct drm_format_info; struct drm_display_mode; @@ -158,7 +158,7 @@ struct drm_mode_config_funcs { * error conditions which don't have to be checked at the in this * callback. * - * See the documentation for &struct drm_atomic_state for how exactly + * See the documentation for &struct drm_atomic_commit for how exactly * an atomic modeset update is described. * * Drivers using the atomic helpers can implement this hook using @@ -184,7 +184,7 @@ struct drm_mode_config_funcs { * treated equally. */ int (*atomic_check)(struct drm_device *dev, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_commit: @@ -194,7 +194,7 @@ struct drm_mode_config_funcs { * calling this function, and that nothing has been changed in the * interim. * - * See the documentation for &struct drm_atomic_state for how exactly + * See the documentation for &struct drm_atomic_commit for how exactly * an atomic modeset update is described. * * Drivers using the atomic helpers can implement this hook using @@ -266,31 +266,31 @@ struct drm_mode_config_funcs { * additional modeset locks). */ int (*atomic_commit)(struct drm_device *dev, - struct drm_atomic_state *state, + struct drm_atomic_commit *state, bool nonblock); /** * @atomic_state_alloc: * * This optional hook can be used by drivers that want to subclass struct - * &drm_atomic_state to be able to track their own driver-private global + * &drm_atomic_commit to be able to track their own driver-private global * state easily. If this hook is implemented, drivers must also * implement @atomic_state_clear and @atomic_state_free. * - * Subclassing of &drm_atomic_state is deprecated in favour of using + * Subclassing of &drm_atomic_commit is deprecated in favour of using * &drm_private_state and &drm_private_obj. * * RETURNS: * - * A new &drm_atomic_state on success or NULL on failure. + * A new &drm_atomic_commit on success or NULL on failure. */ - struct drm_atomic_state *(*atomic_state_alloc)(struct drm_device *dev); + struct drm_atomic_commit *(*atomic_state_alloc)(struct drm_device *dev); /** * @atomic_state_clear: * * This hook must clear any driver private state duplicated into the - * passed-in &drm_atomic_state. This hook is called when the caller + * passed-in &drm_atomic_commit. This hook is called when the caller * encountered a &drm_modeset_lock deadlock and needs to drop all * already acquired locks as part of the deadlock avoidance dance * implemented in drm_modeset_backoff(). @@ -299,28 +299,28 @@ struct drm_mode_config_funcs { * update might change it, and the drm atomic interfaces always apply * updates as relative changes to the current state. * - * Drivers that implement this must call drm_atomic_state_default_clear() + * Drivers that implement this must call drm_atomic_commit_default_clear() * to clear common state. * - * Subclassing of &drm_atomic_state is deprecated in favour of using + * Subclassing of &drm_atomic_commit is deprecated in favour of using * &drm_private_state and &drm_private_obj. */ - void (*atomic_state_clear)(struct drm_atomic_state *state); + void (*atomic_state_clear)(struct drm_atomic_commit *state); /** * @atomic_state_free: * - * This hook needs driver private resources and the &drm_atomic_state - * itself. Note that the core first calls drm_atomic_state_clear() to + * This hook needs driver private resources and the &drm_atomic_commit + * itself. Note that the core first calls drm_atomic_commit_clear() to * avoid code duplicate between the clear and free hooks. * * Drivers that implement this must call - * drm_atomic_state_default_release() to release common resources. + * drm_atomic_commit_default_release() to release common resources. * - * Subclassing of &drm_atomic_state is deprecated in favour of using + * Subclassing of &drm_atomic_commit is deprecated in favour of using * &drm_private_state and &drm_private_obj. */ - void (*atomic_state_free)(struct drm_atomic_state *state); + void (*atomic_state_free)(struct drm_atomic_commit *state); }; /** @@ -985,7 +985,7 @@ struct drm_mode_config { * Set by drm_mode_config_helper_suspend() and cleared by * drm_mode_config_helper_resume(). */ - struct drm_atomic_state *suspend_state; + struct drm_atomic_commit *suspend_state; const struct drm_mode_config_helper_funcs *helper_private; }; diff --git a/include/drm/drm_modeset_helper_vtables.h b/include/drm/drm_modeset_helper_vtables.h index 3e68213958dd..ca6268945c28 100644 --- a/include/drm/drm_modeset_helper_vtables.h +++ b/include/drm/drm_modeset_helper_vtables.h @@ -332,7 +332,7 @@ struct drm_crtc_helper_funcs { * deadlock. */ int (*atomic_check)(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_begin: @@ -353,7 +353,7 @@ struct drm_crtc_helper_funcs { * optional. */ void (*atomic_begin)(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_flush: * @@ -377,7 +377,7 @@ struct drm_crtc_helper_funcs { * optional. */ void (*atomic_flush)(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_enable: @@ -399,7 +399,7 @@ struct drm_crtc_helper_funcs { * This function is optional. */ void (*atomic_enable)(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_disable: @@ -419,7 +419,7 @@ struct drm_crtc_helper_funcs { * This function is optional. */ void (*atomic_disable)(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @get_scanout_position: @@ -713,7 +713,7 @@ struct drm_encoder_helper_funcs { * @atomic_enable. */ void (*atomic_disable)(struct drm_encoder *encoder, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_enable: @@ -736,7 +736,7 @@ struct drm_encoder_helper_funcs { * @atomic_disable. */ void (*atomic_enable)(struct drm_encoder *encoder, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @disable: @@ -809,7 +809,7 @@ struct drm_encoder_helper_funcs { * * This function is called in the check phase of an atomic update. The * driver is not allowed to change anything outside of the free-standing - * state objects passed-in or assembled in the overall &drm_atomic_state + * state objects passed-in or assembled in the overall &drm_atomic_commit * update tracking structure. * * Also beware that userspace can request its own custom modes, neither @@ -1044,7 +1044,7 @@ struct drm_connector_helper_funcs { * * This function is called in the check phase of an atomic update. The * driver is not allowed to change anything outside of the - * &drm_atomic_state update tracking structure passed in. + * &drm_atomic_commit update tracking structure passed in. * * RETURNS: * @@ -1054,7 +1054,7 @@ struct drm_connector_helper_funcs { * for this. */ struct drm_encoder *(*atomic_best_encoder)(struct drm_connector *connector, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_check: @@ -1077,7 +1077,7 @@ struct drm_connector_helper_funcs { * * This function is called in the check phase of an atomic update. The * driver is not allowed to change anything outside of the free-standing - * state objects passed-in or assembled in the overall &drm_atomic_state + * state objects passed-in or assembled in the overall &drm_atomic_commit * update tracking structure. * * RETURNS: @@ -1088,7 +1088,7 @@ struct drm_connector_helper_funcs { * deadlock. */ int (*atomic_check)(struct drm_connector *connector, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_commit: @@ -1103,7 +1103,7 @@ struct drm_connector_helper_funcs { * This callback is used by the atomic modeset helpers. */ void (*atomic_commit)(struct drm_connector *connector, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @prepare_writeback_job: @@ -1299,7 +1299,7 @@ struct drm_plane_helper_funcs { * * This function is called in the check phase of an atomic update. The * driver is not allowed to change anything outside of the - * &drm_atomic_state update tracking structure. + * &drm_atomic_commit update tracking structure. * * RETURNS: * @@ -1309,7 +1309,7 @@ struct drm_plane_helper_funcs { * deadlock. */ int (*atomic_check)(struct drm_plane *plane, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_update: @@ -1326,7 +1326,7 @@ struct drm_plane_helper_funcs { * This callback is used by the atomic modeset helpers, but it is optional. */ void (*atomic_update)(struct drm_plane *plane, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_enable: @@ -1351,7 +1351,7 @@ struct drm_plane_helper_funcs { * implement the complete plane update in @atomic_update. */ void (*atomic_enable)(struct drm_plane *plane, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_disable: @@ -1376,7 +1376,7 @@ struct drm_plane_helper_funcs { * optional. It's intended to reverse the effects of @atomic_enable. */ void (*atomic_disable)(struct drm_plane *plane, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @atomic_async_check: @@ -1400,7 +1400,7 @@ struct drm_plane_helper_funcs { * can not be applied in asynchronous manner. */ int (*atomic_async_check)(struct drm_plane *plane, - struct drm_atomic_state *state, bool flip); + struct drm_atomic_commit *state, bool flip); /** * @atomic_async_update: @@ -1437,7 +1437,7 @@ struct drm_plane_helper_funcs { * for deferring if needed, until a common solution is created. */ void (*atomic_async_update)(struct drm_plane *plane, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); /** * @get_scanout_buffer: @@ -1530,7 +1530,7 @@ struct drm_mode_config_helper_funcs { * This hook is optional, the default implementation is * drm_atomic_helper_commit_tail(). */ - void (*atomic_commit_tail)(struct drm_atomic_state *state); + void (*atomic_commit_tail)(struct drm_atomic_commit *state); /** * @atomic_commit_setup: @@ -1551,7 +1551,7 @@ struct drm_mode_config_helper_funcs { * * This hook is optional. */ - int (*atomic_commit_setup)(struct drm_atomic_state *state); + int (*atomic_commit_setup)(struct drm_atomic_commit *state); }; #endif diff --git a/include/drm/drm_plane.h b/include/drm/drm_plane.h index 703ef4d1bbbc..419c88c873a6 100644 --- a/include/drm/drm_plane.h +++ b/include/drm/drm_plane.h @@ -259,8 +259,8 @@ struct drm_plane_state { */ struct drm_crtc_commit *commit; - /** @state: backpointer to global drm_atomic_state */ - struct drm_atomic_state *state; + /** @state: backpointer to global drm_atomic_commit */ + struct drm_atomic_commit *state; /** * @color_mgmt_changed: Color management properties have changed. Used @@ -739,7 +739,7 @@ struct drm_plane { * * This is protected by @mutex. Note that nonblocking atomic commits * access the current plane state without taking locks. Either by going - * through the &struct drm_atomic_state pointers, see + * through the &struct drm_atomic_commit pointers, see * for_each_oldnew_plane_in_state(), for_each_old_plane_in_state() and * for_each_new_plane_in_state(). Or through careful ordering of atomic * commit operations as implemented in the atomic helpers, see diff --git a/include/drm/drm_self_refresh_helper.h b/include/drm/drm_self_refresh_helper.h index 520235c20708..95c190125b60 100644 --- a/include/drm/drm_self_refresh_helper.h +++ b/include/drm/drm_self_refresh_helper.h @@ -8,11 +8,11 @@ #ifndef DRM_SELF_REFRESH_HELPER_H_ #define DRM_SELF_REFRESH_HELPER_H_ -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_crtc; -void drm_self_refresh_helper_alter_state(struct drm_atomic_state *state); -void drm_self_refresh_helper_update_avg_times(struct drm_atomic_state *state, +void drm_self_refresh_helper_alter_state(struct drm_atomic_commit *state); +void drm_self_refresh_helper_update_avg_times(struct drm_atomic_commit *state, unsigned int commit_time_ms, unsigned int new_self_refresh_mask); diff --git a/include/drm/drm_vblank_helper.h b/include/drm/drm_vblank_helper.h index fcd8a9b35846..28051f08d0f4 100644 --- a/include/drm/drm_vblank_helper.h +++ b/include/drm/drm_vblank_helper.h @@ -6,7 +6,7 @@ #include #include -struct drm_atomic_state; +struct drm_atomic_commit; struct drm_crtc; /* @@ -14,11 +14,11 @@ struct drm_crtc; */ void drm_crtc_vblank_atomic_flush(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_crtc_vblank_atomic_enable(struct drm_crtc *crtc, - struct drm_atomic_state *state); + struct drm_atomic_commit *state); void drm_crtc_vblank_atomic_disable(struct drm_crtc *crtc, - struct drm_atomic_state *crtc_state); + struct drm_atomic_commit *crtc_state); /** * DRM_CRTC_HELPER_VBLANK_FUNCS - Default implementation for VBLANK helpers -- cgit v1.2.3 From 5d801b59633f6af60bb0e18d3bbb18b7b040a6d9 Mon Sep 17 00:00:00 2001 From: Jackson Lee Date: Tue, 24 Mar 2026 14:03:57 +0900 Subject: media: v4l2-controls: Add control for background detection Add a generic V4L2 boolean control V4L2_CID_MPEG_VIDEO_BACKGROUND_DETECTION that allows encoders to detect background regions in a frame and use fewer bits or skip mode to encode them, potentially reducing bitrate for streams with stationary scenes. Signed-off-by: Jackson Lee Signed-off-by: Nas Chung Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil --- include/uapi/linux/v4l2-controls.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h index 68dd0c4e47b2..affec0ab4781 100644 --- a/include/uapi/linux/v4l2-controls.h +++ b/include/uapi/linux/v4l2-controls.h @@ -464,6 +464,8 @@ enum v4l2_mpeg_video_intra_refresh_period_type { V4L2_CID_MPEG_VIDEO_INTRA_REFRESH_PERIOD_TYPE_CYCLIC = 1, }; +#define V4L2_CID_MPEG_VIDEO_BACKGROUND_DETECTION (V4L2_CID_CODEC_BASE + 238) + /* CIDs for the MPEG-2 Part 2 (H.262) codec */ #define V4L2_CID_MPEG_VIDEO_MPEG2_LEVEL (V4L2_CID_CODEC_BASE+270) enum v4l2_mpeg_video_mpeg2_level { -- cgit v1.2.3 From bfdc854ba63bc815cf710701f889544a9d27df83 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 28 Apr 2026 17:45:07 +0200 Subject: gpiolib: move legacy interface into linux/gpio/legacy.h Split the old contents from gpio.h for clarity. Ideally any driver that still includes linux/gpio.h can now be ported over to use either linux/gpio/legacy.h or linux/gpio/consumer.h, with the original file getting removed once that is complete. No functional changes intended for now. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260428154522.2861492-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski --- include/linux/gpio.h | 162 +---------------------------------------- include/linux/gpio/legacy.h | 173 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 177 insertions(+), 158 deletions(-) create mode 100644 include/linux/gpio/legacy.h (limited to 'include') diff --git a/include/linux/gpio.h b/include/linux/gpio.h index 8f85ddb26429..b0d4942a65de 100644 --- a/include/linux/gpio.h +++ b/include/linux/gpio.h @@ -2,13 +2,11 @@ /* * NOTE: This header *must not* be included. * - * This is the LEGACY GPIO bulk include file, including legacy APIs. It is - * used for GPIO drivers still referencing the global GPIO numberspace, - * and should not be included in new code. - * * If you're implementing a GPIO driver, only include * If you're implementing a GPIO consumer, only include + * If you're using the legacy interfaces, include */ + #ifndef __LINUX_GPIO_H #define __LINUX_GPIO_H @@ -18,159 +16,7 @@ #endif #ifdef CONFIG_GPIOLIB_LEGACY - -struct device; - -/* make these flag values available regardless of GPIO kconfig options */ -#define GPIOF_IN ((1 << 0)) -#define GPIOF_OUT_INIT_LOW ((0 << 0) | (0 << 1)) -#define GPIOF_OUT_INIT_HIGH ((0 << 0) | (1 << 1)) - -#ifdef CONFIG_GPIOLIB -/* - * "valid" GPIO numbers are nonnegative and may be passed to - * setup routines like gpio_request(). Only some valid numbers - * can successfully be requested and used. - * - * Invalid GPIO numbers are useful for indicating no-such-GPIO in - * platform data and other tables. - */ -static inline bool gpio_is_valid(int number) -{ - /* only non-negative numbers are valid */ - return number >= 0; -} - -/* - * Platforms may implement their GPIO interface with library code, - * at a small performance cost for non-inlined operations and some - * extra memory (for code and for per-GPIO table entries). - */ - -/* Always use the library code for GPIO management calls, - * or when sleeping may be involved. - */ -int gpio_request(unsigned gpio, const char *label); -void gpio_free(unsigned gpio); - -static inline int gpio_direction_input(unsigned gpio) -{ - return gpiod_direction_input(gpio_to_desc(gpio)); -} -static inline int gpio_direction_output(unsigned gpio, int value) -{ - return gpiod_direction_output_raw(gpio_to_desc(gpio), value); -} - -static inline int gpio_get_value_cansleep(unsigned gpio) -{ - return gpiod_get_raw_value_cansleep(gpio_to_desc(gpio)); -} -static inline void gpio_set_value_cansleep(unsigned gpio, int value) -{ - gpiod_set_raw_value_cansleep(gpio_to_desc(gpio), value); -} - -static inline int gpio_get_value(unsigned gpio) -{ - return gpiod_get_raw_value(gpio_to_desc(gpio)); -} -static inline void gpio_set_value(unsigned gpio, int value) -{ - gpiod_set_raw_value(gpio_to_desc(gpio), value); -} - -static inline int gpio_to_irq(unsigned gpio) -{ - return gpiod_to_irq(gpio_to_desc(gpio)); -} - -int gpio_request_one(unsigned gpio, unsigned long flags, const char *label); - -int devm_gpio_request_one(struct device *dev, unsigned gpio, - unsigned long flags, const char *label); - -#else /* ! CONFIG_GPIOLIB */ - -#include - -#include -#include - -static inline bool gpio_is_valid(int number) -{ - return false; -} - -static inline int gpio_request(unsigned gpio, const char *label) -{ - return -ENOSYS; -} - -static inline int gpio_request_one(unsigned gpio, - unsigned long flags, const char *label) -{ - return -ENOSYS; -} - -static inline void gpio_free(unsigned gpio) -{ - might_sleep(); - - /* GPIO can never have been requested */ - WARN_ON(1); -} - -static inline int gpio_direction_input(unsigned gpio) -{ - return -ENOSYS; -} - -static inline int gpio_direction_output(unsigned gpio, int value) -{ - return -ENOSYS; -} - -static inline int gpio_get_value(unsigned gpio) -{ - /* GPIO can never have been requested or set as {in,out}put */ - WARN_ON(1); - return 0; -} - -static inline void gpio_set_value(unsigned gpio, int value) -{ - /* GPIO can never have been requested or set as output */ - WARN_ON(1); -} - -static inline int gpio_get_value_cansleep(unsigned gpio) -{ - /* GPIO can never have been requested or set as {in,out}put */ - WARN_ON(1); - return 0; -} - -static inline void gpio_set_value_cansleep(unsigned gpio, int value) -{ - /* GPIO can never have been requested or set as output */ - WARN_ON(1); -} - -static inline int gpio_to_irq(unsigned gpio) -{ - /* GPIO can never have been requested or set as input */ - WARN_ON(1); - return -EINVAL; -} - -static inline int devm_gpio_request_one(struct device *dev, unsigned gpio, - unsigned long flags, const char *label) -{ - WARN_ON(1); - return -EINVAL; -} - -#endif /* ! CONFIG_GPIOLIB */ +#include #endif /* CONFIG_GPIOLIB_LEGACY */ + #endif /* __LINUX_GPIO_H */ diff --git a/include/linux/gpio/legacy.h b/include/linux/gpio/legacy.h new file mode 100644 index 000000000000..557ef635935e --- /dev/null +++ b/include/linux/gpio/legacy.h @@ -0,0 +1,173 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * This is the LEGACY GPIO include file, used only for legacy APIs. + * + * No new code should use this, but instead use the linux/gpio/consumer.h + * interfaces directly. + */ + +#ifndef __LINUX_GPIO_LEGACY_H +#define __LINUX_GPIO_LEGACY_H + +#include + +#ifdef CONFIG_GPIOLIB_LEGACY + +struct device; + +/* make these flag values available regardless of GPIO kconfig options */ +#define GPIOF_IN ((1 << 0)) +#define GPIOF_OUT_INIT_LOW ((0 << 0) | (0 << 1)) +#define GPIOF_OUT_INIT_HIGH ((0 << 0) | (1 << 1)) + +#ifdef CONFIG_GPIOLIB + +#include + +/* + * "valid" GPIO numbers are nonnegative and may be passed to + * setup routines like gpio_request(). Only some valid numbers + * can successfully be requested and used. + * + * Invalid GPIO numbers are useful for indicating no-such-GPIO in + * platform data and other tables. + */ +static inline bool gpio_is_valid(int number) +{ + /* only non-negative numbers are valid */ + return number >= 0; +} + +/* + * Platforms may implement their GPIO interface with library code, + * at a small performance cost for non-inlined operations and some + * extra memory (for code and for per-GPIO table entries). + */ + +/* Always use the library code for GPIO management calls, + * or when sleeping may be involved. + */ +int gpio_request(unsigned gpio, const char *label); +void gpio_free(unsigned gpio); + +static inline int gpio_direction_input(unsigned gpio) +{ + return gpiod_direction_input(gpio_to_desc(gpio)); +} +static inline int gpio_direction_output(unsigned gpio, int value) +{ + return gpiod_direction_output_raw(gpio_to_desc(gpio), value); +} + +static inline int gpio_get_value_cansleep(unsigned gpio) +{ + return gpiod_get_raw_value_cansleep(gpio_to_desc(gpio)); +} +static inline void gpio_set_value_cansleep(unsigned gpio, int value) +{ + gpiod_set_raw_value_cansleep(gpio_to_desc(gpio), value); +} + +static inline int gpio_get_value(unsigned gpio) +{ + return gpiod_get_raw_value(gpio_to_desc(gpio)); +} +static inline void gpio_set_value(unsigned gpio, int value) +{ + gpiod_set_raw_value(gpio_to_desc(gpio), value); +} + +static inline int gpio_to_irq(unsigned gpio) +{ + return gpiod_to_irq(gpio_to_desc(gpio)); +} + +int gpio_request_one(unsigned gpio, unsigned long flags, const char *label); + +int devm_gpio_request_one(struct device *dev, unsigned gpio, + unsigned long flags, const char *label); + +#else /* ! CONFIG_GPIOLIB */ + +#include + +#include +#include + +static inline bool gpio_is_valid(int number) +{ + return false; +} + +static inline int gpio_request(unsigned gpio, const char *label) +{ + return -ENOSYS; +} + +static inline int gpio_request_one(unsigned gpio, + unsigned long flags, const char *label) +{ + return -ENOSYS; +} + +static inline void gpio_free(unsigned gpio) +{ + might_sleep(); + + /* GPIO can never have been requested */ + WARN_ON(1); +} + +static inline int gpio_direction_input(unsigned gpio) +{ + return -ENOSYS; +} + +static inline int gpio_direction_output(unsigned gpio, int value) +{ + return -ENOSYS; +} + +static inline int gpio_get_value(unsigned gpio) +{ + /* GPIO can never have been requested or set as {in,out}put */ + WARN_ON(1); + return 0; +} + +static inline void gpio_set_value(unsigned gpio, int value) +{ + /* GPIO can never have been requested or set as output */ + WARN_ON(1); +} + +static inline int gpio_get_value_cansleep(unsigned gpio) +{ + /* GPIO can never have been requested or set as {in,out}put */ + WARN_ON(1); + return 0; +} + +static inline void gpio_set_value_cansleep(unsigned gpio, int value) +{ + /* GPIO can never have been requested or set as output */ + WARN_ON(1); +} + +static inline int gpio_to_irq(unsigned gpio) +{ + /* GPIO can never have been requested or set as input */ + WARN_ON(1); + return -EINVAL; +} + +static inline int devm_gpio_request_one(struct device *dev, unsigned gpio, + unsigned long flags, const char *label) +{ + WARN_ON(1); + return -EINVAL; +} + +#endif /* ! CONFIG_GPIOLIB */ +#endif /* CONFIG_GPIOLIB_LEGACY */ +#endif /* __LINUX_GPIO_LEGAGY_H */ -- cgit v1.2.3 From 0f63ba15dde8748ed3818fa6553c81b5296318f1 Mon Sep 17 00:00:00 2001 From: Wolfram Sang Date: Thu, 2 Apr 2026 13:27:05 +0200 Subject: dt-bindings: soc: renesas: Document MFIS IP core Document the Renesas Multifunctional Interface (MFIS) as found on the Renesas R-Car X5H (r8a78000) SoC. MFIS includes features like Mailbox/HW Spinlock/Product Register/Error Injection/Error Detection and the likes. Family-compatible values are not introduced here because MFIS is usually very different per SoC. Signed-off-by: Wolfram Sang Reviewed-by: Krzysztof Kozlowski Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260402112709.13002-2-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven --- include/dt-bindings/soc/renesas,r8a78000-mfis.h | 28 +++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 include/dt-bindings/soc/renesas,r8a78000-mfis.h (limited to 'include') diff --git a/include/dt-bindings/soc/renesas,r8a78000-mfis.h b/include/dt-bindings/soc/renesas,r8a78000-mfis.h new file mode 100644 index 000000000000..147a8aefc643 --- /dev/null +++ b/include/dt-bindings/soc/renesas,r8a78000-mfis.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +#ifndef _DT_BINDINGS_SOC_RENESAS_R8A78000_MFIS_H +#define _DT_BINDINGS_SOC_RENESAS_R8A78000_MFIS_H + +/* + * Constants for the second mbox-cell of the Renesas MFIS IP core. To be treated + * as bit flags which can be ORed. + */ + +/* + * MFIS HW design before r8a78001 requires a channel to be marked as either + * TX or RX. + */ +#define MFIS_CHANNEL_TX (0 << 0) +#define MFIS_CHANNEL_RX (1 << 0) + +/* + * MFIS variants before r8a78001 work with pairs of IICR and EICR registers. + * Usually, it is specified in the datasheets which of the two a specific core + * should use. Then, it does not need extra description in DT. For plain MFIS + * of r8a78000, this is selectable, though. According to the system design and + * the firmware in use, these channels need to be marked. This is not needed + * with other versions of the MFIS, not even with MFIS-SCP of r8a78000. + */ +#define MFIS_CHANNEL_IICR (0 << 1) +#define MFIS_CHANNEL_EICR (1 << 1) + +#endif /* _DT_BINDINGS_SOC_RENESAS_R8A78000_MFIS_H */ -- cgit v1.2.3 From 6913a6159688edee07185a6ed0f1c4ad57c881e5 Mon Sep 17 00:00:00 2001 From: Tommaso Merciai Date: Wed, 8 Apr 2026 12:36:48 +0200 Subject: clk: renesas: r9a09g047: Add CLK_PLLDSI{0,1} clocks Add support for the PLLDSI{0,1} clocks in the r9a09g047 CPG driver. Introduce CLK_PLLDSI{0,1} also, introduce the rzg3e_cpg_pll_dsi{0,1}_limits structures to describe the frequency constraints specific to the RZ/G3E SoC. On Renesas RZ/G3E: - PLLDSI0 maximum output frequency: 1218 MHz - PLLDSI1 maximum output frequency: 609 MHz These limits are enforced through the newly added RZG3E_CPG_PLL_DSI{0,1}_LIMITS(). Reviewed-by: Geert Uytterhoeven Signed-off-by: Tommaso Merciai Link: https://patch.msgid.link/d26ec5349b0eb7ddb7d244fc53d1111a8530328f.1775636898.git.tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven --- include/linux/clk/renesas.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'include') diff --git a/include/linux/clk/renesas.h b/include/linux/clk/renesas.h index c360df9fa735..0949400f44de 100644 --- a/include/linux/clk/renesas.h +++ b/include/linux/clk/renesas.h @@ -164,6 +164,26 @@ struct rzv2h_pll_div_pars { .k = { .min = -32768, .max = 32767 }, \ } \ +#define RZG3E_CPG_PLL_DSI0_LIMITS(name) \ + static const struct rzv2h_pll_limits (name) = { \ + .fout = { .min = 25 * MEGA, .max = 1218 * MEGA }, \ + .fvco = { .min = 1600 * MEGA, .max = 3200 * MEGA }, \ + .m = { .min = 64, .max = 533 }, \ + .p = { .min = 1, .max = 4 }, \ + .s = { .min = 0, .max = 6 }, \ + .k = { .min = -32768, .max = 32767 }, \ + } \ + +#define RZG3E_CPG_PLL_DSI1_LIMITS(name) \ + static const struct rzv2h_pll_limits (name) = { \ + .fout = { .min = 25 * MEGA, .max = 609 * MEGA }, \ + .fvco = { .min = 1600 * MEGA, .max = 3200 * MEGA }, \ + .m = { .min = 64, .max = 533 }, \ + .p = { .min = 1, .max = 4 }, \ + .s = { .min = 0, .max = 6 }, \ + .k = { .min = -32768, .max = 32767 }, \ + } \ + #ifdef CONFIG_CLK_RZV2H bool rzv2h_get_pll_pars(const struct rzv2h_pll_limits *limits, struct rzv2h_pll_pars *pars, u64 freq_millihz); -- cgit v1.2.3 From 5e5b64b6dc702c7bcd8da340263535128a3d5518 Mon Sep 17 00:00:00 2001 From: Eduardo Vasconcelos Date: Fri, 24 Apr 2026 15:36:29 -0300 Subject: drm/crc: Fix typo in doc for drm_crtc_crc Fix a typo in the documentation for struct drm_crtc_crc ("occured." -> "occurred"). Signed-off-by: Eduardo Vasconcelos Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260424183630.3764-1-eduardo@eduardovasconcelos.com --- include/drm/drm_debugfs_crc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/drm/drm_debugfs_crc.h b/include/drm/drm_debugfs_crc.h index 1b4c98c2f838..1cb71c03bf44 100644 --- a/include/drm/drm_debugfs_crc.h +++ b/include/drm/drm_debugfs_crc.h @@ -49,7 +49,7 @@ struct drm_crtc_crc_entry { * @lock: protects the fields in this struct * @source: name of the currently configured source of CRCs * @opened: whether userspace has opened the data file for reading - * @overflow: whether an overflow occured. + * @overflow: whether an overflow occurred * @entries: array of entries, with size of %DRM_CRC_ENTRIES_NR * @head: head of circular queue * @tail: tail of circular queue -- cgit v1.2.3 From 22fa40c7ecdb11ddc1c95db88cce379408687962 Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Wed, 29 Apr 2026 19:56:39 +0200 Subject: mtd: spinand: Expose spinand_op_is_odtr() This helper is going to be needed in a vendor driver, so expose it. Signed-off-by: Miquel Raynal --- include/linux/mtd/spinand.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/mtd/spinand.h b/include/linux/mtd/spinand.h index 58abd306ebe3..e1f19664bb25 100644 --- a/include/linux/mtd/spinand.h +++ b/include/linux/mtd/spinand.h @@ -862,6 +862,8 @@ static inline void spinand_set_of_node(struct spinand_device *spinand, nanddev_set_of_node(&spinand->base, np); } +bool spinand_op_is_odtr(const struct spi_mem_op *op); + int spinand_match_and_init(struct spinand_device *spinand, const struct spinand_info *table, unsigned int table_size, -- cgit v1.2.3 From c952533f25e3dc9f121a612299bd54adc795b2ec Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Wed, 29 Apr 2026 19:56:40 +0200 Subject: mtd: spinand: Drop ECC dirmaps Direct mappings are very static concepts, which allow us to reuse a template to perform reads or writes in a very efficient manner after a single initialization. With the introduction of pipelined ECC engines for SPI controllers, the need to differentiate between an operation with and without correction has arised. The chosen solution at that time has been to create new direct mappings for these operations, jumping from 2 to 4 dirmaps per target. Enabling ECC was done by choosing the correct dirmap. Today, we need to further parametrize dirmaps. With the goal to enable continuous reads on a wider range of devices, we will need more flexibility regarding the read from cache operation template to pick at run time, for instance to use shorter "continuous read from cache" variants. We could create other direct mappings, but it would increase the matrix by a power of two, bringing the theoretical number of dirmaps to 8 (read/write, ecc, shorter read variants) per target. This grow is not sustainable, so let's change how dirmaps work - a little bit. Operations already carry an ECC parameter, use it to indicate whether error correction is required or not. In practice this change happens only at the core level, SPI controller drivers do not care about the direct mapping structure in this case, they just pick whatever is in the template as a base. As a result, we allow the core to dynamically change the content of the templates. He who can do more can do less, so during the checking steps, make sure to enable the ECC requirement just for the time of the checks. Signed-off-by: Miquel Raynal --- include/linux/mtd/spinand.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/mtd/spinand.h b/include/linux/mtd/spinand.h index e1f19664bb25..896e9b5de0c4 100644 --- a/include/linux/mtd/spinand.h +++ b/include/linux/mtd/spinand.h @@ -684,8 +684,6 @@ struct spinand_info { struct spinand_dirmap { struct spi_mem_dirmap_desc *wdesc; struct spi_mem_dirmap_desc *rdesc; - struct spi_mem_dirmap_desc *wdesc_ecc; - struct spi_mem_dirmap_desc *rdesc_ecc; }; /** -- cgit v1.2.3 From 39d0ea33123ffe0214217b529830ad91574c8757 Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Wed, 29 Apr 2026 19:56:41 +0200 Subject: spi: spi-mem: Transform the read operation template As of now, we only use a single operation template when creating SPI memory direct mappings. With the idea to extend this possibility to 2, rename the template to reflect that we are currently setting the "primary" operation, and create a pointer in the same structure to point to it. From a user point of view, the op_tmpl name remains but becomes a pointer, leading to minor changes in both the SPI NAND and SPI NOR cores. There is no functional change. Acked-by: Mark Brown Signed-off-by: Miquel Raynal --- include/linux/spi/spi-mem.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h index c8e207522223..9a96ddace3eb 100644 --- a/include/linux/spi/spi-mem.h +++ b/include/linux/spi/spi-mem.h @@ -237,7 +237,8 @@ struct spi_mem_op { * direction is directly encoded in the ->op_tmpl.data.dir field. */ struct spi_mem_dirmap_info { - struct spi_mem_op op_tmpl; + struct spi_mem_op *op_tmpl; + struct spi_mem_op primary_op_tmpl; u64 offset; u64 length; }; -- cgit v1.2.3 From 6f96f2fa152518d93ffeedbea781db50aef7f7dc Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Wed, 29 Apr 2026 19:56:42 +0200 Subject: spi: spi-mem: Create a secondary read operation In some situations, direct mappings may need to use different operation templates. For instance, when enabling continuous reads, Winbond SPI NANDs no longer expect address cycles because they would be ignoring them otherwise. Hence, right after the command opcode, they start counting dummy cycles, followed by the data cycles as usual. This breaks the assumptions of "reads from cache" always being done identically once the best variant has been picked up, across the lifetime of the system. In order to support this feature, we must give direct mapping more than a single operation template to use, in order to switch to using secondary operations upon request by the upper layer. Create the concept of optional secondary operation template, which may or may not be fulfilled by the SPI NAND and SPI NOR cores. If the underlying SPI controller does not leverage any kind of direct mapping acceleration, the feature has no impact and can be freely used. Otherwise, the controller driver needs to opt-in for using this feature, if supported. The condition checked to know whether a secondary operation has been provided or not is to look for a non zero opcode to limit the creation of extra variables. In practice, the opcode 0x00 exist, but is not related to any cache related operation. Acked-by: Mark Brown Signed-off-by: Miquel Raynal --- include/linux/spi/spi-mem.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h index 9a96ddace3eb..2012a3b2ef91 100644 --- a/include/linux/spi/spi-mem.h +++ b/include/linux/spi/spi-mem.h @@ -227,6 +227,8 @@ struct spi_mem_op { * struct spi_mem_dirmap_info - Direct mapping information * @op_tmpl: operation template that should be used by the direct mapping when * the memory device is accessed + * @secondary_op_tmpl: secondary template, may be used as an alternative to the + * primary template (decided by the upper layer) * @offset: absolute offset this direct mapping is pointing to * @length: length in byte of this direct mapping * @@ -239,6 +241,7 @@ struct spi_mem_op { struct spi_mem_dirmap_info { struct spi_mem_op *op_tmpl; struct spi_mem_op primary_op_tmpl; + struct spi_mem_op secondary_op_tmpl; u64 offset; u64 length; }; @@ -382,12 +385,14 @@ struct spi_controller_mem_ops { * @swap16: Supports swapping bytes on a 16 bit boundary when configured in * Octal DTR * @per_op_freq: Supports per operation frequency switching + * @secondary_op_tmpl: Supports leveraging a secondary memory operation template */ struct spi_controller_mem_caps { bool dtr; bool ecc; bool swap16; bool per_op_freq; + bool secondary_op_tmpl; }; #define spi_mem_controller_is_capable(ctlr, cap) \ -- cgit v1.2.3 From 38fbe4b3f66e5b8e2f2ab8e7ca3d912e1e935fe2 Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Thu, 26 Mar 2026 17:47:15 +0100 Subject: spi: spi-mem: Add a no_cs_assertion capability Some controllers are 'smart', and that's a problem. For instance, the Cadence quadspi controller is capable of deasserting the CS automatically whenever a too long period of time without any data to transfer elapses. This 'feature' combined with a loaded interconnect with arbitration, a "long" transfer may be split into smaller DMA transfers. In this case the controller may allow itself to deassert the CS between chunks. Deasserting the CS stops any ongoing continuous read. Reasserting it later to continue the reading will only result in the host getting garbage. In this case, the host controller driver has no control over the CS state, so we cannot reliably enable continuous reads. Flag this limitation through a spi-mem controller capability. The inversion in the flag name (starting with 'no_') is voluntary, in order to avoid the need to set this flag in all controller drivers. Only the broken controllers shall set this bit, the default being that the controller masters its CS fully. Reviewed-by: Mark Brown Signed-off-by: Miquel Raynal --- include/linux/spi/spi-mem.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h index 2012a3b2ef91..722abd9aee3c 100644 --- a/include/linux/spi/spi-mem.h +++ b/include/linux/spi/spi-mem.h @@ -385,7 +385,10 @@ struct spi_controller_mem_ops { * @swap16: Supports swapping bytes on a 16 bit boundary when configured in * Octal DTR * @per_op_freq: Supports per operation frequency switching - * @secondary_op_tmpl: Supports leveraging a secondary memory operation template + * @no_cs_assertion: The controller may automatically deassert the CS if there + * is a pause in the transfer (eg. internal bus contention or + * DMA arbitration on an interconnect). Features such as NAND + * continuous reads shall not be leveraged. */ struct spi_controller_mem_caps { bool dtr; @@ -393,6 +396,7 @@ struct spi_controller_mem_caps { bool swap16; bool per_op_freq; bool secondary_op_tmpl; + bool no_cs_assertion; }; #define spi_mem_controller_is_capable(ctlr, cap) \ -- cgit v1.2.3 From 6eb7c193e751f057b2d75af9b174cfe5dd060696 Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Wed, 29 Apr 2026 19:56:43 +0200 Subject: mtd: spinand: Use secondary ops for continuous reads In case a chip supports continuous reads, but uses a slightly different cache operation for these, it may provide a secondary operation template which will be used only during continuous cache read operations. From a vendor driver point of view, enabling this feature implies providing a new set of templates for these continuous read operations. The core will automatically pick the fastest variant, depending on the hardware capabilities. Signed-off-by: Miquel Raynal --- include/linux/mtd/spinand.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/linux/mtd/spinand.h b/include/linux/mtd/spinand.h index f53f5f0499b4..44f4347104d6 100644 --- a/include/linux/mtd/spinand.h +++ b/include/linux/mtd/spinand.h @@ -583,6 +583,7 @@ enum spinand_bus_interface { * @op_variants.read_cache: variants of the read-cache operation * @op_variants.write_cache: variants of the write-cache operation * @op_variants.update_cache: variants of the update-cache operation + * @op_variants.cont_read_cache: variants of the continuous read-cache operation * @vendor_ops: vendor specific operations * @select_target: function used to select a target/die. Required only for * multi-die chips @@ -607,6 +608,7 @@ struct spinand_info { const struct spinand_op_variants *read_cache; const struct spinand_op_variants *write_cache; const struct spinand_op_variants *update_cache; + const struct spinand_op_variants *cont_read_cache; } op_variants; const struct spinand_op_variants *vendor_ops; int (*select_target)(struct spinand_device *spinand, @@ -636,6 +638,14 @@ struct spinand_info { .update_cache = __update, \ } +#define SPINAND_INFO_OP_VARIANTS_WITH_CONT(__read, __write, __update, __cont_read) \ + { \ + .read_cache = __read, \ + .write_cache = __write, \ + .update_cache = __update, \ + .cont_read_cache = __cont_read, \ + } + #define SPINAND_INFO_VENDOR_OPS(__ops) \ .vendor_ops = __ops @@ -707,6 +717,7 @@ struct spinand_dirmap { * @read_cache: read cache op template * @write_cache: write cache op template * @update_cache: update cache op template + * @cont_read_cache: continuous read cache op template (optional) */ struct spinand_mem_ops { struct spi_mem_op reset; @@ -721,6 +732,7 @@ struct spinand_mem_ops { const struct spi_mem_op *read_cache; const struct spi_mem_op *write_cache; const struct spi_mem_op *update_cache; + const struct spi_mem_op *cont_read_cache; }; /** -- cgit v1.2.3 From cb3c257e08248521b22c67259d50ebb18574d1a1 Mon Sep 17 00:00:00 2001 From: Charles Keepax Date: Thu, 30 Apr 2026 16:09:29 +0100 Subject: ASoC: SDCA: Add correct masks whilst reporting SDCA jack status Currently, all SDCA jacks simply report against a mask of 0xFFFF. This works fine for system with a single SDCA jack control as the status reflects that single control at all times. However, if two SDCA jack controls exist in the system, such as a separate representation for input and output, then the second control can cancel reports from the other since it will only report its relevant bits and zero in all other slots. This is exactly what the mask is for. Build up a mask using all the possible states for an SCDA jack control at registration time and use that mask when reporting a particular jack. It is worth noting this still doesn't handle cases such as two headphone jacks as that would require separate ALSA jacks to report to. Reviewed-by: Pierre-Louis Bossart Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260430150931.2025953-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown --- include/sound/sdca_jack.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/sound/sdca_jack.h b/include/sound/sdca_jack.h index 3ec22046d3eb..181541f0f4d8 100644 --- a/include/sound/sdca_jack.h +++ b/include/sound/sdca_jack.h @@ -18,10 +18,13 @@ struct snd_soc_jack; * struct jack_state - Jack state structure to keep data between interrupts * @kctl: Pointer to the ALSA control attached to this jack * @jack: Pointer to the ASoC jack struct for this jack + * @mask: Possible reported jack status bits for this jack */ struct jack_state { struct snd_kcontrol *kctl; struct snd_soc_jack *jack; + + unsigned int mask; }; int sdca_jack_alloc_state(struct sdca_interrupt *interrupt); -- cgit v1.2.3 From df036250d7d5f751de04300a5600b2dadb927ae9 Mon Sep 17 00:00:00 2001 From: Charles Keepax Date: Thu, 30 Apr 2026 16:09:30 +0100 Subject: ASoC: SDCA: Remove sdca_function_data duplication The class driver internally has an array of sdca_function_data pointers that it uses to store the parsed DisCo data. However, there is already an sdca_function_data attached to the auxdev device. It makes more sense to use the one already provided in the auxdev device, as it could also be used by custom drivers for parts that require those. Using the auxdev copy also prevents the need for the class function drivers to search through the array for the correct data, which currently is based off matching the function type. This has problems when two functions have the same type as the current code will find the same data for both drivers, using the auxdev copy of the data avoids this problem. Reviewed-by: Pierre-Louis Bossart Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260430150931.2025953-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown --- include/sound/sdca_function.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/sound/sdca_function.h b/include/sound/sdca_function.h index 0e871c786513..b1489178b0ef 100644 --- a/include/sound/sdca_function.h +++ b/include/sound/sdca_function.h @@ -1452,7 +1452,6 @@ static inline u32 sdca_range_search(struct sdca_control_range *range, } int sdca_parse_function(struct device *dev, struct sdw_slave *sdw, - struct sdca_function_desc *desc, struct sdca_function_data *function); const char *sdca_find_terminal_name(enum sdca_terminal_type type); -- cgit v1.2.3 From 250922577ed16c29b994197b84a231dcbe7798e8 Mon Sep 17 00:00:00 2001 From: Charles Keepax Date: Thu, 30 Apr 2026 16:09:31 +0100 Subject: ASoC: SDCA: Support devices with multiple functions of identical type It is possible that SDCAs devices might have multiple functions of the same type, as the entity names within a function are defined by the specification it is very likely such a device will have duplicate entities. This causes problems where DAIs and ALSA controls end up with clashing names. This can be handled by adding the function address into the names to ensure uniqueness, although, ideally this would have been included from the start. User-space already has UCM using the current control names, so as a compromise the first function of a given type will use the raw entity names, then duplicates will get an added function address. Reviewed-by: Pierre-Louis Bossart Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260430150931.2025953-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown --- include/sound/sdca.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/sound/sdca.h b/include/sound/sdca.h index 67ff3c88705d..2bdf4e333e04 100644 --- a/include/sound/sdca.h +++ b/include/sound/sdca.h @@ -26,6 +26,8 @@ struct sdca_dev; * @name: Human-readable string. * @type: Function topology type. * @adr: ACPI address (used for SDCA register access). + * @duplicate: Internal flag to indicate if other functions of the same type + * exist. */ struct sdca_function_desc { struct fwnode_handle *node; @@ -33,6 +35,8 @@ struct sdca_function_desc { const char *name; u32 type; u8 adr; + + bool duplicate; }; /** -- cgit v1.2.3 From a1b6cf8e5e7e9102f114f58e599ef1758c732efb Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Tue, 7 Apr 2026 13:49:51 +0300 Subject: drm: uapi: Use SPDX in DRM core uAPI headers The DRM core uAPI headers are licensed under the MIT license, and carry copies of the license with slight variations. Replace them with SPDX headers. Following a discussion with Simona Vetter on this topic, add a clarification in the drm-uapi.rst file that independent closed-source userspace implementations of software using the DRM uAPI are accepted, as allowed by the MIT license. Signed-off-by: Laurent Pinchart Reviewed-by: Greg Kroah-Hartman Reviewed-by: Thomas Gleixner Reviewed-by: Simona Vetter Reviewed-by: Dave Airlie Link: https://patch.msgid.link/20260407104951.1781047-1-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Tomi Valkeinen --- include/uapi/drm/drm.h | 20 +------------------- include/uapi/drm/drm_fourcc.h | 20 +------------------- include/uapi/drm/drm_mode.h | 19 +------------------ include/uapi/drm/drm_sarea.h | 20 +------------------- 4 files changed, 4 insertions(+), 75 deletions(-) (limited to 'include') diff --git a/include/uapi/drm/drm.h b/include/uapi/drm/drm.h index 495462e44a17..bc7ef7684099 100644 --- a/include/uapi/drm/drm.h +++ b/include/uapi/drm/drm.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: MIT */ /* * Header for the Direct Rendering Manager * @@ -11,25 +12,6 @@ * Copyright 1999 Precision Insight, Inc., Cedar Park, Texas. * Copyright 2000 VA Linux Systems, Inc., Sunnyvale, California. * All rights reserved. - * - * Permission is hereby granted, free of charge, to any person obtaining a - * copy of this software and associated documentation files (the "Software"), - * to deal in the Software without restriction, including without limitation - * the rights to use, copy, modify, merge, publish, distribute, sublicense, - * and/or sell copies of the Software, and to permit persons to whom the - * Software is furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice (including the next - * paragraph) shall be included in all copies or substantial portions of the - * Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL - * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR - * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, - * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR - * OTHER DEALINGS IN THE SOFTWARE. */ #ifndef _DRM_H_ diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index ac66fa93b5a3..2caf8249f892 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -1,24 +1,6 @@ +/* SPDX-License-Identifier: MIT */ /* * Copyright 2011 Intel Corporation - * - * Permission is hereby granted, free of charge, to any person obtaining a - * copy of this software and associated documentation files (the "Software"), - * to deal in the Software without restriction, including without limitation - * the rights to use, copy, modify, merge, publish, distribute, sublicense, - * and/or sell copies of the Software, and to permit persons to whom the - * Software is furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice (including the next - * paragraph) shall be included in all copies or substantial portions of the - * Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL - * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR - * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, - * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR - * OTHER DEALINGS IN THE SOFTWARE. */ #ifndef DRM_FOURCC_H diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h index a4bdc4bd11bc..381a3e857d4e 100644 --- a/include/uapi/drm/drm_mode.h +++ b/include/uapi/drm/drm_mode.h @@ -1,27 +1,10 @@ +/* SPDX-License-Identifier: MIT */ /* * Copyright (c) 2007 Dave Airlie * Copyright (c) 2007 Jakob Bornecrantz * Copyright (c) 2008 Red Hat Inc. * Copyright (c) 2007-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA * Copyright (c) 2007-2008 Intel Corporation - * - * Permission is hereby granted, free of charge, to any person obtaining a - * copy of this software and associated documentation files (the "Software"), - * to deal in the Software without restriction, including without limitation - * the rights to use, copy, modify, merge, publish, distribute, sublicense, - * and/or sell copies of the Software, and to permit persons to whom the - * Software is furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS - * IN THE SOFTWARE. */ #ifndef _DRM_MODE_H diff --git a/include/uapi/drm/drm_sarea.h b/include/uapi/drm/drm_sarea.h index a951ced60ebe..1e38d028332d 100644 --- a/include/uapi/drm/drm_sarea.h +++ b/include/uapi/drm/drm_sarea.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: MIT */ /** * \file drm_sarea.h * \brief SAREA definitions @@ -8,25 +9,6 @@ /* * Copyright 2002 Tungsten Graphics, Inc., Cedar Park, Texas. * All Rights Reserved. - * - * Permission is hereby granted, free of charge, to any person obtaining a - * copy of this software and associated documentation files (the "Software"), - * to deal in the Software without restriction, including without limitation - * the rights to use, copy, modify, merge, publish, distribute, sublicense, - * and/or sell copies of the Software, and to permit persons to whom the - * Software is furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice (including the next - * paragraph) shall be included in all copies or substantial portions of the - * Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL - * TUNGSTEN GRAPHICS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR - * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, - * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR - * OTHER DEALINGS IN THE SOFTWARE. */ #ifndef _DRM_SAREA_H_ -- cgit v1.2.3 From d4c14903bf5e28e740516c4fbb7db01e0dedf3af Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6nig?= Date: Mon, 10 Nov 2025 19:58:10 +0100 Subject: dma-buf/dma_fence_array: remove unused functionality v4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Amdgpu was the only user of the signal on any feature and we dropped that use case recently, so we can remove that functionality. v2: update num_pending only after the fence is signaled v3: separate out simplifying dma_fence_array implementation v4: fix XE patch split fallout Signed-off-by: Christian König Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260422103012.1647-1-christian.koenig@amd.com --- include/linux/dma-fence-array.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/dma-fence-array.h b/include/linux/dma-fence-array.h index 370b3d2bba37..1b1d87579c38 100644 --- a/include/linux/dma-fence-array.h +++ b/include/linux/dma-fence-array.h @@ -81,13 +81,11 @@ to_dma_fence_array(struct dma_fence *fence) struct dma_fence_array *dma_fence_array_alloc(int num_fences); void dma_fence_array_init(struct dma_fence_array *array, int num_fences, struct dma_fence **fences, - u64 context, unsigned seqno, - bool signal_on_any); + u64 context, unsigned seqno); struct dma_fence_array *dma_fence_array_create(int num_fences, struct dma_fence **fences, - u64 context, unsigned seqno, - bool signal_on_any); + u64 context, unsigned seqno); bool dma_fence_match_context(struct dma_fence *fence, u64 context); -- cgit v1.2.3 From 4f42beeb9796e24e8009c46d1a2d676803e5ab24 Mon Sep 17 00:00:00 2001 From: Ashish Mhetre Date: Thu, 30 Apr 2026 09:52:00 +0000 Subject: memory: tegra: Make ->resume() callback return void tegra186_mc_resume() is the only implementation of the SoC ->resume() op in struct tegra_mc_ops, and it can never fail as the SID override loop has no error path. The int return value is therefore not used. Change the prototype to return void so callers do not need to deal with a value that is always 0. If a future SoC needs to report failure from resume, an int return type can be reintroduced then. Signed-off-by: Ashish Mhetre Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260430095202.1167651-2-amhetre@nvidia.com Signed-off-by: Krzysztof Kozlowski --- include/soc/tegra/mc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/soc/tegra/mc.h b/include/soc/tegra/mc.h index e6da035d1306..25d465d70493 100644 --- a/include/soc/tegra/mc.h +++ b/include/soc/tegra/mc.h @@ -164,7 +164,7 @@ struct tegra_mc_ops { */ int (*probe)(struct tegra_mc *mc); void (*remove)(struct tegra_mc *mc); - int (*resume)(struct tegra_mc *mc); + void (*resume)(struct tegra_mc *mc); int (*probe_device)(struct tegra_mc *mc, struct device *dev); }; -- cgit v1.2.3 From bf7cf25d4245fe49c71eba0e3b09b6260a336999 Mon Sep 17 00:00:00 2001 From: Ashish Mhetre Date: Mon, 27 Apr 2026 07:34:18 +0000 Subject: dt-bindings: memory: tegra: Add nvidia,tegra238-mc compatible Document the device tree binding for the Tegra238 memory controller. Tegra238 has 8 memory controller channels plus broadcast and stream-id registers. Add the stream ID header (nvidia,tegra238-mc.h) defining ISO and NISO stream IDs for SMMU configuration. Signed-off-by: Ashish Mhetre Reviewed-by: Jon Hunter Link: https://patch.msgid.link/20260427073419.567360-2-amhetre@nvidia.com Signed-off-by: Krzysztof Kozlowski --- include/dt-bindings/memory/nvidia,tegra238-mc.h | 74 +++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 include/dt-bindings/memory/nvidia,tegra238-mc.h (limited to 'include') diff --git a/include/dt-bindings/memory/nvidia,tegra238-mc.h b/include/dt-bindings/memory/nvidia,tegra238-mc.h new file mode 100644 index 000000000000..be24c0eb3f15 --- /dev/null +++ b/include/dt-bindings/memory/nvidia,tegra238-mc.h @@ -0,0 +1,74 @@ +/* SPDX-License-Identifier: (GPL-2.0 OR MIT) */ +/* Copyright (c) 2026, NVIDIA CORPORATION. All rights reserved. */ + +#ifndef DT_BINDINGS_MEMORY_TEGRA238_MC_H +#define DT_BINDINGS_MEMORY_TEGRA238_MC_H + +/* special clients */ +#define TEGRA238_SID_INVALID 0x0 +#define TEGRA238_SID_PASSTHROUGH 0x7f + +/* ISO stream IDs */ +#define TEGRA238_SID_ISO_NVDISPLAY 0x1 +#define TEGRA238_SID_ISO_APE0 0x2 +#define TEGRA238_SID_ISO_APE1 0x3 + +/* NISO stream IDs */ +#define TEGRA238_SID_AON 0x1 +#define TEGRA238_SID_BPMP 0x2 +#define TEGRA238_SID_ETR 0x3 +#define TEGRA238_SID_FDE 0x4 +#define TEGRA238_SID_HC 0x5 +#define TEGRA238_SID_HDA 0x6 +#define TEGRA238_SID_NVDEC 0x7 +#define TEGRA238_SID_NVDISPLAY 0x8 +#define TEGRA238_SID_NVENC 0x9 +#define TEGRA238_SID_OFA 0xa +#define TEGRA238_SID_PCIE0 0xb +#define TEGRA238_SID_PCIE1 0xc +#define TEGRA238_SID_PCIE2 0xd +#define TEGRA238_SID_PCIE3 0xe +#define TEGRA238_SID_HWMP_PMA 0xf +#define TEGRA238_SID_PSC 0x10 +#define TEGRA238_SID_SDMMC1A 0x11 +#define TEGRA238_SID_SDMMC4A 0x12 +#define TEGRA238_SID_SES_SE0 0x13 +#define TEGRA238_SID_SES_SE1 0x14 +#define TEGRA238_SID_SES_SE2 0x15 +#define TEGRA238_SID_SEU1_SE0 0x16 +#define TEGRA238_SID_SEU1_SE1 0x17 +#define TEGRA238_SID_SEU1_SE2 0x18 +#define TEGRA238_SID_TSEC 0x19 +#define TEGRA238_SID_UFSHC 0x1a +#define TEGRA238_SID_VIC 0x1b +#define TEGRA238_SID_XUSB_HOST 0x1c +#define TEGRA238_SID_XUSB_DEV 0x1d +#define TEGRA238_SID_GPCDMA_0 0x1e +#define TEGRA238_SID_SMMU_TEST 0x1f + +/* Host1x virtualization clients. */ +#define TEGRA238_SID_HOST1X_CTX0 0x20 +#define TEGRA238_SID_HOST1X_CTX1 0x21 +#define TEGRA238_SID_HOST1X_CTX2 0x22 +#define TEGRA238_SID_HOST1X_CTX3 0x23 +#define TEGRA238_SID_HOST1X_CTX4 0x24 +#define TEGRA238_SID_HOST1X_CTX5 0x25 +#define TEGRA238_SID_HOST1X_CTX6 0x26 +#define TEGRA238_SID_HOST1X_CTX7 0x27 + +#define TEGRA238_SID_XUSB_VF0 0x28 +#define TEGRA238_SID_XUSB_VF1 0x29 +#define TEGRA238_SID_XUSB_VF2 0x2a +#define TEGRA238_SID_XUSB_VF3 0x2b + +/* Host1x command buffers */ +#define TEGRA238_SID_HC_VM0 0x2c +#define TEGRA238_SID_HC_VM1 0x2d +#define TEGRA238_SID_HC_VM2 0x2e +#define TEGRA238_SID_HC_VM3 0x2f +#define TEGRA238_SID_HC_VM4 0x30 +#define TEGRA238_SID_HC_VM5 0x31 +#define TEGRA238_SID_HC_VM6 0x32 +#define TEGRA238_SID_HC_VM7 0x33 + +#endif -- cgit v1.2.3 From b0822a883408f32d494ce9cdc26f4266774cf3f1 Mon Sep 17 00:00:00 2001 From: Svyatoslav Ryhel Date: Mon, 27 Apr 2026 10:03:06 +0300 Subject: dt-bindings: memory: Document Tegra114 Memory Controller Add Tegra114 support into existing Tegra124 MC schema with the most notable difference in the amount of EMEM timings. Each memory client has unique hardware ID, add these IDs. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260427070312.81679-2-clamor95@gmail.com Signed-off-by: Krzysztof Kozlowski --- include/dt-bindings/memory/tegra114-mc.h | 67 ++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/memory/tegra114-mc.h b/include/dt-bindings/memory/tegra114-mc.h index dfe99c8a5ba5..5e0d6a1b91f2 100644 --- a/include/dt-bindings/memory/tegra114-mc.h +++ b/include/dt-bindings/memory/tegra114-mc.h @@ -40,4 +40,71 @@ #define TEGRA114_MC_RESET_VDE 14 #define TEGRA114_MC_RESET_VI 15 +#define TEGRA114_MC_PTCR 0 +#define TEGRA114_MC_DISPLAY0A 1 +#define TEGRA114_MC_DISPLAY0AB 2 +#define TEGRA114_MC_DISPLAY0B 3 +#define TEGRA114_MC_DISPLAY0BB 4 +#define TEGRA114_MC_DISPLAY0C 5 +#define TEGRA114_MC_DISPLAY0CB 6 +#define TEGRA114_MC_DISPLAY1B 7 +#define TEGRA114_MC_DISPLAY1BB 8 +#define TEGRA114_MC_EPPUP 9 +#define TEGRA114_MC_G2PR 10 +#define TEGRA114_MC_G2SR 11 +#define TEGRA114_MC_MPEUNIFBR 12 +#define TEGRA114_MC_VIRUV 13 +#define TEGRA114_MC_AFIR 14 +#define TEGRA114_MC_AVPCARM7R 15 +#define TEGRA114_MC_DISPLAYHC 16 +#define TEGRA114_MC_DISPLAYHCB 17 +#define TEGRA114_MC_FDCDRD 18 +#define TEGRA114_MC_FDCDRD2 19 +#define TEGRA114_MC_G2DR 20 +#define TEGRA114_MC_HDAR 21 +#define TEGRA114_MC_HOST1XDMAR 22 +#define TEGRA114_MC_HOST1XR 23 +#define TEGRA114_MC_IDXSRD 24 +#define TEGRA114_MC_IDXSRD2 25 +#define TEGRA114_MC_MPE_IPRED 26 +#define TEGRA114_MC_MPEAMEMRD 27 +#define TEGRA114_MC_MPECSRD 28 +#define TEGRA114_MC_PPCSAHBDMAR 29 +#define TEGRA114_MC_PPCSAHBSLVR 30 +#define TEGRA114_MC_SATAR 31 +#define TEGRA114_MC_TEXSRD 32 +#define TEGRA114_MC_TEXSRD2 33 +#define TEGRA114_MC_VDEBSEVR 34 +#define TEGRA114_MC_VDEMBER 35 +#define TEGRA114_MC_VDEMCER 36 +#define TEGRA114_MC_VDETPER 37 +#define TEGRA114_MC_MPCORELPR 38 +#define TEGRA114_MC_MPCORER 39 +#define TEGRA114_MC_EPPU 40 +#define TEGRA114_MC_EPPV 41 +#define TEGRA114_MC_EPPY 42 +#define TEGRA114_MC_MPEUNIFBW 43 +#define TEGRA114_MC_VIWSB 44 +#define TEGRA114_MC_VIWU 45 +#define TEGRA114_MC_VIWV 46 +#define TEGRA114_MC_VIWY 47 +#define TEGRA114_MC_G2DW 48 +#define TEGRA114_MC_AFIW 49 +#define TEGRA114_MC_AVPCARM7W 50 +#define TEGRA114_MC_FDCDWR 51 +#define TEGRA114_MC_FDCDWR2 52 +#define TEGRA114_MC_HDAW 53 +#define TEGRA114_MC_HOST1XW 54 +#define TEGRA114_MC_ISPW 55 +#define TEGRA114_MC_MPCORELPW 56 +#define TEGRA114_MC_MPCOREW 57 +#define TEGRA114_MC_MPECSWR 58 +#define TEGRA114_MC_PPCSAHBDMAW 59 +#define TEGRA114_MC_PPCSAHBSLVW 60 +#define TEGRA114_MC_SATAW 61 +#define TEGRA114_MC_VDEBSEVW 62 +#define TEGRA114_MC_VDEDBGW 63 +#define TEGRA114_MC_VDEMBEW 64 +#define TEGRA114_MC_VDETPMW 65 + #endif -- cgit v1.2.3 From 627e28455578d2faef6552cd15d241b20e27e423 Mon Sep 17 00:00:00 2001 From: Prabhudasu Vatala Date: Sun, 3 May 2026 19:48:26 +0530 Subject: driver core: class: fix typo in struct class documentation Fix a spelling error in the comment for the ns_type member of struct class. Change "detemine" to "determine". Signed-off-by: Prabhudasu Vatala Link: https://patch.msgid.link/20260503141826.27462-1-prabhudasuvatala@gmail.com Signed-off-by: Danilo Krummrich --- include/linux/device/class.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/device/class.h b/include/linux/device/class.h index 78ab8d2b3e30..9db1d61ba743 100644 --- a/include/linux/device/class.h +++ b/include/linux/device/class.h @@ -34,7 +34,7 @@ struct fwnode_handle; * @class_release: Called to release this class. * @dev_release: Called to release the device. * @shutdown_pre: Called at shut-down time before driver shutdown. - * @ns_type: Callbacks so sysfs can detemine namespaces. + * @ns_type: Callbacks so sysfs can determine namespaces. * @namespace: Namespace of the device belongs to this class. * @get_ownership: Allows class to specify uid/gid of the sysfs directories * for the devices belonging to the class. Usually tied to -- cgit v1.2.3 From e4f26243953fd3e87df93786b40293ca3a6a465e Mon Sep 17 00:00:00 2001 From: Koichiro Den Date: Tue, 14 Apr 2026 23:15:14 +0900 Subject: PCI: endpoint: pci-ep-msi: Add embedded doorbell fallback Some endpoint platforms cannot use platform MSI / GIC ITS to implement EP-side doorbells. In those cases, EPF drivers cannot provide an interrupt-driven doorbell and often fall back to polling. Add an "embedded" doorbell backend that uses a controller-integrated doorbell target (e.g. DesignWare integrated eDMA interrupt-emulation doorbell). The backend locates the doorbell register and a corresponding Linux IRQ via the EPC aux-resource API. If the doorbell register is already exposed via a fixed BAR mapping, provide BAR+offset. Otherwise provide the DMA address returned by dma_map_resource() (which may be an IOVA when an IOMMU is enabled) so EPF drivers can map it into BAR space. When MSI doorbell allocation fails with -ENODEV, pci_epf_alloc_doorbell() falls back to this embedded backend. Suggested-by: Manivannan Sadhasivam Signed-off-by: Koichiro Den Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260414141514.1341429-8-den@valinux.co.jp --- include/linux/pci-epf.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/pci-epf.h b/include/linux/pci-epf.h index cd747447a1ea..8a6c64a35890 100644 --- a/include/linux/pci-epf.h +++ b/include/linux/pci-epf.h @@ -171,6 +171,12 @@ enum pci_epf_doorbell_type { * (NO_BAR if not) * @offset: offset within @bar for the doorbell target (valid iff * @bar != NO_BAR) + * @iova_base: Internal: base DMA address returned by dma_map_resource() for the + * embedded doorbell MMIO window (used only for unmapping). Valid + * when @type is PCI_EPF_DOORBELL_EMBEDDED and @iova_size is + * non-zero. + * @iova_size: Internal: size of the dma_map_resource() mapping at @iova_base. + * Zero when no mapping was created (e.g. pre-exposed fixed BAR). */ struct pci_epf_doorbell_msg { struct msi_msg msg; @@ -179,6 +185,8 @@ struct pci_epf_doorbell_msg { enum pci_epf_doorbell_type type; enum pci_barno bar; resource_size_t offset; + dma_addr_t iova_base; + size_t iova_size; }; /** -- cgit v1.2.3 From 3f3aa77ff1c8b45ec8c9e40212f1a24a93e00df3 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Fri, 1 May 2026 13:59:16 +0000 Subject: net/sched: add qstats_cpu_drop_inc() helper 1) Using this_cpu_inc() is better than going through this_cpu_ptr(): - Single instruction on x86. - Store tearing prevention. 2) Change tcf_action_update_stats() to use this_cpu_add(). 3) Add WRITE_ONCE() to __qdisc_qstats_drop() and qstats_drop_inc() in preparation for lockless "tc qdisc show". $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 3/17 up/down: 72/-216 (-144) Function old new delta dualpi2_enqueue_skb 462 511 +49 tcf_ife_act 1061 1077 +16 taprio_enqueue 613 620 +7 codel_qdisc_enqueue 149 143 -6 tcf_vlan_act 684 676 -8 tcf_skbedit_act 626 618 -8 tcf_police_act 725 717 -8 tcf_mpls_act 1297 1289 -8 tcf_gate_act 310 302 -8 tcf_gact_act 222 214 -8 tcf_csum_act 2438 2430 -8 tcf_bpf_act 709 701 -8 tcf_action_update_stats 124 115 -9 pie_qdisc_enqueue 865 856 -9 pfifo_enqueue 116 107 -9 choke_enqueue 2069 2059 -10 plug_enqueue 139 128 -11 bfifo_enqueue 121 110 -11 tcf_nat_act 1501 1489 -12 gred_enqueue 1743 1668 -75 Total: Before=24388609, After=24388465, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260501135916.2566766-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/act_api.h | 2 +- include/net/sch_generic.h | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/act_api.h b/include/net/act_api.h index 2ec4ef9a5d0c..167435c5615e 100644 --- a/include/net/act_api.h +++ b/include/net/act_api.h @@ -241,7 +241,7 @@ static inline void tcf_action_update_bstats(struct tc_action *a, static inline void tcf_action_inc_drop_qstats(struct tc_action *a) { if (likely(a->cpu_qstats)) { - qstats_drop_inc(this_cpu_ptr(a->cpu_qstats)); + qstats_cpu_drop_inc(a->cpu_qstats); return; } atomic_inc(&a->tcfa_drops); diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index cbfe9ed435fd..ccfabfac674e 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -996,12 +996,17 @@ static inline void qdisc_qstats_cpu_requeues_inc(struct Qdisc *sch) static inline void __qdisc_qstats_drop(struct Qdisc *sch, int count) { - sch->qstats.drops += count; + WRITE_ONCE(sch->qstats.drops, sch->qstats.drops + count); } static inline void qstats_drop_inc(struct gnet_stats_queue *qstats) { - qstats->drops++; + WRITE_ONCE(qstats->drops, qstats->drops + 1); +} + +static inline void qstats_cpu_drop_inc(struct gnet_stats_queue __percpu *qstats) +{ + this_cpu_inc(qstats->drops); } static inline void qstats_cpu_overlimit_inc(struct gnet_stats_queue __percpu *qstats) -- cgit v1.2.3 From 726fa7da2d8c9c021eefad178097448b0356a284 Mon Sep 17 00:00:00 2001 From: Ujjal Roy Date: Sat, 2 May 2026 13:19:02 +0000 Subject: ipv4: igmp: get rid of IGMPV3_{QQIC,MRC} and simplify calculation Get rid of the IGMPV3_MRC macro and use the igmpv3_mrt() API to calculate the Max Resp Time from the Maximum Response Code. Similarly, for IGMPV3_QQIC, use the igmpv3_qqi() API to calculate the Querier's Query Interval from the QQIC field. Reviewed-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Signed-off-by: Ujjal Roy Link: https://patch.msgid.link/20260502131907.987-2-royujjal@gmail.com Signed-off-by: Jakub Kicinski --- include/linux/igmp.h | 80 ++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 72 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/igmp.h b/include/linux/igmp.h index 073b30a9b850..0e095c9f234e 100644 --- a/include/linux/igmp.h +++ b/include/linux/igmp.h @@ -92,15 +92,79 @@ struct ip_mc_list { struct rcu_head rcu; }; +/* RFC3376, relevant sections: + * - 4.1.1. Maximum Response Code + * - 4.1.7. QQIC (Querier's Query Interval Code) + * + * For both MRC and QQIC, values >= 128 use the same floating-point + * encoding as follows: + * + * 0 1 2 3 4 5 6 7 + * +-+-+-+-+-+-+-+-+ + * |1| exp | mant | + * +-+-+-+-+-+-+-+-+ + */ +#define IGMPV3_FP_EXP(value) (((value) >> 4) & 0x07) +#define IGMPV3_FP_MAN(value) ((value) & 0x0f) + +/* IGMPv3 floating-point exponential field min threshold */ +#define IGMPV3_EXP_MIN_THRESHOLD 128 + /* V3 exponential field decoding */ -#define IGMPV3_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value)) -#define IGMPV3_EXP(thresh, nbmant, nbexp, value) \ - ((value) < (thresh) ? (value) : \ - ((IGMPV3_MASK(value, nbmant) | (1<<(nbmant))) << \ - (IGMPV3_MASK((value) >> (nbmant), nbexp) + (nbexp)))) - -#define IGMPV3_QQIC(value) IGMPV3_EXP(0x80, 4, 3, value) -#define IGMPV3_MRC(value) IGMPV3_EXP(0x80, 4, 3, value) + +/* IGMPv3 MRC/QQIC 8-bit exponential field decode + * + * RFC3376, 4.1.1 & 4.1.7. defines the decoding formula: + * 0 1 2 3 4 5 6 7 + * +-+-+-+-+-+-+-+-+ + * |1| exp | mant | + * +-+-+-+-+-+-+-+-+ + * Max Resp Time = (mant | 0x10) << (exp + 3) + * QQI = (mant | 0x10) << (exp + 3) + */ +static inline unsigned long igmpv3_exp_field_decode(const u8 code) +{ + if (code < IGMPV3_EXP_MIN_THRESHOLD) { + return code; + } else { + unsigned long mc_man, mc_exp; + + mc_exp = IGMPV3_FP_EXP(code); + mc_man = IGMPV3_FP_MAN(code); + + return (mc_man | 0x10) << (mc_exp + 3); + } +} + +/* Calculate Max Resp Time from Maximum Response Code + * + * RFC3376, relevant sections: + * - 4.1.1. Maximum Response Code + * - 8.3. Query Response Interval + * + * After decode, MRC represents the Maximum Response Time (MRT) in + * units of 0.1 seconds (100 ms). + */ +static inline unsigned long igmpv3_mrt(const struct igmpv3_query *ih3) +{ + return igmpv3_exp_field_decode(ih3->code); +} + +/* Calculate Querier's Query Interval from Querier's Query Interval Code + * + * RFC3376, relevant sections: + * - 4.1.7. QQIC (Querier's Query Interval Code) + * - 8.2. Query Interval + * - 8.12. Older Version Querier Present Timeout + * (the [Query Interval] in the last Query received) + * + * After decode, QQIC represents the Querier's Query Interval in units + * of seconds. + */ +static inline unsigned long igmpv3_qqi(const struct igmpv3_query *ih3) +{ + return igmpv3_exp_field_decode(ih3->qqic); +} static inline int ip_mc_may_pull(struct sk_buff *skb, unsigned int len) { -- cgit v1.2.3 From 12cfb4ecc471652890cae362b8609d9f71b46ee9 Mon Sep 17 00:00:00 2001 From: Ujjal Roy Date: Sat, 2 May 2026 13:19:03 +0000 Subject: ipv6: mld: rename mldv2_mrc() and add mldv2_qqi() Rename mldv2_mrc() to mldv2_mrd() as it is used to calculate the Maximum Response Delay from the Maximum Response Code. Introduce a new API mldv2_qqi() to define the existing calculation logic of QQI from QQIC. This also organizes the existing mld_update_qi() API. Reviewed-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Signed-off-by: Ujjal Roy Link: https://patch.msgid.link/20260502131907.987-3-royujjal@gmail.com Signed-off-by: Jakub Kicinski --- include/net/mld.h | 66 +++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 57 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/net/mld.h b/include/net/mld.h index c07359808493..10e402e0fe08 100644 --- a/include/net/mld.h +++ b/include/net/mld.h @@ -89,29 +89,77 @@ struct mld2_query { #define MLDV2_QQIC_EXP(value) (((value) >> 4) & 0x07) #define MLDV2_QQIC_MAN(value) ((value) & 0x0f) -#define MLD_EXP_MIN_LIMIT 32768UL -#define MLDV1_MRD_MAX_COMPAT (MLD_EXP_MIN_LIMIT - 1) +/* MLDv2 QQIC floating-point exponential field min threshold */ +#define MLD_QQIC_MIN_THRESHOLD 128 +/* MLDv2 MRC floating-point exponential field min threshold */ +#define MLD_MRC_MIN_THRESHOLD 32768UL +#define MLDV1_MRD_MAX_COMPAT (MLD_MRC_MIN_THRESHOLD - 1) #define MLD_MAX_QUEUE 8 #define MLD_MAX_SKBS 32 -static inline unsigned long mldv2_mrc(const struct mld2_query *mlh2) +/* V2 exponential field decoding */ + +/* Calculate Maximum Response Delay from Maximum Response Code + * + * RFC3810, relevant sections: + * - 5.1.3. Maximum Response Code defines the decoding formula: + * 0 1 2 3 4 5 6 7 8 9 A B C D E F + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * |1| exp | mant | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * Maximum Response Delay = (mant | 0x1000) << (exp+3) + * - 9.3. Query Response Interval + * + * After decode, MRC represents the Maximum Response Delay (MRD) in + * units of milliseconds. + */ +static inline unsigned long mldv2_mrd(const struct mld2_query *mlh2) { - /* RFC3810, 5.1.3. Maximum Response Code */ - unsigned long ret, mc_mrc = ntohs(mlh2->mld2q_mrc); + unsigned long mc_mrc = ntohs(mlh2->mld2q_mrc); - if (mc_mrc < MLD_EXP_MIN_LIMIT) { - ret = mc_mrc; + if (mc_mrc < MLD_MRC_MIN_THRESHOLD) { + return mc_mrc; } else { unsigned long mc_man, mc_exp; mc_exp = MLDV2_MRC_EXP(mc_mrc); mc_man = MLDV2_MRC_MAN(mc_mrc); - ret = (mc_man | 0x1000) << (mc_exp + 3); + return (mc_man | 0x1000) << (mc_exp + 3); } +} - return ret; +/* Calculate Querier's Query Interval from Querier's Query Interval Code + * + * RFC3810, relevant sections: + * - 5.1.9. QQIC (Querier's Query Interval Code) defines the decoding formula: + * 0 1 2 3 4 5 6 7 + * +-+-+-+-+-+-+-+-+ + * |1| exp | mant | + * +-+-+-+-+-+-+-+-+ + * QQI = (mant | 0x10) << (exp + 3) + * - 9.2. Query Interval + * - 9.12. Older Version Querier Present Timeout + * (the [Query Interval] in the last Query received) + * + * After decode, QQIC represents the Querier's Query Interval in units + * of seconds. + */ +static inline unsigned long mldv2_qqi(const struct mld2_query *mlh2) +{ + unsigned long qqic = mlh2->mld2q_qqic; + + if (qqic < MLD_QQIC_MIN_THRESHOLD) { + return qqic; + } else { + unsigned long mc_man, mc_exp; + + mc_exp = MLDV2_QQIC_EXP(qqic); + mc_man = MLDV2_QQIC_MAN(qqic); + + return (mc_man | 0x10) << (mc_exp + 3); + } } #endif -- cgit v1.2.3 From 95bfd196f0dc6ccf8ef02356cf7088778b84416b Mon Sep 17 00:00:00 2001 From: Ujjal Roy Date: Sat, 2 May 2026 13:19:04 +0000 Subject: ipv4: igmp: encode multicast exponential fields In IGMP, MRC and QQIC fields are not correctly encoded when generating query packets. Since the receiver of the query interprets these fields using the IGMPv3 floating- point decoding logic, any value that exceeds the linear threshold is incorrectly parsed as an exponential value, leading to an incorrect interval calculation. Encode and assign the corresponding protocol fields during query generation. Introduce the logic to dynamically calculate the exponent and mantissa using bit-scan (fls). This ensures MRC and QQIC fields (8-bit) are properly encoded when transmitting query packets with intervals that exceed their respective linear threshold value of 128 (for MRT/QQI). RFC3376: for both MRC and QQIC, values >= 128 represent the same floating-point encoding as follows: 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |1| exp | mant | +-+-+-+-+-+-+-+-+ Reviewed-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Signed-off-by: Ujjal Roy Link: https://patch.msgid.link/20260502131907.987-4-royujjal@gmail.com Signed-off-by: Jakub Kicinski --- include/linux/igmp.h | 87 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) (limited to 'include') diff --git a/include/linux/igmp.h b/include/linux/igmp.h index 0e095c9f234e..3a2d35a9f307 100644 --- a/include/linux/igmp.h +++ b/include/linux/igmp.h @@ -109,6 +109,93 @@ struct ip_mc_list { /* IGMPv3 floating-point exponential field min threshold */ #define IGMPV3_EXP_MIN_THRESHOLD 128 +/* IGMPv3 FP max threshold (mant = 0xF, exp = 7) -> 31744 */ +#define IGMPV3_EXP_MAX_THRESHOLD 31744 + +/* V3 exponential field encoding */ + +/* IGMPv3 MRC/QQIC 8-bit exponential field encode + * + * RFC3376, 4.1.1 & 4.1.7. defines only the decoding formula: + * MRT/QQI = (mant | 0x10) << (exp + 3) + * + * but does NOT define the encoding procedure. To derive exponent: + * + * For any value of mantissa and exponent, the decoding formula + * indicates that the "hidden bit" (0x10) is shifted 4 bits left + * to sit above the 4-bit mantissa. The RFC again shifts this + * entire block left by (exp + 3) to reconstruct the value. + * So, 'hidden bit' is the MSB which is shifted by (4 + exp + 3). + * + * Total left shift of the 'hidden bit' = 4 + (exp + 3) = exp + 7. + * This is the MSB at the 0-based bit position: (exp + 7). + * Since fls() is 1-based, fls(value) - 1 = exp + 7. + * + * Therefore: + * exp = fls(value) - 8 + * mant = (value >> (exp + 3)) & 0x0F + * + * Final encoding formula: + * 0x80 | (exp << 4) | mant + * + * Example (value = 3200): + * 0 1 + * 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * |0 0 0 0 1 1 0 0 1 0 0 0 0 0 0 0| (value = 3200) + * | ^-^-mant^ ^..(exp+3)..^| exp = 4, mant = 9 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * + * Encoded: + * 0x80 | (4 << 4) | 9 = 0xC9 + */ +static inline u8 igmpv3_exp_field_encode(unsigned long value) +{ + u8 mc_exp, mc_man; + + /* MRC/QQIC < 128 is literal */ + if (value < IGMPV3_EXP_MIN_THRESHOLD) + return value; + + /* Saturate at max representable (mant = 0xF, exp = 7) -> 31744 */ + if (value >= IGMPV3_EXP_MAX_THRESHOLD) + return 0xFF; + + mc_exp = fls(value) - 8; + mc_man = (value >> (mc_exp + 3)) & 0x0F; + + return 0x80 | (mc_exp << 4) | mc_man; +} + +/* Calculate Maximum Response Code from Max Resp Time + * + * RFC3376, relevant sections: + * - 4.1.1. Maximum Response Code + * - 8.3. Query Response Interval + * + * MRC represents the encoded form of Max Resp Time (MRT); once + * decoded, the resulting value is in units of 0.1 seconds (100 ms). + */ +static inline u8 igmpv3_mrc(unsigned long mrt) +{ + return igmpv3_exp_field_encode(mrt); +} + +/* Calculate Querier's Query Interval Code from Querier's Query Interval + * + * RFC3376, relevant sections: + * - 4.1.7. QQIC (Querier's Query Interval Code) + * - 8.2. Query Interval + * - 8.12. Older Version Querier Present Timeout + * (the [Query Interval] in the last Query received) + * + * QQIC represents the encoded form of Querier's Query Interval (QQI); + * once decoded, the resulting value is in units of seconds. + */ +static inline u8 igmpv3_qqic(unsigned long qi) +{ + return igmpv3_exp_field_encode(qi); +} /* V3 exponential field decoding */ -- cgit v1.2.3 From e51560f4220a5c2185dc1abbfc3aa0eb543139c2 Mon Sep 17 00:00:00 2001 From: Ujjal Roy Date: Sat, 2 May 2026 13:19:05 +0000 Subject: ipv6: mld: encode multicast exponential fields In MLD, MRC and QQIC fields are not correctly encoded when generating query packets. Since the receiver of the query interprets these fields using the MLDv2 floating-point decoding logic, any value that exceeds the linear threshold is incorrectly parsed as an exponential value, leading to an incorrect interval calculation. Encode and assign the corresponding protocol fields during query generation. Introduce the logic to dynamically calculate the exponent and mantissa using bit-scan (fls). This ensures MRC (16-bit) and QQIC (8-bit) fields are properly encoded when transmitting query packets with intervals that exceed their respective linear thresholds (32768 for MRD; 128 for QQI). RFC3810: If Maximum Response Code >= 32768, the Maximum Response Code field represents a floating-point value as follows: 0 1 2 3 4 5 6 7 8 9 A B C D E F +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |1| exp | mant | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ RFC3810: If QQIC >= 128, the QQIC field represents a floating-point value as follows: 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |1| exp | mant | +-+-+-+-+-+-+-+-+ Reviewed-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Signed-off-by: Ujjal Roy Link: https://patch.msgid.link/20260502131907.987-5-royujjal@gmail.com Signed-off-by: Jakub Kicinski --- include/net/mld.h | 119 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 119 insertions(+) (limited to 'include') diff --git a/include/net/mld.h b/include/net/mld.h index 10e402e0fe08..23255cc47ced 100644 --- a/include/net/mld.h +++ b/include/net/mld.h @@ -91,13 +91,132 @@ struct mld2_query { /* MLDv2 QQIC floating-point exponential field min threshold */ #define MLD_QQIC_MIN_THRESHOLD 128 +/* MLDv2 QQIC FP max threshold (mant = 0xF, exp = 7) -> 31744 */ +#define MLD_QQIC_MAX_THRESHOLD 31744 /* MLDv2 MRC floating-point exponential field min threshold */ #define MLD_MRC_MIN_THRESHOLD 32768UL +/* MLDv2 MRC FP max threshold (mant = 0xFFF, exp = 7) -> 8387584 */ +#define MLD_MRC_MAX_THRESHOLD 8387584 #define MLDV1_MRD_MAX_COMPAT (MLD_MRC_MIN_THRESHOLD - 1) #define MLD_MAX_QUEUE 8 #define MLD_MAX_SKBS 32 +/* V2 exponential field encoding */ + +/* + * Calculate Maximum Response Code from Maximum Response Delay + * + * MRC represents the 16-bit encoded form of Maximum Response Delay (MRD); + * once decoded, the resulting value is in milliseconds. + * + * RFC3810, 5.1.3. defines only the decoding formula: + * Maximum Response Delay = (mant | 0x1000) << (exp + 3) + * + * but does NOT define the encoding procedure. To derive exponent: + * + * For the 16-bit MRC, the "hidden bit" (0x1000) is left shifted by 12 to + * sit above the 12-bit mantissa. The RFC then shifts this entire block + * left by (exp + 3) to reconstruct the value. So, 'hidden bit' is the + * MSB which is shifted by (12 + exp + 3). + * + * Total left shift of the hidden bit = 12 + (exp + 3) = exp + 15. + * This is the MSB at the 0-based bit position: (exp + 15). + * Since fls() is 1-based, fls(value) - 1 = exp + 15. + * + * Therefore: + * exp = fls(value) - 16 + * mant = (value >> (exp + 3)) & 0x0FFF + * + * Final encoding formula: + * 0x8000 | (exp << 12) | mant + * + * Example (value = 1311744): + * 0 1 2 3 + * 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * |0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0| 1311744 + * | ^-^--------mant---------^ ^...(exp+3)...^| exp=5 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * + * Encoded: + * 0x8000 | (5 << 12) | 0x404 = 0xD404 + */ +static inline u16 mldv2_mrc(unsigned long mrd) +{ + u16 mc_man, mc_exp; + + /* MRC < 32768 is literal */ + if (mrd < MLD_MRC_MIN_THRESHOLD) + return mrd; + + /* Saturate at max representable (mant = 0xFFF, exp = 7) -> 8387584 */ + if (mrd >= MLD_MRC_MAX_THRESHOLD) + return 0xFFFF; + + mc_exp = fls(mrd) - 16; + mc_man = (mrd >> (mc_exp + 3)) & 0x0FFF; + + return 0x8000 | (mc_exp << 12) | mc_man; +} + +/* + * Calculate Querier's Query Interval Code from Querier's Query Interval + * + * QQIC represents the 8-bit encoded form of Querier's Query Interval (QQI); + * once decoded, the resulting value is in seconds. + * + * RFC3810, 5.1.9. defines only the decoding formula: + * QQI = (mant | 0x10) << (exp + 3) + * + * but does NOT define the encoding procedure. To derive exponent: + * + * For any value of mantissa and exponent, the decoding formula indicates + * that the "hidden bit" (0x10) is shifted 4 bits left to sit above the + * 4-bit mantissa. The RFC again shifts this entire block left by (exp + 3) + * to reconstruct the value. So, 'hidden bit' is the MSB which is shifted + * by (4 + exp + 3). + * + * Total left shift of the 'hidden bit' = 4 + (exp + 3) = exp + 7. + * This is the MSB at the 0-based bit position: (exp + 7). + * Since fls() is 1-based, fls(value) - 1 = exp + 7. + * + * Therefore: + * exp = fls(value) - 8 + * mant = (value >> (exp + 3)) & 0x0F + * + * Final encoding formula: + * 0x80 | (exp << 4) | mant + * + * Example (value = 3200): + * 0 1 + * 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * |0 0 0 0 1 1 0 0 1 0 0 0 0 0 0 0| (value = 3200) + * | ^-^-mant^ ^..(exp+3)..^| exp = 4, mant = 9 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * + * Encoded: + * 0x80 | (4 << 4) | 9 = 0xC9 + */ +static inline u8 mldv2_qqic(unsigned long value) +{ + u8 mc_man, mc_exp; + + /* QQIC < 128 is literal */ + if (value < MLD_QQIC_MIN_THRESHOLD) + return value; + + /* Saturate at max representable (mant = 0xF, exp = 7) -> 31744 */ + if (value >= MLD_QQIC_MAX_THRESHOLD) + return 0xFF; + + mc_exp = fls(value) - 8; + mc_man = (value >> (mc_exp + 3)) & 0x0F; + + return 0x80 | (mc_exp << 4) | mc_man; +} + /* V2 exponential field decoding */ /* Calculate Maximum Response Delay from Maximum Response Code -- cgit v1.2.3 From 949af038b6d2a41c54502179c5a8ddfb3d57dd17 Mon Sep 17 00:00:00 2001 From: Can Guo Date: Fri, 24 Apr 2026 08:14:20 -0700 Subject: scsi: ufs: core: Add support to retrieve and store TX Equalization settings Add support for UFS v5.0 JEDEC attributes qTxEQGnSettings and wTxEQGnSettingsExt to enable persistent storage and retrieval of optimal TX Equalization settings. This provides a fast-path for TX Equalization by reusing previously stored optimal settings, avoiding TX Equalization Training (EQTR) procedures during subsequent Power Mode changes. When no valid TX Equalization settings are found, fall back to full TX EQTR procedures and optionally save the results for future use. The validity of one set of TX Equalization settings is indicated by Bit[15] in wTxEQGnSettingsExt. Signed-off-by: Can Guo Reviewed-by: Peter Wang Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260424151420.111675-3-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen --- include/ufs/ufs.h | 2 ++ include/ufs/ufshcd.h | 2 ++ 2 files changed, 4 insertions(+) (limited to 'include') diff --git a/include/ufs/ufs.h b/include/ufs/ufs.h index 602aa34c9822..0d48e137d66d 100644 --- a/include/ufs/ufs.h +++ b/include/ufs/ufs.h @@ -191,6 +191,8 @@ enum attr_idn { QUERY_ATTR_IDN_WB_BUF_RESIZE_HINT = 0x3C, QUERY_ATTR_IDN_WB_BUF_RESIZE_EN = 0x3D, QUERY_ATTR_IDN_WB_BUF_RESIZE_STATUS = 0x3E, + QUERY_ATTR_IDN_TX_EQ_GN_SETTINGS = 0x47, + QUERY_ATTR_IDN_TX_EQ_GN_SETTINGS_EXT = 0x48, }; /* Descriptor idn for Query requests */ diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h index cfbc75d8df83..f48d6416e299 100644 --- a/include/ufs/ufshcd.h +++ b/include/ufs/ufshcd.h @@ -358,6 +358,7 @@ struct ufshcd_tx_eqtr_record { * @eqtr_record: Pointer to TX EQTR record * @is_valid: True if parameter contains valid TX Equalization settings * @is_applied: True if settings have been applied to UniPro of both sides + * @is_trained: True if parameters obtained from TX EQTR procedure */ struct ufshcd_tx_eq_params { struct ufshcd_tx_eq_settings host[UFS_MAX_LANES]; @@ -365,6 +366,7 @@ struct ufshcd_tx_eq_params { struct ufshcd_tx_eqtr_record *eqtr_record; bool is_valid; bool is_applied; + bool is_trained; }; /** -- cgit v1.2.3 From 0814869dc26e7f82b31683fdfc5d43dcf3331f9f Mon Sep 17 00:00:00 2001 From: Israel Kozitz Date: Mon, 4 May 2026 12:17:40 +0300 Subject: wifi: cfg80211: fix max_channel_switch_time documentation unit The max_channel_switch_time field in struct wiphy_nan_capa was documented as being in milliseconds, but it is actually in microseconds as defined in the Wi-Fi Aware specification and as indicated in the nl80211 NL80211_NAN_CAPA_MAX_CHANNEL_SWITCH_TIME attribute. Fix the documentation to say microseconds. Signed-off-by: Israel Kozitz Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260504121734.d0a0152f7d8c.I47e5c91f7ead4f8006fb13f9194d95a55cf9c398@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index a40ab36b8edb..51eded4204cf 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -6027,7 +6027,7 @@ enum wiphy_nan_flags { * nibble indicates the number of TX antennas and upper nibble indicates the * number of RX antennas. Value 0 indicates the information is not * available. - * @max_channel_switch_time: maximum channel switch time in milliseconds. + * @max_channel_switch_time: maximum channel switch time in microseconds. * @dev_capabilities: NAN device capabilities as defined in Wi-Fi Aware (TM) * specification Table 79 (Capabilities field). * @phy: Band-agnostic capabilities for NAN data interfaces. Since NAN -- cgit v1.2.3 From 829b815e910b8cc7bf36c85005abc3e66b59303b Mon Sep 17 00:00:00 2001 From: Kavita Kavita Date: Mon, 4 May 2026 18:06:23 +0530 Subject: wifi: cfg80211: indicate (Re)Association frame encryption to userspace In SME-in-driver mode, the driver handles the entire (re)association exchange. Userspace (e.g., wpa_supplicant) currently has no explicit indication of whether the (re)association exchange was encrypted, making it difficult to distinguish EPP (Enhanced Privacy Protection, IEEE 802.11bi) associations from non-EPP associations. When (Re)Association frame encryption is used, the (Re)Association Response frame must contain a Key Delivery element as specified in IEEE P802.11bi/D4.0, Table 9-65. Userspace must process this element only when the (Re)Association Response frame is actually encrypted. Processing it unconditionally for unencrypted frames leads to incorrect behavior. Without an explicit indication from the driver, userspace cannot determine whether encryption was used and whether the Key Delivery element is valid. Add a new flag attribute NL80211_ATTR_ASSOC_ENCRYPTED and a corresponding field "assoc_encrypted" in cfg80211_connect_resp_params to indicate that both the (Re)Association Request and Response frames are transmitted encrypted over the air. For mac80211-based drivers, extend cfg80211_rx_assoc_resp_data with the assoc_encrypted field as well, which is then propagated to cfg80211_connect_resp_params. Pass the flag to userspace via NL80211_CMD_CONNECT event. Signed-off-by: Kavita Kavita Link: https://patch.msgid.link/20260504123624.529218-2-kavita.kavita@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 6 ++++++ include/uapi/linux/nl80211.h | 9 +++++++++ 2 files changed, 15 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 51eded4204cf..b0a908b2ba73 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -8305,6 +8305,7 @@ void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr); * as the AC bitmap in the QoS info field * @req_ies: information elements from the (Re)Association Request frame * @req_ies_len: length of req_ies data + * @assoc_encrypted: indicate if the (re)association exchange is encrypted. * @ap_mld_addr: AP MLD address (in case of MLO) * @links: per-link information indexed by link ID, use links[0] for * non-MLO connections @@ -8319,6 +8320,7 @@ struct cfg80211_rx_assoc_resp_data { const u8 *req_ies; size_t req_ies_len; int uapsd_queues; + bool assoc_encrypted; const u8 *ap_mld_addr; struct { u8 addr[ETH_ALEN] __aligned(2); @@ -8838,6 +8840,9 @@ struct cfg80211_fils_resp_params { * @links.status: per-link status code, to report a status code that's not * %WLAN_STATUS_SUCCESS for a given link, it must also be in the * @valid_links bitmap and may have a BSS pointer (which is then released) + * @assoc_encrypted: The driver should set this flag to indicate that the + * (Re)Association Request/Response frames are transmitted encrypted over + * the air. */ struct cfg80211_connect_resp_params { int status; @@ -8847,6 +8852,7 @@ struct cfg80211_connect_resp_params { size_t resp_ie_len; struct cfg80211_fils_resp_params fils; enum nl80211_timeout_reason timeout_reason; + bool assoc_encrypted; const u8 *ap_mld_addr; u16 valid_links; diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 072b383d7d3c..e26d65c1b737 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -3142,6 +3142,13 @@ enum nl80211_commands { * association response etc., since it's abridged in the beacon. Used * for START_AP etc. * + * @NL80211_ATTR_ASSOC_ENCRYPTED: Flag attribute, used only with the + * %NL80211_CMD_CONNECT event in SME-in-driver mode. The driver should + * set this flag to indicate that both the (Re)Association Request frame + * and the corresponding (Re)Association Response frame are transmitted + * encrypted over the air. Enhanced Privacy Protection (EPP), as defined + * in IEEE P802.11bi/D4.0, mandates this encryption. + * * @NUM_NL80211_ATTR: total number of nl80211_attrs available * @NL80211_ATTR_MAX: highest attribute number currently defined * @__NL80211_ATTR_AFTER_LAST: internal use @@ -3735,6 +3742,8 @@ enum nl80211_attrs { NL80211_ATTR_NAN_MAX_CHAN_SWITCH_TIME, NL80211_ATTR_NAN_PEER_MAPS, + NL80211_ATTR_ASSOC_ENCRYPTED, + /* add attributes here, update the policy in nl80211.c */ __NL80211_ATTR_AFTER_LAST, -- cgit v1.2.3 From 43ef5856bdab300acc90ea2c3c437f5535a5f66f Mon Sep 17 00:00:00 2001 From: Miri Korenblit Date: Mon, 4 May 2026 10:20:41 +0300 Subject: wifi: mac80211: track the id of the NAN cluster we joined Currently, we store in nan.conf the cluster id that was configured from upper layer to be used when the device opens a cluster. But after we joined a cluster, the configured cluster id is no longer relevant. Particularly, in reconfig we will give the driver the (possibly) wrong cluster id. Add an API to be called by the driver when joined a cluster in which the cluster id will be updated. Use the locally stored cluster id instead of cfg80211's copy. Ignore cluster id updates from cfg80211 if we already have one configured. Adjust the drivers that use the cfg80211 API (cfg80211_nan_cluster_joined) directly, otherwise we break functionality (i.e. accept frame check won't evaluate to true). Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260504101829.5dada1b756a4.I0f1060215267fd8aef31afd99f8f42e6fde7f234@changeid Signed-off-by: Johannes Berg --- include/net/mac80211.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'include') diff --git a/include/net/mac80211.h b/include/net/mac80211.h index 02318a4be0e1..0d1b1d726b9c 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -7891,6 +7891,20 @@ void ieee80211_nan_func_match(struct ieee80211_vif *vif, */ void ieee80211_nan_sched_update_done(struct ieee80211_vif *vif); +/** + * ieee80211_nan_cluster_joined - notify about NAN cluster join. + * + * This function is used to notify mac80211 about NAN cluster join. + * + * @vif: &struct ieee80211_vif pointer from the add_interface callback. + * @cluster_id: the cluster ID that was joined + * @new_cluster: true if this is a new cluster + * @gfp: allocation flags + */ +void ieee80211_nan_cluster_joined(struct ieee80211_vif *vif, + const u8 *cluster_id, bool new_cluster, + gfp_t gfp); + /** * ieee80211_calc_rx_airtime - calculate estimated transmission airtime for RX. * -- cgit v1.2.3 From 42c9de58d990337a8848671591252f71d0db18c8 Mon Sep 17 00:00:00 2001 From: Miri Korenblit Date: Mon, 4 May 2026 10:20:47 +0300 Subject: wifi: mac80211: add NAN channel evacuation support A NAN channel can be evacuated, i.e. detached from its chanctx, if all chanctxs are used by NAN and a chanctx is needed for something else. For example if the STA interface needs to perform a channel switch. Implement the evacuation: detach the NAN channel from its chanctx, remove all the peer NAN channels that were using this chanctx, and update the driver. Internally, the NAN channel evacuation will be triggered in the scenario described above, and API is provided for the driver to also trigger it. The driver/device is assumed to publish a ULW to notify the peers about the fact that we won't be present on this NAN channel anymore. Also export this as an API for the drivers: if a driver has other resources per channel, it might want to trigger channel evacuation in order to free up such internal resources for other usages. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260504101829.1e1dc40d2f3e.I003fe84dc6373bb9ad55abd7824b9fc21c51203f@changeid Signed-off-by: Johannes Berg --- include/net/mac80211.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'include') diff --git a/include/net/mac80211.h b/include/net/mac80211.h index 0d1b1d726b9c..d909bc1b29ff 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -7905,6 +7905,21 @@ void ieee80211_nan_cluster_joined(struct ieee80211_vif *vif, const u8 *cluster_id, bool new_cluster, gfp_t gfp); +/** + * ieee80211_nan_try_evacuate - try to evacuate a NAN channel + * + * This function tries to evacuate a NAN channel that is using the given + * channel context, to free up channel context resources. + * + * @hw: pointer as obtained from ieee80211_alloc_hw() + * @conf: the channel context configuration to try to evacuate. If %NULL, + * the NAN channel that has the fewest slots scheduled will be evacuated. + * + * Return: %true if a channel was evacuated, %false otherwise + */ +bool ieee80211_nan_try_evacuate(struct ieee80211_hw *hw, + struct ieee80211_chanctx_conf *conf); + /** * ieee80211_calc_rx_airtime - calculate estimated transmission airtime for RX. * -- cgit v1.2.3 From b00192d78bb4f8b85d3545c7f86722610f088554 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Thu, 30 Apr 2026 16:39:27 -0700 Subject: locking/barrier: Use correct parameter names Use the correct parameter names in kernel-doc comments to avoid warnings: Warning: include/asm-generic/barrier.h:245 function parameter 'cond_expr' not described in 'smp_cond_load_relaxed' Warning: include/asm-generic/barrier.h:267 function parameter 'cond_expr' not described in 'smp_cond_load_acquire' Signed-off-by: Randy Dunlap Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260430233927.2620050-1-rdunlap@infradead.org --- include/asm-generic/barrier.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/asm-generic/barrier.h b/include/asm-generic/barrier.h index d4f581c1e21d..b99cb57dfccc 100644 --- a/include/asm-generic/barrier.h +++ b/include/asm-generic/barrier.h @@ -235,7 +235,7 @@ do { \ /** * smp_cond_load_relaxed() - (Spin) wait for cond with no ordering guarantees * @ptr: pointer to the variable to wait on - * @cond: boolean expression to wait for + * @cond_expr: boolean expression to wait for * * Equivalent to using READ_ONCE() on the condition variable. * @@ -259,7 +259,7 @@ do { \ /** * smp_cond_load_acquire() - (Spin) wait for cond with ACQUIRE ordering * @ptr: pointer to the variable to wait on - * @cond: boolean expression to wait for + * @cond_expr: boolean expression to wait for * * Equivalent to using smp_load_acquire() on the condition variable but employs * the control dependency of the wait to reduce the barrier on many platforms. -- cgit v1.2.3 From b718f041842071b8c09faf658e3adca7b506e1bb Mon Sep 17 00:00:00 2001 From: Tomi Valkeinen Date: Thu, 23 Apr 2026 17:21:13 +0300 Subject: drm/fourcc: Add DRM_FORMAT_P230 Add a new pixel format, DRM_FORMAT_P230 ("P230") P230 is 2 plane 10 bit per component YCbCr 2x1 subsampled format. P230 is similar to the already existing P030 format, which is 2x2 subsampled. Reviewed-by: Dmitry Baryshkov Reviewed-by: Vishal Sagar Reviewed-by: Laurent Pinchart Reviewed-by: Simon Ser Link: https://patch.msgid.link/20260423-xilinx-formats-v10-2-c690c2b8ea89@ideasonboard.com Signed-off-by: Tomi Valkeinen --- include/uapi/drm/drm_fourcc.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index 2caf8249f892..7eb55028f35c 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -361,6 +361,14 @@ extern "C" { */ #define DRM_FORMAT_P030 fourcc_code('P', '0', '3', '0') /* 2x2 subsampled Cr:Cb plane 10 bits per channel packed */ +/* + * 2 plane YCbCr422. + * 3 10 bit components and 2 padding bits packed into 4 bytes. + * index 0 = Y plane, [31:0] x:Y2:Y1:Y0 2:10:10:10 little endian + * index 1 = Cr:Cb plane, [63:0] x:Cr2:Cb2:Cr1:x:Cb1:Cr0:Cb0 [2:10:10:10:2:10:10:10] little endian + */ +#define DRM_FORMAT_P230 fourcc_code('P', '2', '3', '0') /* 2x1 subsampled Cr:Cb plane 10 bits per channel packed */ + /* 3 plane non-subsampled (444) YCbCr * 16 bits per component, but only 10 bits are used and 6 bits are padded * index 0: Y plane, [15:0] Y:x [10:6] little endian -- cgit v1.2.3 From c0f8aaa7dcecee19a773a5454665998cdc848fda Mon Sep 17 00:00:00 2001 From: Tomi Valkeinen Date: Thu, 23 Apr 2026 17:21:14 +0300 Subject: drm/fourcc: Add DRM_FORMAT_Y8 Add greyscale Y8 format. The 8-bit greyscale format has been discussed before, and the earlier guidance was to use DRM_FORMAT_R8, as a single-channel 8-bit pixel. However, adding DRM_FORMAT_Y8 makes sense, we can mark it as 'is_yuv' in the drm_format_info, and this can help the drivers handle e.g. full/limited range. This will distinguish two single-channel formats: R8, which is a RGB format with the same value for all components, and Y8, which is a Y-only YCbCr format, with Cb and Cr being neutral. Acked-by: Dmitry Baryshkov Reviewed-by: Pekka Paalanen Reviewed-by: Vishal Sagar Reviewed-by: Laurent Pinchart Acked-by: Simon Ser Link: https://patch.msgid.link/20260423-xilinx-formats-v10-3-c690c2b8ea89@ideasonboard.com Signed-off-by: Tomi Valkeinen --- include/uapi/drm/drm_fourcc.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index 7eb55028f35c..ede96c192169 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -441,6 +441,15 @@ extern "C" { #define DRM_FORMAT_YUV444 fourcc_code('Y', 'U', '2', '4') /* non-subsampled Cb (1) and Cr (2) planes */ #define DRM_FORMAT_YVU444 fourcc_code('Y', 'V', '2', '4') /* non-subsampled Cr (1) and Cb (2) planes */ +/* + * Y-only (greyscale) formats + * + * The Y-only formats are handled similarly to the YCbCr formats in the display + * pipeline, with the Cb and Cr implicitly neutral (0.0 in nominal values). This + * also means that COLOR_RANGE property applies to the Y-only formats. + */ + +#define DRM_FORMAT_Y8 fourcc_code('G', 'R', 'E', 'Y') /* 8-bit Y-only */ /* * Format Modifiers: -- cgit v1.2.3 From e8e388c301809378f8a4789192dd965eb085dddb Mon Sep 17 00:00:00 2001 From: Tomi Valkeinen Date: Thu, 23 Apr 2026 17:21:15 +0300 Subject: drm/fourcc: Add DRM_FORMAT_XYYY2101010 Add XYYY2101010 ("YPA4"), a 10 bit greyscale format, with 3 pixels packed into 32-bit container, and two bits of padding. The fourcc for the format is 'YPA4', which comes from Y - Y only, P - packed, A - 10 (as in 0xA), 4 - 4 bytes. Reviewed-by: Vishal Sagar Reviewed-by: Pekka Paalanen Reviewed-by: Laurent Pinchart Reviewed-by: Simon Ser Link: https://patch.msgid.link/20260423-xilinx-formats-v10-4-c690c2b8ea89@ideasonboard.com Signed-off-by: Tomi Valkeinen --- include/uapi/drm/drm_fourcc.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index ede96c192169..480c67296d6a 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -450,6 +450,7 @@ extern "C" { */ #define DRM_FORMAT_Y8 fourcc_code('G', 'R', 'E', 'Y') /* 8-bit Y-only */ +#define DRM_FORMAT_XYYY2101010 fourcc_code('Y', 'P', 'A', '4') /* [31:0] x:Y2:Y1:Y0 2:10:10:10 little endian */ /* * Format Modifiers: -- cgit v1.2.3 From 7db42b1718dac7aa67ec68acad177164516af71d Mon Sep 17 00:00:00 2001 From: Tomi Valkeinen Date: Thu, 23 Apr 2026 17:21:16 +0300 Subject: drm/fourcc: Add DRM_FORMAT_T430 Add T430, a 3 plane 10 bits per component non-subsampled YCbCr format. A new initial letter was chosen for this one, as the format doesn't match the existing P, Q or S formats. T is the next one in the alphabet. It was definitely not chosen because of the initial letter in the author's name. Reviewed-by: Dmitry Baryshkov Reviewed-by: Vishal Sagar Reviewed-by: Laurent Pinchart Reviewed-by: Simon Ser Link: https://patch.msgid.link/20260423-xilinx-formats-v10-5-c690c2b8ea89@ideasonboard.com Signed-off-by: Tomi Valkeinen --- include/uapi/drm/drm_fourcc.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index 480c67296d6a..250b0b00ed88 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -385,6 +385,15 @@ extern "C" { */ #define DRM_FORMAT_Q401 fourcc_code('Q', '4', '0', '1') +/* + * 3 plane non-subsampled (444) YCbCr LSB aligned + * 10 bpc, 30 bits per sample image data in a single contiguous buffer. + * index 0: Y plane, [31:0] x:Y2:Y1:Y0 [2:10:10:10] little endian + * index 1: Cb plane, [31:0] x:Cb2:Cb1:Cb0 [2:10:10:10] little endian + * index 2: Cr plane, [31:0] x:Cr2:Cr1:Cr0 [2:10:10:10] little endian + */ +#define DRM_FORMAT_T430 fourcc_code('T', '4', '3', '0') + /* * 3 plane YCbCr LSB aligned * In order to use these formats in a similar fashion to MSB aligned ones -- cgit v1.2.3 From 3c8ed384503f42b985b48310fbe611418b3d5370 Mon Sep 17 00:00:00 2001 From: Tomi Valkeinen Date: Thu, 23 Apr 2026 17:21:17 +0300 Subject: drm/fourcc: Add DRM_FORMAT_XVUY2101010 Add XVUY2101010, a 10 bits per component YCbCr format in a 32 bit container. Reviewed-by: Laurent Pinchart Reviewed-by: Vishal Sagar Reviewed-by: Simon Ser Link: https://patch.msgid.link/20260423-xilinx-formats-v10-6-c690c2b8ea89@ideasonboard.com Signed-off-by: Tomi Valkeinen --- include/uapi/drm/drm_fourcc.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index 250b0b00ed88..15aa0a8f44b0 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -246,6 +246,7 @@ extern "C" { #define DRM_FORMAT_XVUY8888 fourcc_code('X', 'V', 'U', 'Y') /* [31:0] X:Cr:Cb:Y 8:8:8:8 little endian */ #define DRM_FORMAT_VUY888 fourcc_code('V', 'U', '2', '4') /* [23:0] Cr:Cb:Y 8:8:8 little endian */ #define DRM_FORMAT_VUY101010 fourcc_code('V', 'U', '3', '0') /* Y followed by U then V, 10:10:10. Non-linear modifier only */ +#define DRM_FORMAT_XVUY2101010 fourcc_code('X', 'Y', '3', '0') /* [31:0] x:Cr:Cb:Y 2:10:10:10 little endian */ /* * packed Y2xx indicate for each component, xx valid data occupy msb -- cgit v1.2.3 From af76cdcf02b7be9277af999f0e316943d94d7fd4 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Sat, 28 Feb 2026 17:12:28 -0800 Subject: soc: ti: knav_dma: fix all kernel-doc warnings in knav_dma.h Use correct struct member names and formats to avoid kernel-doc warnings: Warning: include/linux/soc/ti/knav_dma.h:83 struct member 'priority' not described in 'knav_dma_tx_cfg' Warning: include/linux/soc/ti/knav_dma.h:113 struct member 'err_mode' not described in 'knav_dma_rx_cfg' Warning: include/linux/soc/ti/knav_dma.h:113 struct member 'desc_type' not described in 'knav_dma_rx_cfg' Warning: include/linux/soc/ti/knav_dma.h:113 struct member 'fdq' not described in 'knav_dma_rx_cfg' Warning: include/linux/soc/ti/knav_dma.h:127 struct member 'direction' not described in 'knav_dma_cfg' Warning: include/linux/soc/ti/knav_dma.h:127 struct member 'u' not described in 'knav_dma_cfg' Signed-off-by: Randy Dunlap Link: https://patch.msgid.link/20260301011228.3064940-1-rdunlap@infradead.org Signed-off-by: Nishanth Menon --- include/linux/soc/ti/knav_dma.h | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/soc/ti/knav_dma.h b/include/linux/soc/ti/knav_dma.h index 18d806a8e52c..eb1e6b014eaf 100644 --- a/include/linux/soc/ti/knav_dma.h +++ b/include/linux/soc/ti/knav_dma.h @@ -75,7 +75,7 @@ enum knav_dma_desc_type { * struct knav_dma_tx_cfg: Tx channel configuration * @filt_einfo: Filter extended packet info * @filt_pswords: Filter PS words present - * @knav_dma_tx_priority: Tx channel scheduling priority + * @priority: Tx channel scheduling priority */ struct knav_dma_tx_cfg { bool filt_einfo; @@ -87,13 +87,13 @@ struct knav_dma_tx_cfg { * struct knav_dma_rx_cfg: Rx flow configuration * @einfo_present: Extended packet info present * @psinfo_present: PS words present - * @knav_dma_rx_err_mode: Error during buffer starvation - * @knav_dma_desc_type: Host or Monolithic desc + * @err_mode: Error during buffer starvation + * @desc_type: Host or Monolithic desc * @psinfo_at_sop: PS word located at start of packet * @sop_offset: Start of packet offset * @dst_q: Destination queue for a given flow * @thresh: Rx flow size threshold - * @fdq[]: Free desc Queue array + * @fdq: Free desc Queue array * @sz_thresh0: RX packet size threshold 0 * @sz_thresh1: RX packet size threshold 1 * @sz_thresh2: RX packet size threshold 2 @@ -115,7 +115,8 @@ struct knav_dma_rx_cfg { /** * struct knav_dma_cfg: Pktdma channel configuration - * @sl_cfg: Slave configuration + * @direction: DMA transfer mode and direction + * @u: union containing @tx or @rx * @tx: Tx channel configuration * @rx: Rx flow configuration */ -- cgit v1.2.3 From 4dbd1829045ee4146ae16b0e1ad122d855a694cb Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:45 +0530 Subject: wifi: cfg80211: Add MAC address filter to remain_on_channel Currently the remain_on_channel operation does not support filtering incoming frames by destination MAC address. This prevents use cases such as PASN authentication in the responder side that need to receive frames addressed to a specific MAC during the off-channel period. Add an rx_addr parameter to the remain_on_channel operation callback and propagate it through the call chain from nl80211 to driver implementations. Introduce the extended feature NL80211_EXT_FEATURE_ROC_ADDR_FILTER as a capability gate so that cfg80211 rejects the request if the driver does not advertise support for address filtering. Extract the address from the NL80211_ATTR_MAC attribute when provided in the netlink message and update the tracing infrastructure to include the address in remain_on_channel trace events. The rx_addr parameter is optional and can be NULL, maintaining backward compatibility with existing drivers. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-3-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 2 +- include/uapi/linux/nl80211.h | 11 ++++++++++- 2 files changed, 11 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index b0a908b2ba73..897dbe325b7e 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -5270,7 +5270,7 @@ struct cfg80211_ops { struct wireless_dev *wdev, struct ieee80211_channel *chan, unsigned int duration, - u64 *cookie); + u64 *cookie, const u8 *rx_addr); int (*cancel_remain_on_channel)(struct wiphy *wiphy, struct wireless_dev *wdev, u64 cookie); diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index e26d65c1b737..8103f2912abc 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -729,7 +729,9 @@ * to remain on the channel. This command is also used as an event to * notify when the requested duration starts (it may take a while for the * driver to schedule this time due to other concurrent needs for the - * radio). + * radio). An optional attribute %NL80211_ATTR_MAC can be used to filter + * incoming frames during remain-on-channel, such that frames + * addressed to the specified destination MAC are reported. * When called, this operation returns a cookie (%NL80211_ATTR_COOKIE) * that will be included with any events pertaining to this request; * the cookie is also used to cancel the request. @@ -7040,6 +7042,12 @@ enum nl80211_feature_flags { * (NL80211_CMD_AUTHENTICATE) in non-AP STA mode, as specified in * "IEEE P802.11bi/D4.0, 12.16.5". * + * @NL80211_EXT_FEATURE_ROC_ADDR_FILTER: Driver supports MAC address + * filtering during remain-on-channel. When %NL80211_ATTR_MAC is + * provided with %NL80211_CMD_REMAIN_ON_CHANNEL, the driver will + * forward frames with a matching MAC address to userspace during + * the off-channel period. + * * @NUM_NL80211_EXT_FEATURES: number of extended features. * @MAX_NL80211_EXT_FEATURES: highest extended feature index. */ @@ -7119,6 +7127,7 @@ enum nl80211_ext_feature_index { NL80211_EXT_FEATURE_EPPKE, NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION, NL80211_EXT_FEATURE_IEEE8021X_AUTH, + NL80211_EXT_FEATURE_ROC_ADDR_FILTER, /* add new features before the definition below */ NUM_NL80211_EXT_FEATURES, -- cgit v1.2.3 From 55f23d68f93a4cce394885886cdcd4015c35e951 Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:46 +0530 Subject: wifi: cfg80211/mac80211: Add NL80211_IFTYPE_PD for PD PASN and PMSR operations Add a new wdev-only interface type NL80211_IFTYPE_PD to support Proximity Detection (PD) operations such as PASN and peer measurement operations. This interface type operates without a netdev, similar to P2P_DEVICE and NAN interfaces. Implement support across cfg80211 and mac80211 layers with PD-specific checks gated by the NL80211_EXT_FEATURE_SECURE_RTT feature flag, management frame registration and transmission capabilities, and proper channel context handling where PD interfaces are excluded from bandwidth calculations. Update mac80211 to recognize the new interface type in the relevant paths for this management-only interface. PD discovery can be performed on any available interface, such as NL80211_IFTYPE_STATION. If PD/PMSR uses the MAC address of an existing interface type, such as NL80211_IFTYPE_STATION, then pairing and measurement shall use that same interface. If PD/PMSR uses a different MAC address, such as a random MAC address, then pairing and measurement can be performed on a new NL80211_IFTYPE_PD interface created with that random MAC address. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-4-peddolla.reddy@oss.qualcomm.com [fix comment style] Signed-off-by: Johannes Berg --- include/uapi/linux/nl80211.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 8103f2912abc..69e13cd7978a 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -3842,6 +3842,7 @@ enum nl80211_attrs { * @NL80211_IFTYPE_NAN_DATA: NAN data interface type (netdev); NAN data * interfaces can only be brought up (IFF_UP) when a NAN interface * already exists and NAN has been started (using %NL80211_CMD_START_NAN). + * @NL80211_IFTYPE_PD: PD device interface type (not a netdev) * @NL80211_IFTYPE_MAX: highest interface type number currently defined * @NUM_NL80211_IFTYPES: number of defined interface types * @@ -3864,6 +3865,7 @@ enum nl80211_iftype { NL80211_IFTYPE_OCB, NL80211_IFTYPE_NAN, NL80211_IFTYPE_NAN_DATA, + NL80211_IFTYPE_PD, /* keep last */ NUM_NL80211_IFTYPES, -- cgit v1.2.3 From b47a6e4d662976efbe53518cb22cf7df86d19c75 Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:47 +0530 Subject: wifi: cfg80211: add start/stop proximity detection commands Currently, the proximity detection (PD) interface type has no start/stop commands defined, preventing user space from controlling PD operations through the nl80211 interface. Add NL80211_CMD_START_PD and NL80211_CMD_STOP_PD commands to allow user space to start and stop a PD interface. Add the corresponding start_pd and stop_pd operations to cfg80211_ops and ieee80211_ops, along with nl80211 command handlers, rdev wrappers, and tracing support. Validate that drivers advertising PD interface support implement the required operations. Handle PD interface teardown during device unregistration and when the interface leaves the network. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-5-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 5 +++++ include/uapi/linux/nl80211.h | 9 +++++++++ 2 files changed, 14 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 897dbe325b7e..8f010af419bf 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -5088,6 +5088,9 @@ struct mgmt_frame_regs { * links by calling cfg80211_mlo_reconf_add_done(). When calling * cfg80211_mlo_reconf_add_done() the bss pointer must be given for each * link for which MLO reconfiguration 'add' operation was requested. + * + * @start_pd: Start the PD interface. + * @stop_pd: Stop the PD interface. */ struct cfg80211_ops { int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow); @@ -5464,6 +5467,8 @@ struct cfg80211_ops { struct cfg80211_ml_reconf_req *req); int (*set_epcs)(struct wiphy *wiphy, struct net_device *dev, bool val); + int (*start_pd)(struct wiphy *wiphy, struct wireless_dev *wdev); + void (*stop_pd)(struct wiphy *wiphy, struct wireless_dev *wdev); }; /* diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 69e13cd7978a..704607824b8a 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -1419,6 +1419,12 @@ * identifying the evacuated channel. * User space may reconfigure the local schedule in response to this * notification. + * @NL80211_CMD_START_PD: Start PD operation, identified by its + * %NL80211_ATTR_WDEV interface. This interface must have been previously + * created with %NL80211_CMD_NEW_INTERFACE. + * @NL80211_CMD_STOP_PD: Stop the PD operation, identified by + * its %NL80211_ATTR_WDEV interface. + * * @NL80211_CMD_MAX: highest used command number * @__NL80211_CMD_AFTER_LAST: internal use */ @@ -1694,6 +1700,9 @@ enum nl80211_commands { NL80211_CMD_NAN_CHANNEL_EVAC, + NL80211_CMD_START_PD, + NL80211_CMD_STOP_PD, + /* add new commands above here */ /* used to define NL80211_CMD_MAX below */ -- cgit v1.2.3 From 18709c618d3b4b2990f202a436784f4c36e2c193 Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:48 +0530 Subject: wifi: cfg80211: add proximity detection capabilities to PMSR Introduce Proximity Detection (PD) capabilities in Peer Measurement Service (PMSR) as defined in the Wi-Fi Alliance specification "Proximity Ranging (PR) Implementation Consideration Draft 1.9 Rev 1 section 3.3". This enables devices to advertise peer to peer ranging support. Restructure FTM capabilities in cfg80211_pmsr_capabilities to replace the single support_rsta flag with nested ista and rsta sub-structs, each carrying per-mode flags for Non-Trigger Based (NTB), Trigger Based (TB), and EDCA based ranging. This allows drivers to advertise detailed role and protocol support for both initiator and responder roles. Add support to pass additional ISTA and RSTA role capabilities to userspace using new nested ISTA_CAPS and RSTA_CAPS attributes. The legacy RSTA_SUPPORT flag is retained for backward compatibility. Add NL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS nested attribute using the nl80211_peer_measurement_ftm_type_capa enum with two sub-flags: NL80211_PMSR_FTM_TYPE_CAPA_ATTR_INFRA_SUPPORT for STA-to-AP or AP-to-STA ranging, and NL80211_PMSR_FTM_TYPE_CAPA_ATTR_PD_SUPPORT for peer-to-peer ranging. Add CONCURRENT_ISTA_RSTA_SUPPORT as a FTM capability flag indicating the device can simultaneously act as initiator and responder in a multi-peer measurement request. Extend FTM capabilities with antenna configuration fields (max_no_of_tx_antennas, max_no_of_rx_antennas) for the PR Element during PASN negotiation, and ranging interval limits (min_allowed_ranging_interval_edca, min_allowed_ranging_interval_ntb) to advertise device timing constraints for EDCA and NTB-based ranging. Update the FTM request validation path in pmsr.c to check RSTA requests against the per-mode rsta capabilities (NTB, TB, EDCA), rejecting requests for modes the device does not support. Co-developed-by: Kavita Kavita Signed-off-by: Kavita Kavita Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-6-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 60 ++++++++++++++++++++++++++++++++-- include/uapi/linux/nl80211.h | 78 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 136 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 8f010af419bf..98943a510112 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -5911,7 +5911,45 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type); * (0 means unknown) * @ftm.max_total_ltf_rx: maximum total number of LTFs that can be received * (0 means unknown) - * @ftm.support_rsta: supports operating as RSTA in PMSR FTM request + * @ftm.ista: initiator role capabilities + * @ftm.ista.support_ntb: supports operating as ISTA in PMSR FTM request for + * NTB ranging. + * @ftm.ista.support_tb: supports operating as ISTA in PMSR FTM request for + * TB ranging. + * @ftm.ista.support_edca: supports operating as ISTA in PMSR FTM request for + * EDCA based ranging. + * @ftm.rsta: responder role capabilities + * @ftm.rsta.support_ntb: supports operating as RSTA in PMSR FTM request for + * NTB ranging. + * @ftm.rsta.support_tb: supports operating as RSTA in PMSR FTM request for + * TB ranging. + * @ftm.rsta.support_edca: supports operating as RSTA in PMSR FTM request for + * EDCA based ranging. + * @ftm.max_no_of_tx_antennas: maximum number of transmit antennas supported for + * EDCA based ranging (0 means unknown) + * @ftm.max_no_of_rx_antennas: maximum number of receive antennas supported for + * EDCA based ranging (0 means unknown) + * @ftm.min_allowed_ranging_interval_edca: Minimum EDCA ranging + * interval supported by the device in milli seconds. (0 means unknown). + * Applications can use this value to estimate the burst period to be + * given in the FTM request for the EDCA based ranging case. If + * non-zero, this value will be used to validate the burst period in + * the FTM request. + * @ftm.min_allowed_ranging_interval_ntb: Minimum NTB ranging + * interval supported by the device in milli seconds. (0 means unknown). + * Applications can use this value to estimate the burst period to be + * given in the FTM request for the NTB ranging case. If non-zero, + * this value will be used to validate the nominal time in the FTM + * request. + * @ftm.type: ranging type capabilities + * @ftm.type.infra_support: supports infrastructure ranging (STA-to-AP or + * AP-to-STA) as part of Proximity Detection + * @ftm.type.pd_support: supports peer-to-peer ranging as mentioned in the + * specification "PR Implementation Consideration Draft 1.9 rev 1" where + * PD stands for proximity detection + * @ftm.concurrent_ista_rsta_support: indicates if the device can + * simultaneously act as initiator and responder in a multi-peer + * measurement request. Only valid if @ftm.rsta_support is set. */ struct cfg80211_pmsr_capabilities { unsigned int max_peers; @@ -5937,7 +5975,25 @@ struct cfg80211_pmsr_capabilities { u8 max_rx_sts; u8 max_total_ltf_tx; u8 max_total_ltf_rx; - u8 support_rsta:1; + struct { + u8 support_ntb:1, + support_tb:1, + support_edca:1; + } ista; + struct { + u8 support_ntb:1, + support_tb:1, + support_edca:1; + } rsta; + u8 max_no_of_tx_antennas; + u8 max_no_of_rx_antennas; + u32 min_allowed_ranging_interval_edca; + u32 min_allowed_ranging_interval_ntb; + struct { + u8 infra_support:1, + pd_support:1; + } type; + u8 concurrent_ista_rsta_support:1; } ftm; }; diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 704607824b8a..ea0acce724ca 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -8111,6 +8111,46 @@ enum nl80211_peer_measurement_attrs { * This limits the allowed combinations of LTF repetitions and STS. * @NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT: flag attribute indicating the * device supports operating as the RSTA in PMSR FTM request + * @NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS: nested attribute containing ISTA + * (initiator) role capabilities. Uses the same sub-attributes as + * %NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS. + * @NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS: nested attribute containing RSTA + * (responder) role capabilities. + * @NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_NTB: flag attribute (used inside + * %NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS or + * %NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS) indicating NTB ranging support. + * @NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_TB: flag attribute (used inside + * %NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS or + * %NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS) indicating TB ranging support. + * @NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_EDCA: flag attribute (used inside + * %NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS or + * %NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS) indicating EDCA based ranging + * support. + * @NL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS: nested attribute containing ranging + * type capabilities. Uses sub-attributes from + * &enum nl80211_peer_measurement_ftm_type_capa. + * @NL80211_PMSR_FTM_CAPA_ATTR_CONCURRENT_ISTA_RSTA_SUPPORT: flag attribute + * indicating that the device can simultaneously act as initiator and + * responder in a multi-peer measurement request. Only valid if + * @NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT is set. + * @NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS: u32 attribute indicating + * the maximum number of transmit antennas supported for EDCA based ranging + * (0 means unknown) + * @NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS: u32 attribute indicating + * the maximum number of receive antennas supported for EDCA based ranging + * (0 means unknown) + * @NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA: u32 attribute indicating + * the minimum EDCA ranging interval supported by the device + * in milli seconds. (0 means unknown). Applications can use this value + * to estimate the burst period to be given in the FTM request for the + * EDCA based ranging case. If non-zero, this value will be used to + * validate the burst period in the FTM request. + * @NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB: u32 attribute indicating + * the minimum NTB ranging interval supported by the device + * in milli seconds. (0 means unknown). Applications can use this value + * to estimate the burst period to be given in the FTM request for the + * NTB ranging case. If non-zero, this value will be used to validate + * the nominal time in the FTM request. * * @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal * @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number @@ -8136,12 +8176,50 @@ enum nl80211_peer_measurement_ftm_capa { NL80211_PMSR_FTM_CAPA_ATTR_MAX_TOTAL_LTF_TX, NL80211_PMSR_FTM_CAPA_ATTR_MAX_TOTAL_LTF_RX, NL80211_PMSR_FTM_CAPA_ATTR_RSTA_SUPPORT, + NL80211_PMSR_FTM_CAPA_ATTR_ISTA_CAPS, + NL80211_PMSR_FTM_CAPA_ATTR_RSTA_CAPS, + NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_NTB, + NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_TB, + NL80211_PMSR_FTM_CAPA_ATTR_SUPPORT_EDCA, + NL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS, + NL80211_PMSR_FTM_CAPA_ATTR_CONCURRENT_ISTA_RSTA_SUPPORT, + NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_TX_ANTENNAS, + NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS, + NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA, + NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB, /* keep last */ NUM_NL80211_PMSR_FTM_CAPA_ATTR, NL80211_PMSR_FTM_CAPA_ATTR_MAX = NUM_NL80211_PMSR_FTM_CAPA_ATTR - 1 }; +/** + * enum nl80211_peer_measurement_ftm_type_capa - FTM ranging type capability + * sub-attributes, used inside %NL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS + * @__NL80211_PMSR_FTM_TYPE_CAPA_ATTR_INVALID: invalid + * + * @NL80211_PMSR_FTM_TYPE_CAPA_ATTR_INFRA_SUPPORT: flag attribute indicating + * that the device supports infrastructure ranging (STA-to-AP or + * AP-to-STA) as part of Proximity Detection + * @NL80211_PMSR_FTM_TYPE_CAPA_ATTR_PD_SUPPORT: flag attribute indicating that + * the device supports peer-to-peer ranging as mentioned in the + * specification "PR Implementation Consideration Draft 1.9 rev 1" where + * PD stands for proximity detection + * + * @NUM_NL80211_PMSR_FTM_TYPE_CAPA_ATTR: internal + * @NL80211_PMSR_FTM_TYPE_CAPA_ATTR_MAX: highest attribute number + */ +enum nl80211_peer_measurement_ftm_type_capa { + __NL80211_PMSR_FTM_TYPE_CAPA_ATTR_INVALID, + + NL80211_PMSR_FTM_TYPE_CAPA_ATTR_INFRA_SUPPORT, + NL80211_PMSR_FTM_TYPE_CAPA_ATTR_PD_SUPPORT, + + /* keep last */ + NUM_NL80211_PMSR_FTM_TYPE_CAPA_ATTR, + NL80211_PMSR_FTM_TYPE_CAPA_ATTR_MAX = NUM_NL80211_PMSR_FTM_TYPE_CAPA_ATTR - 1 +}; + /** * enum nl80211_peer_measurement_ftm_req - FTM request attributes * @__NL80211_PMSR_FTM_REQ_ATTR_INVALID: invalid -- cgit v1.2.3 From 8823a9b0e7af5395cbfa06bf23806197d59cd124 Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:49 +0530 Subject: wifi: cfg80211: add NTB continuous ranging and FTM request type support Enable NTB continuous ranging with configurable timing and measurement parameters as per the Wi-Fi Alliance specification "Proximity Ranging (PR) Implementation Consideration Draft 1.9 Rev 1, section 5.3". Add new FTM request attributes for min/max time between measurements, nominal time (mandatory for NTB), AW duration, and total measurement count. Add NL80211_PMSR_PEER_ATTR_REQ_TYPE attribute using the new nl80211_peer_measurement_ftm_req_type enum to allow userspace to specify the ranging request type per peer: - NL80211_PMSR_FTM_REQ_TYPE_INFRA: STA-to-AP or AP-to-STA ranging (default if attribute is absent) - NL80211_PMSR_FTM_REQ_TYPE_PD: peer-to-peer ranging Validate the request type against the device TYPE_CAPS capabilities advertised via NL80211_PMSR_FTM_CAPA_ATTR_TYPE_CAPS. Reject PD requests if the device does not advertise PD support. Reject PD requests that set trigger-based ranging, as TB ranging is not compatible with peer-to-peer proximity detection. Add ftms_per_burst limit of 4 for PD NTB ranging requests. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-7-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 35 ++++++++++++++++++++++++- include/uapi/linux/nl80211.h | 62 ++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 94 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 98943a510112..28923539456e 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -4527,7 +4527,8 @@ struct cfg80211_pmsr_result { * @burst_duration: burst duration. If @trigger_based or @non_trigger_based is * set, this is the burst duration in milliseconds, and zero means the * device should pick an appropriate value based on @ftms_per_burst. - * @ftms_per_burst: number of FTMs per burst + * @ftms_per_burst: number of FTMs per burst. If set to 0, the firmware or + * driver can automatically select an appropriate value. * @ftmr_retries: number of retries for FTM request * @request_lci: request LCI information * @request_civicloc: request civic location information @@ -4544,6 +4545,31 @@ struct cfg80211_pmsr_result { * @bss_color: the bss color of the responder. Optional. Set to zero to * indicate the driver should set the BSS color. Only valid if * @non_trigger_based or @trigger_based is set. + * @request_type: ranging request type, one of + * &enum nl80211_peer_measurement_ftm_req_type. Defaults to + * %NL80211_PMSR_FTM_REQ_TYPE_INFRA if not specified. + * @min_time_between_measurements: minimum time between two consecutive range + * measurements in units of 100 microseconds, for non-trigger based + * ranging. Should be set as short as possible to minimize turnaround + * time, since two-way ranging with delayed LMR requires two measurements. + * Only valid if @non_trigger_based is set. + * @max_time_between_measurements: maximum time between two consecutive range + * measurements in units of 10 milliseconds, for non-trigger based + * ranging. Acts as a session timeout; if exceeded, the ranging session + * should be terminated. Only valid if @non_trigger_based is set. + * @availability_window: duration of the availability window (AW) in units of + * 1 millisecond (0-255 ms). Only valid if @non_trigger_based is set. + * If set to 0, the firmware or driver can automatically select an + * appropriate value. + * @nominal_time: Nominal duration between adjacent availability windows + * in units of milli seconds. Only valid if @non_trigger_based is set. + * If set to 0, the firmware or driver can automatically select an + * appropriate value. + * @num_measurements: number of Availability Windows (AWs) to schedule + * for non-trigger-based ranging. Each AW may contain multiple FTM + * exchanges as configured by @ftms_per_burst. Only valid if + * @non_trigger_based is set. If set to 0, the firmware or driver + * can automatically select an appropriate value. * * See also nl80211 for the respective attribute documentation. */ @@ -4563,6 +4589,13 @@ struct cfg80211_pmsr_ftm_request_peer { u8 ftms_per_burst; u8 ftmr_retries; u8 bss_color; + + u32 request_type; + u32 min_time_between_measurements; + u32 max_time_between_measurements; + u8 availability_window; + u32 nominal_time; + u32 num_measurements; }; /** diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index ea0acce724ca..6be89e656276 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -7991,6 +7991,26 @@ enum nl80211_peer_measurement_resp { NL80211_PMSR_RESP_ATTR_MAX = NUM_NL80211_PMSR_RESP_ATTRS - 1 }; +/** + * enum nl80211_peer_measurement_ftm_req_type - FTM ranging request type, + * used with %NL80211_PMSR_PEER_ATTR_REQ_TYPE + * + * @NL80211_PMSR_FTM_REQ_TYPE_INFRA: infrastructure ranging, i.e. STA-to-AP + * @NL80211_PMSR_FTM_REQ_TYPE_PD: peer-to-peer ranging as defined in the + * Wi-Fi Alliance specification "Proximity Ranging (PR) Implementation + * Consideration Draft 1.9 Rev 1" + * @NUM_NL80211_PMSR_FTM_REQ_TYPE: internal + * @NL80211_PMSR_FTM_REQ_TYPE_MAX: highest request type value + */ +enum nl80211_peer_measurement_ftm_req_type { + NL80211_PMSR_FTM_REQ_TYPE_INFRA, + NL80211_PMSR_FTM_REQ_TYPE_PD, + + /* keep last */ + NUM_NL80211_PMSR_FTM_REQ_TYPE, + NL80211_PMSR_FTM_REQ_TYPE_MAX = NUM_NL80211_PMSR_FTM_REQ_TYPE - 1 +}; + /** * enum nl80211_peer_measurement_peer_attrs - peer attributes for measurement * @__NL80211_PMSR_PEER_ATTR_INVALID: invalid @@ -8004,6 +8024,9 @@ enum nl80211_peer_measurement_resp { * @NL80211_PMSR_PEER_ATTR_RESP: This is a nested attribute indexed by * measurement type, with attributes from the * &enum nl80211_peer_measurement_resp inside. + * @NL80211_PMSR_PEER_ATTR_REQ_TYPE: u32 attribute specifying the ranging + * request type, using values from &enum nl80211_peer_measurement_ftm_req_type. + * If absent, defaults to %NL80211_PMSR_FTM_REQ_TYPE_INFRA. * * @NUM_NL80211_PMSR_PEER_ATTRS: internal * @NL80211_PMSR_PEER_ATTR_MAX: highest attribute number @@ -8015,6 +8038,7 @@ enum nl80211_peer_measurement_peer_attrs { NL80211_PMSR_PEER_ATTR_CHAN, NL80211_PMSR_PEER_ATTR_REQ, NL80211_PMSR_PEER_ATTR_RESP, + NL80211_PMSR_PEER_ATTR_REQ_TYPE, /* keep last */ NUM_NL80211_PMSR_PEER_ATTRS, @@ -8238,9 +8262,11 @@ enum nl80211_peer_measurement_ftm_type_capa { * default 15 i.e. "no preference"). For non-EDCA ranging, this is the * burst duration in milliseconds (optional with default 0, i.e. let the * device decide). - * @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST: number of successful FTM frames - * requested per burst + * @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST: (Optional) number of successful + * FTM frames requested per burst * (u8, 0-31, optional with default 0 i.e. "no preference") + * If the attribute is absent ("no preference"), the driver or firmware can + * choose a suitable value. * @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES: number of FTMR frame retries * (u8, default 3) * @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI: request LCI data (flag) @@ -8274,6 +8300,33 @@ enum nl80211_peer_measurement_ftm_type_capa { * Only valid if %NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK is set (so the * RSTA will have the measurement results to report back in the FTM * response). + * @NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS: minimum time + * between two consecutive range measurements in units of 100 microseconds, + * for non-trigger based ranging (u32). Should be set as short as possible + * to minimize turnaround time, since two-way ranging with delayed LMR + * requires two measurements. Only valid if + * %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set. + * @NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS: maximum time + * between two consecutive range measurements in units of 10 milliseconds, + * for non-trigger based ranging (u32). Acts as a session timeout; if + * exceeded, the ranging session should be terminated. Only valid if + * %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set. + * @NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME: The nominal time field shall be + * set to the nominal duration between adjacent Availability Windows in + * units of milli seconds (u32). Mandatory if + * %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set. + * @NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION: (Optional) The AW duration field + * shall be set to the duration of the AW in units of 1ms (0-255 ms) (u32). + * Only valid if %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set. + * If the attribute is absent ("no preference"), the driver or firmware + * can choose a suitable value. + * @NL80211_PMSR_FTM_REQ_ATTR_NUM_MEASUREMENTS: (Optional) number of + * Availability Windows (AWs) to schedule for non-trigger-based ranging. + * Each AW may contain multiple FTM exchanges as configured by + * %NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST. Only valid if + * %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set. + * If the attribute is absent ("no preference"), the driver or firmware + * can choose a suitable value. * * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number @@ -8295,6 +8348,11 @@ enum nl80211_peer_measurement_ftm_req { NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK, NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR, NL80211_PMSR_FTM_REQ_ATTR_RSTA, + NL80211_PMSR_FTM_REQ_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS, + NL80211_PMSR_FTM_REQ_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS, + NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME, + NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION, + NL80211_PMSR_FTM_REQ_ATTR_NUM_MEASUREMENTS, /* keep last */ NUM_NL80211_PMSR_FTM_REQ_ATTR, -- cgit v1.2.3 From 4e901e99edd2c289e6917cb79027e39c98d711e2 Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:50 +0530 Subject: wifi: cfg80211: extend PMSR FTM response for proximity ranging Applications need negotiated session parameters to interpret proximity ranging results and perform post-processing. Currently, the FTM response lacks LTF repetition counts, time constraints, spatial stream configuration, and availability window parameters. Extend the FTM response structure to report these negotiated parameters, enabling applications to track session configuration and use them in post-processing to increase ranging precision. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-8-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 56 ++++++++++++++++++++++++++++++++++++++++++-- include/uapi/linux/nl80211.h | 38 ++++++++++++++++++++++++++++++ 2 files changed, 92 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 28923539456e..ad32353e87e0 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -4436,6 +4436,25 @@ struct cfg80211_ftm_responder_stats { * (must have either this or @rtt_avg) * @dist_variance: variance of distances measured (see also @rtt_variance) * @dist_spread: spread of distances measured (see also @rtt_spread) + * @tx_ltf_repetition_count: negotiated value of number of tx ltf repetitions + * in NDP frames + * @rx_ltf_repetition_count: negotiated value of number of rx ltf repetitions + * in NDP frames + * @max_time_between_measurements: the negotiated maximum interval (in units of + * 10 ms) by which the ISTA must complete the next measurement cycle. + * @min_time_between_measurements: the negotiated minimum interval (in units of + * 100 us) between two consecutive range measurements initiated by the + * ISTA. + * @num_tx_spatial_streams: number of Tx space-time streams used in the NDP + * frame during the measurement sounding phase. + * @num_rx_spatial_streams: number of Rx space-time streams used in the NDP + * frame during the measurement sounding phase. + * @nominal_time: negotiated nominal duration between adjacent availability + * windows in units of milliseconds (u32). + * @availability_window: negotiated availability window time used in this + * session in units of milliseconds (u8). + * @chan_width: band width used for measurement. + * @preamble: preamble used for measurement. * @num_ftmr_attempts_valid: @num_ftmr_attempts is valid * @num_ftmr_successes_valid: @num_ftmr_successes is valid * @rssi_avg_valid: @rssi_avg is valid @@ -4448,6 +4467,18 @@ struct cfg80211_ftm_responder_stats { * @dist_avg_valid: @dist_avg is valid * @dist_variance_valid: @dist_variance is valid * @dist_spread_valid: @dist_spread is valid + * @tx_ltf_repetition_count_valid: @tx_ltf_repetition_count is valid + * @rx_ltf_repetition_count_valid: @rx_ltf_repetition_count is valid + * @max_time_between_measurements_valid: @max_time_between_measurements is valid + * @min_time_between_measurements_valid: @min_time_between_measurements is valid + * @num_tx_spatial_streams_valid: @num_tx_spatial_streams is valid + * @num_rx_spatial_streams_valid: @num_rx_spatial_streams is valid + * @nominal_time_valid: @nominal_time is valid + * @availability_window_valid: @availability_window is valid + * @chan_width_valid: @chan_width is valid. + * @preamble_valid: @preamble is valid. + * @is_delayed_lmr: indicates if the reported LMR is of the current burst or the + * previous burst, flag. */ struct cfg80211_pmsr_ftm_result { const u8 *lci; @@ -4471,8 +4502,18 @@ struct cfg80211_pmsr_ftm_result { s64 dist_avg; s64 dist_variance; s64 dist_spread; + u32 tx_ltf_repetition_count; + u32 rx_ltf_repetition_count; + u32 max_time_between_measurements; + u32 min_time_between_measurements; + u8 num_tx_spatial_streams; + u8 num_rx_spatial_streams; + u32 nominal_time; + u8 availability_window; + enum nl80211_chan_width chan_width; + enum nl80211_preamble preamble; - u16 num_ftmr_attempts_valid:1, + u32 num_ftmr_attempts_valid:1, num_ftmr_successes_valid:1, rssi_avg_valid:1, rssi_spread_valid:1, @@ -4483,7 +4524,18 @@ struct cfg80211_pmsr_ftm_result { rtt_spread_valid:1, dist_avg_valid:1, dist_variance_valid:1, - dist_spread_valid:1; + dist_spread_valid:1, + tx_ltf_repetition_count_valid:1, + rx_ltf_repetition_count_valid:1, + max_time_between_measurements_valid:1, + min_time_between_measurements_valid:1, + num_tx_spatial_streams_valid:1, + num_rx_spatial_streams_valid:1, + nominal_time_valid:1, + availability_window_valid:1, + chan_width_valid:1, + preamble_valid:1, + is_delayed_lmr:1; }; /** diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 6be89e656276..08e8e4de650c 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -8439,6 +8439,33 @@ enum nl80211_peer_measurement_ftm_failure_reasons { * @NL80211_PMSR_FTM_RESP_ATTR_PAD: ignore, for u64/s64 padding only * @NL80211_PMSR_FTM_RESP_ATTR_BURST_PERIOD: actual burst period used by * the responder (similar to request, u16) + * @NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT: negotiated value of + * number of tx ltf repetitions in NDP frames (u32, optional) + * @NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT: negotiated value of + * number of rx ltf repetitions in NDP frames (u32, optional) + * @NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS: negotiated value + * where latest time by which the ISTA needs to complete the next round of + * measurements, in units of 10 ms (u32, optional) + * @NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS: negotiated + * minimum time between two consecutive range measurements initiated by an + * ISTA, in units of 100 us (u32, optional) + * @NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS: number of Tx space-time + * streams used in NDP frames during the measurement sounding phase + * (u32, optional). + * @NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS: number of Rx space-time + * streams used in the NDP frames during the measurement sounding phase + * (u32, optional) + * @NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME: negotiated nominal time used in + * this session in milliseconds. (u32, optional) + * @NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW: negotiated availability + * window time used in this session, in units of milli seconds. + * (u32, optional) + * @NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH: u32 attribute indicating channel + * width used for measurement, see &enum nl80211_chan_width (optional). + * @NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE: u32 attribute indicating the preamble + * type used for the measurement, see &enum nl80211_preamble (optional). + * @NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR: flag, indicates if the + * current result is delayed LMR data. * * @NUM_NL80211_PMSR_FTM_RESP_ATTR: internal * @NL80211_PMSR_FTM_RESP_ATTR_MAX: highest attribute number @@ -8468,6 +8495,17 @@ enum nl80211_peer_measurement_ftm_resp { NL80211_PMSR_FTM_RESP_ATTR_CIVICLOC, NL80211_PMSR_FTM_RESP_ATTR_PAD, NL80211_PMSR_FTM_RESP_ATTR_BURST_PERIOD, + NL80211_PMSR_FTM_RESP_ATTR_TX_LTF_REPETITION_COUNT, + NL80211_PMSR_FTM_RESP_ATTR_RX_LTF_REPETITION_COUNT, + NL80211_PMSR_FTM_RESP_ATTR_MAX_TIME_BETWEEN_MEASUREMENTS, + NL80211_PMSR_FTM_RESP_ATTR_MIN_TIME_BETWEEN_MEASUREMENTS, + NL80211_PMSR_FTM_RESP_ATTR_NUM_TX_SPATIAL_STREAMS, + NL80211_PMSR_FTM_RESP_ATTR_NUM_RX_SPATIAL_STREAMS, + NL80211_PMSR_FTM_RESP_ATTR_NOMINAL_TIME, + NL80211_PMSR_FTM_RESP_ATTR_AVAILABILITY_WINDOW, + NL80211_PMSR_FTM_RESP_ATTR_CHANNEL_WIDTH, + NL80211_PMSR_FTM_RESP_ATTR_PREAMBLE, + NL80211_PMSR_FTM_RESP_ATTR_IS_DELAYED_LMR, /* keep last */ NUM_NL80211_PMSR_FTM_RESP_ATTR, -- cgit v1.2.3 From ea996c2c036df21fbd3b195e6c5c42c11eadb6c4 Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:51 +0530 Subject: wifi: cfg80211: add role-based peer limits to FTM capabilities Peer measurement capabilities currently advertise a single maximum peer count regardless of device role. Some devices support different peer limits when operating as initiator versus responder. Add max_peers fields inside the ftm.ista and ftm.rsta sub-structs of cfg80211_pmsr_capabilities to allow drivers to advertise per-role peer limits. These limits are generic and not restricted to any specific ranging type. Expose these over nl80211 using new NL80211_PMSR_ATTR_MAX_PEER_ISTA_ROLE and NL80211_PMSR_ATTR_MAX_PEER_RSTA_ROLE attributes inside the ISTA_CAPS and RSTA_CAPS nested attributes respectively. When a role limit is advertised, validate the number of peers in the request separately for each role using the existing rsta flag in the FTM request, and reject the request if the limit is exceeded. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-9-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 6 ++++++ include/uapi/linux/nl80211.h | 14 ++++++++++++++ 2 files changed, 20 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index ad32353e87e0..5669948e0f3d 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -6003,6 +6003,8 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type); * TB ranging. * @ftm.ista.support_edca: supports operating as ISTA in PMSR FTM request for * EDCA based ranging. + * @ftm.ista.max_peers: maximum number of peers supported in the ISTA role. + * If zero, no role-specific peer limit applies. * @ftm.rsta: responder role capabilities * @ftm.rsta.support_ntb: supports operating as RSTA in PMSR FTM request for * NTB ranging. @@ -6010,6 +6012,8 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type); * TB ranging. * @ftm.rsta.support_edca: supports operating as RSTA in PMSR FTM request for * EDCA based ranging. + * @ftm.rsta.max_peers: maximum number of peers supported in the RSTA role. + * If zero, no role-specific peer limit applies. * @ftm.max_no_of_tx_antennas: maximum number of transmit antennas supported for * EDCA based ranging (0 means unknown) * @ftm.max_no_of_rx_antennas: maximum number of receive antennas supported for @@ -6064,11 +6068,13 @@ struct cfg80211_pmsr_capabilities { u8 support_ntb:1, support_tb:1, support_edca:1; + u32 max_peers; } ista; struct { u8 support_ntb:1, support_tb:1, support_edca:1; + u32 max_peers; } rsta; u8 max_no_of_tx_antennas; u8 max_no_of_rx_antennas; diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 08e8e4de650c..e31ff2a745b2 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -8065,6 +8065,18 @@ enum nl80211_peer_measurement_peer_attrs { * meaningless, just a list of peers to measure with, with the * sub-attributes taken from * &enum nl80211_peer_measurement_peer_attrs. + * @NL80211_PMSR_ATTR_MAX_PEER_ISTA_ROLE: u32 attribute indicating the + * maximum number of peers supported when the device operates in the + * ISTA (Initiator STA) role. If absent, no role-specific peer limit + * applies. The sum of %NL80211_PMSR_ATTR_MAX_PEER_ISTA_ROLE and + * %NL80211_PMSR_ATTR_MAX_PEER_RSTA_ROLE is enforced when the device + * supports concurrent ISTA/RSTA operation. + * @NL80211_PMSR_ATTR_MAX_PEER_RSTA_ROLE: u32 attribute indicating the + * maximum number of peers supported when the device operates in the + * RSTA (Responder STA) role. If absent, no role-specific peer limit + * applies. The sum of %NL80211_PMSR_ATTR_MAX_PEER_ISTA_ROLE and + * %NL80211_PMSR_ATTR_MAX_PEER_RSTA_ROLE is enforced when the device + * supports concurrent ISTA/RSTA operation. * * @NUM_NL80211_PMSR_ATTR: internal * @NL80211_PMSR_ATTR_MAX: highest attribute number @@ -8077,6 +8089,8 @@ enum nl80211_peer_measurement_attrs { NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR, NL80211_PMSR_ATTR_TYPE_CAPA, NL80211_PMSR_ATTR_PEERS, + NL80211_PMSR_ATTR_MAX_PEER_ISTA_ROLE, + NL80211_PMSR_ATTR_MAX_PEER_RSTA_ROLE, /* keep last */ NUM_NL80211_PMSR_ATTR, -- cgit v1.2.3 From 99529edd28df505576366753e204ba78a406659b Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:52 +0530 Subject: wifi: cfg80211: add ingress/egress distance thresholds for FTM Proximity detection applications need to receive measurement results only when devices cross specific distance boundaries to avoid unnecessary host wakeups and reduce power consumption. Introduce configurable distance-based reporting thresholds that drivers can use to implement selective result reporting. Add ingress and egress distance parameters allowing applications to specify when results should be reported as peers cross these boundaries. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-10-peddolla.reddy@oss.qualcomm.com [remove mm units from variables] Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 14 ++++++++++++++ include/uapi/linux/nl80211.h | 15 +++++++++++++++ 2 files changed, 29 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 5669948e0f3d..87e848750339 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -4622,6 +4622,18 @@ struct cfg80211_pmsr_result { * exchanges as configured by @ftms_per_burst. Only valid if * @non_trigger_based is set. If set to 0, the firmware or driver * can automatically select an appropriate value. + * @ingress_distance: optional ingress threshold in units of mm. When set, + * the measurement result of the peer needs to be indicated if the device + * moves into this range. Measurement results need to be sent on a burst + * index basis in this case. + * @egress_distance: optional egress threshold in units of mm. When set, + * the measurement result of the peer needs to be indicated if the device + * moves out of this range. Measurement results need to be sent on a burst + * index basis in this case. + * If neither or only one of @ingress_distance and @egress_distance + * is set, only the specified threshold is used. If both are set, both + * thresholds are applied. If neither is set, results are reported without + * threshold filtering. * * See also nl80211 for the respective attribute documentation. */ @@ -4648,6 +4660,8 @@ struct cfg80211_pmsr_ftm_request_peer { u8 availability_window; u32 nominal_time; u32 num_measurements; + u64 ingress_distance; + u64 egress_distance; }; /** diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index e31ff2a745b2..02fe42b4f29c 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -8341,6 +8341,18 @@ enum nl80211_peer_measurement_ftm_type_capa { * %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED is set. * If the attribute is absent ("no preference"), the driver or firmware * can choose a suitable value. + * @NL80211_PMSR_FTM_REQ_ATTR_PAD: ignore, for u64/s64 padding only. + * @NL80211_PMSR_FTM_REQ_ATTR_INGRESS: optional u64 attribute in units of mm. + * When specified, the measurement result of the peer needs to be + * indicated if the device moves into this range. + * @NL80211_PMSR_FTM_REQ_ATTR_EGRESS: optional u64 attribute in units of mm. + * When specified, the measurement result of the peer needs to be + * indicated if the device moves out of this range. + * If neither or only one of @NL80211_PMSR_FTM_REQ_ATTR_INGRESS and + * @NL80211_PMSR_FTM_REQ_ATTR_EGRESS is specified, only the specified + * threshold is used. If both are specified, both thresholds are applied. + * If neither is specified, results are reported without threshold + * filtering. * * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number @@ -8367,6 +8379,9 @@ enum nl80211_peer_measurement_ftm_req { NL80211_PMSR_FTM_REQ_ATTR_NOMINAL_TIME, NL80211_PMSR_FTM_REQ_ATTR_AW_DURATION, NL80211_PMSR_FTM_REQ_ATTR_NUM_MEASUREMENTS, + NL80211_PMSR_FTM_REQ_ATTR_PAD, + NL80211_PMSR_FTM_REQ_ATTR_INGRESS, + NL80211_PMSR_FTM_REQ_ATTR_EGRESS, /* keep last */ NUM_NL80211_PMSR_FTM_REQ_ATTR, -- cgit v1.2.3 From 5733daa670dc1e1464be59dfcacaa76597201b3e Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:53 +0530 Subject: wifi: cfg80211: add PD-specific preamble and bandwidth capabilities Devices may support different preamble and bandwidth configurations for proximity detection (PD) ranging versus standard ranging. Add separate pd_preambles and pd_bandwidths fields to cfg80211_pmsr_capabilities to allow drivers to advertise PD-specific capabilities. Expose these over nl80211 using new attributes NL80211_PMSR_FTM_CAPA_ATTR_PD_PREAMBLES and NL80211_PMSR_FTM_CAPA_ATTR_PD_BANDWIDTHS, advertised only when pd_support is set. For PD requests, validate bandwidth and preamble against pd_bandwidths and pd_preambles. For non-PD requests, validate against the existing bandwidths and preambles fields. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-11-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 6 ++++++ include/uapi/linux/nl80211.h | 10 ++++++++++ 2 files changed, 16 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 87e848750339..f5a47a0c7532 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -6053,6 +6053,10 @@ cfg80211_get_iftype_ext_capa(struct wiphy *wiphy, enum nl80211_iftype type); * @ftm.concurrent_ista_rsta_support: indicates if the device can * simultaneously act as initiator and responder in a multi-peer * measurement request. Only valid if @ftm.rsta_support is set. + * @ftm.pd_preambles: bitmap of preambles supported (&enum nl80211_preamble) + * for PD ranging requests. Ignored if @ftm.type.pd_support is not set. + * @ftm.pd_bandwidths: bitmap of bandwidths supported (&enum nl80211_chan_width) + * for PD ranging requests. Ignored if @ftm.type.pd_support is not set. */ struct cfg80211_pmsr_capabilities { unsigned int max_peers; @@ -6099,6 +6103,8 @@ struct cfg80211_pmsr_capabilities { pd_support:1; } type; u8 concurrent_ista_rsta_support:1; + u32 pd_preambles; + u32 pd_bandwidths; } ftm; }; diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 02fe42b4f29c..5bef8fd25270 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -8189,6 +8189,14 @@ enum nl80211_peer_measurement_attrs { * to estimate the burst period to be given in the FTM request for the * NTB ranging case. If non-zero, this value will be used to validate * the nominal time in the FTM request. + * @NL80211_PMSR_FTM_CAPA_ATTR_PD_PREAMBLES: u32 bitmap of values from + * &enum nl80211_preamble indicating the supported preambles for PD + * ranging requests. Only valid if %NL80211_PMSR_FTM_TYPE_CAPA_ATTR_PD_SUPPORT + * is set. + * @NL80211_PMSR_FTM_CAPA_ATTR_PD_BANDWIDTHS: u32 bitmap of values from + * &enum nl80211_chan_width indicating the supported channel bandwidths + * for PD ranging requests. Only valid if + * %NL80211_PMSR_FTM_TYPE_CAPA_ATTR_PD_SUPPORT is set. * * @NUM_NL80211_PMSR_FTM_CAPA_ATTR: internal * @NL80211_PMSR_FTM_CAPA_ATTR_MAX: highest attribute number @@ -8225,6 +8233,8 @@ enum nl80211_peer_measurement_ftm_capa { NL80211_PMSR_FTM_CAPA_ATTR_MAX_NUM_RX_ANTENNAS, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_EDCA, NL80211_PMSR_FTM_CAPA_ATTR_MIN_INTERVAL_NTB, + NL80211_PMSR_FTM_CAPA_ATTR_PD_PREAMBLES, + NL80211_PMSR_FTM_CAPA_ATTR_PD_BANDWIDTHS, /* keep last */ NUM_NL80211_PMSR_FTM_CAPA_ATTR, -- cgit v1.2.3 From 410aa47fd9d308029f3520e97eec71a8eb508622 Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:54 +0530 Subject: wifi: cfg80211: allow suppressing FTM result reporting for PD requests Proximity detection often does not require detailed ranging measurements, yet userspace currently receives full FTM results for every request, causing unnecessary data transfer, host wakeups, and processing overhead. Add an optional control to suppress ranging result reporting for peer-to-peer PD requests. Introduce the NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS flag; when set with a PD request, the device may perform the measurements (e.g. when acting as RSTA) but must not report the measurement results to userspace. Validate that the flag is only accepted when request_type is set to NL80211_PMSR_FTM_REQ_TYPE_PD, reject otherwise. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-12-peddolla.reddy@oss.qualcomm.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 6 ++++++ include/uapi/linux/nl80211.h | 6 ++++++ 2 files changed, 12 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index f5a47a0c7532..fdc8363b296c 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -4634,6 +4634,11 @@ struct cfg80211_pmsr_result { * is set, only the specified threshold is used. If both are set, both * thresholds are applied. If neither is set, results are reported without * threshold filtering. + * @pd_suppress_range_results: flag to suppress ranging results for PD + * requests. When set, the device performs ranging measurements to + * provide ranging services to a peer (e.g. in RSTA role) but does + * not report the measurement results to userspace. Only valid when + * @request_type is %NL80211_PMSR_FTM_REQ_TYPE_PD. * * See also nl80211 for the respective attribute documentation. */ @@ -4662,6 +4667,7 @@ struct cfg80211_pmsr_ftm_request_peer { u32 num_measurements; u64 ingress_distance; u64 egress_distance; + u8 pd_suppress_range_results:1; }; /** diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 5bef8fd25270..1da4dc3fc816 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -8363,6 +8363,11 @@ enum nl80211_peer_measurement_ftm_type_capa { * threshold is used. If both are specified, both thresholds are applied. * If neither is specified, results are reported without threshold * filtering. + * @NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS: Flag to suppress ranging + * results for PD requests. When set, ranging measurements are performed + * but results are not reported to userspace, regardless of ranging role + * or type. Only valid when %NL80211_PMSR_PEER_ATTR_REQ_TYPE is set to + * %NL80211_PMSR_FTM_REQ_TYPE_PD. * * @NUM_NL80211_PMSR_FTM_REQ_ATTR: internal * @NL80211_PMSR_FTM_REQ_ATTR_MAX: highest attribute number @@ -8392,6 +8397,7 @@ enum nl80211_peer_measurement_ftm_req { NL80211_PMSR_FTM_REQ_ATTR_PAD, NL80211_PMSR_FTM_REQ_ATTR_INGRESS, NL80211_PMSR_FTM_REQ_ATTR_EGRESS, + NL80211_PMSR_FTM_REQ_ATTR_PD_SUPPRESS_RESULTS, /* keep last */ NUM_NL80211_PMSR_FTM_REQ_ATTR, -- cgit v1.2.3 From 4bb6e58bc29ab772c26c5eb471ab255fe2e044d8 Mon Sep 17 00:00:00 2001 From: Peddolla Harshavardhan Reddy Date: Mon, 20 Apr 2026 14:38:55 +0530 Subject: wifi: cfg80211: add LTF keyseed support for secure ranging Currently there is no way to install an LTF key seed that can be used in non-trigger-based (NTB) and trigger-based (TB) FTM ranging to protect NDP frames. Without this, drivers cannot enable PHY-layer security for peer measurement sessions, leaving ranging measurements vulnerable to eavesdropping and manipulation. Introduce NL80211_KEY_LTF_SEED attribute and the dedicated extended feature flag NL80211_EXT_FEATURE_SET_KEY_LTF_SEED to allow drivers to advertise and install LTF key seeds via nl80211. The key seed must be configured beforehand to ensure the peer measurement session is secure. The driver must advertise both NL80211_EXT_FEATURE_SECURE_LTF and NL80211_EXT_FEATURE_SET_KEY_LTF_SEED for the key seed installation to be permitted. The LTF key seed is pairwise key material and must only be used with pairwise key type. Reject attempts to use it with other key types. Signed-off-by: Peddolla Harshavardhan Reddy Link: https://patch.msgid.link/20260420090856.2152905-13-peddolla.reddy@oss.qualcomm.com [fix policy coding style] Signed-off-by: Johannes Berg --- include/linux/ieee80211.h | 1 + include/net/cfg80211.h | 4 ++++ include/uapi/linux/nl80211.h | 18 ++++++++++++++++++ 3 files changed, 23 insertions(+) (limited to 'include') diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index 23f9df9be837..11106589acc6 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -2236,6 +2236,7 @@ struct ieee80211_multiple_bssid_configuration { #define WLAN_AKM_SUITE_WFA_DPP SUITE(WLAN_OUI_WFA, 2) #define WLAN_MAX_KEY_LEN 32 +#define WLAN_MAX_SECURE_LTF_KEYSEED_LEN 48 #define WLAN_PMK_NAME_LEN 16 #define WLAN_PMKID_LEN 16 diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index fdc8363b296c..13e035fecf7f 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -830,6 +830,8 @@ struct vif_params { * @seq_len: length of @seq. * @vlan_id: vlan_id for VLAN group key (if nonzero) * @mode: key install mode (RX_TX, NO_TX or SET_TX) + * @ltf_keyseed: LTF key seed material + * @ltf_keyseed_len: length of LTF key seed material */ struct key_params { const u8 *key; @@ -839,6 +841,8 @@ struct key_params { u16 vlan_id; u32 cipher; enum nl80211_key_mode mode; + const u8 *ltf_keyseed; + size_t ltf_keyseed_len; }; /** diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 1da4dc3fc816..6c7e6c05b9a8 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -5814,6 +5814,18 @@ enum nl80211_key_default_types { * @NL80211_KEY_MODE: the mode from enum nl80211_key_mode. * Defaults to @NL80211_KEY_RX_TX. * @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key + * @NL80211_KEY_LTF_SEED: LTF key seed is used by the driver to generate + * secure LTF keys used in case of peer measurement request with FTM + * request type as either %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED + * or %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED. Secure LTF key seeds + * will help enable PHY security in peer measurement session. + * The LTF key seed is installed along with the TK (Temporal Key) using + * %NL80211_CMD_NEW_KEY. The TK is configured using the + * %NL80211_ATTR_KEY_DATA attribute, while the LTF key seed is configured + * using this attribute. Both keys must be configured before initiation + * of peer measurement to ensure peer measurement session is secure. + * Only valid if %NL80211_EXT_FEATURE_SET_KEY_LTF_SEED is set. This + * attribute is restricted to pairwise keys (%NL80211_KEYTYPE_PAIRWISE). * * @__NL80211_KEY_AFTER_LAST: internal * @NL80211_KEY_MAX: highest key attribute @@ -5830,6 +5842,7 @@ enum nl80211_key_attributes { NL80211_KEY_DEFAULT_TYPES, NL80211_KEY_MODE, NL80211_KEY_DEFAULT_BEACON, + NL80211_KEY_LTF_SEED, /* keep last */ __NL80211_KEY_AFTER_LAST, @@ -7059,6 +7072,10 @@ enum nl80211_feature_flags { * forward frames with a matching MAC address to userspace during * the off-channel period. * + * @NL80211_EXT_FEATURE_SET_KEY_LTF_SEED: Driver supports installing the + * LTF key seed via %NL80211_KEY_LTF_SEED. The seed is used to generate + * secure LTF keys for secure LTF measurement sessions. + * * @NUM_NL80211_EXT_FEATURES: number of extended features. * @MAX_NL80211_EXT_FEATURES: highest extended feature index. */ @@ -7139,6 +7156,7 @@ enum nl80211_ext_feature_index { NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION, NL80211_EXT_FEATURE_IEEE8021X_AUTH, NL80211_EXT_FEATURE_ROC_ADDR_FILTER, + NL80211_EXT_FEATURE_SET_KEY_LTF_SEED, /* add new features before the definition below */ NUM_NL80211_EXT_FEATURES, -- cgit v1.2.3 From f5cc545f59699549adbaa4084149f8247865a51d Mon Sep 17 00:00:00 2001 From: Mika Westerberg Date: Wed, 19 Nov 2025 12:53:58 +0200 Subject: thunderbolt: Wait for tb_domain_release() to complete when driver is removed We should not call nhi_shutdown() before the domain structure and the control channel rings are completely released. Otherwise we might release resources like the nhi->msix_ida that are still referenced in tb_domain_release(). For this reason wait for the tb_domain_release() to be completed before continuing to nhi_shutdown() and eventually releasing of the rest of the data structures. Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index 0ba112175bb3..a5ef7100a6d3 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -493,6 +493,7 @@ static inline struct tb_xdomain *tb_service_parent(struct tb_service *svc) * MSI-X is used. * @hop_count: Number of rings (end point hops) supported by NHI. * @quirks: NHI specific quirks if any + * @domain_released: Completed when domain has been fully released */ struct tb_nhi { spinlock_t lock; @@ -507,6 +508,7 @@ struct tb_nhi { struct work_struct interrupt_work; u32 hop_count; unsigned long quirks; + struct completion domain_released; }; /** -- cgit v1.2.3 From cf0c38ee554c3e9062408cc3a38325483d52ecd0 Mon Sep 17 00:00:00 2001 From: Alan Borzeszkowski Date: Thu, 2 Oct 2025 15:37:22 +0300 Subject: thunderbolt: Don't create multiple DMA tunnels on firmware connection manager Firmware connection manager supports only one DMA tunnel per XDomain connection. Firmware prior Intel Titan Ridge failed the operation directly but the same does not happen anymore on Titan Ridge and forward. For this reason add an explicit check, and fail the operation accordingly in the driver. Signed-off-by: Alan Borzeszkowski Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index a5ef7100a6d3..bbdbbc84c999 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -228,6 +228,7 @@ enum tb_link_width { * changed notification * @bonding_possible: True if lane bonding is possible on local side * @target_link_width: Target link width from the remote host + * @ntunnels: Keeps track of how many tunnels go through this XDomain * @link: Root switch link the remote domain is connected (ICM only) * @depth: Depth in the chain the remote domain is connected (ICM only) * @@ -273,6 +274,7 @@ struct tb_xdomain { int properties_changed_retries; bool bonding_possible; u8 target_link_width; + atomic_t ntunnels; u8 link; u8 depth; }; -- cgit v1.2.3 From ca283942e5b91894d3a9228eaf789837f66c986f Mon Sep 17 00:00:00 2001 From: "Mike Marciniszyn (Meta)" Date: Thu, 30 Apr 2026 11:08:00 -0400 Subject: net: mdio: Add support for RSFEC Control register for PMA Add the constants associated with RS-FEC configuration and status as well as the indicated separated bits for DEVS1 to convey a separated PMA. Reviewed-by: Andrew Lunn Signed-off-by: Mike Marciniszyn (Meta) Link: https://patch.msgid.link/20260430150802.3521-2-mike.marciniszyn@gmail.com Signed-off-by: Paolo Abeni --- include/uapi/linux/mdio.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/mdio.h b/include/uapi/linux/mdio.h index 8d769f100de6..b2541c948fc1 100644 --- a/include/uapi/linux/mdio.h +++ b/include/uapi/linux/mdio.h @@ -23,6 +23,10 @@ #define MDIO_MMD_DTEXS 5 /* DTE Extender Sublayer */ #define MDIO_MMD_TC 6 /* Transmission Convergence */ #define MDIO_MMD_AN 7 /* Auto-Negotiation */ +#define MDIO_MMD_SEP_PMA1 8 /* Separated PMA (1) */ +#define MDIO_MMD_SEP_PMA2 9 /* Separated PMA (2) */ +#define MDIO_MMD_SEP_PMA3 10 /* Separated PMA (3) */ +#define MDIO_MMD_SEP_PMA4 11 /* Separated PMA (4) */ #define MDIO_MMD_POWER_UNIT 13 /* PHY Power Unit */ #define MDIO_MMD_C22EXT 29 /* Clause 22 extension */ #define MDIO_MMD_VEND1 30 /* Vendor specific 1 */ @@ -63,6 +67,8 @@ * Lanes B-D are numbered 134-136. */ #define MDIO_PMA_10GBR_FSRT_CSR 147 /* 10GBASE-R fast retrain status and control */ #define MDIO_PMA_10GBR_FECABLE 170 /* 10GBASE-R FEC ability */ +#define MDIO_PMA_RSFEC_CTRL 200 /* RSFEC control */ +#define MDIO_PMA_RSFEC_LANE_MAP 206 /* RSFEC lane mapping */ #define MDIO_PCS_10GBX_STAT1 24 /* 10GBASE-X PCS status 1 */ #define MDIO_PCS_10GBRT_STAT1 32 /* 10GBASE-R/-T PCS status 1 */ #define MDIO_PCS_10GBRT_STAT2 33 /* 10GBASE-R/-T PCS status 2 */ @@ -175,6 +181,10 @@ #define MDIO_DEVS_DTEXS MDIO_DEVS_PRESENT(MDIO_MMD_DTEXS) #define MDIO_DEVS_TC MDIO_DEVS_PRESENT(MDIO_MMD_TC) #define MDIO_DEVS_AN MDIO_DEVS_PRESENT(MDIO_MMD_AN) +#define MDIO_DEVS_SEP_PMA1 MDIO_DEVS_PRESENT(MDIO_MMD_SEP_PMA1) +#define MDIO_DEVS_SEP_PMA2 MDIO_DEVS_PRESENT(MDIO_MMD_SEP_PMA2) +#define MDIO_DEVS_SEP_PMA3 MDIO_DEVS_PRESENT(MDIO_MMD_SEP_PMA3) +#define MDIO_DEVS_SEP_PMA4 MDIO_DEVS_PRESENT(MDIO_MMD_SEP_PMA4) #define MDIO_DEVS_C22EXT MDIO_DEVS_PRESENT(MDIO_MMD_C22EXT) #define MDIO_DEVS_VEND1 MDIO_DEVS_PRESENT(MDIO_MMD_VEND1) #define MDIO_DEVS_VEND2 MDIO_DEVS_PRESENT(MDIO_MMD_VEND2) -- cgit v1.2.3 From 05e58da46d8e8f8b29bc9b47053bb0637891c06f Mon Sep 17 00:00:00 2001 From: Frank Li Date: Mon, 4 May 2026 19:54:35 -0400 Subject: mux: add devm_mux_state_get_from_np() to get mux from child node Add new API devm_mux_state_get_from_np() to retrieve a mux control from a specified child device node. Make devm_mux_state_get() call devm_mux_state_get_from_np() with a NULL node parameter, which defaults to using the device's own of_node. Support the following DT schema: pinctrl@0 { uart-func { mux-state = <&mux_chip 0>; }; spi-func { mux-state = <&mux_chip 1>; }; }; Signed-off-by: Frank Li Signed-off-by: Linus Walleij --- include/linux/mux/consumer.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/mux/consumer.h b/include/linux/mux/consumer.h index a961861a503b..449e38e6e2c5 100644 --- a/include/linux/mux/consumer.h +++ b/include/linux/mux/consumer.h @@ -60,7 +60,10 @@ struct mux_control *mux_control_get_optional(struct device *dev, const char *mux void mux_control_put(struct mux_control *mux); struct mux_control *devm_mux_control_get(struct device *dev, const char *mux_name); -struct mux_state *devm_mux_state_get(struct device *dev, const char *mux_name); + +struct mux_state * +devm_mux_state_get_from_np(struct device *dev, const char *mux_name, struct device_node *np); + struct mux_state *devm_mux_state_get_optional(struct device *dev, const char *mux_name); struct mux_state *devm_mux_state_get_selected(struct device *dev, const char *mux_name); struct mux_state *devm_mux_state_get_optional_selected(struct device *dev, const char *mux_name); @@ -161,4 +164,7 @@ static inline struct mux_state *devm_mux_state_get_optional_selected(struct devi #endif /* CONFIG_MULTIPLEXER */ +#define devm_mux_state_get(dev, mux_name) \ + devm_mux_state_get_from_np(dev, mux_name, NULL) + #endif /* _LINUX_MUX_CONSUMER_H */ -- cgit v1.2.3 From 418a2bbdee2927d543db6913073d0e7ec8b540ee Mon Sep 17 00:00:00 2001 From: Frank Li Date: Mon, 4 May 2026 19:54:38 -0400 Subject: pinctrl: add optional .release_mux() callback Add an optional .release_mux() callback to struct pinmux_ops. Some drivers acquire additional resources in .set_mux(), such as software locks. These resources may need to be released when the mux function is no longer active. Introducing a dedicated .release_mux() callback allows drivers to clean up such resources. The callback is optional and does not affect existing drivers. Commit 2243a87d90b42 ("pinctrl: avoid duplicated calling enable_pinmux_setting for a pin") removed the .disable() callback to resolve two issues: 1. desc->mux_usecount increasing monotonically 2. Hardware glitches caused by repeated .disable()/.enable() calls Adding .release_mux() does not reintroduce those problems. The callback is intended only for releasing driver-side resources (e.g. locks) and must not modify hardware registers. Signed-off-by: Frank Li Signed-off-by: Linus Walleij --- include/linux/pinctrl/pinmux.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/pinctrl/pinmux.h b/include/linux/pinctrl/pinmux.h index 094bbe2fd6fd..77664937eeb2 100644 --- a/include/linux/pinctrl/pinmux.h +++ b/include/linux/pinctrl/pinmux.h @@ -51,6 +51,8 @@ struct pinctrl_gpio_range; * are handled by the pinmux subsystem. The @func_selector selects a * certain function whereas @group_selector selects a certain set of pins * to be used. On simple controllers the latter argument may be ignored + * @release_mux: Release software resources acquired by @set_mux. This callback + * must not change hardware state to avoid glitches when switching mux. * @gpio_request_enable: requests and enables GPIO on a certain pin. * Implement this only if you can mux every pin individually as GPIO. The * affected GPIO range is passed along with an offset(pin number) into that @@ -80,6 +82,9 @@ struct pinmux_ops { unsigned int selector); int (*set_mux) (struct pinctrl_dev *pctldev, unsigned int func_selector, unsigned int group_selector); + void (*release_mux) (struct pinctrl_dev *pctldev, + unsigned int func_selector, + unsigned int group_selector); int (*gpio_request_enable) (struct pinctrl_dev *pctldev, struct pinctrl_gpio_range *range, unsigned int offset); -- cgit v1.2.3 From f6310f043fb4f45f0027da842e46fcddf9c859fe Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 10:36:57 +0200 Subject: wifi: mac80211: update UHR capabilities field order Since 802.11bn D1.4 the DBE capabilities are after the PHY capabilities, not between MAC and PHY, adjust the code accordingly. Also add a struct for DBE capabilities and use it for checking the correct length instead of hard-coding the lengths. Signed-off-by: Johannes Berg Reviewed-by: Miriam Rachel Korenblit Link: https://patch.msgid.link/20260428103657.b40af50f182d.I75306a092dc2c8a9eb7276160f0b7144b4846d18@changeid Signed-off-by: Johannes Berg --- include/linux/ieee80211-uhr.h | 55 +++++++++++++++++-------------------------- 1 file changed, 21 insertions(+), 34 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h index d199f3ebdba0..f4f4bd8256df 100644 --- a/include/linux/ieee80211-uhr.h +++ b/include/linux/ieee80211-uhr.h @@ -372,6 +372,12 @@ ieee80211_uhr_npca_dis_subch_bitmap(const struct ieee80211_uhr_operation *oper) #define IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_160_PRES 0x08 #define IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_320_PRES 0x10 +struct ieee80211_uhr_cap_dbe { + u8 cap; + /* present 0, 1 or 2 times depending on _PRES bits */ + struct ieee80211_eht_mcs_nss_supp_bw eht_mcs_map[]; +} __packed; + /** * enum ieee80211_uhr_dbe_max_supported_bw - DBE Maximum Supported Bandwidth * @@ -394,12 +400,6 @@ struct ieee80211_uhr_cap_mac { u8 mac_cap[5]; } __packed; -struct ieee80211_uhr_cap { - struct ieee80211_uhr_cap_mac mac; - /* DBE, PHY capabilities */ - u8 variable[]; -} __packed; - #define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 0x01 #define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_LE80 0x02 #define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_160 0x04 @@ -413,11 +413,18 @@ struct ieee80211_uhr_cap_phy { u8 cap; } __packed; +struct ieee80211_uhr_cap { + struct ieee80211_uhr_cap_mac mac; + struct ieee80211_uhr_cap_phy phy; + /* optional DBE capabilities */ + u8 variable[]; +} __packed; + static inline bool ieee80211_uhr_capa_size_ok(const u8 *data, u8 len, bool from_ap) { const struct ieee80211_uhr_cap *cap = (const void *)data; - size_t needed = sizeof(*cap) + sizeof(struct ieee80211_uhr_cap_phy); + size_t needed = sizeof(*cap); if (len < needed) return false; @@ -427,44 +434,24 @@ static inline bool ieee80211_uhr_capa_size_ok(const u8 *data, u8 len, * in the UHR MAC Capabilities Information field. */ if (from_ap && cap->mac.mac_cap[1] & IEEE80211_UHR_MAC_CAP1_DBE_SUPP) { - u8 dbe; + const struct ieee80211_uhr_cap_dbe *dbe; - needed += 1; + needed += sizeof(struct ieee80211_uhr_cap_dbe); if (len < needed) return false; - dbe = cap->variable[0]; + dbe = (const void *)cap->variable; - if (dbe & IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_160_PRES) - needed += 3; + if (dbe->cap & IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_160_PRES) + needed += sizeof(dbe->eht_mcs_map[0]); - if (dbe & IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_320_PRES) - needed += 3; + if (dbe->cap & IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_320_PRES) + needed += sizeof(dbe->eht_mcs_map[0]); } return len >= needed; } -static inline const struct ieee80211_uhr_cap_phy * -ieee80211_uhr_phy_cap(const struct ieee80211_uhr_cap *cap, bool from_ap) -{ - u8 offs = 0; - - if (from_ap && cap->mac.mac_cap[1] & IEEE80211_UHR_MAC_CAP1_DBE_SUPP) { - u8 dbe = cap->variable[0]; - - offs += 1; - - if (dbe & IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_160_PRES) - offs += 3; - - if (dbe & IEEE80211_UHR_MAC_CAP_DBE_EHT_MCS_MAP_320_PRES) - offs += 3; - } - - return (const void *)&cap->variable[offs]; -} - #define IEEE80211_SMD_INFO_CAPA_DL_DATA_FWD 0x01 #define IEEE80211_SMD_INFO_CAPA_MAX_NUM_PREP 0x0E #define IEEE80211_SMD_INFO_CAPA_TYPE 0x10 -- cgit v1.2.3 From 32ae6c6f7b8f85ad403d9606d27b03d8d7e03fec Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 11:06:56 +0200 Subject: wifi: ieee80211: define UHR ML-PM extended MLD capability UHR defines bit 8 to mean multi-link power management, add a definition for it. Also reindent the other definitions to use tabs, not spaces. Link: https://patch.msgid.link/20260428110915.c6b6a06016cf.I7ebd97397507d320124547017e21191b55c5d34d@changeid Signed-off-by: Johannes Berg --- include/linux/ieee80211-eht.h | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index 335e78bd4b5d..87d92fb86fab 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -9,7 +9,7 @@ * Copyright (c) 2006, Michael Wu * Copyright (c) 2013 - 2014 Intel Mobile Communications GmbH * Copyright (c) 2016 - 2017 Intel Deutschland GmbH - * Copyright (c) 2018 - 2025 Intel Corporation + * Copyright (c) 2018 - 2026 Intel Corporation */ #ifndef LINUX_IEEE80211_EHT_H @@ -750,11 +750,13 @@ static inline u16 ieee80211_mle_get_mld_capa_op(const u8 *data) } /* Defined in Figure 9-1074t in P802.11be_D7.0 */ -#define IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_PARAM_UPDATE 0x0001 -#define IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_RECO_MAX_LINKS_MASK 0x001e -#define IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE 0x0020 -#define IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK 0x0040 -#define IEEE80211_EHT_ML_EXT_MLD_CAPA_BTM_MLD_RECO_MULTI_AP 0x0080 +#define IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_PARAM_UPDATE 0x0001 +#define IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_RECO_MAX_LINKS_MASK 0x001e +#define IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE 0x0020 +#define IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK 0x0040 +#define IEEE80211_EHT_ML_EXT_MLD_CAPA_BTM_MLD_RECO_MULTI_AP 0x0080 +/* defined by UHR Draft P802.11bn_D1.3 Figure 9-1147 */ +#define IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM 0x0100 /** * ieee80211_mle_get_ext_mld_capa_op - returns the extended MLD capabilities -- cgit v1.2.3 From 6765bc7429f8d9fa1984430b86c71a17237fd86a Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 11:06:57 +0200 Subject: wifi: mac80211: track AP's extended MLD capa/ops For UHR multi-link power management, the driver/device needs to know if the AP supports it, to be able to use it. Track the AP's extended MLD capabilities and operations so it does. Link: https://patch.msgid.link/20260428110915.e4038a00e4b2.I323686be5d4a73e8b962019a30d51309496b86a6@changeid Signed-off-by: Johannes Berg --- include/net/mac80211.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/net/mac80211.h b/include/net/mac80211.h index d909bc1b29ff..ba1723e62481 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -2674,6 +2674,8 @@ struct ieee80211_link_sta { * @epp_peer: indicates that the peer is an EPP peer. * @nmi: For NDI stations, pointer to the NMI station of the peer. * @nan_sched: NAN peer schedule for this station. Valid only for NMI stations. + * @ext_mld_capa_ops: the MLD's extended MLD capabilities and operations + * NOTE: currently only tracked for AP STAs */ struct ieee80211_sta { u8 addr[ETH_ALEN] __aligned(2); @@ -2698,6 +2700,7 @@ struct ieee80211_sta { struct ieee80211_txq *txq[IEEE80211_NUM_TIDS + 1]; u16 valid_links; + u16 ext_mld_capa_ops; bool epp_peer; struct ieee80211_link_sta deflink; struct ieee80211_link_sta __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS]; -- cgit v1.2.3 From fb19b4d67d81fb91d3c0dce0ddea7fc393a37b2e Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 11:06:59 +0200 Subject: wifi: cfg80211: allow devices to advertise extended MLD capa/ops For UHR, multi-link power-management capability lives there, and so it's needed that hostapd knows what to advertise, and clients should have it shown to userspace for information. Repurpose the existing NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS by renaming it to NL80211_ATTR_EXT_MLD_CAPA_AND_OPS (with a define for compatibility) and advertise the capabilities. We can also later use the value, if needed, to set per-station capabilities on STAs added to AP interfaces. Link: https://patch.msgid.link/20260428110915.e808e70feed6.I378a7c017bfc1ebb072fa8d5d1db2ac9b45596c9@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 2 ++ include/uapi/linux/nl80211.h | 15 +++++++++------ 2 files changed, 11 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 13e035fecf7f..5755aa288912 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -5969,6 +5969,7 @@ struct wiphy_vendor_command { * @extended_capabilities_len: length of the extended capabilities * @eml_capabilities: EML capabilities (for MLO) * @mld_capa_and_ops: MLD capabilities and operations (for MLO) + * @ext_mld_capa_and_ops: Extended MLD capabilities and operations (for MLO) */ struct wiphy_iftype_ext_capab { enum nl80211_iftype iftype; @@ -5977,6 +5978,7 @@ struct wiphy_iftype_ext_capab { u8 extended_capabilities_len; u16 eml_capabilities; u16 mld_capa_and_ops; + u16 ext_mld_capa_and_ops; }; /** diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 6c7e6c05b9a8..235d7ae72e60 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -3004,11 +3004,13 @@ enum nl80211_commands { * @NL80211_ATTR_EPCS: Flag attribute indicating that EPCS is enabled for a * station interface. * - * @NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS: Extended MLD capabilities and - * operations that userspace implements to use during association/ML - * link reconfig, currently only "BTM MLD Recommendation For Multiple - * APs Support". Drivers may set additional flags that they support - * in the kernel or device. + * @NL80211_ATTR_EXT_MLD_CAPA_AND_OPS: Extended MLD capabilities and operations. + * For association and link reconfiguration, indicates extra capabilities + * that userspace implements, currently only "BTM MLD Recommendation For + * Multiple APs Support". + * For wiphy information, additional flags that drivers will set, but + * this is informational only for userspace (it's not expected to set + * these.) * * @NL80211_ATTR_WIPHY_RADIO_INDEX: (int) Integer attribute denoting the index * of the radio in interest. Internally a value of -1 is used to @@ -3715,7 +3717,7 @@ enum nl80211_attrs { NL80211_ATTR_MLO_RECONF_REM_LINKS, NL80211_ATTR_EPCS, - NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS, + NL80211_ATTR_EXT_MLD_CAPA_AND_OPS, NL80211_ATTR_WIPHY_RADIO_INDEX, @@ -3769,6 +3771,7 @@ enum nl80211_attrs { #define NL80211_ATTR_SAE_DATA NL80211_ATTR_AUTH_DATA #define NL80211_ATTR_CSA_C_OFF_BEACON NL80211_ATTR_CNTDWN_OFFS_BEACON #define NL80211_ATTR_CSA_C_OFF_PRESP NL80211_ATTR_CNTDWN_OFFS_PRESP +#define NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS NL80211_ATTR_EXT_MLD_CAPA_AND_OPS /* * Allow user space programs to use #ifdef on new attributes by defining them -- cgit v1.2.3 From 1cf1d06e956dfbb05a7f69f64ab3c8938117eabe Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 11:25:32 +0200 Subject: wifi: cfg80211: allow representing NPCA in chandef Add the necessary fields to the chandef data structure to represent NPCA (the NPCA primary channel and NPCA punctured/disabled subchannels bitmap), and the code to check these for validity, compatibility, as well as allowing it to be passed for AP mode for capable devices. Compatibility is assumed to only be the case when it's actually identical, enabling later management of this in channel contexts in mac80211 for multiple APs, but requiring userspace to set up the identical chandef on all AP interfaces that share a channel (and BSS color.) Link: https://patch.msgid.link/20260428112708.46f3872aeb35.I85888dab88a6659ba52db4b3318979ca5bcfc0c8@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 11 +++++++++-- include/uapi/linux/nl80211.h | 6 ++++++ 2 files changed, 15 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 5755aa288912..16e11c5718b5 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -848,6 +848,7 @@ struct key_params { /** * struct cfg80211_chan_def - channel definition * @chan: the (control) channel + * @npca_chan: the NPCA primary channel * @width: channel width * @center_freq1: center frequency of first segment * @center_freq2: center frequency of second segment @@ -860,18 +861,22 @@ struct key_params { * @punctured: mask of the punctured 20 MHz subchannels, with * bits turned on being disabled (punctured); numbered * from lower to higher frequency (like in the spec) + * @npca_punctured: NPCA puncturing bitmap, like @punctured but for + * NPCA transmissions. If NPCA is used (@npca_chan is not %NULL) + * this will be a superset of the @punctured bimap. * @s1g_primary_2mhz: Indicates if the control channel pointed to * by 'chan' exists as a 1MHz primary subchannel within an * S1G 2MHz primary channel. */ struct cfg80211_chan_def { struct ieee80211_channel *chan; + struct ieee80211_channel *npca_chan; enum nl80211_chan_width width; u32 center_freq1; u32 center_freq2; struct ieee80211_edmg edmg; u16 freq1_offset; - u16 punctured; + u16 punctured, npca_punctured; bool s1g_primary_2mhz; }; @@ -1018,7 +1023,9 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1, chandef1->freq1_offset == chandef2->freq1_offset && chandef1->center_freq2 == chandef2->center_freq2 && chandef1->punctured == chandef2->punctured && - chandef1->s1g_primary_2mhz == chandef2->s1g_primary_2mhz); + chandef1->s1g_primary_2mhz == chandef2->s1g_primary_2mhz && + chandef1->npca_chan == chandef2->npca_chan && + chandef1->npca_punctured == chandef2->npca_punctured); } /** diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 235d7ae72e60..9998f6c0a665 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -3162,6 +3162,9 @@ enum nl80211_commands { * encrypted over the air. Enhanced Privacy Protection (EPP), as defined * in IEEE P802.11bi/D4.0, mandates this encryption. * + * @NL80211_ATTR_NPCA_PRIMARY_FREQ: NPCA primary channel (u32) + * @NL80211_ATTR_NPCA_PUNCT_BITMAP: NPCA puncturing bitmap (u32) + * * @NUM_NL80211_ATTR: total number of nl80211_attrs available * @NL80211_ATTR_MAX: highest attribute number currently defined * @__NL80211_ATTR_AFTER_LAST: internal use @@ -3757,6 +3760,9 @@ enum nl80211_attrs { NL80211_ATTR_ASSOC_ENCRYPTED, + NL80211_ATTR_NPCA_PRIMARY_FREQ, + NL80211_ATTR_NPCA_PUNCT_BITMAP, + /* add attributes here, update the policy in nl80211.c */ __NL80211_ATTR_AFTER_LAST, -- cgit v1.2.3 From 3ca884399be1bcb04baec264a75133cf7a422b52 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 11:25:33 +0200 Subject: wifi: cfg80211: add helper for parsing NPCA to chandef Add a cfg80211_chandef_add_npca() helper function that takes an existing chandef without NPCA and sets the NPCA information from the format used in UHR operation and UHR Parameters Update. Link: https://patch.msgid.link/20260428112708.5cdc4e69a306.I95d396ac671da438f340b1afb735ebfe33164894@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 16e11c5718b5..e807999fc8e8 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -1154,6 +1154,19 @@ int cfg80211_chandef_primary(const struct cfg80211_chan_def *chandef, enum nl80211_chan_width primary_chan_width, u16 *punctured); +/** + * cfg80211_chandef_add_npca - parse and add NPCA information to chandef + * @wiphy: the wiphy this will be used for, for channel pointer lookup + * @chandef: the chandef to modify, must be a valid chandef without NPCA + * @npca: the NPCA information, can be %NULL + * + * Returns: 0 if the NPCA information was added and the resulting + * chandef is valid, a negative error code on errors + */ +int cfg80211_chandef_add_npca(struct wiphy *wiphy, + struct cfg80211_chan_def *chandef, + const struct ieee80211_uhr_npca_info *npca); + /** * nl80211_send_chandef - sends the channel definition. * @msg: the msg to send channel definition -- cgit v1.2.3 From a731e2fc26b68c0af61de7138e4b468091668a55 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 11:25:37 +0200 Subject: wifi: mac80211: allow only AP chanctx sharing with NPCA When two interfaces share a channel context, disable NPCA unless both are AP interfaces that require NPCA. This way, two AP interfaces can have identical chandefs set up and share the channel context, but any non-APs cannot share a chanctx with NPCA (they'd almost certainly have different BSS color.) This doesn't mean the chanctx cannot be shared but rather that NPCA will be disabled on the shared channel context. Link: https://patch.msgid.link/20260428112708.3832e15f4e78.I08a7c7f47d796f4d5d8f9a682c1fba37db2e4cf5@changeid Signed-off-by: Johannes Berg --- include/net/mac80211.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/net/mac80211.h b/include/net/mac80211.h index ba1723e62481..ae7fd44e17b5 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -218,6 +218,8 @@ struct ieee80211_low_level_stats { * bandwidth) OFDMA settings need to be changed * @IEEE80211_CHANCTX_CHANGE_PUNCTURING: The punctured channel(s) bitmap * was changed. + * @IEEE80211_CHANCTX_CHANGE_NPCA: NPCA configuration changed + * @IEEE80211_CHANCTX_CHANGE_NPCA_PUNCT: NPCA puncturing changed */ enum ieee80211_chanctx_change { IEEE80211_CHANCTX_CHANGE_WIDTH = BIT(0), @@ -227,6 +229,8 @@ enum ieee80211_chanctx_change { IEEE80211_CHANCTX_CHANGE_MIN_DEF = BIT(4), IEEE80211_CHANCTX_CHANGE_AP = BIT(5), IEEE80211_CHANCTX_CHANGE_PUNCTURING = BIT(6), + IEEE80211_CHANCTX_CHANGE_NPCA = BIT(7), + IEEE80211_CHANCTX_CHANGE_NPCA_PUNCT = BIT(8), }; /** @@ -234,10 +238,13 @@ enum ieee80211_chanctx_change { * @oper: channel definition to use for operation * @ap: the channel definition of the AP, if any * (otherwise the chan member is %NULL) + * @require_npca: If NPCA is configured, require it to + * remain, this is used by AP interfaces */ struct ieee80211_chan_req { struct cfg80211_chan_def oper; struct cfg80211_chan_def ap; + bool require_npca; }; /** -- cgit v1.2.3 From 5af8f06349d85824a32aa15949cb66b174e0f713 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 11:25:38 +0200 Subject: wifi: mac80211: mlme: use NPCA chandef if capable If the device is capable, parse the AP chandef with NPCA. Also advertise the other NPCA operational parameters to the underlying driver and track if they change (though not with BSS critical update etc. yet) Since NPCA can only be enabled when the chanctx isn't shared, the channel context code needs to clear/set npca.enabled in the per-link configuration, except during association since we can't enable NPCA before having completed association. In this case, set npca.enabled during the association process. Link: https://patch.msgid.link/20260428112708.eb1e42c0b6d7.I0acd8445d4600363afb8430922531450399d0fab@changeid Signed-off-by: Johannes Berg --- include/net/mac80211.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'include') diff --git a/include/net/mac80211.h b/include/net/mac80211.h index ae7fd44e17b5..4fb579805e0f 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -373,6 +373,7 @@ struct ieee80211_vif_chanctx_switch { * @BSS_CHANGED_MLD_TTLM: negotiated TID to link mapping was changed * @BSS_CHANGED_TPE: transmit power envelope changed * @BSS_CHANGED_NAN_LOCAL_SCHED: NAN local schedule changed (NAN mode only) + * @BSS_CHANGED_NPCA: NPCA parameters changed */ enum ieee80211_bss_change { BSS_CHANGED_ASSOC = 1<<0, @@ -411,6 +412,7 @@ enum ieee80211_bss_change { BSS_CHANGED_MLD_TTLM = BIT_ULL(34), BSS_CHANGED_TPE = BIT_ULL(35), BSS_CHANGED_NAN_LOCAL_SCHED = BIT_ULL(36), + BSS_CHANGED_NPCA = BIT_ULL(37), /* when adding here, make sure to change ieee80211_reconfig */ }; @@ -596,6 +598,26 @@ struct ieee80211_parsed_tpe { struct ieee80211_parsed_tpe_psd psd_local[2], psd_reg_client[2]; }; +/** + * struct ieee80211_bss_npca_params - NPCA parameters + * @min_dur_thresh: NPCA minimum duration threshold (512 + 128*n usec) + * @switch_delay: NPCA switch delay (units of 4 usec) + * @switch_back_delay: NPCA switch back delay (units of 4 usec) + * @init_qsrc: initial QSRC value + * @moplen: indicates MOPLEN NPCA is permitted in the BSS + * @enabled: NPCA is enabled for this link + * + * Note: the individual values (except @enabled) are in spec representation. + */ +struct ieee80211_bss_npca_params { + u32 min_dur_thresh:4, + switch_delay:6, + switch_back_delay:6, + init_qsrc:2, + moplen:1, + enabled:1; +}; + /** * struct ieee80211_bss_conf - holds the BSS's changing parameters * @@ -770,6 +792,7 @@ struct ieee80211_parsed_tpe { * (as opposed to hearing its value from another link's beacon). * @s1g_long_beacon_period: number of beacon intervals between each long * beacon transmission. + * @npca: NPCA parameters */ struct ieee80211_bss_conf { struct ieee80211_vif *vif; @@ -873,6 +896,8 @@ struct ieee80211_bss_conf { u8 bss_param_ch_cnt_link_id; u8 s1g_long_beacon_period; + + struct ieee80211_bss_npca_params npca; }; #define IEEE80211_NAN_MAX_CHANNELS 3 -- cgit v1.2.3 From 07f3e2174606202f7954e3a0454dd59064148610 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 28 Apr 2026 11:25:40 +0200 Subject: wifi: cfg80211: separate NPCA validity from chandef validity When considering both NPCA and DBE, it can appear that the NPCA configuration is invalid, e.g. for an 80 MHz BSS channel with DBE to 160 MHz: | primary channel | NPCA primary channel | | V V | p | | n | | | | | | | BSS channel | | DBE channel | Now the NPCA primary channel is in the same half as the primary channel, and the NPCA puncturing bitmap could be completely invalid as a puncturing bitmap when considering the overall channel. Split out the validity checks from cfg80211_chandef_valid() to a new cfg80211_chandef_npca_valid() function that just checks the NPCA configuration against the BSS chandef. Link: https://patch.msgid.link/20260428112708.1225df131557.If3a6afadcce05d215b72fd82175f72373a0f6d24@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index e807999fc8e8..ddcf559430dd 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -849,6 +849,10 @@ struct key_params { * struct cfg80211_chan_def - channel definition * @chan: the (control) channel * @npca_chan: the NPCA primary channel + * Note that if DBE is in use, this channel may appear to be + * inside the primary half of the chandef. Implementations + * can use the position of this channel to understand how + * NPCA is used. * @width: channel width * @center_freq1: center frequency of first segment * @center_freq2: center frequency of second segment @@ -864,6 +868,8 @@ struct key_params { * @npca_punctured: NPCA puncturing bitmap, like @punctured but for * NPCA transmissions. If NPCA is used (@npca_chan is not %NULL) * this will be a superset of the @punctured bimap. + * Note that if DBE is used, this bitmap is also shifted to be in + * accordance with the overall chandef bandwidth. * @s1g_primary_2mhz: Indicates if the control channel pointed to * by 'chan' exists as a 1MHz primary subchannel within an * S1G 2MHz primary channel. @@ -1154,6 +1160,23 @@ int cfg80211_chandef_primary(const struct cfg80211_chan_def *chandef, enum nl80211_chan_width primary_chan_width, u16 *punctured); +/** + * cfg80211_chandef_npca_valid - check that NPCA information is valid + * @wiphy: the wiphy to check for, for channel pointer lookup + * @chandef: the BSS channel chandef to check against + * @npca: NPCA information, can be %NULL in which case this + * always returns %true + * + * Note that DBE must not have been configured into the chandef yet + * before checking NPCA, i.e. @chandef must represent the BSS channel. + * + * Returns: %true if the NPCA channel and puncturing bitmap are valid + * according to the chandef, %false otherwise + */ +bool cfg80211_chandef_npca_valid(struct wiphy *wiphy, + const struct cfg80211_chan_def *chandef, + const struct ieee80211_uhr_npca_info *npca); + /** * cfg80211_chandef_add_npca - parse and add NPCA information to chandef * @wiphy: the wiphy this will be used for, for channel pointer lookup -- cgit v1.2.3 From dc7ccfc86c1af6406c5a0aeeac122e64711ea5da Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Thu, 5 Mar 2026 09:56:44 +0800 Subject: firmware: arm_scmi: imx: Support getting reset reason of MISC protocol MISC protocol supports getting reset reason per Logical Machine or System. Add the API for user to retrieve the information from System Manager. Signed-off-by: Peng Fan Reviewed-by: Daniel Baluta Link: https://patch.msgid.link/20260305-scmi-imx-reset-v1-1-18de78978ba9@nxp.com Signed-off-by: Sudeep Holla --- include/linux/scmi_imx_protocol.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'include') diff --git a/include/linux/scmi_imx_protocol.h b/include/linux/scmi_imx_protocol.h index 2407d7693b6b..ab867463c08c 100644 --- a/include/linux/scmi_imx_protocol.h +++ b/include/linux/scmi_imx_protocol.h @@ -52,6 +52,17 @@ struct scmi_imx_misc_ctrl_notify_report { unsigned int flags; }; + +#define MISC_EXT_INFO_LEN_MAX 4 +struct scmi_imx_misc_reset_reason { + bool valid:1; + bool orig_valid:1; + bool err_valid:1; + u32 reason; + u32 origin; + u32 errid; +}; + struct scmi_imx_misc_proto_ops { int (*misc_ctrl_set)(const struct scmi_protocol_handle *ph, u32 id, u32 num, u32 *val); @@ -61,6 +72,9 @@ struct scmi_imx_misc_proto_ops { u32 ctrl_id, u32 evt_id, u32 flags); int (*misc_syslog)(const struct scmi_protocol_handle *ph, u16 *size, void *array); + int (*misc_reset_reason)(const struct scmi_protocol_handle *ph, + bool system, struct scmi_imx_misc_reset_reason *boot_r, + struct scmi_imx_misc_reset_reason *shut_r, u32 *extinfo); }; /* See LMM_ATTRIBUTES in imx95.rst */ -- cgit v1.2.3 From 0c6eb5d019c1e4b9cfcfc47000e08858bbbc5e52 Mon Sep 17 00:00:00 2001 From: Marek Vasut Date: Mon, 6 Apr 2026 17:52:54 +0200 Subject: firmware: arm_scmi: Rename struct scmi_revision_info to scmi_base_info Rename struct scmi_revision_info to struct scmi_base_info , to accurately represent its content. The scmi_revision_info is no longer accurate, because the structure now contains more than only SCMI base protocol revision, it now also contains number of protocols, agents, vendor and subvendor strings. All those are fetched from the base protocol, so rename the structure to scmi_base_info, to match the other scmi_*_info structure names. No functional change. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260406155343.72087-1-marek.vasut+renesas@mailbox.org Signed-off-by: Sudeep Holla --- include/linux/scmi_protocol.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h index aafaac1496b0..8d0b106caed8 100644 --- a/include/linux/scmi_protocol.h +++ b/include/linux/scmi_protocol.h @@ -18,7 +18,7 @@ #define SCMI_MAX_NUM_RATES 16 /** - * struct scmi_revision_info - version information structure + * struct scmi_base_info - version information structure * * @major_ver: Major ABI version. Change here implies risk of backward * compatibility break. @@ -31,7 +31,7 @@ * @vendor_id: A vendor identifier(Null terminated ASCII string) * @sub_vendor_id: A sub-vendor identifier(Null terminated ASCII string) */ -struct scmi_revision_info { +struct scmi_base_info { u16 major_ver; u16 minor_ver; u8 num_protocols; @@ -901,7 +901,7 @@ struct scmi_notify_ops { */ struct scmi_handle { struct device *dev; - struct scmi_revision_info *version; + struct scmi_base_info *version; int __must_check (*devm_protocol_acquire)(struct scmi_device *sdev, u8 proto); -- cgit v1.2.3 From 5e6c21c56998e1e58d2f314e70779989ea0fee5d Mon Sep 17 00:00:00 2001 From: Ben Reed Date: Tue, 5 May 2026 10:16:33 -0600 Subject: PCI: switchtec: Add Gen6 Device IDs Add device IDs for the next generation of switchtec products. No changes to the driver were required with the new version of the hardware. [logang: rewrote commit message] Signed-off-by: Ben Reed Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260505161633.67454-1-logang@deltatee.com --- include/linux/switchtec.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/switchtec.h b/include/linux/switchtec.h index cdb58d61c152..724da6c08bf7 100644 --- a/include/linux/switchtec.h +++ b/include/linux/switchtec.h @@ -42,6 +42,7 @@ enum switchtec_gen { SWITCHTEC_GEN3, SWITCHTEC_GEN4, SWITCHTEC_GEN5, + SWITCHTEC_GEN6, }; struct mrpc_regs { -- cgit v1.2.3 From 944bfc1b1c6fe9417668006aae7124886bcca038 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 2 May 2026 03:12:54 +0000 Subject: udp_tunnel: Pass struct sock to udp_tunnel_sock_release(). None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. While the UDP tunnel interface accepts struct socket, this encourages users to store the pointer unnecessarily. This leads to extra dereferences when accessing struct sock fields (e.g., sk->sk_user_data instead of sock->sk->sk_user_data). Furthermore, these dereferences necessitate synchronize_rcu() in udp_tunnel_sock_release() to protect the fast paths from sock_orphan() setting sk->sk_socket to NULL. This overhead can be avoided if users store the struct sock pointer directly in their private structures. As a prep, let's change udp_tunnel_sock_release() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-2-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/udp_tunnel.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h index 47c23d4a1740..dbbd56280f50 100644 --- a/include/net/udp_tunnel.h +++ b/include/net/udp_tunnel.h @@ -176,7 +176,7 @@ static inline void udp_tunnel_set_inner_protocol(struct sk_buff *skb, skb_set_inner_protocol(skb, inner_proto); } -void udp_tunnel_sock_release(struct socket *sock); +void udp_tunnel_sock_release(struct sock *sk); struct rtable *udp_tunnel_dst_lookup(struct sk_buff *skb, struct net_device *dev, -- cgit v1.2.3 From 2cba193628fe523cee6dd61938db2c4563ce15a9 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 2 May 2026 03:12:55 +0000 Subject: udp_tunnel: Pass struct sock to setup_udp_tunnel_sock(). None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. Even setup_udp_tunnel_sock() does not need struct socket. Let's change setup_udp_tunnel_sock() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-3-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/udp_tunnel.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h index dbbd56280f50..49324e28ec27 100644 --- a/include/net/udp_tunnel.h +++ b/include/net/udp_tunnel.h @@ -94,7 +94,7 @@ struct udp_tunnel_sock_cfg { }; /* Setup the given (UDP) sock to receive UDP encapsulated packets */ -void setup_udp_tunnel_sock(struct net *net, struct socket *sock, +void setup_udp_tunnel_sock(struct net *net, struct sock *sk, struct udp_tunnel_sock_cfg *sock_cfg); /* -- List of parsable UDP tunnel types -- -- cgit v1.2.3 From 9333d5ff28bd9aa5a8d961a2414afc704ea34095 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 2 May 2026 03:12:56 +0000 Subject: udp_tunnel: Pass struct sock to udp_tunnel6_dst_lookup(). None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. Even udp_tunnel6_dst_lookup() does not need struct socket. Let's change udp_tunnel6_dst_lookup() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-4-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/udp_tunnel.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h index 49324e28ec27..14a9c5155608 100644 --- a/include/net/udp_tunnel.h +++ b/include/net/udp_tunnel.h @@ -188,7 +188,7 @@ struct rtable *udp_tunnel_dst_lookup(struct sk_buff *skb, struct dst_entry *udp_tunnel6_dst_lookup(struct sk_buff *skb, struct net_device *dev, struct net *net, - struct socket *sock, int oif, + struct sock *sk, int oif, struct in6_addr *saddr, const struct ip_tunnel_key *key, __be16 sport, __be16 dport, u8 dsfield, -- cgit v1.2.3 From 8d0012ce1b413c010ead5e3ca71dec6bb49280ff Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 2 May 2026 03:12:57 +0000 Subject: udp_tunnel: Pass struct sock to udp_tunnel_{push,drop}_rx_port(). None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. Even udp_tunnel_{push,drop}_rx_port() do not need struct socket. Let's change udp_tunnel_{push,drop}_rx_port() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-5-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/udp_tunnel.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h index 14a9c5155608..29ead6a38ef6 100644 --- a/include/net/udp_tunnel.h +++ b/include/net/udp_tunnel.h @@ -127,9 +127,9 @@ struct udp_tunnel_info { }; /* Notify network devices of offloadable types */ -void udp_tunnel_push_rx_port(struct net_device *dev, struct socket *sock, +void udp_tunnel_push_rx_port(struct net_device *dev, struct sock *sk, unsigned short type); -void udp_tunnel_drop_rx_port(struct net_device *dev, struct socket *sock, +void udp_tunnel_drop_rx_port(struct net_device *dev, struct sock *sk, unsigned short type); void udp_tunnel_notify_add_rx_port(struct socket *sock, unsigned short type); void udp_tunnel_notify_del_rx_port(struct socket *sock, unsigned short type); -- cgit v1.2.3 From af3f903fbb70eced6394770cd704951767394015 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 2 May 2026 03:12:58 +0000 Subject: udp_tunnel: Pass struct sock to udp_tunnel_notify_{add,del}_rx_port(). None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. Even udp_tunnel_notify_{add,del}_rx_port() do not need struct socket. Let's change udp_tunnel_notify_{add,del}_rx_port() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-6-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/udp_tunnel.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h index 29ead6a38ef6..498b7b262fa9 100644 --- a/include/net/udp_tunnel.h +++ b/include/net/udp_tunnel.h @@ -131,8 +131,8 @@ void udp_tunnel_push_rx_port(struct net_device *dev, struct sock *sk, unsigned short type); void udp_tunnel_drop_rx_port(struct net_device *dev, struct sock *sk, unsigned short type); -void udp_tunnel_notify_add_rx_port(struct socket *sock, unsigned short type); -void udp_tunnel_notify_del_rx_port(struct socket *sock, unsigned short type); +void udp_tunnel_notify_add_rx_port(struct sock *sk, unsigned short type); +void udp_tunnel_notify_del_rx_port(struct sock *sk, unsigned short type); /* Transmit the skb using UDP encapsulation. */ void udp_tunnel_xmit_skb(struct rtable *rt, struct sock *sk, struct sk_buff *skb, -- cgit v1.2.3 From 027bffa1ad19f5da59ee7923464dd248b0a9930f Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 2 May 2026 03:13:00 +0000 Subject: vxlan: Store struct sock in struct vxlan_sock. Commit 3cf7203ca620 ("net/tunnel: wait until all sk_user_data reader finish before releasing the sock") added synchronize_rcu() in udp_tunnel_sock_release(). This was intended to protect the fast path of a dying vxlan device from dereferencing vxlan_sock->sock->sk after sock_orphan() has set sock->sk to NULL. However, vxlan does not need to access struct socket itself in the fast path; it only reads struct sock, and struct socket is only used for tunnel setup and teardown. Let's store struct sock directly in struct vxlan_sock. In the next patch, we will free vxlan_sock with kfree_rcu(), then vxlan no longer needs synchronize_rcu() in udp_tunnel_sock_release(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-8-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/vxlan.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/vxlan.h b/include/net/vxlan.h index 0ee50785f4f1..8b52294b2902 100644 --- a/include/net/vxlan.h +++ b/include/net/vxlan.h @@ -185,7 +185,7 @@ struct vxlan_metadata { /* per UDP socket information */ struct vxlan_sock { struct hlist_node hlist; - struct socket *sock; + struct sock *sk; struct hlist_head vni_list[VNI_HASH_SIZE]; refcount_t refcnt; u32 flags; @@ -448,7 +448,7 @@ static inline __be32 vxlan_compute_rco(unsigned int start, unsigned int offset) static inline unsigned short vxlan_get_sk_family(struct vxlan_sock *vs) { - return vs->sock->sk->sk_family; + return vs->sk->sk_family; } #if IS_ENABLED(CONFIG_IPV6) -- cgit v1.2.3 From 4f71dd1b421d1300237adf546aa14521cdf46355 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 2 May 2026 03:13:01 +0000 Subject: vxlan: Free vxlan_sock with kfree_rcu(). We will remove synchronize_rcu() in udp_tunnel_sock_release(). We must ensure that vxlan_sock is freed after inflight RX fast path. Let's free vxlan_sock with kfree_rcu(). Note that vxlan_sock.vni_list[] is 8K and struct rcu_head must be placed before it. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-9-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/vxlan.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/vxlan.h b/include/net/vxlan.h index 8b52294b2902..dfba89695efc 100644 --- a/include/net/vxlan.h +++ b/include/net/vxlan.h @@ -186,6 +186,7 @@ struct vxlan_metadata { struct vxlan_sock { struct hlist_node hlist; struct sock *sk; + struct rcu_head rcu; struct hlist_head vni_list[VNI_HASH_SIZE]; refcount_t refcnt; u32 flags; -- cgit v1.2.3 From 65c6e06d5abad33ff2ad43daad472efb90deafc2 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 2 May 2026 03:13:05 +0000 Subject: amt: Store struct sock in struct amt_dev. amt does not need to access struct socket itself in the fast path; it only reads struct sock, and struct socket is only used for tunnel setup and teardown. Let's store struct sock directly in struct amt. amt_dev_stop() is called as dev->netdev_ops->ndo_stop(). synchronize_net() in unregister_netdevice_many_notify() ensures that inflight amt RX fast paths finish before amt_dev is freed. amt no longer needs synchronize_rcu() in udp_tunnel_sock_release(). Note that amt_dev_stop() looks buggy; cancel_delayed_work_sync() should be called after udp_tunnel_sock_release(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-13-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/amt.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/amt.h b/include/net/amt.h index c881bc8b673b..a0255491f5b0 100644 --- a/include/net/amt.h +++ b/include/net/amt.h @@ -331,7 +331,7 @@ struct amt_dev { enum amt_status status; /* Generated key */ siphash_key_t key; - struct socket __rcu *sock; + struct sock __rcu *sk; u32 max_groups; u32 max_sources; u32 hash_buckets; -- cgit v1.2.3 From 087623676248f5f91c5a592870369a2fe856b0b9 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 5 May 2026 22:24:24 +0200 Subject: ASoC: arm: pxa2xx: remove platform_data processing Nothing ever sets pxa2xx_audio_ops_t since the last users were removed in ce79f3a1ad5f ("ARM: pxa: prune unused device support") , so stop passing it around through the sound, ac97 code. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260505202426.3605262-1-arnd@kernel.org Signed-off-by: Mark Brown --- include/linux/platform_data/asoc-pxa.h | 21 --------------------- include/sound/ac97/codec.h | 5 ++++- include/sound/ac97/controller.h | 5 ++--- 3 files changed, 6 insertions(+), 25 deletions(-) (limited to 'include') diff --git a/include/linux/platform_data/asoc-pxa.h b/include/linux/platform_data/asoc-pxa.h index 7b5b9e20fbf5..7df78867db49 100644 --- a/include/linux/platform_data/asoc-pxa.h +++ b/include/linux/platform_data/asoc-pxa.h @@ -6,27 +6,6 @@ #include #include -/* - * @reset_gpio: AC97 reset gpio (normally gpio113 or gpio95) - * a -1 value means no gpio will be used for reset - * @codec_pdata: AC97 codec platform_data - - * reset_gpio should only be specified for pxa27x CPUs where a silicon - * bug prevents correct operation of the reset line. If not specified, - * the default behaviour on these CPUs is to consider gpio 113 as the - * AC97 reset line, which is the default on most boards. - */ -typedef struct { - int (*startup)(struct snd_pcm_substream *, void *); - void (*shutdown)(struct snd_pcm_substream *, void *); - void (*suspend)(void *); - void (*resume)(void *); - void *priv; - int reset_gpio; - void *codec_pdata[AC97_BUS_MAX_DEVICES]; -} pxa2xx_audio_ops_t; - -extern void pxa_set_ac97_info(pxa2xx_audio_ops_t *ops); extern void pxa27x_configure_ac97reset(int reset_gpio, bool to_gpio); #endif diff --git a/include/sound/ac97/codec.h b/include/sound/ac97/codec.h index 882b849b9255..69b404c354f5 100644 --- a/include/sound/ac97/codec.h +++ b/include/sound/ac97/codec.h @@ -108,6 +108,9 @@ static inline void ac97_set_drvdata(struct ac97_codec_device *adev, dev_set_drvdata(ac97_codec_dev2dev(adev), data); } -void *snd_ac97_codec_get_platdata(const struct ac97_codec_device *adev); +static inline void *snd_ac97_codec_get_platdata(const struct ac97_codec_device *adev) +{ + return NULL; +} #endif diff --git a/include/sound/ac97/controller.h b/include/sound/ac97/controller.h index 06b5afb7fa6b..d5895ea3922b 100644 --- a/include/sound/ac97/controller.h +++ b/include/sound/ac97/controller.h @@ -62,14 +62,13 @@ struct ac97_controller_ops { #if IS_ENABLED(CONFIG_AC97_BUS_NEW) struct ac97_controller *snd_ac97_controller_register( const struct ac97_controller_ops *ops, struct device *dev, - unsigned short slots_available, void **codecs_pdata); + unsigned short slots_available); void snd_ac97_controller_unregister(struct ac97_controller *ac97_ctrl); #else static inline struct ac97_controller * snd_ac97_controller_register(const struct ac97_controller_ops *ops, struct device *dev, - unsigned short slots_available, - void **codecs_pdata) + unsigned short slots_available) { return ERR_PTR(-ENODEV); } -- cgit v1.2.3 From a11fbb793ab4843549840571036bf042897d3a76 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 5 May 2026 22:24:25 +0200 Subject: ASoC: pxa2xx: push gpio usage into arch code There are no remaining static platform_device users of pxa2xx ac97, so the rest of that code path can go away as well. Since nothing in the driver uses the gpio number now, constrain the use of the legacy gpio interface to the architecture specific code. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260505202426.3605262-2-arnd@kernel.org Signed-off-by: Mark Brown --- include/linux/platform_data/asoc-pxa.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/platform_data/asoc-pxa.h b/include/linux/platform_data/asoc-pxa.h index 7df78867db49..0d5eaf4b100c 100644 --- a/include/linux/platform_data/asoc-pxa.h +++ b/include/linux/platform_data/asoc-pxa.h @@ -6,6 +6,6 @@ #include #include -extern void pxa27x_configure_ac97reset(int reset_gpio, bool to_gpio); +extern void pxa27x_configure_ac97reset(struct gpio_desc *reset_gpio, bool to_gpio); #endif -- cgit v1.2.3 From 42f67e1d1cba52d22291d18f85d34bb5cf61c7d2 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 5 May 2026 22:24:26 +0200 Subject: ASoC: pxa: integrate sound/arm/pxa2xx into sound/soc/pxa2xx The pxa2xx sound library modules are only used by the ASoC driver since commit b094de7810f3 ("ASoC: codec: Remove pxa2xx-ac97.c"), so move the code into the one module that uses as a simpliciation. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260505202426.3605262-3-arnd@kernel.org Signed-off-by: Mark Brown --- include/sound/pxa2xx-lib.h | 50 +--------------------------------------------- 1 file changed, 1 insertion(+), 49 deletions(-) (limited to 'include') diff --git a/include/sound/pxa2xx-lib.h b/include/sound/pxa2xx-lib.h index 0a6f8dabf8c4..2d86f62f9408 100644 --- a/include/sound/pxa2xx-lib.h +++ b/include/sound/pxa2xx-lib.h @@ -2,55 +2,7 @@ #ifndef PXA2XX_LIB_H #define PXA2XX_LIB_H -#include -#include - -/* PCM */ -struct snd_pcm_substream; -struct snd_pcm_hw_params; -struct snd_soc_pcm_runtime; -struct snd_pcm; -struct snd_soc_component; - -extern int pxa2xx_pcm_hw_params(struct snd_pcm_substream *substream, - struct snd_pcm_hw_params *params); -extern int pxa2xx_pcm_trigger(struct snd_pcm_substream *substream, int cmd); -extern snd_pcm_uframes_t pxa2xx_pcm_pointer(struct snd_pcm_substream *substream); -extern int pxa2xx_pcm_prepare(struct snd_pcm_substream *substream); -extern int pxa2xx_pcm_open(struct snd_pcm_substream *substream); -extern int pxa2xx_pcm_close(struct snd_pcm_substream *substream); -extern int pxa2xx_pcm_preallocate_dma_buffer(struct snd_pcm *pcm); -extern int pxa2xx_soc_pcm_new(struct snd_soc_component *component, - struct snd_soc_pcm_runtime *rtd); -extern int pxa2xx_soc_pcm_open(struct snd_soc_component *component, - struct snd_pcm_substream *substream); -extern int pxa2xx_soc_pcm_close(struct snd_soc_component *component, - struct snd_pcm_substream *substream); -extern int pxa2xx_soc_pcm_hw_params(struct snd_soc_component *component, - struct snd_pcm_substream *substream, - struct snd_pcm_hw_params *params); -extern int pxa2xx_soc_pcm_prepare(struct snd_soc_component *component, - struct snd_pcm_substream *substream); -extern int pxa2xx_soc_pcm_trigger(struct snd_soc_component *component, - struct snd_pcm_substream *substream, int cmd); -extern snd_pcm_uframes_t -pxa2xx_soc_pcm_pointer(struct snd_soc_component *component, - struct snd_pcm_substream *substream); - -/* AC97 */ - -extern int pxa2xx_ac97_read(int slot, unsigned short reg); -extern int pxa2xx_ac97_write(int slot, unsigned short reg, unsigned short val); - -extern bool pxa2xx_ac97_try_warm_reset(void); -extern bool pxa2xx_ac97_try_cold_reset(void); -extern void pxa2xx_ac97_finish_reset(void); - -extern int pxa2xx_ac97_hw_suspend(void); -extern int pxa2xx_ac97_hw_resume(void); - -extern int pxa2xx_ac97_hw_probe(struct platform_device *dev); -extern void pxa2xx_ac97_hw_remove(struct platform_device *dev); +#include /* modem registers, used by touchscreen driver */ u32 pxa2xx_ac97_read_modr(void); -- cgit v1.2.3 From d07efe5a6e641af59f2dbbef4a748fab6d967747 Mon Sep 17 00:00:00 2001 From: Aditya Garg Date: Sat, 2 May 2026 00:45:33 -0700 Subject: net: mana: Use per-queue allocation for tx_qp to reduce allocation size Convert tx_qp from a single contiguous array allocation to per-queue individual allocations. Each mana_tx_qp struct is approximately 35KB. With many queues (e.g., 32/64), the flat array requires a single contiguous allocation that can fail under memory fragmentation. Change mana_tx_qp *tx_qp to mana_tx_qp **tx_qp (array of pointers), allocating each queue's mana_tx_qp individually via kvzalloc. This reduces each allocation to ~35KB and provides vmalloc fallback, avoiding allocation failure due to fragmentation. Signed-off-by: Aditya Garg Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/20260502074552.23857-2-gargaditya@linux.microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/mana.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h index 8f721cd4e4a7..aa90a858c8e3 100644 --- a/include/net/mana/mana.h +++ b/include/net/mana/mana.h @@ -507,7 +507,7 @@ struct mana_port_context { bool tx_shortform_allowed; u16 tx_vp_offset; - struct mana_tx_qp *tx_qp; + struct mana_tx_qp **tx_qp; /* Indirection Table for RX & TX. The values are queue indexes */ u32 *indir_table; -- cgit v1.2.3 From 5a7dfbcbbdb683e6f704966e73c02f4ba8eb6014 Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Thu, 23 Apr 2026 18:53:53 +0200 Subject: timers/migration: Handle capacity in connect tracepoints This let tracers know to which hierarchy a CPU belongs to. Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260423165354.95152-6-frederic@kernel.org --- include/trace/events/timer_migration.h | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/trace/events/timer_migration.h b/include/trace/events/timer_migration.h index 61171b13c687..0b135e9301b1 100644 --- a/include/trace/events/timer_migration.h +++ b/include/trace/events/timer_migration.h @@ -33,15 +33,16 @@ TRACE_EVENT(tmigr_group_set, TRACE_EVENT(tmigr_connect_child_parent, - TP_PROTO(struct tmigr_group *child), + TP_PROTO(struct tmigr_hierarchy *hier, struct tmigr_group *child), - TP_ARGS(child), + TP_ARGS(hier, child), TP_STRUCT__entry( __field( void *, child ) __field( void *, parent ) __field( unsigned int, lvl ) __field( unsigned int, numa_node ) + __field( unsigned int, capacity ) __field( unsigned int, num_children ) __field( u32, groupmask ) ), @@ -51,26 +52,28 @@ TRACE_EVENT(tmigr_connect_child_parent, __entry->parent = child->parent; __entry->lvl = child->parent->level; __entry->numa_node = child->parent->numa_node; + __entry->capacity = hier->capacity; __entry->num_children = child->parent->num_children; __entry->groupmask = child->groupmask; ), - TP_printk("group=%p groupmask=%0x parent=%p lvl=%d numa=%d num_children=%d", - __entry->child, __entry->groupmask, __entry->parent, - __entry->lvl, __entry->numa_node, __entry->num_children) + TP_printk("group=%p groupmask=%0x parent=%p lvl=%d numa=%d capacity=%d num_children=%d", + __entry->child, __entry->groupmask, __entry->parent, __entry->lvl, + __entry->numa_node, __entry->capacity, __entry->num_children) ); TRACE_EVENT(tmigr_connect_cpu_parent, - TP_PROTO(struct tmigr_cpu *tmc), + TP_PROTO(struct tmigr_hierarchy *hier, struct tmigr_cpu *tmc), - TP_ARGS(tmc), + TP_ARGS(hier, tmc), TP_STRUCT__entry( __field( void *, parent ) __field( unsigned int, cpu ) __field( unsigned int, lvl ) __field( unsigned int, numa_node ) + __field( unsigned int, capacity ) __field( unsigned int, num_children ) __field( u32, groupmask ) ), @@ -80,13 +83,14 @@ TRACE_EVENT(tmigr_connect_cpu_parent, __entry->cpu = tmc->cpuevt.cpu; __entry->lvl = tmc->tmgroup->level; __entry->numa_node = tmc->tmgroup->numa_node; + __entry->capacity = hier->capacity; __entry->num_children = tmc->tmgroup->num_children; __entry->groupmask = tmc->groupmask; ), - TP_printk("cpu=%d groupmask=%0x parent=%p lvl=%d numa=%d num_children=%d", - __entry->cpu, __entry->groupmask, __entry->parent, - __entry->lvl, __entry->numa_node, __entry->num_children) + TP_printk("cpu=%d groupmask=%0x parent=%p lvl=%d numa=%d capacity=%d num_children=%d", + __entry->cpu, __entry->groupmask, __entry->parent, __entry->lvl, + __entry->numa_node, __entry->capacity, __entry->num_children) ); DECLARE_EVENT_CLASS(tmigr_group_and_cpu, -- cgit v1.2.3 From 33d4bfc49613301c8e451a597e377aaa331944bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Mon, 4 May 2026 08:54:27 +0200 Subject: clocksource: Clean up clocksource_update_freq() functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove the unused functions __clocksource_update_freq_hz() and __clocksource_update_freq_khz(). Then make __clocksource_update_freq_scale() static as it is not used from external callers anymore. Also clean up the comment accordingly. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://patch.msgid.link/20260504-clocksource-update_freq-v2-1-3e696fb01776@linutronix.de --- include/linux/clocksource.h | 12 ------------ 1 file changed, 12 deletions(-) (limited to 'include') diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h index 7c38190b10bf..c61aa458d4ec 100644 --- a/include/linux/clocksource.h +++ b/include/linux/clocksource.h @@ -236,8 +236,6 @@ clocks_calc_mult_shift(u32 *mult, u32 *shift, u32 from, u32 to, u32 minsec); */ extern int __clocksource_register_scale(struct clocksource *cs, u32 scale, u32 freq); -extern void -__clocksource_update_freq_scale(struct clocksource *cs, u32 scale, u32 freq); /* * Don't call this unless you are a default clocksource @@ -258,16 +256,6 @@ static inline int clocksource_register_khz(struct clocksource *cs, u32 khz) return __clocksource_register_scale(cs, 1000, khz); } -static inline void __clocksource_update_freq_hz(struct clocksource *cs, u32 hz) -{ - __clocksource_update_freq_scale(cs, 1, hz); -} - -static inline void __clocksource_update_freq_khz(struct clocksource *cs, u32 khz) -{ - __clocksource_update_freq_scale(cs, 1000, khz); -} - #ifdef CONFIG_ARCH_CLOCKSOURCE_INIT extern void clocksource_arch_init(struct clocksource *cs); #else -- cgit v1.2.3 From 3af1f49f415dcac8c0df8bfc593df0371c219876 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Mon, 4 May 2026 08:56:10 +0200 Subject: hrtimer: Return ktime_t from hrtimer_get_next_event()/hrtimer_next_event_without() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit These functions really work in terms of ktime_t and not u64. Change their return types and adapt the callers. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260504-hrtimer-next_event-v2-1-7a5d0550b42f@linutronix.de --- include/linux/hrtimer.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 66cc98c773cf..6862dea0acc5 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -268,8 +268,8 @@ static inline ktime_t hrtimer_get_remaining(const struct hrtimer *timer) return __hrtimer_get_remaining(timer, false); } -extern u64 hrtimer_get_next_event(void); -extern u64 hrtimer_next_event_without(const struct hrtimer *exclude); +extern ktime_t hrtimer_get_next_event(void); +extern ktime_t hrtimer_next_event_without(const struct hrtimer *exclude); extern bool hrtimer_active(const struct hrtimer *timer); -- cgit v1.2.3 From a562d6dc86bdfdd299e1b4734977a8d63e803583 Mon Sep 17 00:00:00 2001 From: Zile Xiong Date: Fri, 20 Mar 2026 14:54:45 +0800 Subject: media: vb2: use ssize_t for vb2_read/vb2_write vb2_read() and vb2_write() return size_t, but propagate negative errno values from __vb2_perform_fileio(). This relies on implicit signed/unsigned conversions in callers (e.g. vb2_fop_read()) to recover error codes: __vb2_perform_fileio() -> -EINVAL vb2_read() -> (size_t)-EINVAL vb2_fop_read() -> -EINVAL This relies on implicit conversions that are not obvious. These helpers are exported (EXPORT_SYMBOL_GPL) and part of the vb2 API, so changing their return type may affect existing users. However, they conceptually follow read/write semantics, where ssize_t is typically used to return either a byte count or a negative error code. Switch vb2_read() and vb2_write() to ssize_t, and update __vb2_perform_fileio() accordingly. Signed-off-by: Zile Xiong Acked-by: Marek Szyprowski Fixes: b25748fe6126 ("[media] v4l: videobuf2: add read() and write() emulator") Cc: stable@vger.kernel.org Signed-off-by: Hans Verkuil --- include/media/videobuf2-core.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h index 4424d481d7f7..4b4f4c15c53a 100644 --- a/include/media/videobuf2-core.h +++ b/include/media/videobuf2-core.h @@ -1093,8 +1093,8 @@ __poll_t vb2_core_poll(struct vb2_queue *q, struct file *file, * @ppos: file handle position tracking pointer * @nonblock: mode selector (1 means blocking calls, 0 means nonblocking) */ -size_t vb2_read(struct vb2_queue *q, char __user *data, size_t count, - loff_t *ppos, int nonblock); +ssize_t vb2_read(struct vb2_queue *q, char __user *data, size_t count, + loff_t *ppos, int nonblock); /** * vb2_write() - implements write() syscall logic. * @q: pointer to &struct vb2_queue with videobuf2 queue. @@ -1103,8 +1103,8 @@ size_t vb2_read(struct vb2_queue *q, char __user *data, size_t count, * @ppos: file handle position tracking pointer * @nonblock: mode selector (1 means blocking calls, 0 means nonblocking) */ -size_t vb2_write(struct vb2_queue *q, const char __user *data, size_t count, - loff_t *ppos, int nonblock); +ssize_t vb2_write(struct vb2_queue *q, const char __user *data, size_t count, + loff_t *ppos, int nonblock); /** * typedef vb2_thread_fnc - callback function for use with vb2_thread. -- cgit v1.2.3 From a2f9e4be82aee2037f904229cbb1efdd023b883d Mon Sep 17 00:00:00 2001 From: Maarten Lankhorst Date: Mon, 4 May 2026 19:06:11 +0200 Subject: Revert "drm/edid: add CTA Video Format Data Block support" This reverts commit e3953ff665742c15c002af9e176bd24d5cd9ec61. Seems to have been accidentally pushed without mandatory review. Signed-off-by: Maarten Lankhorst Acked-by: Thomas Zimmermann #irc Acked-by: Maxime Ripard #irc --- include/drm/drm_edid.h | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h index 272506331634..04f7a7f1f108 100644 --- a/include/drm/drm_edid.h +++ b/include/drm/drm_edid.h @@ -463,9 +463,6 @@ struct drm_display_mode * drm_display_mode_from_cea_vic(struct drm_device *dev, u8 video_code); -struct drm_display_mode *drm_ovt_mode(struct drm_device *dev, int rid, - int vrefresh); - /* Interface based on struct drm_edid */ const struct drm_edid *drm_edid_alloc(const void *edid, size_t size); const struct drm_edid *drm_edid_dup(const struct drm_edid *drm_edid); -- cgit v1.2.3 From e68a60f9e6a602684f335ede8af1170c13998b37 Mon Sep 17 00:00:00 2001 From: Balasubramani Vivekanandan Date: Tue, 5 May 2026 13:18:56 +0530 Subject: drm/xe/cri: Add new PCI IDs Add support for new CRI PCI IDs. Bspec: 77979 Reviewed-by: Gustavo Sousa Link: https://patch.msgid.link/20260505074855.3813063-2-balasubramani.vivekanandan@intel.com Signed-off-by: Balasubramani Vivekanandan --- include/drm/intel/pciids.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/drm/intel/pciids.h b/include/drm/intel/pciids.h index 33b91cb2e684..e32ef763427c 100644 --- a/include/drm/intel/pciids.h +++ b/include/drm/intel/pciids.h @@ -898,7 +898,11 @@ /* CRI */ #define INTEL_CRI_IDS(MACRO__, ...) \ - MACRO__(0x674C, ## __VA_ARGS__) + MACRO__(0x674C, ## __VA_ARGS__), \ + MACRO__(0x674D, ## __VA_ARGS__), \ + MACRO__(0x674E, ## __VA_ARGS__), \ + MACRO__(0x674F, ## __VA_ARGS__), \ + MACRO__(0x6750, ## __VA_ARGS__) /* NVL-P */ #define INTEL_NVLP_IDS(MACRO__, ...) \ -- cgit v1.2.3 From b9bdd68b8b979c7e9de58b2e7d21e1d7d932c755 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= Date: Tue, 5 May 2026 08:18:16 -0300 Subject: firmware_loader: Add cancel helper for async requests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit request_firmware_nowait() keeps the callback module pinned and holds a device reference until the firmware work completes. Callers still have no way to cancel or synchronize the queued callback before tearing down their driver-private state. Track scheduled async firmware work in an internal list and add request_firmware_nowait_cancel(). The helper cancels work matching the device, callback context and callback function. It cancels work that has not started yet and waits for an already-running callback to return. If the request has already completed, it is a no-op. Keep the existing request_firmware_nowait() lifetime model manual. A devres-managed variant can be layered on top separately if needed. Signed-off-by: Cássio Gabriel Reviewed-by: Takashi Iwai Acked-by: Danilo Krummrich Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260505-alsa-hda-tas2781-fw-callback-teardown-v4-1-e7c4bf930dc8@gmail.com --- include/linux/firmware.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'include') diff --git a/include/linux/firmware.h b/include/linux/firmware.h index aae1b85ffc10..0fa3b027f02f 100644 --- a/include/linux/firmware.h +++ b/include/linux/firmware.h @@ -110,6 +110,9 @@ int request_firmware_nowait( struct module *module, bool uevent, const char *name, struct device *device, gfp_t gfp, void *context, void (*cont)(const struct firmware *fw, void *context)); +void request_firmware_nowait_cancel(struct device *device, void *context, + void (*cont)(const struct firmware *fw, + void *context)); int request_firmware_direct(const struct firmware **fw, const char *name, struct device *device); int request_firmware_into_buf(const struct firmware **firmware_p, @@ -157,6 +160,13 @@ static inline int request_firmware_nowait( return -EINVAL; } +static inline void request_firmware_nowait_cancel(struct device *device, + void *context, + void (*cont)(const struct firmware *fw, + void *context)) +{ +} + static inline void release_firmware(const struct firmware *fw) { } -- cgit v1.2.3 From 94a1206522d11302ae7e7c28d3d494c8f0c9c58e Mon Sep 17 00:00:00 2001 From: Ben Horgan Date: Wed, 6 May 2026 09:28:50 +0100 Subject: x86,fs/resctrl: Create 'event_filter' files read only if they're not configurable When the counter assignment mode is mbm_event resctrl assumes the MBM events are configurable and exposes the 'event_filter' files. These files live at info/L3_MON/event_configs//event_filter and are used to display and set the event configuration. The MPAM architecture has support for configuring the memory bandwidth utilization (MBWU) counters to only count reads or only count writes. However, in MPAM, this event filtering support is optional in the hardware (and not yet implemented in the MPAM driver) but MBM counter assignment is always possible for MPAM MBWU counters. In order to support mbm_event mode with MPAM, create the 'event_filter' files read only if the event configuration can't be changed. A user can still chmod the file and so also return early with an error from event_filter_write(). Introduce a new monitor property, mbm_cntr_configurable, to indicate whether or not assignable MBM counters are configurable. On x86, set this to true whenever mbm_cntr_assignable is true to keep existing behaviour. Signed-off-by: Ben Horgan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Reinette Chatre Reviewed-by: Babu Moger Tested-by: Babu Moger Link: https://lore.kernel.org/20260506082855.3694761-1-ben.horgan@arm.com --- include/linux/resctrl.h | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/linux/resctrl.h b/include/linux/resctrl.h index 006e57fd7ca5..06e8c72e8660 100644 --- a/include/linux/resctrl.h +++ b/include/linux/resctrl.h @@ -286,13 +286,14 @@ enum resctrl_schema_fmt { /** * struct resctrl_mon - Monitoring related data of a resctrl resource. - * @num_rmid: Number of RMIDs available. - * @mbm_cfg_mask: Memory transactions that can be tracked when bandwidth - * monitoring events can be configured. - * @num_mbm_cntrs: Number of assignable counters. - * @mbm_cntr_assignable:Is system capable of supporting counter assignment? - * @mbm_assign_on_mkdir:True if counters should automatically be assigned to MBM - * events of monitor groups created via mkdir. + * @num_rmid: Number of RMIDs available. + * @mbm_cfg_mask: Memory transactions that can be tracked when + * bandwidth monitoring events can be configured. + * @num_mbm_cntrs: Number of assignable counters. + * @mbm_cntr_assignable: Is system capable of supporting counter assignment? + * @mbm_assign_on_mkdir: True if counters should automatically be assigned to MBM + * events of monitor groups created via mkdir. + * @mbm_cntr_configurable: True if assignable counters are configurable. */ struct resctrl_mon { u32 num_rmid; @@ -300,6 +301,7 @@ struct resctrl_mon { int num_mbm_cntrs; bool mbm_cntr_assignable; bool mbm_assign_on_mkdir; + bool mbm_cntr_configurable; }; /** -- cgit v1.2.3 From 88f731e7962945614a477a8a86c2517d87fd6b02 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Wed, 6 May 2026 10:51:44 -0700 Subject: spi: s3c64xx: fix all kernel-doc warnings Add kernel-doc for one struct member and use the correct function name to eliminate kernel-doc warnings: Warning: include/linux/platform_data/spi-s3c64xx.h:40 struct member 'polling' not described in 's3c64xx_spi_info' Warning: include/linux/platform_data/spi-s3c64xx.h:51 expecting prototype for s3c64xx_spi_set_platdata(). Prototype was for s3c64xx_spi0_set_platdata() instead Signed-off-by: Randy Dunlap Reviewed-by: Krzysztof Kozlowski Reviewed-by: Tudor Ambarus Link: https://patch.msgid.link/20260506175144.449364-1-rdunlap@infradead.org Signed-off-by: Mark Brown --- include/linux/platform_data/spi-s3c64xx.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/platform_data/spi-s3c64xx.h b/include/linux/platform_data/spi-s3c64xx.h index 1d6e6c424fc6..f92bb4a1213b 100644 --- a/include/linux/platform_data/spi-s3c64xx.h +++ b/include/linux/platform_data/spi-s3c64xx.h @@ -30,6 +30,7 @@ struct s3c64xx_spi_csinfo { * @src_clk_nr: Clock source index for the CLK_CFG[SPI_CLKSEL] field. * @num_cs: Number of CS this controller emulates. * @no_cs: Used when CS line is not connected. + * @polling: Using polling mode when %true (no 'dmas' property in devicetree) * @cfg_gpio: Configure pins for this SPI controller. */ struct s3c64xx_spi_info { @@ -41,7 +42,7 @@ struct s3c64xx_spi_info { }; /** - * s3c64xx_spi_set_platdata - SPI Controller configure callback by the board + * s3c64xx_spi0_set_platdata - SPI Controller configure callback by the board * initialization code. * @src_clk_nr: Clock the SPI controller is to use to generate SPI clocks. * @num_cs: Number of elements in the 'cs' array. -- cgit v1.2.3 From 32a72840ee300fe88e9f31dc55f9ae1dacdc8b8d Mon Sep 17 00:00:00 2001 From: Mark Bloch Date: Sun, 3 May 2026 23:27:24 +0300 Subject: net/mlx5: E-Switch, serialize representor lifecycle Representor callbacks can be registered and unregistered while the E-Switch is already in switchdev mode, and the same E-Switch may also be reconfigured by devlink, VF changes and SF changes. Serialize these paths with the per-E-Switch representor mutex instead of relying on ad-hoc bit state and wait queues. Take the representor lock around the mode transition, VF/SF representor changes and representor ops registration. Keep mode_lock and the representor lock unnested by using the operation flag while the mode lock is dropped. During mode changes, drop the representor lock around the auxiliary bus rescan because driver bind/unbind may register or unregister representor ops. Split representor ops registration into locked public wrappers and blocked internal helpers, clear the ops pointer on unregister, and add nested wrappers for the shared-FDB master IB path that registers peer representor ops while another E-Switch representor lock is already held. On unregister, always call __unload_reps_all_vport() before marking reps unregistered and clearing rep_ops. The per-representor state check makes this a no-op for types that were not loaded, so unregister no longer has to infer load state from esw->mode. Signed-off-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260503202726.266415-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski --- include/linux/mlx5/eswitch.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/mlx5/eswitch.h b/include/linux/mlx5/eswitch.h index 3b29a3c6794d..a0dd162baa78 100644 --- a/include/linux/mlx5/eswitch.h +++ b/include/linux/mlx5/eswitch.h @@ -63,7 +63,13 @@ struct mlx5_eswitch_rep { void mlx5_eswitch_register_vport_reps(struct mlx5_eswitch *esw, const struct mlx5_eswitch_rep_ops *ops, u8 rep_type); +void +mlx5_eswitch_register_vport_reps_nested(struct mlx5_eswitch *esw, + const struct mlx5_eswitch_rep_ops *ops, + u8 rep_type); void mlx5_eswitch_unregister_vport_reps(struct mlx5_eswitch *esw, u8 rep_type); +void mlx5_eswitch_unregister_vport_reps_nested(struct mlx5_eswitch *esw, + u8 rep_type); void *mlx5_eswitch_get_proto_dev(struct mlx5_eswitch *esw, u16 vport_num, u8 rep_type); -- cgit v1.2.3 From 5e138e0ec32b12d99f639947fc77b4bebda8f6e9 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 5 May 2026 20:04:57 +0200 Subject: w5100: remove MMIO support This driver supports both SPI and MMIO based register access, but only the former has devicetree support. While MMIO mode would have worked with old-style board files, those have never defined such a device upstream. Remove the MMIO mode, leaving SPI as the only way to use this driver, but leave it in two loadable modules. More cleanups can be done by combining the two into one file. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260505180459.1247690-1-arnd@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/platform_data/wiznet.h | 23 ----------------------- 1 file changed, 23 deletions(-) delete mode 100644 include/linux/platform_data/wiznet.h (limited to 'include') diff --git a/include/linux/platform_data/wiznet.h b/include/linux/platform_data/wiznet.h deleted file mode 100644 index 1154c4db8a13..000000000000 --- a/include/linux/platform_data/wiznet.h +++ /dev/null @@ -1,23 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* - * Ethernet driver for the WIZnet W5x00 chip. - */ - -#ifndef PLATFORM_DATA_WIZNET_H -#define PLATFORM_DATA_WIZNET_H - -#include - -struct wiznet_platform_data { - int link_gpio; - u8 mac_addr[ETH_ALEN]; -}; - -#ifndef CONFIG_WIZNET_BUS_SHIFT -#define CONFIG_WIZNET_BUS_SHIFT 0 -#endif - -#define W5100_BUS_DIRECT_SIZE (0x8000 << CONFIG_WIZNET_BUS_SHIFT) -#define W5300_BUS_DIRECT_SIZE (0x0400 << CONFIG_WIZNET_BUS_SHIFT) - -#endif /* PLATFORM_DATA_WIZNET_H */ -- cgit v1.2.3 From 8e4020e08398546be9b98b5540f94275d4489661 Mon Sep 17 00:00:00 2001 From: Shuicheng Lin Date: Fri, 1 May 2026 17:59:56 +0000 Subject: drm/gpusvm: Drop redundant @flags.* kernel-doc on struct drm_gpusvm_pages The kernel-doc block above struct drm_gpusvm_pages duplicates the descriptions of the bit-flags that live in struct drm_gpusvm_pages_flags using dotted notation (@flags.migrate_devmem, @flags.unmapped, ...). That dotted notation is intended for nested anonymous structs/unions that the parser flattens into the parent's parameter list. Here, however, flags is of a named external type, so the parser does not flatten its members and the dotted entries do not match any member of drm_gpusvm_pages. They also duplicate the canonical descriptions already present in the kernel-doc of struct drm_gpusvm_pages_flags itself. Drop the five @flags.* lines and replace them with a single @flags entry that cross-references the type via kernel-doc's "&struct ..." syntax. This eliminates the redundancy and removes warnings emitted by the new parameterdescs check in scripts/kernel-doc: Excess struct member 'flags.migrate_devmem' description in 'drm_gpusvm_pages' Excess struct member 'flags.unmapped' description in 'drm_gpusvm_pages' Excess struct member 'flags.partial_unmap' description in 'drm_gpusvm_pages' Excess struct member 'flags.has_devmem_pages' description in 'drm_gpusvm_pages' Excess struct member 'flags.has_dma_mapping' description in 'drm_gpusvm_pages' No functional change. Assisted-by: Claude:claude-opus-4.6 Cc: Matthew Auld Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://patch.msgid.link/20260501175956.4054088-1-shuicheng.lin@intel.com --- include/drm/drm_gpusvm.h | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) (limited to 'include') diff --git a/include/drm/drm_gpusvm.h b/include/drm/drm_gpusvm.h index cd94bb2ee6ee..8a4d7134a9a7 100644 --- a/include/drm/drm_gpusvm.h +++ b/include/drm/drm_gpusvm.h @@ -140,12 +140,7 @@ struct drm_gpusvm_pages_flags { * @state: DMA IOVA state for mapping. * @state_offset: DMA IOVA offset for mapping. * @notifier_seq: Notifier sequence number of the range's pages - * @flags: Flags for range - * @flags.migrate_devmem: Flag indicating whether the range can be migrated to device memory - * @flags.unmapped: Flag indicating if the range has been unmapped - * @flags.partial_unmap: Flag indicating if the range has been partially unmapped - * @flags.has_devmem_pages: Flag indicating if the range has devmem pages - * @flags.has_dma_mapping: Flag indicating if the range has a DMA mapping + * @flags: Flags for the range; see &struct drm_gpusvm_pages_flags */ struct drm_gpusvm_pages { struct drm_pagemap_addr *dma_addr; -- cgit v1.2.3 From 7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4 Mon Sep 17 00:00:00 2001 From: Maoyi Xie Date: Mon, 4 May 2026 22:27:36 +0800 Subject: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE. XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the rest of the xfrm/af_key netlink path was made netns-aware in 2008. The other 14 multicast paths in xfrm_user.c route their event using xs_net(x), xp_net(xp) or sock_net(skb->sk); only the migrate path was missed. Two consequences of the init_net hardcoding: 1. The notification (selector, old/new endpoint addresses, and the km_address) is delivered to listeners on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups rather than on the issuing netns. An IKE daemon running in init_net therefore receives migration notifications originating from any other netns on the host. 2. An IKE daemon running inside a non-init netns and subscribed to its own XFRMNLGRP_MIGRATE / pfkey groups never receives the notification of its own migration. IKEv2 MOBIKE / address-update handling inside a netns is silently broken. Thread struct net through km_migrate() and the xfrm_mgr.migrate function pointer, drop the &init_net override in xfrm_send_migrate() and pfkey_send_migrate(), and pass the caller's net (already in scope in xfrm_migrate() via sock_net(skb->sk)) all the way down. struct xfrm_mgr is in-tree only and not exported as a stable API, so the function-pointer signature change is internal. pfkey_broadcast() is already netns-aware via net_generic(net, pfkey_net_id) since the pernet conversion. The five other pfkey_broadcast() callers in af_key.c already pass xs_net(x), sock_net(sk) or a per-netns net, so this only removes the &init_net outlier. Fixes: 5c79de6e79cd ("[XFRM]: User interface for handling XFRM_MSG_MIGRATE") Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Maoyi Xie Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 10d3edde6b2f..874409127e29 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -715,6 +715,7 @@ struct xfrm_mgr { const struct xfrm_migrate *m, int num_bundles, const struct xfrm_kmaddress *k, + struct net *net, const struct xfrm_encap_tmpl *encap); bool (*is_alive)(const struct km_event *c); }; @@ -1891,7 +1892,7 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); #ifdef CONFIG_XFRM_MIGRATE int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, const struct xfrm_migrate *m, int num_bundles, - const struct xfrm_kmaddress *k, + const struct xfrm_kmaddress *k, struct net *net, const struct xfrm_encap_tmpl *encap); struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, u32 if_id); -- cgit v1.2.3 From ddc4dedb9ba3c8eecbc8c050fffd46d1b7e75c21 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 19 Apr 2026 23:33:46 -0700 Subject: crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG drbg_cpu_to_be32() is being used to do a plain write to a byte array, which doesn't have any alignment guarantee. This can cause a misaligned write. Replace it with the correct function, put_unaligned_be32(). Fixes: 72f3e00dd67e ("crypto: drbg - replace int2byte with cpu_to_be") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- include/crypto/internal/drbg.h | 18 ------------------ 1 file changed, 18 deletions(-) (limited to 'include') diff --git a/include/crypto/internal/drbg.h b/include/crypto/internal/drbg.h index 371e52dcee6c..b4e5ef0be602 100644 --- a/include/crypto/internal/drbg.h +++ b/include/crypto/internal/drbg.h @@ -9,24 +9,6 @@ #ifndef _INTERNAL_DRBG_H #define _INTERNAL_DRBG_H -/* - * Convert an integer into a byte representation of this integer. - * The byte representation is big-endian - * - * @val value to be converted - * @buf buffer holding the converted integer -- caller must ensure that - * buffer size is at least 32 bit - */ -static inline void drbg_cpu_to_be32(__u32 val, unsigned char *buf) -{ - struct s { - __be32 conv; - }; - struct s *conversion = (struct s *)buf; - - conversion->conv = cpu_to_be32(val); -} - /* * Concatenation Helper and string operation helper * -- cgit v1.2.3 From 6f49f00c981bbb9ef602966f19bfdbef46b681d2 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 19 Apr 2026 23:33:48 -0700 Subject: crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels On 64-bit kernels, drbg_max_addtl() returns 2**35 bytes. That's too large, for two reasons: 1. SP800-90A says the maximum limit is 2**35 *bits*, not 2**35 bytes. So the implemented limit has confused bits and bytes. 2. When drbg_kcapi_hash() calls crypto_shash_update() on the additional information string, the length is implicitly cast to 'unsigned int'. That truncates the additional information string to U32_MAX bytes. Fix the maximum additional information string length to always be U32_MAX - 1, causing an error to be returned for any longer lengths. Fixes: 541af946fe13 ("crypto: drbg - SP800-90A Deterministic Random Bit Generator") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- include/crypto/drbg.h | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/crypto/drbg.h b/include/crypto/drbg.h index 2d42518cbdce..c11eaf757ed0 100644 --- a/include/crypto/drbg.h +++ b/include/crypto/drbg.h @@ -148,19 +148,15 @@ static inline size_t drbg_max_request_bytes(struct drbg_state *drbg) return (1 << 16); } +/* + * SP800-90A allows implementations to support additional info / personalization + * strings of up to 2**35 bits. Implementations can have a smaller maximum. We + * use 2**35 - 16 bits == U32_MAX - 1 bytes so that the max + 1 always fits in a + * size_t, allowing drbg_healthcheck_sanity() to verify its enforcement. + */ static inline size_t drbg_max_addtl(struct drbg_state *drbg) { - /* SP800-90A requires 2**35 bytes additional info str / pers str */ -#if (__BITS_PER_LONG == 32) - /* - * SP800-90A allows smaller maximum numbers to be returned -- we - * return SIZE_MAX - 1 to allow the verification of the enforcement - * of this value in drbg_healthcheck_sanity. - */ - return (SIZE_MAX - 1); -#else - return (1UL<<35); -#endif + return U32_MAX - 1; } static inline size_t drbg_max_requests(struct drbg_state *drbg) -- cgit v1.2.3 From 06dc3f01e789cdad4d99b99eba35acb26d227f53 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 19 Apr 2026 23:33:52 -0700 Subject: crypto: drbg - Remove unhelpful helper functions Fold the contents of the inline functions crypto_drbg_get_bytes_addtl(), crypto_drbg_get_bytes_addtl_test(), and crypto_drbg_reset_test() into their only caller in drbg_cavs_test(). It ends up being much simpler. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- include/crypto/drbg.h | 76 --------------------------------------------------- 1 file changed, 76 deletions(-) (limited to 'include') diff --git a/include/crypto/drbg.h b/include/crypto/drbg.h index c11eaf757ed0..486aa793688e 100644 --- a/include/crypto/drbg.h +++ b/include/crypto/drbg.h @@ -78,10 +78,6 @@ struct drbg_state_ops { }; -struct drbg_test_data { - struct drbg_string *testentropy; /* TEST PARAMETER: test entropy */ -}; - enum drbg_seed_state { DRBG_SEED_STATE_UNSEEDED, DRBG_SEED_STATE_PARTIAL, /* Seeded with !rng_is_initialized() */ @@ -165,78 +161,6 @@ static inline size_t drbg_max_requests(struct drbg_state *drbg) return (1<<20); } -/* - * This is a wrapper to the kernel crypto API function of - * crypto_rng_generate() to allow the caller to provide additional data. - * - * @drng DRBG handle -- see crypto_rng_get_bytes - * @outbuf output buffer -- see crypto_rng_get_bytes - * @outlen length of output buffer -- see crypto_rng_get_bytes - * @addtl_input additional information string input buffer - * @addtllen length of additional information string buffer - * - * return - * see crypto_rng_get_bytes - */ -static inline int crypto_drbg_get_bytes_addtl(struct crypto_rng *drng, - unsigned char *outbuf, unsigned int outlen, - struct drbg_string *addtl) -{ - return crypto_rng_generate(drng, addtl->buf, addtl->len, - outbuf, outlen); -} - -/* - * TEST code - * - * This is a wrapper to the kernel crypto API function of - * crypto_rng_generate() to allow the caller to provide additional data and - * allow furnishing of test_data - * - * @drng DRBG handle -- see crypto_rng_get_bytes - * @outbuf output buffer -- see crypto_rng_get_bytes - * @outlen length of output buffer -- see crypto_rng_get_bytes - * @addtl_input additional information string input buffer - * @addtllen length of additional information string buffer - * @test_data filled test data - * - * return - * see crypto_rng_get_bytes - */ -static inline int crypto_drbg_get_bytes_addtl_test(struct crypto_rng *drng, - unsigned char *outbuf, unsigned int outlen, - struct drbg_string *addtl, - struct drbg_test_data *test_data) -{ - crypto_rng_set_entropy(drng, test_data->testentropy->buf, - test_data->testentropy->len); - return crypto_rng_generate(drng, addtl->buf, addtl->len, - outbuf, outlen); -} - -/* - * TEST code - * - * This is a wrapper to the kernel crypto API function of - * crypto_rng_reset() to allow the caller to provide test_data - * - * @drng DRBG handle -- see crypto_rng_reset - * @pers personalization string input buffer - * @perslen length of additional information string buffer - * @test_data filled test data - * - * return - * see crypto_rng_reset - */ -static inline int crypto_drbg_reset_test(struct crypto_rng *drng, - struct drbg_string *pers, - struct drbg_test_data *test_data) -{ - crypto_rng_set_entropy(drng, test_data->testentropy->buf, - test_data->testentropy->len); - return crypto_rng_reset(drng, pers->buf, pers->len); -} - /* DRBG type flags */ #define DRBG_CTR ((drbg_flag_t)1<<0) #define DRBG_HMAC ((drbg_flag_t)1<<1) -- cgit v1.2.3 From f4919bbca03c8d130a46eba99535b5730edd89a6 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 19 Apr 2026 23:33:53 -0700 Subject: crypto: drbg - Remove obsolete FIPS 140-2 continuous test FIPS 140-2 required that a continuous test for repeated outputs be done on both "Approved RNGs" and "Non-Approved RNGs". That's apparently why crypto/drbg.c does such a test on the bytes it pulls from get_random_bytes(), despite get_random_bytes() being a "Non-Approved RNG" that is credited with zero entropy for FIPS purposes. (From FIPS's point of view, the "Approved RNG" is jitterentropy.) FIPS 140-3 "modernized" the continuous RNG test requirements. They're now a bit more sophisticated, requiring both an "Adaptive Proportion Test" and a "Repetition Count Test". At the same time, FIPS 140-3 doesn't require continuous RNG tests on "Non-Approved RNGs" if a "vetted conditioning component" is used. The SP800-90A DRBGs are exactly such a vetted conditioning component, by their design. (In the case of HASH_DRBG and CTR_DRBG, the derivation function does have to be implemented. But the kernel does that.) In other words: from FIPS 140-3's point of view, get_random_bytes() still produces zero entropy, but the way the DRBG combines those bytes with the jitterentropy bytes preserves all the "approved" entropy from jitterentropy. Thus no test for get_random_bytes() is required. Seeing as FIPS 140-2 certificates stopped being issued in 2021 in favor of FIPS 140-3, this means this code is obsolete. Remove it. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- include/crypto/drbg.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/crypto/drbg.h b/include/crypto/drbg.h index 486aa793688e..4fafc69a8ee6 100644 --- a/include/crypto/drbg.h +++ b/include/crypto/drbg.h @@ -109,8 +109,6 @@ struct drbg_state { enum drbg_seed_state seeded; /* DRBG fully seeded? */ unsigned long last_seed_time; bool pr; /* Prediction resistance enabled? */ - bool fips_primed; /* Continuous test primed? */ - unsigned char *prev; /* FIPS 140-2 continuous test value */ struct crypto_rng *jent; const struct drbg_state_ops *d_ops; const struct drbg_core *core; -- cgit v1.2.3 From 262ec4782cf4ae3b661b30ff11d3af86f667c69c Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 19 Apr 2026 23:33:54 -0700 Subject: crypto: drbg - Fold include/crypto/drbg.h into crypto/drbg.c include/crypto/drbg.h no longer contains anything that is used externally to crypto/drbg.c. Therefore, fold it into crypto/drbg.c. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- include/crypto/drbg.h | 181 -------------------------------------------------- 1 file changed, 181 deletions(-) delete mode 100644 include/crypto/drbg.h (limited to 'include') diff --git a/include/crypto/drbg.h b/include/crypto/drbg.h deleted file mode 100644 index 4fafc69a8ee6..000000000000 --- a/include/crypto/drbg.h +++ /dev/null @@ -1,181 +0,0 @@ -/* - * DRBG based on NIST SP800-90A - * - * Copyright Stephan Mueller , 2014 - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, and the entire permission notice in its entirety, - * including the disclaimer of warranties. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote - * products derived from this software without specific prior - * written permission. - * - * ALTERNATIVELY, this product may be distributed under the terms of - * the GNU General Public License, in which case the provisions of the GPL are - * required INSTEAD OF the above restrictions. (This clause is - * necessary due to a potential bad interaction between the GPL and - * the restrictions contained in a BSD-style copyright.) - * - * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED - * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ALL OF - * WHICH ARE HEREBY DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE - * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT - * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR - * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF - * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE - * USE OF THIS SOFTWARE, EVEN IF NOT ADVISED OF THE POSSIBILITY OF SUCH - * DAMAGE. - */ - -#ifndef _DRBG_H -#define _DRBG_H - - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -struct drbg_state; -typedef uint32_t drbg_flag_t; - -struct drbg_core { - drbg_flag_t flags; /* flags for the cipher */ - __u8 statelen; /* maximum state length */ - __u8 blocklen_bytes; /* block size of output in bytes */ - char cra_name[CRYPTO_MAX_ALG_NAME]; /* mapping to kernel crypto API */ - /* kernel crypto API backend cipher name */ - char backend_cra_name[CRYPTO_MAX_ALG_NAME]; -}; - -struct drbg_state_ops { - int (*update)(struct drbg_state *drbg, struct list_head *seed, - int reseed); - int (*generate)(struct drbg_state *drbg, - unsigned char *buf, unsigned int buflen, - struct list_head *addtl); - int (*crypto_init)(struct drbg_state *drbg); - int (*crypto_fini)(struct drbg_state *drbg); - -}; - -enum drbg_seed_state { - DRBG_SEED_STATE_UNSEEDED, - DRBG_SEED_STATE_PARTIAL, /* Seeded with !rng_is_initialized() */ - DRBG_SEED_STATE_FULL, -}; - -struct drbg_state { - struct mutex drbg_mutex; /* lock around DRBG */ - unsigned char *V; /* internal state 10.1.1.1 1a) */ - unsigned char *Vbuf; - /* hash: static value 10.1.1.1 1b) hmac / ctr: key */ - unsigned char *C; - unsigned char *Cbuf; - /* Number of RNG requests since last reseed -- 10.1.1.1 1c) */ - size_t reseed_ctr; - size_t reseed_threshold; - /* some memory the DRBG can use for its operation */ - unsigned char *scratchpad; - unsigned char *scratchpadbuf; - void *priv_data; /* Cipher handle */ - - struct crypto_skcipher *ctr_handle; /* CTR mode cipher handle */ - struct skcipher_request *ctr_req; /* CTR mode request handle */ - __u8 *outscratchpadbuf; /* CTR mode output scratchpad */ - __u8 *outscratchpad; /* CTR mode aligned outbuf */ - struct crypto_wait ctr_wait; /* CTR mode async wait obj */ - struct scatterlist sg_in, sg_out; /* CTR mode SGLs */ - - enum drbg_seed_state seeded; /* DRBG fully seeded? */ - unsigned long last_seed_time; - bool pr; /* Prediction resistance enabled? */ - struct crypto_rng *jent; - const struct drbg_state_ops *d_ops; - const struct drbg_core *core; - struct drbg_string test_data; -}; - -static inline __u8 drbg_statelen(struct drbg_state *drbg) -{ - if (drbg && drbg->core) - return drbg->core->statelen; - return 0; -} - -static inline __u8 drbg_blocklen(struct drbg_state *drbg) -{ - if (drbg && drbg->core) - return drbg->core->blocklen_bytes; - return 0; -} - -static inline __u8 drbg_keylen(struct drbg_state *drbg) -{ - if (drbg && drbg->core) - return (drbg->core->statelen - drbg->core->blocklen_bytes); - return 0; -} - -static inline size_t drbg_max_request_bytes(struct drbg_state *drbg) -{ - /* SP800-90A requires the limit 2**19 bits, but we return bytes */ - return (1 << 16); -} - -/* - * SP800-90A allows implementations to support additional info / personalization - * strings of up to 2**35 bits. Implementations can have a smaller maximum. We - * use 2**35 - 16 bits == U32_MAX - 1 bytes so that the max + 1 always fits in a - * size_t, allowing drbg_healthcheck_sanity() to verify its enforcement. - */ -static inline size_t drbg_max_addtl(struct drbg_state *drbg) -{ - return U32_MAX - 1; -} - -static inline size_t drbg_max_requests(struct drbg_state *drbg) -{ - /* SP800-90A requires 2**48 maximum requests before reseeding */ - return (1<<20); -} - -/* DRBG type flags */ -#define DRBG_CTR ((drbg_flag_t)1<<0) -#define DRBG_HMAC ((drbg_flag_t)1<<1) -#define DRBG_HASH ((drbg_flag_t)1<<2) -#define DRBG_TYPE_MASK (DRBG_CTR | DRBG_HMAC | DRBG_HASH) -/* DRBG strength flags */ -#define DRBG_STRENGTH128 ((drbg_flag_t)1<<3) -#define DRBG_STRENGTH192 ((drbg_flag_t)1<<4) -#define DRBG_STRENGTH256 ((drbg_flag_t)1<<5) -#define DRBG_STRENGTH_MASK (DRBG_STRENGTH128 | DRBG_STRENGTH192 | \ - DRBG_STRENGTH256) - -enum drbg_prefixes { - DRBG_PREFIX0 = 0x00, - DRBG_PREFIX1, - DRBG_PREFIX2, - DRBG_PREFIX3 -}; - -#endif /* _DRBG_H */ -- cgit v1.2.3 From 6f88f41eeb7d4ef34e4ddb133d10779a316da67f Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 19 Apr 2026 23:33:56 -0700 Subject: crypto: drbg - Remove support for CTR_DRBG Remove the support for CTR_DRBG. It's likely unused code, seeing as HMAC_DRBG is always enabled and prioritized over it unless NETLINK_CRYPTO is used to change the algorithm priorities. There's also no compelling reason to support more than one of [HMAC_DRBG, HASH_DRBG, CTR_DRBG]. By definition, callers cannot tell any difference in their outputs. And all are FIPS-certifiable, which is the only point of the kernel's NIST DRBGs anyway. Switching to CTR_DRBG doesn't seem all that compelling, either. While it's often the fastest NIST DRBG, it has several disadvantages: - CTR_DRBG uses AES. Some platforms don't have AES acceleration at all, causing a fallback to the table-based AES code which is very slow and can be vulnerable to cache-timing attacks. In contrast, HMAC_DRBG uses primitives that are consistently constant-time. - CTR_DRBG is usually considered to be somewhat less cryptographically robust than HMAC_DRBG. Granted, HMAC_DRBG isn't all that great either, e.g. given the negative result from Woodage & Shumow (2018) (https://eprint.iacr.org/2018/349.pdf), but that can be worked around. - CTR_DRBG is more complex than HMAC_DRBG, risking bugs. Indeed, while reviewing the CTR_DRBG code, I found two bugs, including one where it can return success while leaving the output buffer uninitialized. - The kernel's implementation of CTR_DRBG uses an "ctr(aes)" crypto_skcipher and relies on it returning the next counter value. That's fragile, and indeed historically many "ctr(aes)" crypto_skcipher implementations haven't done that. E.g. see commit 511306b2d075 ("crypto: arm/aes-ce - update IV after partial final CTR block"), commit fa5fd3afc7e6 ("crypto: arm64/aes-blk - update IV after partial final CTR block"), commit 371731ec2179 ("crypto: atmel-aes - Fix saving of IV for CTR mode"), commit 25baaf8e2c93 ("crypto: crypto4xx - fix ctr-aes missing output IV"), commit 334d37c9e263 ("crypto: caam - update IV using HW support"), commit 0a4491d3febe ("crypto: chelsio - count incomplete block in IV"), commit e8e3c1ca57d4 ("crypto: s5p - update iv after AES-CBC op end"). I.e., there were many years where the kernel's CTR_DRBG code (if it were to have actually been used) repeated outputs on some platforms. AES-CTR also uses a 128-bit counter, which creates overflow edge cases that are sometimes gotten wrong. E.g. see commit 009b30ac7444 ("crypto: vmx - CTR: always increment IV as quadword"). So, while switching to CTR_DRBG for performance reasons isn't completely out of the question (notably BoringSSL uses it), it would take quite a bit more work to create a solid implementation of it in the kernel, including a more solid implementation of AES-CTR itself (in lib/crypto/, with a scalar bit-sliced fallback, etc). Since HMAC_DRBG has always been the default NIST DRBG variant in the kernel and is in a better state, let's just standardize on it for now. Signed-off-by: Eric Biggers Acked-by: Geert Uytterhoeven # m68k Signed-off-by: Herbert Xu --- include/crypto/internal/drbg.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/crypto/internal/drbg.h b/include/crypto/internal/drbg.h index b4e5ef0be602..5d4174cc6a53 100644 --- a/include/crypto/internal/drbg.h +++ b/include/crypto/internal/drbg.h @@ -9,6 +9,9 @@ #ifndef _INTERNAL_DRBG_H #define _INTERNAL_DRBG_H +#include +#include + /* * Concatenation Helper and string operation helper * -- cgit v1.2.3 From 6585b5b4fddd47c174310a57930369e52335a034 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 19 Apr 2026 23:34:11 -0700 Subject: crypto: drbg - Eliminate use of 'drbg_string' and lists Use straightforward (buffer, len) parameters instead of struct drbg_string or lists of strings. This simplifies the code considerably. For now struct drbg_string is still used in crypto_drbg_ctr_df(), so move its definition to crypto/df_sp80090a.h. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- include/crypto/df_sp80090a.h | 25 +++++++++++++++++++++++++ include/crypto/internal/drbg.h | 39 --------------------------------------- 2 files changed, 25 insertions(+), 39 deletions(-) delete mode 100644 include/crypto/internal/drbg.h (limited to 'include') diff --git a/include/crypto/df_sp80090a.h b/include/crypto/df_sp80090a.h index cb5d6fe15d40..e594fb718eb8 100644 --- a/include/crypto/df_sp80090a.h +++ b/include/crypto/df_sp80090a.h @@ -9,6 +9,31 @@ #include #include +#include + +/* + * Concatenation Helper and string operation helper + * + * SP800-90A requires the concatenation of different data. To avoid copying + * buffers around or allocate additional memory, the following data structure + * is used to point to the original memory with its size. In addition, it + * is used to build a linked list. The linked list defines the concatenation + * of individual buffers. The order of memory block referenced in that + * linked list determines the order of concatenation. + */ +struct drbg_string { + const unsigned char *buf; + size_t len; + struct list_head list; +}; + +static inline void drbg_string_fill(struct drbg_string *string, + const unsigned char *buf, size_t len) +{ + string->buf = buf; + string->len = len; + INIT_LIST_HEAD(&string->list); +} static inline int crypto_drbg_ctr_df_datalen(u8 statelen, u8 blocklen) { diff --git a/include/crypto/internal/drbg.h b/include/crypto/internal/drbg.h deleted file mode 100644 index 5d4174cc6a53..000000000000 --- a/include/crypto/internal/drbg.h +++ /dev/null @@ -1,39 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ - -/* - * NIST SP800-90A DRBG derivation function - * - * Copyright (C) 2014, Stephan Mueller - */ - -#ifndef _INTERNAL_DRBG_H -#define _INTERNAL_DRBG_H - -#include -#include - -/* - * Concatenation Helper and string operation helper - * - * SP800-90A requires the concatenation of different data. To avoid copying - * buffers around or allocate additional memory, the following data structure - * is used to point to the original memory with its size. In addition, it - * is used to build a linked list. The linked list defines the concatenation - * of individual buffers. The order of memory block referenced in that - * linked list determines the order of concatenation. - */ -struct drbg_string { - const unsigned char *buf; - size_t len; - struct list_head list; -}; - -static inline void drbg_string_fill(struct drbg_string *string, - const unsigned char *buf, size_t len) -{ - string->buf = buf; - string->len = len; - INIT_LIST_HEAD(&string->list); -} - -#endif //_INTERNAL_DRBG_H -- cgit v1.2.3 From cdff2e6ab8908f523474931e6f986022f045fb3f Mon Sep 17 00:00:00 2001 From: Niranjan H Y Date: Tue, 5 May 2026 16:48:03 +0530 Subject: ASoC: SDCA: Add PDE verification reusable helper Implement sdca_asoc_pde_ensure_ps() helper function to poll for PDE power state transitions. Per SDCA specification, after writing REQUESTED_PS, drivers must poll ACTUAL_PS until the target power state is reached. Changes include: - Add sdca_asoc_pde_ensure_ps() to handle ACTUAL_PS polling with support for device-specific delay tables or default intervals - Export function via sdca_asoc.h for use by SDCA-compliant drivers - Refactor entity_pde_event() in sdca_asoc.c to use the helper Signed-off-by: Niranjan H Y Reviewed-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260505111806.2280-2-niranjan.hy@ti.com Signed-off-by: Mark Brown --- include/sound/sdca_asoc.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/sound/sdca_asoc.h b/include/sound/sdca_asoc.h index 46a61a52decc..ca35d5a44370 100644 --- a/include/sound/sdca_asoc.h +++ b/include/sound/sdca_asoc.h @@ -13,6 +13,7 @@ struct device; struct regmap; struct sdca_function_data; +struct sdca_pde_delay; struct snd_ctl_elem_value; struct snd_kcontrol; struct snd_kcontrol_new; @@ -99,4 +100,9 @@ int sdca_asoc_q78_put_volsw(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol); int sdca_asoc_q78_get_volsw(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol); +int sdca_asoc_pde_poll_actual_ps(struct device *dev, struct regmap *regmap, + int function_id, int entity_id, + int from_ps, int to_ps, + const struct sdca_pde_delay *pde_delays, + int num_delays); #endif // __SDCA_ASOC_H__ -- cgit v1.2.3 From e812de61e9a0cb45ab8c156bb0349ab9df503d3a Mon Sep 17 00:00:00 2001 From: Niranjan H Y Date: Tue, 5 May 2026 16:48:05 +0530 Subject: ASoC: sdw_utils: TI amp utility for tac5xx2 family Add TI amp utility for supporting the tac5xx2 family of devices to support tac5572, tac5672, tac5682 and tas2883 Signed-off-by: Niranjan H Y Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20260505111806.2280-4-niranjan.hy@ti.com Signed-off-by: Mark Brown --- include/sound/soc_sdw_utils.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/sound/soc_sdw_utils.h b/include/sound/soc_sdw_utils.h index 489083183673..d713ab2f6620 100644 --- a/include/sound/soc_sdw_utils.h +++ b/include/sound/soc_sdw_utils.h @@ -272,7 +272,11 @@ int asoc_sdw_ti_amp_init(struct snd_soc_card *card, struct asoc_sdw_codec_info *info, bool playback); int asoc_sdw_ti_spk_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai); +int asoc_sdw_ti_tac5xx2_spk_rtd_init(struct snd_soc_pcm_runtime *rtd, + struct snd_soc_dai *dai); int asoc_sdw_ti_amp_initial_settings(struct snd_soc_card *card, const char *name_prefix); +int asoc_sdw_ti_dmic_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai); +int asoc_sdw_ti_sdca_jack_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai); #endif -- cgit v1.2.3 From ee3d4c81d89c92fbeb65807971ac22b3dfa49220 Mon Sep 17 00:00:00 2001 From: Ben Horgan Date: Wed, 6 May 2026 09:28:52 +0100 Subject: fs/resctrl: Add monitor property 'mbm_cntr_assign_fixed' Commit 3b497c3f4f04 ("fs/resctrl: Introduce the interface to display monitoring modes") introduced CONFIG_RESCTRL_ASSIGN_FIXED but left adding the Kconfig entry until it was necessary. The counter assignment mode is fixed in MPAM, even when there are assignable counters, and so addressing this is needed to support MPAM. To avoid the burden of another Kconfig entry, replace CONFIG_RESCTRL_ASSIGN_FIXED with a new property in 'struct resctrl_mon', 'mbm_cntr_assign_fixed' to be set by the architecture. Do not request the architecture to change the counter assignment mode if it does not support doing so. Provide insight to user space about why such a request fails. Signed-off-by: Ben Horgan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Babu Moger Reviewed-by: Reinette Chatre Tested-by: Babu Moger Link: https://lore.kernel.org/20260506082855.3694761-1-ben.horgan@arm.com --- include/linux/resctrl.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/resctrl.h b/include/linux/resctrl.h index 06e8c72e8660..73ff522448a0 100644 --- a/include/linux/resctrl.h +++ b/include/linux/resctrl.h @@ -294,6 +294,7 @@ enum resctrl_schema_fmt { * @mbm_assign_on_mkdir: True if counters should automatically be assigned to MBM * events of monitor groups created via mkdir. * @mbm_cntr_configurable: True if assignable counters are configurable. + * @mbm_cntr_assign_fixed: True if the counter assignment mode is fixed. */ struct resctrl_mon { u32 num_rmid; @@ -302,6 +303,7 @@ struct resctrl_mon { bool mbm_cntr_assignable; bool mbm_assign_on_mkdir; bool mbm_cntr_configurable; + bool mbm_cntr_assign_fixed; }; /** -- cgit v1.2.3 From 061bc966cfe97314b9f4dcd849fc7042fb12122f Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Fri, 27 Mar 2026 11:49:10 +0100 Subject: gpio: timberdale: Remove platform data header With no more users, we can remove timb_gpio.h. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260327-gpio-timberdale-swnode-v3-4-9a1bc1b2b124@oss.qualcomm.com Signed-off-by: Lee Jones --- include/linux/timb_gpio.h | 25 ------------------------- 1 file changed, 25 deletions(-) delete mode 100644 include/linux/timb_gpio.h (limited to 'include') diff --git a/include/linux/timb_gpio.h b/include/linux/timb_gpio.h deleted file mode 100644 index 74f5e73bf6db..000000000000 --- a/include/linux/timb_gpio.h +++ /dev/null @@ -1,25 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * timb_gpio.h timberdale FPGA GPIO driver, platform data definition - * Copyright (c) 2009 Intel Corporation - */ - -#ifndef _LINUX_TIMB_GPIO_H -#define _LINUX_TIMB_GPIO_H - -/** - * struct timbgpio_platform_data - Platform data of the Timberdale GPIO driver - * @gpio_base: The number of the first GPIO pin, set to -1 for - * dynamic number allocation. - * @nr_pins: Number of pins that is supported by the hardware (1-32) - * @irq_base: If IRQ is supported by the hardware, this is the base - * number of IRQ:s. One IRQ per pin will be used. Set to - * -1 if IRQ:s is not supported. - */ -struct timbgpio_platform_data { - int gpio_base; - int nr_pins; - int irq_base; -}; - -#endif -- cgit v1.2.3 From 7b1a245b180579a844e506193f1f714edaf24bc1 Mon Sep 17 00:00:00 2001 From: David Zhang Date: Tue, 5 May 2026 09:09:31 -0700 Subject: accel/amdxdna: Add initial support for AIE4 VF Add basic device initialization support for AIE4 Virtual Functions (PCI device IDs 0x17F3 and 0x1B0C). Co-developed-by: Hayden Laccabue Signed-off-by: Hayden Laccabue Signed-off-by: David Zhang Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260505160936.3917732-2-lizhi.hou@amd.com --- include/uapi/drm/amdxdna_accel.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/drm/amdxdna_accel.h b/include/uapi/drm/amdxdna_accel.h index 0b11e8e3ea5d..34212feee15c 100644 --- a/include/uapi/drm/amdxdna_accel.h +++ b/include/uapi/drm/amdxdna_accel.h @@ -30,6 +30,7 @@ extern "C" { enum amdxdna_device_type { AMDXDNA_DEV_TYPE_UNKNOWN = -1, AMDXDNA_DEV_TYPE_KMQ = 0, + AMDXDNA_DEV_TYPE_UMQ = 1, AMDXDNA_DEV_TYPE_PF = 2, }; -- cgit v1.2.3 From 193612791eea3648e6647ad74cacb191f9d0ef33 Mon Sep 17 00:00:00 2001 From: David Zhang Date: Tue, 5 May 2026 09:09:33 -0700 Subject: accel/amdxdna: Add AIE4 VF hardware context create and destroy Implement hardware context creation and destruction for AIE4 VF devices. Co-developed-by: Hayden Laccabue Signed-off-by: Hayden Laccabue Signed-off-by: David Zhang Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260505160936.3917732-4-lizhi.hou@amd.com --- include/uapi/drm/amdxdna_accel.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/drm/amdxdna_accel.h b/include/uapi/drm/amdxdna_accel.h index 34212feee15c..ad9b33dd7b13 100644 --- a/include/uapi/drm/amdxdna_accel.h +++ b/include/uapi/drm/amdxdna_accel.h @@ -18,6 +18,7 @@ extern "C" { #define AMDXDNA_INVALID_CTX_HANDLE 0 #define AMDXDNA_INVALID_BO_HANDLE 0 #define AMDXDNA_INVALID_FENCE_HANDLE 0 +#define AMDXDNA_INVALID_DOORBELL_OFFSET (~0U) /* * Define hardware context priority -- cgit v1.2.3 From 91f4da826c082f7dca4a1f90fa3f032255f69c18 Mon Sep 17 00:00:00 2001 From: David Zhang Date: Tue, 5 May 2026 09:09:34 -0700 Subject: accel/amdxdna: Add command doorbell and wait support Expose the command doorbell register to userspace on a per-hardware context basis, enabling applications to notify the firmware of pending commands via doorbell writes. Introduce DRM_IOCTL_AMDXDNA_WAIT_CMD to allow userspace to wait for completion of individual commands. Co-developed-by: Hayden Laccabue Signed-off-by: Hayden Laccabue Signed-off-by: David Zhang Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260505160936.3917732-5-lizhi.hou@amd.com --- include/uapi/drm/amdxdna_accel.h | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/drm/amdxdna_accel.h b/include/uapi/drm/amdxdna_accel.h index ad9b33dd7b13..51a507561df6 100644 --- a/include/uapi/drm/amdxdna_accel.h +++ b/include/uapi/drm/amdxdna_accel.h @@ -45,7 +45,8 @@ enum amdxdna_drm_ioctl_id { DRM_AMDXDNA_EXEC_CMD, DRM_AMDXDNA_GET_INFO, DRM_AMDXDNA_SET_STATE, - DRM_AMDXDNA_GET_ARRAY = 10, + DRM_AMDXDNA_WAIT_CMD, + DRM_AMDXDNA_GET_ARRAY, }; /** @@ -274,6 +275,21 @@ struct amdxdna_drm_exec_cmd { __u64 seq; }; +/** + * struct amdxdna_drm_wait_cmd - Wait execution command. + * + * @hwctx: Context handle. + * @timeout: timeout in ms, 0 implies infinite wait. + * @seq: sequence number of the command returned by execute command. + * + * Wait a command specified by seq to be completed. + */ +struct amdxdna_drm_wait_cmd { + __u32 hwctx; + __u32 timeout; + __u64 seq; +}; + /** * struct amdxdna_drm_query_aie_status - Query the status of the AIE hardware * @buffer: The user space buffer that will return the AIE status. @@ -739,6 +755,10 @@ struct amdxdna_drm_set_power_mode { DRM_IOWR(DRM_COMMAND_BASE + DRM_AMDXDNA_GET_ARRAY, \ struct amdxdna_drm_get_array) +#define DRM_IOCTL_AMDXDNA_WAIT_CMD \ + DRM_IOW(DRM_COMMAND_BASE + DRM_AMDXDNA_WAIT_CMD, \ + struct amdxdna_drm_wait_cmd) + #if defined(__cplusplus) } /* extern c end */ #endif -- cgit v1.2.3 From 35b535db69589ea0025ec3f06df08f2e3faad26f Mon Sep 17 00:00:00 2001 From: Tejas Upadhyay Date: Fri, 8 May 2026 12:25:45 +0530 Subject: drm/buddy: Integrate lockdep annotations for gpu buddy manager gpu_buddy APIs are expected to be called with the driver-provided lock held, but there is no runtime enforcement of this contract. Add lockdep annotations to catch locking violations early. Introduce gpu_buddy_driver_set_lock() for the driver to register the lock that protects the buddy manager. Add gpu_buddy_driver_lock_held() assertions to all exported gpu_buddy and drm_buddy APIs that access/modify the manager state. The lock_dep_map field is only compiled in when CONFIG_LOCKDEP is enabled, adding zero overhead to production builds. Wire up xe_ttm_vram_mgr to register its mutex with the buddy manager after initialization. Assisted-by: Copilot:claude-opus-4.6 Suggested-by: Matthew Brost Signed-off-by: Tejas Upadhyay Reviewed-by: Matthew Auld Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260508065544.4049240-2-tejas.upadhyay@intel.com --- include/linux/gpu_buddy.h | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) (limited to 'include') diff --git a/include/linux/gpu_buddy.h b/include/linux/gpu_buddy.h index 5fa917ba5450..71941a039648 100644 --- a/include/linux/gpu_buddy.h +++ b/include/linux/gpu_buddy.h @@ -154,6 +154,7 @@ struct gpu_buddy_block { * @avail: Total free space currently available for allocation in bytes. * @clear_avail: Free space available in the clear tree (zeroed memory) in bytes. * This is a subset of @avail. + * @lock_dep_map: Annotates gpu_buddy API with a driver provided lock. */ struct gpu_buddy { /* private: */ @@ -179,8 +180,48 @@ struct gpu_buddy { u64 size; u64 avail; u64 clear_avail; +#ifdef CONFIG_LOCKDEP + struct lockdep_map *lock_dep_map; +#endif }; +#ifdef CONFIG_LOCKDEP +/** + * gpu_buddy_driver_set_lock() - Set the lock protecting accesses to GPU BUDDY + * @mm: Pointer to GPU buddy structure. + * @lock: the lock used to protect the gpu buddy. The locking primitive + * must contain a dep_map field. + * + * Call this to annotate gpu_buddy APIs which access/modify gpu_buddy manager + */ +#define gpu_buddy_driver_set_lock(mm, lock) \ + do { \ + struct gpu_buddy *__mm = (mm); \ + if (!WARN(__mm->lock_dep_map, "GPU BUDDY MM lock should be set only once.")) \ + __mm->lock_dep_map = &(lock)->dep_map; \ + } while (0) +#else +#define gpu_buddy_driver_set_lock(mm, lock) do { (void)(mm); (void)(lock); } while (0) +#endif + +#ifdef CONFIG_LOCKDEP +/** + * gpu_buddy_driver_lock_held() - Assert GPU BUDDY manager lock is held + * @mm: Pointer to the GPU BUDDY structure. + * + * Ensure driver lock is held. + */ +static inline void gpu_buddy_driver_lock_held(struct gpu_buddy *mm) +{ + if (mm->lock_dep_map) + lockdep_assert(lock_is_held_type(mm->lock_dep_map, 0)); +} +#else +static inline void gpu_buddy_driver_lock_held(struct gpu_buddy *mm) +{ +} +#endif + static inline u64 gpu_buddy_block_offset(const struct gpu_buddy_block *block) { -- cgit v1.2.3 From 083a59e05db9203c346e87d822c0c12a0f7a7c85 Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Mon, 4 May 2026 12:58:56 +0200 Subject: ACPI: provide acpi_bus_find_device_by_name() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Provide a helper allowing to locate an ACPI device by its name. Signed-off-by: Bartosz Golaszewski Acked-by: Rafael J. Wysocki (Intel) Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260504-baytrail-real-swnode-v5-1-c7878b69e383@oss.qualcomm.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen --- include/linux/acpi.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 67effb91fa98..10d6c6c11bdf 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -798,6 +798,8 @@ int acpi_get_local_u64_address(acpi_handle handle, u64 *addr); int acpi_get_local_address(acpi_handle handle, u32 *addr); const char *acpi_get_subsystem_id(acpi_handle handle); +struct device *acpi_bus_find_device_by_name(const char *name); + #ifdef CONFIG_ACPI_MRRM int acpi_mrrm_max_mem_region(void); #endif @@ -1106,6 +1108,11 @@ static inline const char *acpi_get_subsystem_id(acpi_handle handle) return ERR_PTR(-ENODEV); } +static inline struct device *acpi_bus_find_device_by_name(const char *name) +{ + return NULL; +} + static inline int acpi_register_wakeup_handler(int wake_irq, bool (*wakeup)(void *context), void *context) { -- cgit v1.2.3 From 77c5f3def45937f3f90ea4018cfdf9342b78b78a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Date: Fri, 8 May 2026 04:35:21 +0000 Subject: PCI: Add pci_resource_is_io() and pci_resource_is_mem() helpers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add helpers to check whether a PCI resource is of I/O port or memory type. These replace the open-coded pci_resource_flags() with IORESOURCE_IO and IORESOURCE_MEM pattern used across the tree. Suggested-by: Ilpo Järvinen Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Tested-by: Shivaprasad G Bhat Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20260508043543.217179-3-kwilczynski@kernel.org --- include/linux/pci.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index 2c4454583c11..e93fbe6b57fe 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -2300,6 +2300,31 @@ int pci_iobar_pfn(struct pci_dev *pdev, int bar, struct vm_area_struct *vma); CONCATENATE(__pci_dev_for_each_res, COUNT_ARGS(__VA_ARGS__)) \ (dev, res, __VA_ARGS__) +/** + * pci_resource_is_io - check if a PCI resource is of I/O port type. + * @dev: PCI device to check. + * @resno: The resource number (BAR index) to check. + * + * Returns true if the resource type is I/O port. + */ +static inline bool pci_resource_is_io(const struct pci_dev *dev, int resno) +{ + return resource_type(pci_resource_n(dev, resno)) == IORESOURCE_IO; +} + +/** + * pci_resource_is_mem - check if a PCI resource is of memory type. + * @dev: PCI device to check. + * @resno: The resource number (BAR index) to check. + * + * Returns true if the resource type is memory, including + * prefetchable memory. + */ +static inline bool pci_resource_is_mem(const struct pci_dev *dev, int resno) +{ + return resource_type(pci_resource_n(dev, resno)) == IORESOURCE_MEM; +} + /* * Similar to the helpers above, these manipulate per-pci_dev * driver-specific data. They are really just a wrapper around -- cgit v1.2.3 From a84391b77351bbca92ea9db2be1f44e17f2eda6d Mon Sep 17 00:00:00 2001 From: Ricardo Ribalda Date: Mon, 16 Mar 2026 13:34:44 +0000 Subject: media: uvcvideo: Import standard controls from uvcdynctrl The uvcdynctrl tool from libwebcam: https://sourceforge.net/projects/libwebcam/ maps proprietary controls into v4l2 controls using the UVCIOC_CTRL_MAP ioctl. The tool has not been updated for 10+ years now, and there is no reason for the UVC driver to not do the mapping by itself. This patch adds the mappings from the uvcdynctrl into the driver. Hopefully this effort can help in deprecating the UVCIOC_CTRL_MAP ioctl. Some background about UVCIOC_CTRL_MAP (thanks Laurent for the context): ``` this was envisioned as the base of a vibrant ecosystem where a large number of vendors would submit XML files that describe their XU control mappings, at a pace faster than could be supported by adding XU mappings to the driver. This vision failed to materialize and the tool has not been updated for 10+ years now. There is no reason to believe the situation will change. ``` During the porting, the following mappings where NOT imported because they were not using standard v4l2 IDs. It is recommended that userspace moves to UVCIOC_CTRL_QUERY for non standard controls. { .id = V4L2_CID_FLASH_MODE, .entity = UVC_GUID_SIS_LED_HW_CONTROL, .selector = 4, .size = 4, .offset = 0, .v4l2_type = V4L2_CTRL_TYPE_MENU, .data_type = UVC_CTRL_DATA_TYPE_UNSIGNED, .menu_mask = 0x3, .menu_mapping = { 0x20, 0x22 }, .menu_names = { "Off", "On" }, }, { .id = V4L2_CID_FLASH_FREQUENCY, .entity = UVC_GUID_SIS_LED_HW_CONTROL, .selector = 4, .size = 8, .offset = 16, .v4l2_type = V4L2_CTRL_TYPE_INTEGER, .data_type = UVC_CTRL_DATA_TYPE_UNSIGNED, }, { .id = V4L2_CID_LED1_MODE, .entity = UVC_GUID_LOGITECH_USER_HW_CONTROL_V1, .selector = 1, .size = 8, .offset = 0, .v4l2_type = V4L2_CTRL_TYPE_MENU, .data_type = UVC_CTRL_DATA_TYPE_UNSIGNED, .menu_mask = 0xF, .menu_mapping = { 0, 1, 2, 3 }, .menu_names = { "Off", "On", "Blinking", "Auto" }, }, { .id = V4L2_CID_LED1_FREQUENCY, .entity = UVC_GUID_LOGITECH_USER_HW_CONTROL_V1, .selector = 1, .size = 8, .offset = 16, .v4l2_type = V4L2_CTRL_TYPE_INTEGER, .data_type = UVC_CTRL_DATA_TYPE_UNSIGNED, }, { .id = V4L2_CID_DISABLE_PROCESSING, .entity = UVC_GUID_LOGITECH_VIDEO_PIPE_V1, .selector = 5, .size = 8, .offset = 0, .v4l2_type = V4L2_CTRL_TYPE_BOOLEAN, .data_type = UVC_CTRL_DATA_TYPE_BOOLEAN, }, { .id = V4L2_CID_RAW_BITS_PER_PIXEL, .entity = UVC_GUID_LOGITECH_VIDEO_PIPE_V1, .selector = 8, .size = 8, .offset = 0, .v4l2_type = V4L2_CTRL_TYPE_INTEGER, .data_type = UVC_CTRL_DATA_TYPE_UNSIGNED, }, { .id = V4L2_CID_LED1_MODE, .entity = UVC_GUID_LOGITECH_PERIPHERAL, .selector = 0x09, .size = 2, .offset = 8, .v4l2_type = V4L2_CTRL_TYPE_MENU, .data_type = UVC_CTRL_DATA_TYPE_UNSIGNED, .menu_mask = 0xF, .menu_mapping = { 0, 1, 2, 3 }, .menu_names = { "Off", "On", "Blink", "Auto" }, }, { .id = V4L2_CID_LED1_FREQUENCY, .entity = UVC_GUID_LOGITECH_PERIPHERAL, .selector = 0x09, .size = 8, .offset = 24, .v4l2_type = V4L2_CTRL_TYPE_INTEGER, .data_type = UVC_CTRL_DATA_TYPE_UNSIGNED, }, This script has been used to generate the mappings. They were then reformatted manually to follow the driver style. import sys import uuid import re import xml.etree.ElementTree as ET def get_namespace(root): return re.match(r"\{.*\}", root.tag).group(0) def get_single_guid(ns, constant): id = constant.find(ns + "id").text value = constant.find(ns + "value").text return (id, value) def get_constants(ns, root): out = dict() for constant in root.iter(ns + "constant"): attr = constant.attrib if attr["type"] == "integer": id, value = get_single_guid(ns, constant) if id in out: print(f"dupe constant {id}") out[id] = value return out def get_guids(ns, root): out = dict() for constant in root.iter(ns + "constant"): attr = constant.attrib if attr["type"] == "guid": id, value = get_single_guid(ns, constant) if id in out: print(f"dupe guid {id}") out[id] = value return out def get_single_control(ns, control): out = {} for id in "entity", "selector", "index", "size", "description": v = control.find(ns + id) if v is None and id == "description": continue out[id] = v.text reqs = set() for r in control.find(ns + "requests"): reqs.add(r.text) out["requests"] = reqs return (control.attrib["id"], out) def get_controls(ns, root): out = dict() for control in root.iter(ns + "control"): id, value = get_single_control(ns, control) if id in out: print(f"Dupe control id {id}") out[id] = value return out def get_single_mapping(ns, mapping): out = {} out["name"] = mapping.find(ns + "name").text uvc = mapping.find(ns + "uvc") for id in "size", "offset", "uvc_type": out[id] = uvc.find(ns + id).text out["control_ref"] = uvc.find(ns + "control_ref").attrib["idref"] v4l2 = mapping.find(ns + "v4l2") for id in "id", "v4l2_type": out[id] = v4l2.find(ns + id).text menu = {} for entry in v4l2.iter(ns + "menu_entry"): menu[entry.attrib["name"]] = entry.attrib["value"] if menu: out["menu"] = menu return out def get_mapping(ns, root): out = [] for control in root.iter(ns + "mapping"): mapping = get_single_mapping(ns, control) out += [mapping] return out def print_guids(guids): for g in guids: print(f"#define {g} \\") u_bytes = uuid.UUID(guids[g]).bytes_le u_bytes = [f"0x{b:02x}" for b in u_bytes] print("\t{ " + ", ".join(u_bytes) + " }") def print_flags(flags): get_range = {"GET_MIN", "GET_DEF", "GET_MAX", "GET_CUR", "GET_RES"} if get_range.issubset(flags): flags -= get_range flags.add("GET_RANGE") flags = list(flags) flags.sort() out = "" for f in flags[:-1]: out += f"UVC_CTRL_FLAG_{f}\n\t\t\t\t| " out += f"UVC_CTRL_FLAG_{flags[-1]}" return out def print_description(desc): print("/*") for line in desc.strip().splitlines(): print(f" * {line.strip()}") print("*/") def print_controls(controls, cons): for id in controls: c = controls[id] if "description" in c: print_description(c["description"]) print( f"""\t{{ \t\t.entity\t\t= {c["entity"]}, \t\t.selector\t= {cons[c["selector"]]}, \t\t.index\t\t= {c["index"]}, \t\t.size\t\t= {c["size"]}, \t\t.flags\t\t= {print_flags(c["requests"])}, \t}},""" ) def menu_mapping_txt(menu): out = f"\n\t\t.menu_mask\t= 0x{((1< Cc: Martin Rubli Reviewed-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil --- include/linux/usb/uvc.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/usb/uvc.h b/include/linux/usb/uvc.h index 05bfebab42b6..84f35c6f4d6e 100644 --- a/include/linux/usb/uvc.h +++ b/include/linux/usb/uvc.h @@ -43,6 +43,12 @@ #define UVC_GUID_MSXU_1_5 \ {0xdc, 0x95, 0x3f, 0x0f, 0x32, 0x26, 0x4e, 0x4c, \ 0x92, 0xc9, 0xa0, 0x47, 0x82, 0xf4, 0x3b, 0xc8} +#define UVC_GUID_LOGITECH_MOTOR_CONTROL_V1 \ + {0x82, 0x06, 0x61, 0x63, 0x70, 0x50, 0xab, 0x49, \ + 0xb8, 0xcc, 0xb3, 0x85, 0x5e, 0x8d, 0x22, 0x56 } +#define UVC_GUID_LOGITECH_PERIPHERAL \ + {0x21, 0x2d, 0xe5, 0xff, 0x30, 0x80, 0x2c, 0x4e, \ + 0x82, 0xd9, 0xf5, 0x87, 0xd0, 0x05, 0x40, 0xbd } /* https://learn.microsoft.com/en-us/windows-hardware/drivers/stream/uvc-extensions-1-5#222-extension-unit-controls */ #define UVC_MSXU_CONTROL_FOCUS 0x01 -- cgit v1.2.3 From 02f93b4f940c66b99258cce954dcaeda7b3295a8 Mon Sep 17 00:00:00 2001 From: Ricardo Ribalda Date: Mon, 16 Mar 2026 13:34:46 +0000 Subject: media: uvcvideo: Introduce allow_privacy_override module parameter Some camera modules have XU controls that can configure the behaviour of the privacy LED. Block mapping of those controls, unless the module is configured with a new parameter: allow_privacy_override. Signed-off-by: Ricardo Ribalda [johannes.goede@oss.qualcomm.com: Remove deprecation warning from param] Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil --- include/linux/usb/uvc.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/usb/uvc.h b/include/linux/usb/uvc.h index 84f35c6f4d6e..99b070ab860f 100644 --- a/include/linux/usb/uvc.h +++ b/include/linux/usb/uvc.h @@ -49,6 +49,10 @@ #define UVC_GUID_LOGITECH_PERIPHERAL \ {0x21, 0x2d, 0xe5, 0xff, 0x30, 0x80, 0x2c, 0x4e, \ 0x82, 0xd9, 0xf5, 0x87, 0xd0, 0x05, 0x40, 0xbd } +#define UVC_GUID_LOGITECH_USER_HW_CONTROL_V1 \ + {0x82, 0x06, 0x61, 0x63, 0x70, 0x50, 0xab, 0x49, \ + 0xb8, 0xcc, 0xb3, 0x85, 0x5e, 0x8d, 0x22, 0x1f } + /* https://learn.microsoft.com/en-us/windows-hardware/drivers/stream/uvc-extensions-1-5#222-extension-unit-controls */ #define UVC_MSXU_CONTROL_FOCUS 0x01 -- cgit v1.2.3 From a54f499838292c1768f6575ed1ec7cf35f1b6489 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christoph=20B=C3=B6hmwalder?= Date: Wed, 6 May 2026 14:45:40 +0200 Subject: drbd: move UAPI headers to include/uapi/linux/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit drbd.h and drbd_limits.h contain only type definitions, enums, and constants shared between kernel and userspace. These should be part of UAPI. Split the genl_api header into two: the genlmsghdr and the enums are UAPI, the rest stays there for now (it will be removed by one of the next commits in this series). drbd_config.h is clearly DRBD-internal, so move it there. Signed-off-by: Christoph Böhmwalder Acked-by: Jakub Kicinski Link: https://patch.msgid.link/20260506124541.1951772-2-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe --- include/linux/drbd.h | 392 ----------------------------------- include/linux/drbd_config.h | 16 -- include/linux/drbd_genl_api.h | 40 ---- include/linux/drbd_limits.h | 251 ----------------------- include/uapi/linux/drbd.h | 432 +++++++++++++++++++++++++++++++++++++++ include/uapi/linux/drbd_limits.h | 251 +++++++++++++++++++++++ 6 files changed, 683 insertions(+), 699 deletions(-) delete mode 100644 include/linux/drbd.h delete mode 100644 include/linux/drbd_config.h delete mode 100644 include/linux/drbd_limits.h create mode 100644 include/uapi/linux/drbd.h create mode 100644 include/uapi/linux/drbd_limits.h (limited to 'include') diff --git a/include/linux/drbd.h b/include/linux/drbd.h deleted file mode 100644 index 5468a2399d48..000000000000 --- a/include/linux/drbd.h +++ /dev/null @@ -1,392 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* - drbd.h - Kernel module for 2.6.x Kernels - - This file is part of DRBD by Philipp Reisner and Lars Ellenberg. - - Copyright (C) 2001-2008, LINBIT Information Technologies GmbH. - Copyright (C) 2001-2008, Philipp Reisner . - Copyright (C) 2001-2008, Lars Ellenberg . - - -*/ -#ifndef DRBD_H -#define DRBD_H -#include - -#ifdef __KERNEL__ -#include -#include -#else -#include -#include -#include - -/* Although the Linux source code makes a difference between - generic endianness and the bitfields' endianness, there is no - architecture as of Linux-2.6.24-rc4 where the bitfields' endianness - does not match the generic endianness. */ - -#if __BYTE_ORDER == __LITTLE_ENDIAN -#define __LITTLE_ENDIAN_BITFIELD -#elif __BYTE_ORDER == __BIG_ENDIAN -#define __BIG_ENDIAN_BITFIELD -#else -# error "sorry, weird endianness on this box" -#endif - -#endif - -enum drbd_io_error_p { - EP_PASS_ON, /* FIXME should the better be named "Ignore"? */ - EP_CALL_HELPER, - EP_DETACH -}; - -enum drbd_fencing_p { - FP_NOT_AVAIL = -1, /* Not a policy */ - FP_DONT_CARE = 0, - FP_RESOURCE, - FP_STONITH -}; - -enum drbd_disconnect_p { - DP_RECONNECT, - DP_DROP_NET_CONF, - DP_FREEZE_IO -}; - -enum drbd_after_sb_p { - ASB_DISCONNECT, - ASB_DISCARD_YOUNGER_PRI, - ASB_DISCARD_OLDER_PRI, - ASB_DISCARD_ZERO_CHG, - ASB_DISCARD_LEAST_CHG, - ASB_DISCARD_LOCAL, - ASB_DISCARD_REMOTE, - ASB_CONSENSUS, - ASB_DISCARD_SECONDARY, - ASB_CALL_HELPER, - ASB_VIOLENTLY -}; - -enum drbd_on_no_data { - OND_IO_ERROR, - OND_SUSPEND_IO -}; - -enum drbd_on_congestion { - OC_BLOCK, - OC_PULL_AHEAD, - OC_DISCONNECT, -}; - -enum drbd_read_balancing { - RB_PREFER_LOCAL, - RB_PREFER_REMOTE, - RB_ROUND_ROBIN, - RB_LEAST_PENDING, - RB_CONGESTED_REMOTE, - RB_32K_STRIPING, - RB_64K_STRIPING, - RB_128K_STRIPING, - RB_256K_STRIPING, - RB_512K_STRIPING, - RB_1M_STRIPING, -}; - -/* KEEP the order, do not delete or insert. Only append. */ -enum drbd_ret_code { - ERR_CODE_BASE = 100, - NO_ERROR = 101, - ERR_LOCAL_ADDR = 102, - ERR_PEER_ADDR = 103, - ERR_OPEN_DISK = 104, - ERR_OPEN_MD_DISK = 105, - ERR_DISK_NOT_BDEV = 107, - ERR_MD_NOT_BDEV = 108, - ERR_DISK_TOO_SMALL = 111, - ERR_MD_DISK_TOO_SMALL = 112, - ERR_BDCLAIM_DISK = 114, - ERR_BDCLAIM_MD_DISK = 115, - ERR_MD_IDX_INVALID = 116, - ERR_IO_MD_DISK = 118, - ERR_MD_INVALID = 119, - ERR_AUTH_ALG = 120, - ERR_AUTH_ALG_ND = 121, - ERR_NOMEM = 122, - ERR_DISCARD_IMPOSSIBLE = 123, - ERR_DISK_CONFIGURED = 124, - ERR_NET_CONFIGURED = 125, - ERR_MANDATORY_TAG = 126, - ERR_MINOR_INVALID = 127, - ERR_INTR = 129, /* EINTR */ - ERR_RESIZE_RESYNC = 130, - ERR_NO_PRIMARY = 131, - ERR_RESYNC_AFTER = 132, - ERR_RESYNC_AFTER_CYCLE = 133, - ERR_PAUSE_IS_SET = 134, - ERR_PAUSE_IS_CLEAR = 135, - ERR_PACKET_NR = 137, - ERR_NO_DISK = 138, - ERR_NOT_PROTO_C = 139, - ERR_NOMEM_BITMAP = 140, - ERR_INTEGRITY_ALG = 141, /* DRBD 8.2 only */ - ERR_INTEGRITY_ALG_ND = 142, /* DRBD 8.2 only */ - ERR_CPU_MASK_PARSE = 143, /* DRBD 8.2 only */ - ERR_CSUMS_ALG = 144, /* DRBD 8.2 only */ - ERR_CSUMS_ALG_ND = 145, /* DRBD 8.2 only */ - ERR_VERIFY_ALG = 146, /* DRBD 8.2 only */ - ERR_VERIFY_ALG_ND = 147, /* DRBD 8.2 only */ - ERR_CSUMS_RESYNC_RUNNING= 148, /* DRBD 8.2 only */ - ERR_VERIFY_RUNNING = 149, /* DRBD 8.2 only */ - ERR_DATA_NOT_CURRENT = 150, - ERR_CONNECTED = 151, /* DRBD 8.3 only */ - ERR_PERM = 152, - ERR_NEED_APV_93 = 153, - ERR_STONITH_AND_PROT_A = 154, - ERR_CONG_NOT_PROTO_A = 155, - ERR_PIC_AFTER_DEP = 156, - ERR_PIC_PEER_DEP = 157, - ERR_RES_NOT_KNOWN = 158, - ERR_RES_IN_USE = 159, - ERR_MINOR_CONFIGURED = 160, - ERR_MINOR_OR_VOLUME_EXISTS = 161, - ERR_INVALID_REQUEST = 162, - ERR_NEED_APV_100 = 163, - ERR_NEED_ALLOW_TWO_PRI = 164, - ERR_MD_UNCLEAN = 165, - ERR_MD_LAYOUT_CONNECTED = 166, - ERR_MD_LAYOUT_TOO_BIG = 167, - ERR_MD_LAYOUT_TOO_SMALL = 168, - ERR_MD_LAYOUT_NO_FIT = 169, - ERR_IMPLICIT_SHRINK = 170, - /* insert new ones above this line */ - AFTER_LAST_ERR_CODE -}; - -#define DRBD_PROT_A 1 -#define DRBD_PROT_B 2 -#define DRBD_PROT_C 3 - -enum drbd_role { - R_UNKNOWN = 0, - R_PRIMARY = 1, /* role */ - R_SECONDARY = 2, /* role */ - R_MASK = 3, -}; - -/* The order of these constants is important. - * The lower ones (=C_WF_REPORT_PARAMS ==> There is a socket - */ -enum drbd_conns { - C_STANDALONE, - C_DISCONNECTING, /* Temporal state on the way to StandAlone. */ - C_UNCONNECTED, /* >= C_UNCONNECTED -> inc_net() succeeds */ - - /* These temporal states are all used on the way - * from >= C_CONNECTED to Unconnected. - * The 'disconnect reason' states - * I do not allow to change between them. */ - C_TIMEOUT, - C_BROKEN_PIPE, - C_NETWORK_FAILURE, - C_PROTOCOL_ERROR, - C_TEAR_DOWN, - - C_WF_CONNECTION, - C_WF_REPORT_PARAMS, /* we have a socket */ - C_CONNECTED, /* we have introduced each other */ - C_STARTING_SYNC_S, /* starting full sync by admin request. */ - C_STARTING_SYNC_T, /* starting full sync by admin request. */ - C_WF_BITMAP_S, - C_WF_BITMAP_T, - C_WF_SYNC_UUID, - - /* All SyncStates are tested with this comparison - * xx >= C_SYNC_SOURCE && xx <= C_PAUSED_SYNC_T */ - C_SYNC_SOURCE, - C_SYNC_TARGET, - C_VERIFY_S, - C_VERIFY_T, - C_PAUSED_SYNC_S, - C_PAUSED_SYNC_T, - - C_AHEAD, - C_BEHIND, - - C_MASK = 31 -}; - -enum drbd_disk_state { - D_DISKLESS, - D_ATTACHING, /* In the process of reading the meta-data */ - D_FAILED, /* Becomes D_DISKLESS as soon as we told it the peer */ - /* when >= D_FAILED it is legal to access mdev->ldev */ - D_NEGOTIATING, /* Late attaching state, we need to talk to the peer */ - D_INCONSISTENT, - D_OUTDATED, - D_UNKNOWN, /* Only used for the peer, never for myself */ - D_CONSISTENT, /* Might be D_OUTDATED, might be D_UP_TO_DATE ... */ - D_UP_TO_DATE, /* Only this disk state allows applications' IO ! */ - D_MASK = 15 -}; - -union drbd_state { -/* According to gcc's docs is the ... - * The order of allocation of bit-fields within a unit (C90 6.5.2.1, C99 6.7.2.1). - * Determined by ABI. - * pointed out by Maxim Uvarov q - * even though we transmit as "cpu_to_be32(state)", - * the offsets of the bitfields still need to be swapped - * on different endianness. - */ - struct { -#if defined(__LITTLE_ENDIAN_BITFIELD) - unsigned role:2 ; /* 3/4 primary/secondary/unknown */ - unsigned peer:2 ; /* 3/4 primary/secondary/unknown */ - unsigned conn:5 ; /* 17/32 cstates */ - unsigned disk:4 ; /* 8/16 from D_DISKLESS to D_UP_TO_DATE */ - unsigned pdsk:4 ; /* 8/16 from D_DISKLESS to D_UP_TO_DATE */ - unsigned susp:1 ; /* 2/2 IO suspended no/yes (by user) */ - unsigned aftr_isp:1 ; /* isp .. imposed sync pause */ - unsigned peer_isp:1 ; - unsigned user_isp:1 ; - unsigned susp_nod:1 ; /* IO suspended because no data */ - unsigned susp_fen:1 ; /* IO suspended because fence peer handler runs*/ - unsigned _pad:9; /* 0 unused */ -#elif defined(__BIG_ENDIAN_BITFIELD) - unsigned _pad:9; - unsigned susp_fen:1 ; - unsigned susp_nod:1 ; - unsigned user_isp:1 ; - unsigned peer_isp:1 ; - unsigned aftr_isp:1 ; /* isp .. imposed sync pause */ - unsigned susp:1 ; /* 2/2 IO suspended no/yes */ - unsigned pdsk:4 ; /* 8/16 from D_DISKLESS to D_UP_TO_DATE */ - unsigned disk:4 ; /* 8/16 from D_DISKLESS to D_UP_TO_DATE */ - unsigned conn:5 ; /* 17/32 cstates */ - unsigned peer:2 ; /* 3/4 primary/secondary/unknown */ - unsigned role:2 ; /* 3/4 primary/secondary/unknown */ -#else -# error "this endianness is not supported" -#endif - }; - unsigned int i; -}; - -enum drbd_state_rv { - SS_CW_NO_NEED = 4, - SS_CW_SUCCESS = 3, - SS_NOTHING_TO_DO = 2, - SS_SUCCESS = 1, - SS_UNKNOWN_ERROR = 0, /* Used to sleep longer in _drbd_request_state */ - SS_TWO_PRIMARIES = -1, - SS_NO_UP_TO_DATE_DISK = -2, - SS_NO_LOCAL_DISK = -4, - SS_NO_REMOTE_DISK = -5, - SS_CONNECTED_OUTDATES = -6, - SS_PRIMARY_NOP = -7, - SS_RESYNC_RUNNING = -8, - SS_ALREADY_STANDALONE = -9, - SS_CW_FAILED_BY_PEER = -10, - SS_IS_DISKLESS = -11, - SS_DEVICE_IN_USE = -12, - SS_NO_NET_CONFIG = -13, - SS_NO_VERIFY_ALG = -14, /* drbd-8.2 only */ - SS_NEED_CONNECTION = -15, /* drbd-8.2 only */ - SS_LOWER_THAN_OUTDATED = -16, - SS_NOT_SUPPORTED = -17, /* drbd-8.2 only */ - SS_IN_TRANSIENT_STATE = -18, /* Retry after the next state change */ - SS_CONCURRENT_ST_CHG = -19, /* Concurrent cluster side state change! */ - SS_O_VOL_PEER_PRI = -20, - SS_OUTDATE_WO_CONN = -21, - SS_AFTER_LAST_ERROR = -22, /* Keep this at bottom */ -}; - -#define SHARED_SECRET_MAX 64 - -#define MDF_CONSISTENT (1 << 0) -#define MDF_PRIMARY_IND (1 << 1) -#define MDF_CONNECTED_IND (1 << 2) -#define MDF_FULL_SYNC (1 << 3) -#define MDF_WAS_UP_TO_DATE (1 << 4) -#define MDF_PEER_OUT_DATED (1 << 5) -#define MDF_CRASHED_PRIMARY (1 << 6) -#define MDF_AL_CLEAN (1 << 7) -#define MDF_AL_DISABLED (1 << 8) - -#define MAX_PEERS 32 - -enum drbd_uuid_index { - UI_CURRENT, - UI_BITMAP, - UI_HISTORY_START, - UI_HISTORY_END, - UI_SIZE, /* nl-packet: number of dirty bits */ - UI_FLAGS, /* nl-packet: flags */ - UI_EXTENDED_SIZE /* Everything. */ -}; - -#define HISTORY_UUIDS MAX_PEERS - -enum drbd_timeout_flag { - UT_DEFAULT = 0, - UT_DEGRADED = 1, - UT_PEER_OUTDATED = 2, -}; - -enum drbd_notification_type { - NOTIFY_EXISTS, - NOTIFY_CREATE, - NOTIFY_CHANGE, - NOTIFY_DESTROY, - NOTIFY_CALL, - NOTIFY_RESPONSE, - - NOTIFY_CONTINUES = 0x8000, - NOTIFY_FLAGS = NOTIFY_CONTINUES, -}; - -enum drbd_peer_state { - P_INCONSISTENT = 3, - P_OUTDATED = 4, - P_DOWN = 5, - P_PRIMARY = 6, - P_FENCING = 7, -}; - -#define UUID_JUST_CREATED ((__u64)4) - -enum write_ordering_e { - WO_NONE, - WO_DRAIN_IO, - WO_BDEV_FLUSH, - WO_BIO_BARRIER -}; - -/* magic numbers used in meta data and network packets */ -#define DRBD_MAGIC 0x83740267 -#define DRBD_MAGIC_BIG 0x835a -#define DRBD_MAGIC_100 0x8620ec20 - -#define DRBD_MD_MAGIC_07 (DRBD_MAGIC+3) -#define DRBD_MD_MAGIC_08 (DRBD_MAGIC+4) -#define DRBD_MD_MAGIC_84_UNCLEAN (DRBD_MAGIC+5) - - -/* how I came up with this magic? - * base64 decode "actlog==" ;) */ -#define DRBD_AL_MAGIC 0x69cb65a2 - -/* these are of type "int" */ -#define DRBD_MD_INDEX_INTERNAL -1 -#define DRBD_MD_INDEX_FLEX_EXT -2 -#define DRBD_MD_INDEX_FLEX_INT -3 - -#define DRBD_CPU_MASK_SIZE 32 - -#endif diff --git a/include/linux/drbd_config.h b/include/linux/drbd_config.h deleted file mode 100644 index d215365c6bb1..000000000000 --- a/include/linux/drbd_config.h +++ /dev/null @@ -1,16 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * drbd_config.h - * DRBD's compile time configuration. - */ - -#ifndef DRBD_CONFIG_H -#define DRBD_CONFIG_H - -extern const char *drbd_buildtag(void); - -#define REL_VERSION "8.4.11" -#define PRO_VERSION_MIN 86 -#define PRO_VERSION_MAX 101 - -#endif diff --git a/include/linux/drbd_genl_api.h b/include/linux/drbd_genl_api.h index 70682c058027..19d263924852 100644 --- a/include/linux/drbd_genl_api.h +++ b/include/linux/drbd_genl_api.h @@ -2,46 +2,6 @@ #ifndef DRBD_GENL_STRUCT_H #define DRBD_GENL_STRUCT_H -/** - * struct drbd_genlmsghdr - DRBD specific header used in NETLINK_GENERIC requests - * @minor: - * For admin requests (user -> kernel): which minor device to operate on. - * For (unicast) replies or informational (broadcast) messages - * (kernel -> user): which minor device the information is about. - * If we do not operate on minors, but on connections or resources, - * the minor value shall be (~0), and the attribute DRBD_NLA_CFG_CONTEXT - * is used instead. - * @flags: possible operation modifiers (relevant only for user->kernel): - * DRBD_GENL_F_SET_DEFAULTS - * @volume: - * When creating a new minor (adding it to a resource), the resource needs - * to know which volume number within the resource this is supposed to be. - * The volume number corresponds to the same volume number on the remote side, - * whereas the minor number on the remote side may be different - * (union with flags). - * @ret_code: kernel->userland unicast cfg reply return code (union with flags); - */ -struct drbd_genlmsghdr { - __u32 minor; - union { - __u32 flags; - __s32 ret_code; - }; -}; - -/* To be used in drbd_genlmsghdr.flags */ -enum { - DRBD_GENL_F_SET_DEFAULTS = 1, -}; - -enum drbd_state_info_bcast_reason { - SIB_GET_STATUS_REPLY = 1, - SIB_STATE_CHANGE = 2, - SIB_HELPER_PRE = 3, - SIB_HELPER_POST = 4, - SIB_SYNC_PROGRESS = 5, -}; - /* hack around predefined gcc/cpp "linux=1", * we cannot possibly include <1/drbd_genl.h> */ #undef linux diff --git a/include/linux/drbd_limits.h b/include/linux/drbd_limits.h deleted file mode 100644 index 5b042fb427e9..000000000000 --- a/include/linux/drbd_limits.h +++ /dev/null @@ -1,251 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - drbd_limits.h - This file is part of DRBD by Philipp Reisner and Lars Ellenberg. -*/ - -/* - * Our current limitations. - * Some of them are hard limits, - * some of them are arbitrary range limits, that make it easier to provide - * feedback about nonsense settings for certain configurable values. - */ - -#ifndef DRBD_LIMITS_H -#define DRBD_LIMITS_H 1 - -#define DEBUG_RANGE_CHECK 0 - -#define DRBD_MINOR_COUNT_MIN 1U -#define DRBD_MINOR_COUNT_MAX 255U -#define DRBD_MINOR_COUNT_DEF 32U -#define DRBD_MINOR_COUNT_SCALE '1' - -#define DRBD_VOLUME_MAX 65534U - -#define DRBD_DIALOG_REFRESH_MIN 0U -#define DRBD_DIALOG_REFRESH_MAX 600U -#define DRBD_DIALOG_REFRESH_SCALE '1' - -/* valid port number */ -#define DRBD_PORT_MIN 1U -#define DRBD_PORT_MAX 0xffffU -#define DRBD_PORT_SCALE '1' - -/* startup { */ - /* if you want more than 3.4 days, disable */ -#define DRBD_WFC_TIMEOUT_MIN 0U -#define DRBD_WFC_TIMEOUT_MAX 300000U -#define DRBD_WFC_TIMEOUT_DEF 0U -#define DRBD_WFC_TIMEOUT_SCALE '1' - -#define DRBD_DEGR_WFC_TIMEOUT_MIN 0U -#define DRBD_DEGR_WFC_TIMEOUT_MAX 300000U -#define DRBD_DEGR_WFC_TIMEOUT_DEF 0U -#define DRBD_DEGR_WFC_TIMEOUT_SCALE '1' - -#define DRBD_OUTDATED_WFC_TIMEOUT_MIN 0U -#define DRBD_OUTDATED_WFC_TIMEOUT_MAX 300000U -#define DRBD_OUTDATED_WFC_TIMEOUT_DEF 0U -#define DRBD_OUTDATED_WFC_TIMEOUT_SCALE '1' -/* }*/ - -/* net { */ - /* timeout, unit centi seconds - * more than one minute timeout is not useful */ -#define DRBD_TIMEOUT_MIN 1U -#define DRBD_TIMEOUT_MAX 600U -#define DRBD_TIMEOUT_DEF 60U /* 6 seconds */ -#define DRBD_TIMEOUT_SCALE '1' - - /* If backing disk takes longer than disk_timeout, mark the disk as failed */ -#define DRBD_DISK_TIMEOUT_MIN 0U /* 0 = disabled */ -#define DRBD_DISK_TIMEOUT_MAX 6000U /* 10 Minutes */ -#define DRBD_DISK_TIMEOUT_DEF 0U /* disabled */ -#define DRBD_DISK_TIMEOUT_SCALE '1' - - /* active connection retries when C_WF_CONNECTION */ -#define DRBD_CONNECT_INT_MIN 1U -#define DRBD_CONNECT_INT_MAX 120U -#define DRBD_CONNECT_INT_DEF 10U /* seconds */ -#define DRBD_CONNECT_INT_SCALE '1' - - /* keep-alive probes when idle */ -#define DRBD_PING_INT_MIN 1U -#define DRBD_PING_INT_MAX 120U -#define DRBD_PING_INT_DEF 10U -#define DRBD_PING_INT_SCALE '1' - - /* timeout for the ping packets.*/ -#define DRBD_PING_TIMEO_MIN 1U -#define DRBD_PING_TIMEO_MAX 300U -#define DRBD_PING_TIMEO_DEF 5U -#define DRBD_PING_TIMEO_SCALE '1' - - /* max number of write requests between write barriers */ -#define DRBD_MAX_EPOCH_SIZE_MIN 1U -#define DRBD_MAX_EPOCH_SIZE_MAX 20000U -#define DRBD_MAX_EPOCH_SIZE_DEF 2048U -#define DRBD_MAX_EPOCH_SIZE_SCALE '1' - - /* I don't think that a tcp send buffer of more than 10M is useful */ -#define DRBD_SNDBUF_SIZE_MIN 0U -#define DRBD_SNDBUF_SIZE_MAX (10U<<20) -#define DRBD_SNDBUF_SIZE_DEF 0U -#define DRBD_SNDBUF_SIZE_SCALE '1' - -#define DRBD_RCVBUF_SIZE_MIN 0U -#define DRBD_RCVBUF_SIZE_MAX (10U<<20) -#define DRBD_RCVBUF_SIZE_DEF 0U -#define DRBD_RCVBUF_SIZE_SCALE '1' - - /* @4k PageSize -> 128kB - 512MB */ -#define DRBD_MAX_BUFFERS_MIN 32U -#define DRBD_MAX_BUFFERS_MAX 131072U -#define DRBD_MAX_BUFFERS_DEF 2048U -#define DRBD_MAX_BUFFERS_SCALE '1' - - /* @4k PageSize -> 4kB - 512MB */ -#define DRBD_UNPLUG_WATERMARK_MIN 1U -#define DRBD_UNPLUG_WATERMARK_MAX 131072U -#define DRBD_UNPLUG_WATERMARK_DEF (DRBD_MAX_BUFFERS_DEF/16) -#define DRBD_UNPLUG_WATERMARK_SCALE '1' - - /* 0 is disabled. - * 200 should be more than enough even for very short timeouts */ -#define DRBD_KO_COUNT_MIN 0U -#define DRBD_KO_COUNT_MAX 200U -#define DRBD_KO_COUNT_DEF 7U -#define DRBD_KO_COUNT_SCALE '1' -/* } */ - -/* syncer { */ - /* FIXME allow rate to be zero? */ -#define DRBD_RESYNC_RATE_MIN 1U -/* channel bonding 10 GbE, or other hardware */ -#define DRBD_RESYNC_RATE_MAX (4 << 20) -#define DRBD_RESYNC_RATE_DEF 250U -#define DRBD_RESYNC_RATE_SCALE 'k' /* kilobytes */ - -#define DRBD_AL_EXTENTS_MIN 67U - /* we use u16 as "slot number", (u16)~0 is "FREE". - * If you use >= 292 kB on-disk ring buffer, - * this is the maximum you can use: */ -#define DRBD_AL_EXTENTS_MAX 0xfffeU -#define DRBD_AL_EXTENTS_DEF 1237U -#define DRBD_AL_EXTENTS_SCALE '1' - -#define DRBD_MINOR_NUMBER_MIN -1 -#define DRBD_MINOR_NUMBER_MAX ((1 << 20) - 1) -#define DRBD_MINOR_NUMBER_DEF -1 -#define DRBD_MINOR_NUMBER_SCALE '1' - -/* } */ - -/* drbdsetup XY resize -d Z - * you are free to reduce the device size to nothing, if you want to. - * the upper limit with 64bit kernel, enough ram and flexible meta data - * is 1 PiB, currently. */ -/* DRBD_MAX_SECTORS */ -#define DRBD_DISK_SIZE_MIN 0LLU -#define DRBD_DISK_SIZE_MAX (1LLU * (2LLU << 40)) -#define DRBD_DISK_SIZE_DEF 0LLU /* = disabled = no user size... */ -#define DRBD_DISK_SIZE_SCALE 's' /* sectors */ - -#define DRBD_ON_IO_ERROR_DEF EP_DETACH -#define DRBD_FENCING_DEF FP_DONT_CARE -#define DRBD_AFTER_SB_0P_DEF ASB_DISCONNECT -#define DRBD_AFTER_SB_1P_DEF ASB_DISCONNECT -#define DRBD_AFTER_SB_2P_DEF ASB_DISCONNECT -#define DRBD_RR_CONFLICT_DEF ASB_DISCONNECT -#define DRBD_ON_NO_DATA_DEF OND_IO_ERROR -#define DRBD_ON_CONGESTION_DEF OC_BLOCK -#define DRBD_READ_BALANCING_DEF RB_PREFER_LOCAL - -#define DRBD_MAX_BIO_BVECS_MIN 0U -#define DRBD_MAX_BIO_BVECS_MAX 128U -#define DRBD_MAX_BIO_BVECS_DEF 0U -#define DRBD_MAX_BIO_BVECS_SCALE '1' - -#define DRBD_C_PLAN_AHEAD_MIN 0U -#define DRBD_C_PLAN_AHEAD_MAX 300U -#define DRBD_C_PLAN_AHEAD_DEF 20U -#define DRBD_C_PLAN_AHEAD_SCALE '1' - -#define DRBD_C_DELAY_TARGET_MIN 1U -#define DRBD_C_DELAY_TARGET_MAX 100U -#define DRBD_C_DELAY_TARGET_DEF 10U -#define DRBD_C_DELAY_TARGET_SCALE '1' - -#define DRBD_C_FILL_TARGET_MIN 0U -#define DRBD_C_FILL_TARGET_MAX (1U<<20) /* 500MByte in sec */ -#define DRBD_C_FILL_TARGET_DEF 100U /* Try to place 50KiB in socket send buffer during resync */ -#define DRBD_C_FILL_TARGET_SCALE 's' /* sectors */ - -#define DRBD_C_MAX_RATE_MIN 250U -#define DRBD_C_MAX_RATE_MAX (4U << 20) -#define DRBD_C_MAX_RATE_DEF 102400U -#define DRBD_C_MAX_RATE_SCALE 'k' /* kilobytes */ - -#define DRBD_C_MIN_RATE_MIN 0U -#define DRBD_C_MIN_RATE_MAX (4U << 20) -#define DRBD_C_MIN_RATE_DEF 250U -#define DRBD_C_MIN_RATE_SCALE 'k' /* kilobytes */ - -#define DRBD_CONG_FILL_MIN 0U -#define DRBD_CONG_FILL_MAX (10U<<21) /* 10GByte in sectors */ -#define DRBD_CONG_FILL_DEF 0U -#define DRBD_CONG_FILL_SCALE 's' /* sectors */ - -#define DRBD_CONG_EXTENTS_MIN DRBD_AL_EXTENTS_MIN -#define DRBD_CONG_EXTENTS_MAX DRBD_AL_EXTENTS_MAX -#define DRBD_CONG_EXTENTS_DEF DRBD_AL_EXTENTS_DEF -#define DRBD_CONG_EXTENTS_SCALE DRBD_AL_EXTENTS_SCALE - -#define DRBD_PROTOCOL_DEF DRBD_PROT_C - -#define DRBD_DISK_BARRIER_DEF 0U -#define DRBD_DISK_FLUSHES_DEF 1U -#define DRBD_DISK_DRAIN_DEF 1U -#define DRBD_MD_FLUSHES_DEF 1U -#define DRBD_TCP_CORK_DEF 1U -#define DRBD_AL_UPDATES_DEF 1U - -/* We used to ignore the discard_zeroes_data setting. - * To not change established (and expected) behaviour, - * by default assume that, for discard_zeroes_data=0, - * we can make that an effective discard_zeroes_data=1, - * if we only explicitly zero-out unaligned partial chunks. */ -#define DRBD_DISCARD_ZEROES_IF_ALIGNED_DEF 1U - -/* Some backends pretend to support WRITE SAME, - * but fail such requests when they are actually submitted. - * This is to tell DRBD to not even try. */ -#define DRBD_DISABLE_WRITE_SAME_DEF 0U - -#define DRBD_ALLOW_TWO_PRIMARIES_DEF 0U -#define DRBD_ALWAYS_ASBP_DEF 0U -#define DRBD_USE_RLE_DEF 1U -#define DRBD_CSUMS_AFTER_CRASH_ONLY_DEF 0U - -#define DRBD_AL_STRIPES_MIN 1U -#define DRBD_AL_STRIPES_MAX 1024U -#define DRBD_AL_STRIPES_DEF 1U -#define DRBD_AL_STRIPES_SCALE '1' - -#define DRBD_AL_STRIPE_SIZE_MIN 4U -#define DRBD_AL_STRIPE_SIZE_MAX 16777216U -#define DRBD_AL_STRIPE_SIZE_DEF 32U -#define DRBD_AL_STRIPE_SIZE_SCALE 'k' /* kilobytes */ - -#define DRBD_SOCKET_CHECK_TIMEO_MIN 0U -#define DRBD_SOCKET_CHECK_TIMEO_MAX DRBD_PING_TIMEO_MAX -#define DRBD_SOCKET_CHECK_TIMEO_DEF 0U -#define DRBD_SOCKET_CHECK_TIMEO_SCALE '1' - -#define DRBD_RS_DISCARD_GRANULARITY_MIN 0U -#define DRBD_RS_DISCARD_GRANULARITY_MAX (1U<<20) /* 1MiByte */ -#define DRBD_RS_DISCARD_GRANULARITY_DEF 0U /* disabled by default */ -#define DRBD_RS_DISCARD_GRANULARITY_SCALE '1' /* bytes */ - -#endif diff --git a/include/uapi/linux/drbd.h b/include/uapi/linux/drbd.h new file mode 100644 index 000000000000..7930a972d8a4 --- /dev/null +++ b/include/uapi/linux/drbd.h @@ -0,0 +1,432 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later WITH Linux-syscall-note */ +/* + drbd.h + Kernel module for 2.6.x Kernels + + This file is part of DRBD by Philipp Reisner and Lars Ellenberg. + + Copyright (C) 2001-2008, LINBIT Information Technologies GmbH. + Copyright (C) 2001-2008, Philipp Reisner . + Copyright (C) 2001-2008, Lars Ellenberg . + + +*/ +#ifndef DRBD_H +#define DRBD_H +#include + +#ifdef __KERNEL__ +#include +#include +#else +#include +#include +#include + +/* Although the Linux source code makes a difference between + generic endianness and the bitfields' endianness, there is no + architecture as of Linux-2.6.24-rc4 where the bitfields' endianness + does not match the generic endianness. */ + +#if __BYTE_ORDER == __LITTLE_ENDIAN +#define __LITTLE_ENDIAN_BITFIELD +#elif __BYTE_ORDER == __BIG_ENDIAN +#define __BIG_ENDIAN_BITFIELD +#else +# error "sorry, weird endianness on this box" +#endif + +#endif + +enum drbd_io_error_p { + EP_PASS_ON, /* FIXME should the better be named "Ignore"? */ + EP_CALL_HELPER, + EP_DETACH +}; + +enum drbd_fencing_p { + FP_NOT_AVAIL = -1, /* Not a policy */ + FP_DONT_CARE = 0, + FP_RESOURCE, + FP_STONITH +}; + +enum drbd_disconnect_p { + DP_RECONNECT, + DP_DROP_NET_CONF, + DP_FREEZE_IO +}; + +enum drbd_after_sb_p { + ASB_DISCONNECT, + ASB_DISCARD_YOUNGER_PRI, + ASB_DISCARD_OLDER_PRI, + ASB_DISCARD_ZERO_CHG, + ASB_DISCARD_LEAST_CHG, + ASB_DISCARD_LOCAL, + ASB_DISCARD_REMOTE, + ASB_CONSENSUS, + ASB_DISCARD_SECONDARY, + ASB_CALL_HELPER, + ASB_VIOLENTLY +}; + +enum drbd_on_no_data { + OND_IO_ERROR, + OND_SUSPEND_IO +}; + +enum drbd_on_congestion { + OC_BLOCK, + OC_PULL_AHEAD, + OC_DISCONNECT, +}; + +enum drbd_read_balancing { + RB_PREFER_LOCAL, + RB_PREFER_REMOTE, + RB_ROUND_ROBIN, + RB_LEAST_PENDING, + RB_CONGESTED_REMOTE, + RB_32K_STRIPING, + RB_64K_STRIPING, + RB_128K_STRIPING, + RB_256K_STRIPING, + RB_512K_STRIPING, + RB_1M_STRIPING, +}; + +/* KEEP the order, do not delete or insert. Only append. */ +enum drbd_ret_code { + ERR_CODE_BASE = 100, + NO_ERROR = 101, + ERR_LOCAL_ADDR = 102, + ERR_PEER_ADDR = 103, + ERR_OPEN_DISK = 104, + ERR_OPEN_MD_DISK = 105, + ERR_DISK_NOT_BDEV = 107, + ERR_MD_NOT_BDEV = 108, + ERR_DISK_TOO_SMALL = 111, + ERR_MD_DISK_TOO_SMALL = 112, + ERR_BDCLAIM_DISK = 114, + ERR_BDCLAIM_MD_DISK = 115, + ERR_MD_IDX_INVALID = 116, + ERR_IO_MD_DISK = 118, + ERR_MD_INVALID = 119, + ERR_AUTH_ALG = 120, + ERR_AUTH_ALG_ND = 121, + ERR_NOMEM = 122, + ERR_DISCARD_IMPOSSIBLE = 123, + ERR_DISK_CONFIGURED = 124, + ERR_NET_CONFIGURED = 125, + ERR_MANDATORY_TAG = 126, + ERR_MINOR_INVALID = 127, + ERR_INTR = 129, /* EINTR */ + ERR_RESIZE_RESYNC = 130, + ERR_NO_PRIMARY = 131, + ERR_RESYNC_AFTER = 132, + ERR_RESYNC_AFTER_CYCLE = 133, + ERR_PAUSE_IS_SET = 134, + ERR_PAUSE_IS_CLEAR = 135, + ERR_PACKET_NR = 137, + ERR_NO_DISK = 138, + ERR_NOT_PROTO_C = 139, + ERR_NOMEM_BITMAP = 140, + ERR_INTEGRITY_ALG = 141, /* DRBD 8.2 only */ + ERR_INTEGRITY_ALG_ND = 142, /* DRBD 8.2 only */ + ERR_CPU_MASK_PARSE = 143, /* DRBD 8.2 only */ + ERR_CSUMS_ALG = 144, /* DRBD 8.2 only */ + ERR_CSUMS_ALG_ND = 145, /* DRBD 8.2 only */ + ERR_VERIFY_ALG = 146, /* DRBD 8.2 only */ + ERR_VERIFY_ALG_ND = 147, /* DRBD 8.2 only */ + ERR_CSUMS_RESYNC_RUNNING= 148, /* DRBD 8.2 only */ + ERR_VERIFY_RUNNING = 149, /* DRBD 8.2 only */ + ERR_DATA_NOT_CURRENT = 150, + ERR_CONNECTED = 151, /* DRBD 8.3 only */ + ERR_PERM = 152, + ERR_NEED_APV_93 = 153, + ERR_STONITH_AND_PROT_A = 154, + ERR_CONG_NOT_PROTO_A = 155, + ERR_PIC_AFTER_DEP = 156, + ERR_PIC_PEER_DEP = 157, + ERR_RES_NOT_KNOWN = 158, + ERR_RES_IN_USE = 159, + ERR_MINOR_CONFIGURED = 160, + ERR_MINOR_OR_VOLUME_EXISTS = 161, + ERR_INVALID_REQUEST = 162, + ERR_NEED_APV_100 = 163, + ERR_NEED_ALLOW_TWO_PRI = 164, + ERR_MD_UNCLEAN = 165, + ERR_MD_LAYOUT_CONNECTED = 166, + ERR_MD_LAYOUT_TOO_BIG = 167, + ERR_MD_LAYOUT_TOO_SMALL = 168, + ERR_MD_LAYOUT_NO_FIT = 169, + ERR_IMPLICIT_SHRINK = 170, + /* insert new ones above this line */ + AFTER_LAST_ERR_CODE +}; + +#define DRBD_PROT_A 1 +#define DRBD_PROT_B 2 +#define DRBD_PROT_C 3 + +enum drbd_role { + R_UNKNOWN = 0, + R_PRIMARY = 1, /* role */ + R_SECONDARY = 2, /* role */ + R_MASK = 3, +}; + +/* The order of these constants is important. + * The lower ones (=C_WF_REPORT_PARAMS ==> There is a socket + */ +enum drbd_conns { + C_STANDALONE, + C_DISCONNECTING, /* Temporal state on the way to StandAlone. */ + C_UNCONNECTED, /* >= C_UNCONNECTED -> inc_net() succeeds */ + + /* These temporal states are all used on the way + * from >= C_CONNECTED to Unconnected. + * The 'disconnect reason' states + * I do not allow to change between them. */ + C_TIMEOUT, + C_BROKEN_PIPE, + C_NETWORK_FAILURE, + C_PROTOCOL_ERROR, + C_TEAR_DOWN, + + C_WF_CONNECTION, + C_WF_REPORT_PARAMS, /* we have a socket */ + C_CONNECTED, /* we have introduced each other */ + C_STARTING_SYNC_S, /* starting full sync by admin request. */ + C_STARTING_SYNC_T, /* starting full sync by admin request. */ + C_WF_BITMAP_S, + C_WF_BITMAP_T, + C_WF_SYNC_UUID, + + /* All SyncStates are tested with this comparison + * xx >= C_SYNC_SOURCE && xx <= C_PAUSED_SYNC_T */ + C_SYNC_SOURCE, + C_SYNC_TARGET, + C_VERIFY_S, + C_VERIFY_T, + C_PAUSED_SYNC_S, + C_PAUSED_SYNC_T, + + C_AHEAD, + C_BEHIND, + + C_MASK = 31 +}; + +enum drbd_disk_state { + D_DISKLESS, + D_ATTACHING, /* In the process of reading the meta-data */ + D_FAILED, /* Becomes D_DISKLESS as soon as we told it the peer */ + /* when >= D_FAILED it is legal to access mdev->ldev */ + D_NEGOTIATING, /* Late attaching state, we need to talk to the peer */ + D_INCONSISTENT, + D_OUTDATED, + D_UNKNOWN, /* Only used for the peer, never for myself */ + D_CONSISTENT, /* Might be D_OUTDATED, might be D_UP_TO_DATE ... */ + D_UP_TO_DATE, /* Only this disk state allows applications' IO ! */ + D_MASK = 15 +}; + +union drbd_state { +/* According to gcc's docs is the ... + * The order of allocation of bit-fields within a unit (C90 6.5.2.1, C99 6.7.2.1). + * Determined by ABI. + * pointed out by Maxim Uvarov q + * even though we transmit as "cpu_to_be32(state)", + * the offsets of the bitfields still need to be swapped + * on different endianness. + */ + struct { +#if defined(__LITTLE_ENDIAN_BITFIELD) + unsigned role:2 ; /* 3/4 primary/secondary/unknown */ + unsigned peer:2 ; /* 3/4 primary/secondary/unknown */ + unsigned conn:5 ; /* 17/32 cstates */ + unsigned disk:4 ; /* 8/16 from D_DISKLESS to D_UP_TO_DATE */ + unsigned pdsk:4 ; /* 8/16 from D_DISKLESS to D_UP_TO_DATE */ + unsigned susp:1 ; /* 2/2 IO suspended no/yes (by user) */ + unsigned aftr_isp:1 ; /* isp .. imposed sync pause */ + unsigned peer_isp:1 ; + unsigned user_isp:1 ; + unsigned susp_nod:1 ; /* IO suspended because no data */ + unsigned susp_fen:1 ; /* IO suspended because fence peer handler runs*/ + unsigned _pad:9; /* 0 unused */ +#elif defined(__BIG_ENDIAN_BITFIELD) + unsigned _pad:9; + unsigned susp_fen:1 ; + unsigned susp_nod:1 ; + unsigned user_isp:1 ; + unsigned peer_isp:1 ; + unsigned aftr_isp:1 ; /* isp .. imposed sync pause */ + unsigned susp:1 ; /* 2/2 IO suspended no/yes */ + unsigned pdsk:4 ; /* 8/16 from D_DISKLESS to D_UP_TO_DATE */ + unsigned disk:4 ; /* 8/16 from D_DISKLESS to D_UP_TO_DATE */ + unsigned conn:5 ; /* 17/32 cstates */ + unsigned peer:2 ; /* 3/4 primary/secondary/unknown */ + unsigned role:2 ; /* 3/4 primary/secondary/unknown */ +#else +# error "this endianness is not supported" +#endif + }; + unsigned int i; +}; + +enum drbd_state_rv { + SS_CW_NO_NEED = 4, + SS_CW_SUCCESS = 3, + SS_NOTHING_TO_DO = 2, + SS_SUCCESS = 1, + SS_UNKNOWN_ERROR = 0, /* Used to sleep longer in _drbd_request_state */ + SS_TWO_PRIMARIES = -1, + SS_NO_UP_TO_DATE_DISK = -2, + SS_NO_LOCAL_DISK = -4, + SS_NO_REMOTE_DISK = -5, + SS_CONNECTED_OUTDATES = -6, + SS_PRIMARY_NOP = -7, + SS_RESYNC_RUNNING = -8, + SS_ALREADY_STANDALONE = -9, + SS_CW_FAILED_BY_PEER = -10, + SS_IS_DISKLESS = -11, + SS_DEVICE_IN_USE = -12, + SS_NO_NET_CONFIG = -13, + SS_NO_VERIFY_ALG = -14, /* drbd-8.2 only */ + SS_NEED_CONNECTION = -15, /* drbd-8.2 only */ + SS_LOWER_THAN_OUTDATED = -16, + SS_NOT_SUPPORTED = -17, /* drbd-8.2 only */ + SS_IN_TRANSIENT_STATE = -18, /* Retry after the next state change */ + SS_CONCURRENT_ST_CHG = -19, /* Concurrent cluster side state change! */ + SS_O_VOL_PEER_PRI = -20, + SS_OUTDATE_WO_CONN = -21, + SS_AFTER_LAST_ERROR = -22, /* Keep this at bottom */ +}; + +#define SHARED_SECRET_MAX 64 + +#define MDF_CONSISTENT (1 << 0) +#define MDF_PRIMARY_IND (1 << 1) +#define MDF_CONNECTED_IND (1 << 2) +#define MDF_FULL_SYNC (1 << 3) +#define MDF_WAS_UP_TO_DATE (1 << 4) +#define MDF_PEER_OUT_DATED (1 << 5) +#define MDF_CRASHED_PRIMARY (1 << 6) +#define MDF_AL_CLEAN (1 << 7) +#define MDF_AL_DISABLED (1 << 8) + +#define MAX_PEERS 32 + +enum drbd_uuid_index { + UI_CURRENT, + UI_BITMAP, + UI_HISTORY_START, + UI_HISTORY_END, + UI_SIZE, /* nl-packet: number of dirty bits */ + UI_FLAGS, /* nl-packet: flags */ + UI_EXTENDED_SIZE /* Everything. */ +}; + +#define HISTORY_UUIDS MAX_PEERS + +enum drbd_timeout_flag { + UT_DEFAULT = 0, + UT_DEGRADED = 1, + UT_PEER_OUTDATED = 2, +}; + +enum drbd_notification_type { + NOTIFY_EXISTS, + NOTIFY_CREATE, + NOTIFY_CHANGE, + NOTIFY_DESTROY, + NOTIFY_CALL, + NOTIFY_RESPONSE, + + NOTIFY_CONTINUES = 0x8000, + NOTIFY_FLAGS = NOTIFY_CONTINUES, +}; + +enum drbd_peer_state { + P_INCONSISTENT = 3, + P_OUTDATED = 4, + P_DOWN = 5, + P_PRIMARY = 6, + P_FENCING = 7, +}; + +#define UUID_JUST_CREATED ((__u64)4) + +enum write_ordering_e { + WO_NONE, + WO_DRAIN_IO, + WO_BDEV_FLUSH, + WO_BIO_BARRIER +}; + +/* magic numbers used in meta data and network packets */ +#define DRBD_MAGIC 0x83740267 +#define DRBD_MAGIC_BIG 0x835a +#define DRBD_MAGIC_100 0x8620ec20 + +#define DRBD_MD_MAGIC_07 (DRBD_MAGIC+3) +#define DRBD_MD_MAGIC_08 (DRBD_MAGIC+4) +#define DRBD_MD_MAGIC_84_UNCLEAN (DRBD_MAGIC+5) + + +/* how I came up with this magic? + * base64 decode "actlog==" ;) */ +#define DRBD_AL_MAGIC 0x69cb65a2 + +/* these are of type "int" */ +#define DRBD_MD_INDEX_INTERNAL -1 +#define DRBD_MD_INDEX_FLEX_EXT -2 +#define DRBD_MD_INDEX_FLEX_INT -3 + +#define DRBD_CPU_MASK_SIZE 32 + +/** + * struct drbd_genlmsghdr - DRBD specific header used in NETLINK_GENERIC requests + * @minor: + * For admin requests (user -> kernel): which minor device to operate on. + * For (unicast) replies or informational (broadcast) messages + * (kernel -> user): which minor device the information is about. + * If we do not operate on minors, but on connections or resources, + * the minor value shall be (~0), and the attribute DRBD_NLA_CFG_CONTEXT + * is used instead. + * @flags: possible operation modifiers (relevant only for user->kernel): + * DRBD_GENL_F_SET_DEFAULTS + * @volume: + * When creating a new minor (adding it to a resource), the resource needs + * to know which volume number within the resource this is supposed to be. + * The volume number corresponds to the same volume number on the remote side, + * whereas the minor number on the remote side may be different + * (union with flags). + * @ret_code: kernel->userland unicast cfg reply return code (union with flags); + */ +struct drbd_genlmsghdr { + __u32 minor; + union { + __u32 flags; + __s32 ret_code; + }; +}; + +/* To be used in drbd_genlmsghdr.flags */ +enum { + DRBD_GENL_F_SET_DEFAULTS = 1, +}; + +enum drbd_state_info_bcast_reason { + SIB_GET_STATUS_REPLY = 1, + SIB_STATE_CHANGE = 2, + SIB_HELPER_PRE = 3, + SIB_HELPER_POST = 4, + SIB_SYNC_PROGRESS = 5, +}; + +#endif diff --git a/include/uapi/linux/drbd_limits.h b/include/uapi/linux/drbd_limits.h new file mode 100644 index 000000000000..a72a102d1ca7 --- /dev/null +++ b/include/uapi/linux/drbd_limits.h @@ -0,0 +1,251 @@ +/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */ +/* + drbd_limits.h + This file is part of DRBD by Philipp Reisner and Lars Ellenberg. +*/ + +/* + * Our current limitations. + * Some of them are hard limits, + * some of them are arbitrary range limits, that make it easier to provide + * feedback about nonsense settings for certain configurable values. + */ + +#ifndef DRBD_LIMITS_H +#define DRBD_LIMITS_H 1 + +#define DEBUG_RANGE_CHECK 0 + +#define DRBD_MINOR_COUNT_MIN 1U +#define DRBD_MINOR_COUNT_MAX 255U +#define DRBD_MINOR_COUNT_DEF 32U +#define DRBD_MINOR_COUNT_SCALE '1' + +#define DRBD_VOLUME_MAX 65534U + +#define DRBD_DIALOG_REFRESH_MIN 0U +#define DRBD_DIALOG_REFRESH_MAX 600U +#define DRBD_DIALOG_REFRESH_SCALE '1' + +/* valid port number */ +#define DRBD_PORT_MIN 1U +#define DRBD_PORT_MAX 0xffffU +#define DRBD_PORT_SCALE '1' + +/* startup { */ + /* if you want more than 3.4 days, disable */ +#define DRBD_WFC_TIMEOUT_MIN 0U +#define DRBD_WFC_TIMEOUT_MAX 300000U +#define DRBD_WFC_TIMEOUT_DEF 0U +#define DRBD_WFC_TIMEOUT_SCALE '1' + +#define DRBD_DEGR_WFC_TIMEOUT_MIN 0U +#define DRBD_DEGR_WFC_TIMEOUT_MAX 300000U +#define DRBD_DEGR_WFC_TIMEOUT_DEF 0U +#define DRBD_DEGR_WFC_TIMEOUT_SCALE '1' + +#define DRBD_OUTDATED_WFC_TIMEOUT_MIN 0U +#define DRBD_OUTDATED_WFC_TIMEOUT_MAX 300000U +#define DRBD_OUTDATED_WFC_TIMEOUT_DEF 0U +#define DRBD_OUTDATED_WFC_TIMEOUT_SCALE '1' +/* }*/ + +/* net { */ + /* timeout, unit centi seconds + * more than one minute timeout is not useful */ +#define DRBD_TIMEOUT_MIN 1U +#define DRBD_TIMEOUT_MAX 600U +#define DRBD_TIMEOUT_DEF 60U /* 6 seconds */ +#define DRBD_TIMEOUT_SCALE '1' + + /* If backing disk takes longer than disk_timeout, mark the disk as failed */ +#define DRBD_DISK_TIMEOUT_MIN 0U /* 0 = disabled */ +#define DRBD_DISK_TIMEOUT_MAX 6000U /* 10 Minutes */ +#define DRBD_DISK_TIMEOUT_DEF 0U /* disabled */ +#define DRBD_DISK_TIMEOUT_SCALE '1' + + /* active connection retries when C_WF_CONNECTION */ +#define DRBD_CONNECT_INT_MIN 1U +#define DRBD_CONNECT_INT_MAX 120U +#define DRBD_CONNECT_INT_DEF 10U /* seconds */ +#define DRBD_CONNECT_INT_SCALE '1' + + /* keep-alive probes when idle */ +#define DRBD_PING_INT_MIN 1U +#define DRBD_PING_INT_MAX 120U +#define DRBD_PING_INT_DEF 10U +#define DRBD_PING_INT_SCALE '1' + + /* timeout for the ping packets.*/ +#define DRBD_PING_TIMEO_MIN 1U +#define DRBD_PING_TIMEO_MAX 300U +#define DRBD_PING_TIMEO_DEF 5U +#define DRBD_PING_TIMEO_SCALE '1' + + /* max number of write requests between write barriers */ +#define DRBD_MAX_EPOCH_SIZE_MIN 1U +#define DRBD_MAX_EPOCH_SIZE_MAX 20000U +#define DRBD_MAX_EPOCH_SIZE_DEF 2048U +#define DRBD_MAX_EPOCH_SIZE_SCALE '1' + + /* I don't think that a tcp send buffer of more than 10M is useful */ +#define DRBD_SNDBUF_SIZE_MIN 0U +#define DRBD_SNDBUF_SIZE_MAX (10U<<20) +#define DRBD_SNDBUF_SIZE_DEF 0U +#define DRBD_SNDBUF_SIZE_SCALE '1' + +#define DRBD_RCVBUF_SIZE_MIN 0U +#define DRBD_RCVBUF_SIZE_MAX (10U<<20) +#define DRBD_RCVBUF_SIZE_DEF 0U +#define DRBD_RCVBUF_SIZE_SCALE '1' + + /* @4k PageSize -> 128kB - 512MB */ +#define DRBD_MAX_BUFFERS_MIN 32U +#define DRBD_MAX_BUFFERS_MAX 131072U +#define DRBD_MAX_BUFFERS_DEF 2048U +#define DRBD_MAX_BUFFERS_SCALE '1' + + /* @4k PageSize -> 4kB - 512MB */ +#define DRBD_UNPLUG_WATERMARK_MIN 1U +#define DRBD_UNPLUG_WATERMARK_MAX 131072U +#define DRBD_UNPLUG_WATERMARK_DEF (DRBD_MAX_BUFFERS_DEF/16) +#define DRBD_UNPLUG_WATERMARK_SCALE '1' + + /* 0 is disabled. + * 200 should be more than enough even for very short timeouts */ +#define DRBD_KO_COUNT_MIN 0U +#define DRBD_KO_COUNT_MAX 200U +#define DRBD_KO_COUNT_DEF 7U +#define DRBD_KO_COUNT_SCALE '1' +/* } */ + +/* syncer { */ + /* FIXME allow rate to be zero? */ +#define DRBD_RESYNC_RATE_MIN 1U +/* channel bonding 10 GbE, or other hardware */ +#define DRBD_RESYNC_RATE_MAX (4 << 20) +#define DRBD_RESYNC_RATE_DEF 250U +#define DRBD_RESYNC_RATE_SCALE 'k' /* kilobytes */ + +#define DRBD_AL_EXTENTS_MIN 67U + /* we use u16 as "slot number", (u16)~0 is "FREE". + * If you use >= 292 kB on-disk ring buffer, + * this is the maximum you can use: */ +#define DRBD_AL_EXTENTS_MAX 0xfffeU +#define DRBD_AL_EXTENTS_DEF 1237U +#define DRBD_AL_EXTENTS_SCALE '1' + +#define DRBD_MINOR_NUMBER_MIN -1 +#define DRBD_MINOR_NUMBER_MAX ((1 << 20) - 1) +#define DRBD_MINOR_NUMBER_DEF -1 +#define DRBD_MINOR_NUMBER_SCALE '1' + +/* } */ + +/* drbdsetup XY resize -d Z + * you are free to reduce the device size to nothing, if you want to. + * the upper limit with 64bit kernel, enough ram and flexible meta data + * is 1 PiB, currently. */ +/* DRBD_MAX_SECTORS */ +#define DRBD_DISK_SIZE_MIN 0LLU +#define DRBD_DISK_SIZE_MAX (1LLU * (2LLU << 40)) +#define DRBD_DISK_SIZE_DEF 0LLU /* = disabled = no user size... */ +#define DRBD_DISK_SIZE_SCALE 's' /* sectors */ + +#define DRBD_ON_IO_ERROR_DEF EP_DETACH +#define DRBD_FENCING_DEF FP_DONT_CARE +#define DRBD_AFTER_SB_0P_DEF ASB_DISCONNECT +#define DRBD_AFTER_SB_1P_DEF ASB_DISCONNECT +#define DRBD_AFTER_SB_2P_DEF ASB_DISCONNECT +#define DRBD_RR_CONFLICT_DEF ASB_DISCONNECT +#define DRBD_ON_NO_DATA_DEF OND_IO_ERROR +#define DRBD_ON_CONGESTION_DEF OC_BLOCK +#define DRBD_READ_BALANCING_DEF RB_PREFER_LOCAL + +#define DRBD_MAX_BIO_BVECS_MIN 0U +#define DRBD_MAX_BIO_BVECS_MAX 128U +#define DRBD_MAX_BIO_BVECS_DEF 0U +#define DRBD_MAX_BIO_BVECS_SCALE '1' + +#define DRBD_C_PLAN_AHEAD_MIN 0U +#define DRBD_C_PLAN_AHEAD_MAX 300U +#define DRBD_C_PLAN_AHEAD_DEF 20U +#define DRBD_C_PLAN_AHEAD_SCALE '1' + +#define DRBD_C_DELAY_TARGET_MIN 1U +#define DRBD_C_DELAY_TARGET_MAX 100U +#define DRBD_C_DELAY_TARGET_DEF 10U +#define DRBD_C_DELAY_TARGET_SCALE '1' + +#define DRBD_C_FILL_TARGET_MIN 0U +#define DRBD_C_FILL_TARGET_MAX (1U<<20) /* 500MByte in sec */ +#define DRBD_C_FILL_TARGET_DEF 100U /* Try to place 50KiB in socket send buffer during resync */ +#define DRBD_C_FILL_TARGET_SCALE 's' /* sectors */ + +#define DRBD_C_MAX_RATE_MIN 250U +#define DRBD_C_MAX_RATE_MAX (4U << 20) +#define DRBD_C_MAX_RATE_DEF 102400U +#define DRBD_C_MAX_RATE_SCALE 'k' /* kilobytes */ + +#define DRBD_C_MIN_RATE_MIN 0U +#define DRBD_C_MIN_RATE_MAX (4U << 20) +#define DRBD_C_MIN_RATE_DEF 250U +#define DRBD_C_MIN_RATE_SCALE 'k' /* kilobytes */ + +#define DRBD_CONG_FILL_MIN 0U +#define DRBD_CONG_FILL_MAX (10U<<21) /* 10GByte in sectors */ +#define DRBD_CONG_FILL_DEF 0U +#define DRBD_CONG_FILL_SCALE 's' /* sectors */ + +#define DRBD_CONG_EXTENTS_MIN DRBD_AL_EXTENTS_MIN +#define DRBD_CONG_EXTENTS_MAX DRBD_AL_EXTENTS_MAX +#define DRBD_CONG_EXTENTS_DEF DRBD_AL_EXTENTS_DEF +#define DRBD_CONG_EXTENTS_SCALE DRBD_AL_EXTENTS_SCALE + +#define DRBD_PROTOCOL_DEF DRBD_PROT_C + +#define DRBD_DISK_BARRIER_DEF 0U +#define DRBD_DISK_FLUSHES_DEF 1U +#define DRBD_DISK_DRAIN_DEF 1U +#define DRBD_MD_FLUSHES_DEF 1U +#define DRBD_TCP_CORK_DEF 1U +#define DRBD_AL_UPDATES_DEF 1U + +/* We used to ignore the discard_zeroes_data setting. + * To not change established (and expected) behaviour, + * by default assume that, for discard_zeroes_data=0, + * we can make that an effective discard_zeroes_data=1, + * if we only explicitly zero-out unaligned partial chunks. */ +#define DRBD_DISCARD_ZEROES_IF_ALIGNED_DEF 1U + +/* Some backends pretend to support WRITE SAME, + * but fail such requests when they are actually submitted. + * This is to tell DRBD to not even try. */ +#define DRBD_DISABLE_WRITE_SAME_DEF 0U + +#define DRBD_ALLOW_TWO_PRIMARIES_DEF 0U +#define DRBD_ALWAYS_ASBP_DEF 0U +#define DRBD_USE_RLE_DEF 1U +#define DRBD_CSUMS_AFTER_CRASH_ONLY_DEF 0U + +#define DRBD_AL_STRIPES_MIN 1U +#define DRBD_AL_STRIPES_MAX 1024U +#define DRBD_AL_STRIPES_DEF 1U +#define DRBD_AL_STRIPES_SCALE '1' + +#define DRBD_AL_STRIPE_SIZE_MIN 4U +#define DRBD_AL_STRIPE_SIZE_MAX 16777216U +#define DRBD_AL_STRIPE_SIZE_DEF 32U +#define DRBD_AL_STRIPE_SIZE_SCALE 'k' /* kilobytes */ + +#define DRBD_SOCKET_CHECK_TIMEO_MIN 0U +#define DRBD_SOCKET_CHECK_TIMEO_MAX DRBD_PING_TIMEO_MAX +#define DRBD_SOCKET_CHECK_TIMEO_DEF 0U +#define DRBD_SOCKET_CHECK_TIMEO_SCALE '1' + +#define DRBD_RS_DISCARD_GRANULARITY_MIN 0U +#define DRBD_RS_DISCARD_GRANULARITY_MAX (1U<<20) /* 1MiByte */ +#define DRBD_RS_DISCARD_GRANULARITY_DEF 0U /* disabled by default */ +#define DRBD_RS_DISCARD_GRANULARITY_SCALE '1' /* bytes */ + +#endif -- cgit v1.2.3 From 8098eeb693c4cc4e774c62fbd4875197cb5578ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christoph=20B=C3=B6hmwalder?= Date: Wed, 6 May 2026 14:45:41 +0200 Subject: drbd: replace genl_magic with explicit netlink serialization MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the genl_magic multi-include macro system with explicit serialization and parsing. The *_gen files were initially produced from a YNL spec via a customized ynl-gen-c, but the DRBD netlink family is effectively frozen, so the generator is kept unmodified. All new functionality will land in a separate, properly-designed family. Carry the resulting code as ordinary in-tree source rather than landing the spec and generator changes that produced it. The bulk of the changes are mechanical renames to fit the YNL naming conventions: - Handler functions: drbd_adm_* -> drbd_nl_*_doit/dumpit - GENL_MAGIC_VERSION -> DRBD_FAMILY_VERSION - GENL_MAGIC_FAMILY_HDRSZ -> sizeof(struct drbd_genlmsghdr) - drbd_genl_family -> drbd_nl_family - Attribute IDs: T_* -> DRBD_A_* Remove the nested_attr_tb static global buffer and move to a per-call allocation approach: each deserialization manages its own nested attribute table. This will be needed anyway when we eventually move to parallel_ops, and it's actually simpler this way, so make the move now. Replace the functionality of the "sensitive" flag: this was only used by a single field (shared_secret); open-code redaction logic for that locally. Also replace the "invariant" flag: this only had a couple of users, and those basically never change. Hard code the check directly inline. The genl_family struct itself is defined manually in drbd_nl.c. Also replace a couple of drbd-specific wrappers (nla_put_u64_0pad, drbd_nla_find_nested) with standard kernel functions while we're at it. Finally, completely remove the genl_magic system; DRBD was its only user. Signed-off-by: Christoph Böhmwalder Acked-by: Jakub Kicinski Link: https://patch.msgid.link/20260506124541.1951772-3-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe --- include/linux/drbd_genl.h | 536 -------------------------------------- include/linux/drbd_genl_api.h | 16 -- include/linux/genl_magic_func.h | 413 ----------------------------- include/linux/genl_magic_struct.h | 272 ------------------- include/uapi/linux/drbd.h | 3 + include/uapi/linux/drbd_genl.h | 359 +++++++++++++++++++++++++ 6 files changed, 362 insertions(+), 1237 deletions(-) delete mode 100644 include/linux/drbd_genl.h delete mode 100644 include/linux/drbd_genl_api.h delete mode 100644 include/linux/genl_magic_func.h delete mode 100644 include/linux/genl_magic_struct.h create mode 100644 include/uapi/linux/drbd_genl.h (limited to 'include') diff --git a/include/linux/drbd_genl.h b/include/linux/drbd_genl.h deleted file mode 100644 index f53c534aba0c..000000000000 --- a/include/linux/drbd_genl.h +++ /dev/null @@ -1,536 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* - * General overview: - * full generic netlink message: - * |nlmsghdr|genlmsghdr| - * - * payload: - * |optional fixed size family header| - * - * sequence of netlink attributes: - * I chose to have all "top level" attributes NLA_NESTED, - * corresponding to some real struct. - * So we have a sequence of |tla, len| - * - * nested nla sequence: - * may be empty, or contain a sequence of netlink attributes - * representing the struct fields. - * - * The tag number of any field (regardless of containing struct) - * will be available as T_ ## field_name, - * so you cannot have the same field name in two differnt structs. - * - * The tag numbers themselves are per struct, though, - * so should always begin at 1 (not 0, that is the special "NLA_UNSPEC" type, - * which we won't use here). - * The tag numbers are used as index in the respective nla_policy array. - * - * GENL_struct(tag_name, tag_number, struct name, struct fields) - struct and policy - * genl_magic_struct.h - * generates the struct declaration, - * generates an entry in the tla enum, - * genl_magic_func.h - * generates an entry in the static tla policy - * with .type = NLA_NESTED - * generates the static _nl_policy definition, - * and static conversion functions - * - * genl_magic_func.h - * - * GENL_mc_group(group) - * genl_magic_struct.h - * does nothing - * genl_magic_func.h - * defines and registers the mcast group, - * and provides a send helper - * - * GENL_notification(op_name, op_num, mcast_group, tla list) - * These are notifications to userspace. - * - * genl_magic_struct.h - * generates an entry in the genl_ops enum, - * genl_magic_func.h - * does nothing - * - * mcast group: the name of the mcast group this notification should be - * expected on - * tla list: the list of expected top level attributes, - * for documentation and sanity checking. - * - * GENL_op(op_name, op_num, flags and handler, tla list) - "genl operations" - * These are requests from userspace. - * - * _op and _notification share the same "number space", - * op_nr will be assigned to "genlmsghdr->cmd" - * - * genl_magic_struct.h - * generates an entry in the genl_ops enum, - * genl_magic_func.h - * generates an entry in the static genl_ops array, - * and static register/unregister functions to - * genl_register_family(). - * - * flags and handler: - * GENL_op_init( .doit = x, .dumpit = y, .flags = something) - * GENL_doit(x) => .dumpit = NULL, .flags = GENL_ADMIN_PERM - * tla list: the list of expected top level attributes, - * for documentation and sanity checking. - */ - -/* - * STRUCTS - */ - -/* this is sent kernel -> userland on various error conditions, and contains - * informational textual info, which is supposedly human readable. - * The computer relevant return code is in the drbd_genlmsghdr. - */ -GENL_struct(DRBD_NLA_CFG_REPLY, 1, drbd_cfg_reply, - /* "arbitrary" size strings, nla_policy.len = 0 */ - __str_field(1, 0, info_text, 0) -) - -/* Configuration requests typically need a context to operate on. - * Possible keys are device minor (fits in the drbd_genlmsghdr), - * the replication link (aka connection) name, - * and/or the replication group (aka resource) name, - * and the volume id within the resource. */ -GENL_struct(DRBD_NLA_CFG_CONTEXT, 2, drbd_cfg_context, - __u32_field(1, 0, ctx_volume) - __str_field(2, 0, ctx_resource_name, 128) - __bin_field(3, 0, ctx_my_addr, 128) - __bin_field(4, 0, ctx_peer_addr, 128) -) - -GENL_struct(DRBD_NLA_DISK_CONF, 3, disk_conf, - __str_field(1, DRBD_F_REQUIRED | DRBD_F_INVARIANT, backing_dev, 128) - __str_field(2, DRBD_F_REQUIRED | DRBD_F_INVARIANT, meta_dev, 128) - __s32_field(3, DRBD_F_REQUIRED | DRBD_F_INVARIANT, meta_dev_idx) - - /* use the resize command to try and change the disk_size */ - __u64_field(4, DRBD_F_INVARIANT, disk_size) - /* we could change the max_bio_bvecs, - * but it won't propagate through the stack */ - __u32_field(5, DRBD_F_INVARIANT, max_bio_bvecs) - - __u32_field_def(6, 0, on_io_error, DRBD_ON_IO_ERROR_DEF) - __u32_field_def(7, 0, fencing, DRBD_FENCING_DEF) - - __u32_field_def(8, 0, resync_rate, DRBD_RESYNC_RATE_DEF) - __s32_field_def(9, 0, resync_after, DRBD_MINOR_NUMBER_DEF) - __u32_field_def(10, 0, al_extents, DRBD_AL_EXTENTS_DEF) - __u32_field_def(11, 0, c_plan_ahead, DRBD_C_PLAN_AHEAD_DEF) - __u32_field_def(12, 0, c_delay_target, DRBD_C_DELAY_TARGET_DEF) - __u32_field_def(13, 0, c_fill_target, DRBD_C_FILL_TARGET_DEF) - __u32_field_def(14, 0, c_max_rate, DRBD_C_MAX_RATE_DEF) - __u32_field_def(15, 0, c_min_rate, DRBD_C_MIN_RATE_DEF) - __u32_field_def(20, 0, disk_timeout, DRBD_DISK_TIMEOUT_DEF) - __u32_field_def(21, 0 /* OPTIONAL */, read_balancing, DRBD_READ_BALANCING_DEF) - __u32_field_def(25, 0 /* OPTIONAL */, rs_discard_granularity, DRBD_RS_DISCARD_GRANULARITY_DEF) - - __flg_field_def(16, 0, disk_barrier, DRBD_DISK_BARRIER_DEF) - __flg_field_def(17, 0, disk_flushes, DRBD_DISK_FLUSHES_DEF) - __flg_field_def(18, 0, disk_drain, DRBD_DISK_DRAIN_DEF) - __flg_field_def(19, 0, md_flushes, DRBD_MD_FLUSHES_DEF) - __flg_field_def(23, 0 /* OPTIONAL */, al_updates, DRBD_AL_UPDATES_DEF) - __flg_field_def(24, 0 /* OPTIONAL */, discard_zeroes_if_aligned, DRBD_DISCARD_ZEROES_IF_ALIGNED_DEF) - __flg_field_def(26, 0 /* OPTIONAL */, disable_write_same, DRBD_DISABLE_WRITE_SAME_DEF) -) - -GENL_struct(DRBD_NLA_RESOURCE_OPTS, 4, res_opts, - __str_field_def(1, 0, cpu_mask, DRBD_CPU_MASK_SIZE) - __u32_field_def(2, 0, on_no_data, DRBD_ON_NO_DATA_DEF) -) - -GENL_struct(DRBD_NLA_NET_CONF, 5, net_conf, - __str_field_def(1, DRBD_F_SENSITIVE, - shared_secret, SHARED_SECRET_MAX) - __str_field_def(2, 0, cram_hmac_alg, SHARED_SECRET_MAX) - __str_field_def(3, 0, integrity_alg, SHARED_SECRET_MAX) - __str_field_def(4, 0, verify_alg, SHARED_SECRET_MAX) - __str_field_def(5, 0, csums_alg, SHARED_SECRET_MAX) - __u32_field_def(6, 0, wire_protocol, DRBD_PROTOCOL_DEF) - __u32_field_def(7, 0, connect_int, DRBD_CONNECT_INT_DEF) - __u32_field_def(8, 0, timeout, DRBD_TIMEOUT_DEF) - __u32_field_def(9, 0, ping_int, DRBD_PING_INT_DEF) - __u32_field_def(10, 0, ping_timeo, DRBD_PING_TIMEO_DEF) - __u32_field_def(11, 0, sndbuf_size, DRBD_SNDBUF_SIZE_DEF) - __u32_field_def(12, 0, rcvbuf_size, DRBD_RCVBUF_SIZE_DEF) - __u32_field_def(13, 0, ko_count, DRBD_KO_COUNT_DEF) - __u32_field_def(14, 0, max_buffers, DRBD_MAX_BUFFERS_DEF) - __u32_field_def(15, 0, max_epoch_size, DRBD_MAX_EPOCH_SIZE_DEF) - __u32_field_def(16, 0, unplug_watermark, DRBD_UNPLUG_WATERMARK_DEF) - __u32_field_def(17, 0, after_sb_0p, DRBD_AFTER_SB_0P_DEF) - __u32_field_def(18, 0, after_sb_1p, DRBD_AFTER_SB_1P_DEF) - __u32_field_def(19, 0, after_sb_2p, DRBD_AFTER_SB_2P_DEF) - __u32_field_def(20, 0, rr_conflict, DRBD_RR_CONFLICT_DEF) - __u32_field_def(21, 0, on_congestion, DRBD_ON_CONGESTION_DEF) - __u32_field_def(22, 0, cong_fill, DRBD_CONG_FILL_DEF) - __u32_field_def(23, 0, cong_extents, DRBD_CONG_EXTENTS_DEF) - __flg_field_def(24, 0, two_primaries, DRBD_ALLOW_TWO_PRIMARIES_DEF) - __flg_field(25, DRBD_F_INVARIANT, discard_my_data) - __flg_field_def(26, 0, tcp_cork, DRBD_TCP_CORK_DEF) - __flg_field_def(27, 0, always_asbp, DRBD_ALWAYS_ASBP_DEF) - __flg_field(28, DRBD_F_INVARIANT, tentative) - __flg_field_def(29, 0, use_rle, DRBD_USE_RLE_DEF) - /* 9: __u32_field_def(30, 0, fencing_policy, DRBD_FENCING_DEF) */ - /* 9: __str_field_def(31, 0, name, SHARED_SECRET_MAX) */ - /* 9: __u32_field(32, DRBD_F_REQUIRED | DRBD_F_INVARIANT, peer_node_id) */ - __flg_field_def(33, 0 /* OPTIONAL */, csums_after_crash_only, DRBD_CSUMS_AFTER_CRASH_ONLY_DEF) - __u32_field_def(34, 0 /* OPTIONAL */, sock_check_timeo, DRBD_SOCKET_CHECK_TIMEO_DEF) -) - -GENL_struct(DRBD_NLA_SET_ROLE_PARMS, 6, set_role_parms, - __flg_field(1, 0, assume_uptodate) -) - -GENL_struct(DRBD_NLA_RESIZE_PARMS, 7, resize_parms, - __u64_field(1, 0, resize_size) - __flg_field(2, 0, resize_force) - __flg_field(3, 0, no_resync) - __u32_field_def(4, 0 /* OPTIONAL */, al_stripes, DRBD_AL_STRIPES_DEF) - __u32_field_def(5, 0 /* OPTIONAL */, al_stripe_size, DRBD_AL_STRIPE_SIZE_DEF) -) - -GENL_struct(DRBD_NLA_STATE_INFO, 8, state_info, - /* the reason of the broadcast, - * if this is an event triggered broadcast. */ - __u32_field(1, 0, sib_reason) - __u32_field(2, DRBD_F_REQUIRED, current_state) - __u64_field(3, 0, capacity) - __u64_field(4, 0, ed_uuid) - - /* These are for broadcast from after state change work. - * prev_state and new_state are from the moment the state change took - * place, new_state is not neccessarily the same as current_state, - * there may have been more state changes since. Which will be - * broadcasted soon, in their respective after state change work. */ - __u32_field(5, 0, prev_state) - __u32_field(6, 0, new_state) - - /* if we have a local disk: */ - __bin_field(7, 0, uuids, (UI_SIZE*sizeof(__u64))) - __u32_field(8, 0, disk_flags) - __u64_field(9, 0, bits_total) - __u64_field(10, 0, bits_oos) - /* and in case resync or online verify is active */ - __u64_field(11, 0, bits_rs_total) - __u64_field(12, 0, bits_rs_failed) - - /* for pre and post notifications of helper execution */ - __str_field(13, 0, helper, 32) - __u32_field(14, 0, helper_exit_code) - - __u64_field(15, 0, send_cnt) - __u64_field(16, 0, recv_cnt) - __u64_field(17, 0, read_cnt) - __u64_field(18, 0, writ_cnt) - __u64_field(19, 0, al_writ_cnt) - __u64_field(20, 0, bm_writ_cnt) - __u32_field(21, 0, ap_bio_cnt) - __u32_field(22, 0, ap_pending_cnt) - __u32_field(23, 0, rs_pending_cnt) -) - -GENL_struct(DRBD_NLA_START_OV_PARMS, 9, start_ov_parms, - __u64_field(1, 0, ov_start_sector) - __u64_field(2, 0, ov_stop_sector) -) - -GENL_struct(DRBD_NLA_NEW_C_UUID_PARMS, 10, new_c_uuid_parms, - __flg_field(1, 0, clear_bm) -) - -GENL_struct(DRBD_NLA_TIMEOUT_PARMS, 11, timeout_parms, - __u32_field(1, DRBD_F_REQUIRED, timeout_type) -) - -GENL_struct(DRBD_NLA_DISCONNECT_PARMS, 12, disconnect_parms, - __flg_field(1, 0, force_disconnect) -) - -GENL_struct(DRBD_NLA_DETACH_PARMS, 13, detach_parms, - __flg_field(1, 0, force_detach) -) - -GENL_struct(DRBD_NLA_RESOURCE_INFO, 15, resource_info, - __u32_field(1, 0, res_role) - __flg_field(2, 0, res_susp) - __flg_field(3, 0, res_susp_nod) - __flg_field(4, 0, res_susp_fen) - /* __flg_field(5, 0, res_weak) */ -) - -GENL_struct(DRBD_NLA_DEVICE_INFO, 16, device_info, - __u32_field(1, 0, dev_disk_state) -) - -GENL_struct(DRBD_NLA_CONNECTION_INFO, 17, connection_info, - __u32_field(1, 0, conn_connection_state) - __u32_field(2, 0, conn_role) -) - -GENL_struct(DRBD_NLA_PEER_DEVICE_INFO, 18, peer_device_info, - __u32_field(1, 0, peer_repl_state) - __u32_field(2, 0, peer_disk_state) - __u32_field(3, 0, peer_resync_susp_user) - __u32_field(4, 0, peer_resync_susp_peer) - __u32_field(5, 0, peer_resync_susp_dependency) -) - -GENL_struct(DRBD_NLA_RESOURCE_STATISTICS, 19, resource_statistics, - __u32_field(1, 0, res_stat_write_ordering) -) - -GENL_struct(DRBD_NLA_DEVICE_STATISTICS, 20, device_statistics, - __u64_field(1, 0, dev_size) /* (sectors) */ - __u64_field(2, 0, dev_read) /* (sectors) */ - __u64_field(3, 0, dev_write) /* (sectors) */ - __u64_field(4, 0, dev_al_writes) /* activity log writes (count) */ - __u64_field(5, 0, dev_bm_writes) /* bitmap writes (count) */ - __u32_field(6, 0, dev_upper_pending) /* application requests in progress */ - __u32_field(7, 0, dev_lower_pending) /* backing device requests in progress */ - __flg_field(8, 0, dev_upper_blocked) - __flg_field(9, 0, dev_lower_blocked) - __flg_field(10, 0, dev_al_suspended) /* activity log suspended */ - __u64_field(11, 0, dev_exposed_data_uuid) - __u64_field(12, 0, dev_current_uuid) - __u32_field(13, 0, dev_disk_flags) - __bin_field(14, 0, history_uuids, HISTORY_UUIDS * sizeof(__u64)) -) - -GENL_struct(DRBD_NLA_CONNECTION_STATISTICS, 21, connection_statistics, - __flg_field(1, 0, conn_congested) -) - -GENL_struct(DRBD_NLA_PEER_DEVICE_STATISTICS, 22, peer_device_statistics, - __u64_field(1, 0, peer_dev_received) /* sectors */ - __u64_field(2, 0, peer_dev_sent) /* sectors */ - __u32_field(3, 0, peer_dev_pending) /* number of requests */ - __u32_field(4, 0, peer_dev_unacked) /* number of requests */ - __u64_field(5, 0, peer_dev_out_of_sync) /* sectors */ - __u64_field(6, 0, peer_dev_resync_failed) /* sectors */ - __u64_field(7, 0, peer_dev_bitmap_uuid) - __u32_field(9, 0, peer_dev_flags) -) - -GENL_struct(DRBD_NLA_NOTIFICATION_HEADER, 23, drbd_notification_header, - __u32_field(1, 0, nh_type) -) - -GENL_struct(DRBD_NLA_HELPER, 24, drbd_helper_info, - __str_field(1, 0, helper_name, 32) - __u32_field(2, 0, helper_status) -) - -/* - * Notifications and commands (genlmsghdr->cmd) - */ -GENL_mc_group(events) - - /* kernel -> userspace announcement of changes */ -GENL_notification( - DRBD_EVENT, 1, events, - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_STATE_INFO, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_NET_CONF, 0) - GENL_tla_expected(DRBD_NLA_DISK_CONF, 0) - GENL_tla_expected(DRBD_NLA_SYNCER_CONF, 0) -) - - /* query kernel for specific or all info */ -GENL_op( - DRBD_ADM_GET_STATUS, 2, - GENL_op_init( - .doit = drbd_adm_get_status, - .dumpit = drbd_adm_get_status_all, - /* anyone may ask for the status, - * it is broadcasted anyways */ - ), - /* To select the object .doit. - * Or a subset of objects in .dumpit. */ - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, 0) -) - - /* add DRBD minor devices as volumes to resources */ -GENL_op(DRBD_ADM_NEW_MINOR, 5, GENL_doit(drbd_adm_new_minor), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_DEL_MINOR, 6, GENL_doit(drbd_adm_del_minor), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) - - /* add or delete resources */ -GENL_op(DRBD_ADM_NEW_RESOURCE, 7, GENL_doit(drbd_adm_new_resource), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_DEL_RESOURCE, 8, GENL_doit(drbd_adm_del_resource), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) - -GENL_op(DRBD_ADM_RESOURCE_OPTS, 9, - GENL_doit(drbd_adm_resource_opts), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_RESOURCE_OPTS, 0) -) - -GENL_op( - DRBD_ADM_CONNECT, 10, - GENL_doit(drbd_adm_connect), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_NET_CONF, DRBD_F_REQUIRED) -) - -GENL_op( - DRBD_ADM_CHG_NET_OPTS, 29, - GENL_doit(drbd_adm_net_opts), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_NET_CONF, DRBD_F_REQUIRED) -) - -GENL_op(DRBD_ADM_DISCONNECT, 11, GENL_doit(drbd_adm_disconnect), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) - -GENL_op(DRBD_ADM_ATTACH, 12, - GENL_doit(drbd_adm_attach), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_DISK_CONF, DRBD_F_REQUIRED) -) - -GENL_op(DRBD_ADM_CHG_DISK_OPTS, 28, - GENL_doit(drbd_adm_disk_opts), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_DISK_OPTS, DRBD_F_REQUIRED) -) - -GENL_op( - DRBD_ADM_RESIZE, 13, - GENL_doit(drbd_adm_resize), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_RESIZE_PARMS, 0) -) - -GENL_op( - DRBD_ADM_PRIMARY, 14, - GENL_doit(drbd_adm_set_role), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_SET_ROLE_PARMS, DRBD_F_REQUIRED) -) - -GENL_op( - DRBD_ADM_SECONDARY, 15, - GENL_doit(drbd_adm_set_role), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_SET_ROLE_PARMS, DRBD_F_REQUIRED) -) - -GENL_op( - DRBD_ADM_NEW_C_UUID, 16, - GENL_doit(drbd_adm_new_c_uuid), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_NEW_C_UUID_PARMS, 0) -) - -GENL_op( - DRBD_ADM_START_OV, 17, - GENL_doit(drbd_adm_start_ov), - GENL_tla_expected(DRBD_NLA_START_OV_PARMS, 0) -) - -GENL_op(DRBD_ADM_DETACH, 18, GENL_doit(drbd_adm_detach), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_DETACH_PARMS, 0)) - -GENL_op(DRBD_ADM_INVALIDATE, 19, GENL_doit(drbd_adm_invalidate), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_INVAL_PEER, 20, GENL_doit(drbd_adm_invalidate_peer), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_PAUSE_SYNC, 21, GENL_doit(drbd_adm_pause_sync), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_RESUME_SYNC, 22, GENL_doit(drbd_adm_resume_sync), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_SUSPEND_IO, 23, GENL_doit(drbd_adm_suspend_io), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_RESUME_IO, 24, GENL_doit(drbd_adm_resume_io), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_OUTDATE, 25, GENL_doit(drbd_adm_outdate), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_GET_TIMEOUT_TYPE, 26, GENL_doit(drbd_adm_get_timeout_type), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) -GENL_op(DRBD_ADM_DOWN, 27, GENL_doit(drbd_adm_down), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED)) - -GENL_op(DRBD_ADM_GET_RESOURCES, 30, - GENL_op_init( - .dumpit = drbd_adm_dump_resources, - ), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, 0) - GENL_tla_expected(DRBD_NLA_RESOURCE_INFO, 0) - GENL_tla_expected(DRBD_NLA_RESOURCE_STATISTICS, 0)) - -GENL_op(DRBD_ADM_GET_DEVICES, 31, - GENL_op_init( - .dumpit = drbd_adm_dump_devices, - .done = drbd_adm_dump_devices_done, - ), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, 0) - GENL_tla_expected(DRBD_NLA_DEVICE_INFO, 0) - GENL_tla_expected(DRBD_NLA_DEVICE_STATISTICS, 0)) - -GENL_op(DRBD_ADM_GET_CONNECTIONS, 32, - GENL_op_init( - .dumpit = drbd_adm_dump_connections, - .done = drbd_adm_dump_connections_done, - ), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, 0) - GENL_tla_expected(DRBD_NLA_CONNECTION_INFO, 0) - GENL_tla_expected(DRBD_NLA_CONNECTION_STATISTICS, 0)) - -GENL_op(DRBD_ADM_GET_PEER_DEVICES, 33, - GENL_op_init( - .dumpit = drbd_adm_dump_peer_devices, - .done = drbd_adm_dump_peer_devices_done, - ), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, 0) - GENL_tla_expected(DRBD_NLA_PEER_DEVICE_INFO, 0) - GENL_tla_expected(DRBD_NLA_PEER_DEVICE_STATISTICS, 0)) - -GENL_notification( - DRBD_RESOURCE_STATE, 34, events, - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_NOTIFICATION_HEADER, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_RESOURCE_INFO, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_RESOURCE_STATISTICS, DRBD_F_REQUIRED)) - -GENL_notification( - DRBD_DEVICE_STATE, 35, events, - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_NOTIFICATION_HEADER, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_DEVICE_INFO, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_DEVICE_STATISTICS, DRBD_F_REQUIRED)) - -GENL_notification( - DRBD_CONNECTION_STATE, 36, events, - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_NOTIFICATION_HEADER, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_CONNECTION_INFO, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_CONNECTION_STATISTICS, DRBD_F_REQUIRED)) - -GENL_notification( - DRBD_PEER_DEVICE_STATE, 37, events, - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_NOTIFICATION_HEADER, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_PEER_DEVICE_INFO, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_PEER_DEVICE_STATISTICS, DRBD_F_REQUIRED)) - -GENL_op( - DRBD_ADM_GET_INITIAL_STATE, 38, - GENL_op_init( - .dumpit = drbd_adm_get_initial_state, - ), - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, 0)) - -GENL_notification( - DRBD_HELPER, 40, events, - GENL_tla_expected(DRBD_NLA_CFG_CONTEXT, DRBD_F_REQUIRED) - GENL_tla_expected(DRBD_NLA_HELPER, DRBD_F_REQUIRED)) - -GENL_notification( - DRBD_INITIAL_STATE_DONE, 41, events, - GENL_tla_expected(DRBD_NLA_NOTIFICATION_HEADER, DRBD_F_REQUIRED)) diff --git a/include/linux/drbd_genl_api.h b/include/linux/drbd_genl_api.h deleted file mode 100644 index 19d263924852..000000000000 --- a/include/linux/drbd_genl_api.h +++ /dev/null @@ -1,16 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef DRBD_GENL_STRUCT_H -#define DRBD_GENL_STRUCT_H - -/* hack around predefined gcc/cpp "linux=1", - * we cannot possibly include <1/drbd_genl.h> */ -#undef linux - -#include -#define GENL_MAGIC_VERSION 1 -#define GENL_MAGIC_FAMILY drbd -#define GENL_MAGIC_FAMILY_HDRSZ sizeof(struct drbd_genlmsghdr) -#define GENL_MAGIC_INCLUDE_FILE -#include - -#endif diff --git a/include/linux/genl_magic_func.h b/include/linux/genl_magic_func.h deleted file mode 100644 index a7d36c9ea924..000000000000 --- a/include/linux/genl_magic_func.h +++ /dev/null @@ -1,413 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef GENL_MAGIC_FUNC_H -#define GENL_MAGIC_FUNC_H - -#include -#include -#include - -/* - * Magic: declare tla policy {{{1 - * Magic: declare nested policies - * {{{2 - */ -#undef GENL_mc_group -#define GENL_mc_group(group) - -#undef GENL_notification -#define GENL_notification(op_name, op_num, mcast_group, tla_list) - -#undef GENL_op -#define GENL_op(op_name, op_num, handler, tla_list) - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ - [tag_name] = { .type = NLA_NESTED }, - -static struct nla_policy CONCATENATE(GENL_MAGIC_FAMILY, _tla_nl_policy)[] = { -#include GENL_MAGIC_INCLUDE_FILE -}; - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ -static struct nla_policy s_name ## _nl_policy[] __read_mostly = \ -{ s_fields }; - -#undef __field -#define __field(attr_nr, attr_flag, name, nla_type, _type, __get, \ - __put, __is_signed) \ - [attr_nr] = { .type = nla_type }, - -#undef __array -#define __array(attr_nr, attr_flag, name, nla_type, _type, maxlen, \ - __get, __put, __is_signed) \ - [attr_nr] = { .type = nla_type, \ - .len = maxlen - (nla_type == NLA_NUL_STRING) }, - -#include GENL_MAGIC_INCLUDE_FILE - -#ifndef __KERNEL__ -#ifndef pr_info -#define pr_info(args...) fprintf(stderr, args); -#endif -#endif - -#ifdef GENL_MAGIC_DEBUG -static void dprint_field(const char *dir, int nla_type, - const char *name, void *valp) -{ - __u64 val = valp ? *(__u32 *)valp : 1; - switch (nla_type) { - case NLA_U8: val = (__u8)val; - case NLA_U16: val = (__u16)val; - case NLA_U32: val = (__u32)val; - pr_info("%s attr %s: %d 0x%08x\n", dir, - name, (int)val, (unsigned)val); - break; - case NLA_U64: - val = *(__u64*)valp; - pr_info("%s attr %s: %lld 0x%08llx\n", dir, - name, (long long)val, (unsigned long long)val); - break; - case NLA_FLAG: - if (val) - pr_info("%s attr %s: set\n", dir, name); - break; - } -} - -static void dprint_array(const char *dir, int nla_type, - const char *name, const char *val, unsigned len) -{ - switch (nla_type) { - case NLA_NUL_STRING: - if (len && val[len-1] == '\0') - len--; - pr_info("%s attr %s: [len:%u] '%s'\n", dir, name, len, val); - break; - default: - /* we can always show 4 byte, - * thats what nlattr are aligned to. */ - pr_info("%s attr %s: [len:%u] %02x%02x%02x%02x ...\n", - dir, name, len, val[0], val[1], val[2], val[3]); - } -} - -#define DPRINT_TLA(a, op, b) pr_info("%s %s %s\n", a, op, b); - -/* Name is a member field name of the struct s. - * If s is NULL (only parsing, no copy requested in *_from_attrs()), - * nla is supposed to point to the attribute containing the information - * corresponding to that struct member. */ -#define DPRINT_FIELD(dir, nla_type, name, s, nla) \ - do { \ - if (s) \ - dprint_field(dir, nla_type, #name, &s->name); \ - else if (nla) \ - dprint_field(dir, nla_type, #name, \ - (nla_type == NLA_FLAG) ? NULL \ - : nla_data(nla)); \ - } while (0) - -#define DPRINT_ARRAY(dir, nla_type, name, s, nla) \ - do { \ - if (s) \ - dprint_array(dir, nla_type, #name, \ - s->name, s->name ## _len); \ - else if (nla) \ - dprint_array(dir, nla_type, #name, \ - nla_data(nla), nla_len(nla)); \ - } while (0) -#else -#define DPRINT_TLA(a, op, b) do {} while (0) -#define DPRINT_FIELD(dir, nla_type, name, s, nla) do {} while (0) -#define DPRINT_ARRAY(dir, nla_type, name, s, nla) do {} while (0) -#endif - -/* - * Magic: provide conversion functions {{{1 - * populate struct from attribute table: - * {{{2 - */ - -/* processing of generic netlink messages is serialized. - * use one static buffer for parsing of nested attributes */ -static struct nlattr *nested_attr_tb[128]; - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ -/* *_from_attrs functions are static, but potentially unused */ \ -static int __ ## s_name ## _from_attrs(struct s_name *s, \ - struct genl_info *info, bool exclude_invariants) \ -{ \ - const int maxtype = ARRAY_SIZE(s_name ## _nl_policy)-1; \ - struct nlattr *tla = info->attrs[tag_number]; \ - struct nlattr **ntb = nested_attr_tb; \ - struct nlattr *nla; \ - int err; \ - BUILD_BUG_ON(ARRAY_SIZE(s_name ## _nl_policy) > ARRAY_SIZE(nested_attr_tb)); \ - if (!tla) \ - return -ENOMSG; \ - DPRINT_TLA(#s_name, "<=-", #tag_name); \ - err = nla_parse_nested_deprecated(ntb, maxtype, tla, \ - s_name ## _nl_policy, NULL); \ - if (err) \ - return err; \ - \ - s_fields \ - return 0; \ -} __attribute__((unused)) \ -static int s_name ## _from_attrs(struct s_name *s, \ - struct genl_info *info) \ -{ \ - return __ ## s_name ## _from_attrs(s, info, false); \ -} __attribute__((unused)) \ -static int s_name ## _from_attrs_for_change(struct s_name *s, \ - struct genl_info *info) \ -{ \ - return __ ## s_name ## _from_attrs(s, info, true); \ -} __attribute__((unused)) \ - -#define __assign(attr_nr, attr_flag, name, nla_type, type, assignment...) \ - nla = ntb[attr_nr]; \ - if (nla) { \ - if (exclude_invariants && !!((attr_flag) & DRBD_F_INVARIANT)) { \ - pr_info("<< must not change invariant attr: %s\n", #name); \ - return -EEXIST; \ - } \ - assignment; \ - } else if (exclude_invariants && !!((attr_flag) & DRBD_F_INVARIANT)) { \ - /* attribute missing from payload, */ \ - /* which was expected */ \ - } else if ((attr_flag) & DRBD_F_REQUIRED) { \ - pr_info("<< missing attr: %s\n", #name); \ - return -ENOMSG; \ - } - -#undef __field -#define __field(attr_nr, attr_flag, name, nla_type, type, __get, __put, \ - __is_signed) \ - __assign(attr_nr, attr_flag, name, nla_type, type, \ - if (s) \ - s->name = __get(nla); \ - DPRINT_FIELD("<<", nla_type, name, s, nla)) - -/* validate_nla() already checked nla_len <= maxlen appropriately. */ -#undef __array -#define __array(attr_nr, attr_flag, name, nla_type, type, maxlen, \ - __get, __put, __is_signed) \ - __assign(attr_nr, attr_flag, name, nla_type, type, \ - if (s) \ - s->name ## _len = \ - __get(s->name, nla, maxlen); \ - DPRINT_ARRAY("<<", nla_type, name, s, nla)) - -#include GENL_MAGIC_INCLUDE_FILE - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) - -/* - * Magic: define op number to op name mapping {{{1 - * {{{2 - */ -static const char *CONCATENATE(GENL_MAGIC_FAMILY, _genl_cmd_to_str)(__u8 cmd) -{ - switch (cmd) { -#undef GENL_op -#define GENL_op(op_name, op_num, handler, tla_list) \ - case op_num: return #op_name; -#include GENL_MAGIC_INCLUDE_FILE - default: - return "unknown"; - } -} - -#ifdef __KERNEL__ -#include -/* - * Magic: define genl_ops {{{1 - * {{{2 - */ - -#undef GENL_op -#define GENL_op(op_name, op_num, handler, tla_list) \ -{ \ - handler \ - .cmd = op_name, \ -}, - -#define ZZZ_genl_ops CONCATENATE(GENL_MAGIC_FAMILY, _genl_ops) -static struct genl_ops ZZZ_genl_ops[] __read_mostly = { -#include GENL_MAGIC_INCLUDE_FILE -}; - -#undef GENL_op -#define GENL_op(op_name, op_num, handler, tla_list) - -/* - * Define the genl_family, multicast groups, {{{1 - * and provide register/unregister functions. - * {{{2 - */ -#define ZZZ_genl_family CONCATENATE(GENL_MAGIC_FAMILY, _genl_family) -static struct genl_family ZZZ_genl_family; -/* - * Magic: define multicast groups - * Magic: define multicast group registration helper - */ -#define ZZZ_genl_mcgrps CONCATENATE(GENL_MAGIC_FAMILY, _genl_mcgrps) -static const struct genl_multicast_group ZZZ_genl_mcgrps[] = { -#undef GENL_mc_group -#define GENL_mc_group(group) { .name = #group, }, -#include GENL_MAGIC_INCLUDE_FILE -}; - -enum CONCATENATE(GENL_MAGIC_FAMILY, group_ids) { -#undef GENL_mc_group -#define GENL_mc_group(group) CONCATENATE(GENL_MAGIC_FAMILY, _group_ ## group), -#include GENL_MAGIC_INCLUDE_FILE -}; - -#undef GENL_mc_group -#define GENL_mc_group(group) \ -static int CONCATENATE(GENL_MAGIC_FAMILY, _genl_multicast_ ## group)( \ - struct sk_buff *skb, gfp_t flags) \ -{ \ - unsigned int group_id = \ - CONCATENATE(GENL_MAGIC_FAMILY, _group_ ## group); \ - return genlmsg_multicast(&ZZZ_genl_family, skb, 0, \ - group_id, flags); \ -} - -#include GENL_MAGIC_INCLUDE_FILE - -#undef GENL_mc_group -#define GENL_mc_group(group) - -static struct genl_family ZZZ_genl_family __ro_after_init = { - .name = __stringify(GENL_MAGIC_FAMILY), - .version = GENL_MAGIC_VERSION, -#ifdef GENL_MAGIC_FAMILY_HDRSZ - .hdrsize = NLA_ALIGN(GENL_MAGIC_FAMILY_HDRSZ), -#endif - .maxattr = ARRAY_SIZE(CONCATENATE(GENL_MAGIC_FAMILY, _tla_nl_policy))-1, - .policy = CONCATENATE(GENL_MAGIC_FAMILY, _tla_nl_policy), -#ifdef GENL_MAGIC_FAMILY_PRE_DOIT - .pre_doit = GENL_MAGIC_FAMILY_PRE_DOIT, - .post_doit = GENL_MAGIC_FAMILY_POST_DOIT, -#endif - .ops = ZZZ_genl_ops, - .n_ops = ARRAY_SIZE(ZZZ_genl_ops), - .mcgrps = ZZZ_genl_mcgrps, - .resv_start_op = 42, /* drbd is currently the only user */ - .n_mcgrps = ARRAY_SIZE(ZZZ_genl_mcgrps), - .module = THIS_MODULE, -}; - -int CONCATENATE(GENL_MAGIC_FAMILY, _genl_register)(void) -{ - return genl_register_family(&ZZZ_genl_family); -} - -void CONCATENATE(GENL_MAGIC_FAMILY, _genl_unregister)(void) -{ - genl_unregister_family(&ZZZ_genl_family); -} - -/* - * Magic: provide conversion functions {{{1 - * populate skb from struct. - * {{{2 - */ - -#undef GENL_op -#define GENL_op(op_name, op_num, handler, tla_list) - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ -static int s_name ## _to_skb(struct sk_buff *skb, struct s_name *s, \ - const bool exclude_sensitive) \ -{ \ - struct nlattr *tla = nla_nest_start(skb, tag_number); \ - if (!tla) \ - goto nla_put_failure; \ - DPRINT_TLA(#s_name, "-=>", #tag_name); \ - s_fields \ - nla_nest_end(skb, tla); \ - return 0; \ - \ -nla_put_failure: \ - if (tla) \ - nla_nest_cancel(skb, tla); \ - return -EMSGSIZE; \ -} \ -static inline int s_name ## _to_priv_skb(struct sk_buff *skb, \ - struct s_name *s) \ -{ \ - return s_name ## _to_skb(skb, s, 0); \ -} \ -static inline int s_name ## _to_unpriv_skb(struct sk_buff *skb, \ - struct s_name *s) \ -{ \ - return s_name ## _to_skb(skb, s, 1); \ -} - - -#undef __field -#define __field(attr_nr, attr_flag, name, nla_type, type, __get, __put, \ - __is_signed) \ - if (!exclude_sensitive || !((attr_flag) & DRBD_F_SENSITIVE)) { \ - DPRINT_FIELD(">>", nla_type, name, s, NULL); \ - if (__put(skb, attr_nr, s->name)) \ - goto nla_put_failure; \ - } - -#undef __array -#define __array(attr_nr, attr_flag, name, nla_type, type, maxlen, \ - __get, __put, __is_signed) \ - if (!exclude_sensitive || !((attr_flag) & DRBD_F_SENSITIVE)) { \ - DPRINT_ARRAY(">>",nla_type, name, s, NULL); \ - if (__put(skb, attr_nr, min_t(int, maxlen, \ - s->name ## _len + (nla_type == NLA_NUL_STRING)),\ - s->name)) \ - goto nla_put_failure; \ - } - -#include GENL_MAGIC_INCLUDE_FILE - - -/* Functions for initializing structs to default values. */ - -#undef __field -#define __field(attr_nr, attr_flag, name, nla_type, type, __get, __put, \ - __is_signed) -#undef __array -#define __array(attr_nr, attr_flag, name, nla_type, type, maxlen, \ - __get, __put, __is_signed) -#undef __u32_field_def -#define __u32_field_def(attr_nr, attr_flag, name, default) \ - x->name = default; -#undef __s32_field_def -#define __s32_field_def(attr_nr, attr_flag, name, default) \ - x->name = default; -#undef __flg_field_def -#define __flg_field_def(attr_nr, attr_flag, name, default) \ - x->name = default; -#undef __str_field_def -#define __str_field_def(attr_nr, attr_flag, name, maxlen) \ - memset(x->name, 0, sizeof(x->name)); \ - x->name ## _len = 0; -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ -static void set_ ## s_name ## _defaults(struct s_name *x) __attribute__((unused)); \ -static void set_ ## s_name ## _defaults(struct s_name *x) { \ -s_fields \ -} - -#include GENL_MAGIC_INCLUDE_FILE - -#endif /* __KERNEL__ */ - -/* }}}1 */ -#endif /* GENL_MAGIC_FUNC_H */ diff --git a/include/linux/genl_magic_struct.h b/include/linux/genl_magic_struct.h deleted file mode 100644 index 2200cedd160a..000000000000 --- a/include/linux/genl_magic_struct.h +++ /dev/null @@ -1,272 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef GENL_MAGIC_STRUCT_H -#define GENL_MAGIC_STRUCT_H - -#ifndef GENL_MAGIC_FAMILY -# error "you need to define GENL_MAGIC_FAMILY before inclusion" -#endif - -#ifndef GENL_MAGIC_VERSION -# error "you need to define GENL_MAGIC_VERSION before inclusion" -#endif - -#ifndef GENL_MAGIC_INCLUDE_FILE -# error "you need to define GENL_MAGIC_INCLUDE_FILE before inclusion" -#endif - -#include -#include -#include - -extern int CONCATENATE(GENL_MAGIC_FAMILY, _genl_register)(void); -extern void CONCATENATE(GENL_MAGIC_FAMILY, _genl_unregister)(void); - -/* - * Extension of genl attribute validation policies {{{2 - */ - -/* - * Flags specific to drbd and not visible at the netlink layer, used in - * _from_attrs and _to_skb: - * - * @DRBD_F_REQUIRED: Attribute is required; a request without this attribute is - * invalid. - * - * @DRBD_F_SENSITIVE: Attribute includes sensitive information and must not be - * included in unpriviledged get requests or broadcasts. - * - * @DRBD_F_INVARIANT: Attribute is set when an object is initially created, but - * cannot subsequently be changed. - */ -#define DRBD_F_REQUIRED (1 << 0) -#define DRBD_F_SENSITIVE (1 << 1) -#define DRBD_F_INVARIANT (1 << 2) - - -/* }}}1 - * MAGIC - * multi-include macro expansion magic starts here - */ - -/* MAGIC helpers {{{2 */ - -static inline int nla_put_u64_0pad(struct sk_buff *skb, int attrtype, u64 value) -{ - return nla_put_64bit(skb, attrtype, sizeof(u64), &value, 0); -} - -/* possible field types */ -#define __flg_field(attr_nr, attr_flag, name) \ - __field(attr_nr, attr_flag, name, NLA_U8, char, \ - nla_get_u8, nla_put_u8, false) -#define __u8_field(attr_nr, attr_flag, name) \ - __field(attr_nr, attr_flag, name, NLA_U8, unsigned char, \ - nla_get_u8, nla_put_u8, false) -#define __u16_field(attr_nr, attr_flag, name) \ - __field(attr_nr, attr_flag, name, NLA_U16, __u16, \ - nla_get_u16, nla_put_u16, false) -#define __u32_field(attr_nr, attr_flag, name) \ - __field(attr_nr, attr_flag, name, NLA_U32, __u32, \ - nla_get_u32, nla_put_u32, false) -#define __s32_field(attr_nr, attr_flag, name) \ - __field(attr_nr, attr_flag, name, NLA_U32, __s32, \ - nla_get_u32, nla_put_u32, true) -#define __u64_field(attr_nr, attr_flag, name) \ - __field(attr_nr, attr_flag, name, NLA_U64, __u64, \ - nla_get_u64, nla_put_u64_0pad, false) -#define __str_field(attr_nr, attr_flag, name, maxlen) \ - __array(attr_nr, attr_flag, name, NLA_NUL_STRING, char, maxlen, \ - nla_strscpy, nla_put, false) -#define __bin_field(attr_nr, attr_flag, name, maxlen) \ - __array(attr_nr, attr_flag, name, NLA_BINARY, char, maxlen, \ - nla_memcpy, nla_put, false) - -/* fields with default values */ -#define __flg_field_def(attr_nr, attr_flag, name, default) \ - __flg_field(attr_nr, attr_flag, name) -#define __u32_field_def(attr_nr, attr_flag, name, default) \ - __u32_field(attr_nr, attr_flag, name) -#define __s32_field_def(attr_nr, attr_flag, name, default) \ - __s32_field(attr_nr, attr_flag, name) -#define __str_field_def(attr_nr, attr_flag, name, maxlen) \ - __str_field(attr_nr, attr_flag, name, maxlen) - -#define GENL_op_init(args...) args -#define GENL_doit(handler) \ - .doit = handler, \ - .flags = GENL_ADMIN_PERM, -#define GENL_dumpit(handler) \ - .dumpit = handler, \ - .flags = GENL_ADMIN_PERM, - -/* }}}1 - * Magic: define the enum symbols for genl_ops - * Magic: define the enum symbols for top level attributes - * Magic: define the enum symbols for nested attributes - * {{{2 - */ - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) - -#undef GENL_mc_group -#define GENL_mc_group(group) - -#undef GENL_notification -#define GENL_notification(op_name, op_num, mcast_group, tla_list) \ - op_name = op_num, - -#undef GENL_op -#define GENL_op(op_name, op_num, handler, tla_list) \ - op_name = op_num, - -enum { -#include GENL_MAGIC_INCLUDE_FILE -}; - -#undef GENL_notification -#define GENL_notification(op_name, op_num, mcast_group, tla_list) - -#undef GENL_op -#define GENL_op(op_name, op_num, handler, attr_list) - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ - tag_name = tag_number, - -enum { -#include GENL_MAGIC_INCLUDE_FILE -}; - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ -enum { \ - s_fields \ -}; - -#undef __field -#define __field(attr_nr, attr_flag, name, nla_type, type, \ - __get, __put, __is_signed) \ - T_ ## name = (__u16)(attr_nr), - -#undef __array -#define __array(attr_nr, attr_flag, name, nla_type, type, \ - maxlen, __get, __put, __is_signed) \ - T_ ## name = (__u16)(attr_nr), - -#include GENL_MAGIC_INCLUDE_FILE - -/* }}}1 - * Magic: compile time assert unique numbers for operations - * Magic: -"- unique numbers for top level attributes - * Magic: -"- unique numbers for nested attributes - * {{{2 - */ - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) - -#undef GENL_op -#define GENL_op(op_name, op_num, handler, attr_list) \ - case op_name: - -#undef GENL_notification -#define GENL_notification(op_name, op_num, mcast_group, tla_list) \ - case op_name: - -static inline void ct_assert_unique_operations(void) -{ - switch (0) { -#include GENL_MAGIC_INCLUDE_FILE - case 0: - ; - } -} - -#undef GENL_op -#define GENL_op(op_name, op_num, handler, attr_list) - -#undef GENL_notification -#define GENL_notification(op_name, op_num, mcast_group, tla_list) - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ - case tag_number: - -static inline void ct_assert_unique_top_level_attributes(void) -{ - switch (0) { -#include GENL_MAGIC_INCLUDE_FILE - case 0: - ; - } -} - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ -static inline void ct_assert_unique_ ## s_name ## _attributes(void) \ -{ \ - switch (0) { \ - s_fields \ - case 0: \ - ; \ - } \ -} - -#undef __field -#define __field(attr_nr, attr_flag, name, nla_type, type, __get, __put, \ - __is_signed) \ - case attr_nr: - -#undef __array -#define __array(attr_nr, attr_flag, name, nla_type, type, maxlen, \ - __get, __put, __is_signed) \ - case attr_nr: - -#include GENL_MAGIC_INCLUDE_FILE - -/* }}}1 - * Magic: declare structs - * struct { - * fields - * }; - * {{{2 - */ - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ -struct s_name { s_fields }; - -#undef __field -#define __field(attr_nr, attr_flag, name, nla_type, type, __get, __put, \ - __is_signed) \ - type name; - -#undef __array -#define __array(attr_nr, attr_flag, name, nla_type, type, maxlen, \ - __get, __put, __is_signed) \ - type name[maxlen]; \ - __u32 name ## _len; - -#include GENL_MAGIC_INCLUDE_FILE - -#undef GENL_struct -#define GENL_struct(tag_name, tag_number, s_name, s_fields) \ -enum { \ - s_fields \ -}; - -#undef __field -#define __field(attr_nr, attr_flag, name, nla_type, type, __get, __put, \ - is_signed) \ - F_ ## name ## _IS_SIGNED = is_signed, - -#undef __array -#define __array(attr_nr, attr_flag, name, nla_type, type, maxlen, \ - __get, __put, is_signed) \ - F_ ## name ## _IS_SIGNED = is_signed, - -#include GENL_MAGIC_INCLUDE_FILE - -/* }}}1 */ -#endif /* GENL_MAGIC_STRUCT_H */ diff --git a/include/uapi/linux/drbd.h b/include/uapi/linux/drbd.h index 7930a972d8a4..5d4d677cf1ad 100644 --- a/include/uapi/linux/drbd.h +++ b/include/uapi/linux/drbd.h @@ -333,6 +333,9 @@ enum drbd_uuid_index { #define HISTORY_UUIDS MAX_PEERS +#define DRBD_NL_UUIDS_SIZE (UI_SIZE * sizeof(__u64)) +#define DRBD_NL_HISTORY_UUIDS_SIZE (HISTORY_UUIDS * sizeof(__u64)) + enum drbd_timeout_flag { UT_DEFAULT = 0, UT_DEGRADED = 1, diff --git a/include/uapi/linux/drbd_genl.h b/include/uapi/linux/drbd_genl.h new file mode 100644 index 000000000000..8b25f08d8a90 --- /dev/null +++ b/include/uapi/linux/drbd_genl.h @@ -0,0 +1,359 @@ +/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */ + +#ifndef _UAPI_LINUX_DRBD_GENL_H +#define _UAPI_LINUX_DRBD_GENL_H + +#define DRBD_FAMILY_NAME "drbd" +#define DRBD_FAMILY_VERSION 1 + +enum { + DRBD_NLA_CFG_REPLY = 1, + DRBD_NLA_CFG_CONTEXT, + DRBD_NLA_DISK_CONF, + DRBD_NLA_RESOURCE_OPTS, + DRBD_NLA_NET_CONF, + DRBD_NLA_SET_ROLE_PARMS, + DRBD_NLA_RESIZE_PARMS, + DRBD_NLA_STATE_INFO, + DRBD_NLA_START_OV_PARMS, + DRBD_NLA_NEW_C_UUID_PARMS, + DRBD_NLA_TIMEOUT_PARMS, + DRBD_NLA_DISCONNECT_PARMS, + DRBD_NLA_DETACH_PARMS, + DRBD_NLA_RESOURCE_INFO = 15, + DRBD_NLA_DEVICE_INFO, + DRBD_NLA_CONNECTION_INFO, + DRBD_NLA_PEER_DEVICE_INFO, + DRBD_NLA_RESOURCE_STATISTICS, + DRBD_NLA_DEVICE_STATISTICS, + DRBD_NLA_CONNECTION_STATISTICS, + DRBD_NLA_PEER_DEVICE_STATISTICS, + DRBD_NLA_NOTIFICATION_HEADER, + DRBD_NLA_HELPER, + + __DRBD_NLA_MAX, + DRBD_NLA_MAX = (__DRBD_NLA_MAX - 1) +}; + +enum { + DRBD_A_DRBD_CFG_REPLY_INFO_TEXT = 1, + + __DRBD_A_DRBD_CFG_REPLY_MAX, + DRBD_A_DRBD_CFG_REPLY_MAX = (__DRBD_A_DRBD_CFG_REPLY_MAX - 1) +}; + +enum { + DRBD_A_DRBD_CFG_CONTEXT_CTX_VOLUME = 1, + DRBD_A_DRBD_CFG_CONTEXT_CTX_RESOURCE_NAME, + DRBD_A_DRBD_CFG_CONTEXT_CTX_MY_ADDR, + DRBD_A_DRBD_CFG_CONTEXT_CTX_PEER_ADDR, + + __DRBD_A_DRBD_CFG_CONTEXT_MAX, + DRBD_A_DRBD_CFG_CONTEXT_MAX = (__DRBD_A_DRBD_CFG_CONTEXT_MAX - 1) +}; + +enum { + DRBD_A_DISK_CONF_BACKING_DEV = 1, + DRBD_A_DISK_CONF_META_DEV, + DRBD_A_DISK_CONF_META_DEV_IDX, + DRBD_A_DISK_CONF_DISK_SIZE, + DRBD_A_DISK_CONF_MAX_BIO_BVECS, + DRBD_A_DISK_CONF_ON_IO_ERROR, + DRBD_A_DISK_CONF_FENCING, + DRBD_A_DISK_CONF_RESYNC_RATE, + DRBD_A_DISK_CONF_RESYNC_AFTER, + DRBD_A_DISK_CONF_AL_EXTENTS, + DRBD_A_DISK_CONF_C_PLAN_AHEAD, + DRBD_A_DISK_CONF_C_DELAY_TARGET, + DRBD_A_DISK_CONF_C_FILL_TARGET, + DRBD_A_DISK_CONF_C_MAX_RATE, + DRBD_A_DISK_CONF_C_MIN_RATE, + DRBD_A_DISK_CONF_DISK_BARRIER, + DRBD_A_DISK_CONF_DISK_FLUSHES, + DRBD_A_DISK_CONF_DISK_DRAIN, + DRBD_A_DISK_CONF_MD_FLUSHES, + DRBD_A_DISK_CONF_DISK_TIMEOUT, + DRBD_A_DISK_CONF_READ_BALANCING, + DRBD_A_DISK_CONF_AL_UPDATES = 23, + DRBD_A_DISK_CONF_DISCARD_ZEROES_IF_ALIGNED, + DRBD_A_DISK_CONF_RS_DISCARD_GRANULARITY, + DRBD_A_DISK_CONF_DISABLE_WRITE_SAME, + + __DRBD_A_DISK_CONF_MAX, + DRBD_A_DISK_CONF_MAX = (__DRBD_A_DISK_CONF_MAX - 1) +}; + +enum { + DRBD_A_RES_OPTS_CPU_MASK = 1, + DRBD_A_RES_OPTS_ON_NO_DATA, + + __DRBD_A_RES_OPTS_MAX, + DRBD_A_RES_OPTS_MAX = (__DRBD_A_RES_OPTS_MAX - 1) +}; + +enum { + DRBD_A_NET_CONF_SHARED_SECRET = 1, + DRBD_A_NET_CONF_CRAM_HMAC_ALG, + DRBD_A_NET_CONF_INTEGRITY_ALG, + DRBD_A_NET_CONF_VERIFY_ALG, + DRBD_A_NET_CONF_CSUMS_ALG, + DRBD_A_NET_CONF_WIRE_PROTOCOL, + DRBD_A_NET_CONF_CONNECT_INT, + DRBD_A_NET_CONF_TIMEOUT, + DRBD_A_NET_CONF_PING_INT, + DRBD_A_NET_CONF_PING_TIMEO, + DRBD_A_NET_CONF_SNDBUF_SIZE, + DRBD_A_NET_CONF_RCVBUF_SIZE, + DRBD_A_NET_CONF_KO_COUNT, + DRBD_A_NET_CONF_MAX_BUFFERS, + DRBD_A_NET_CONF_MAX_EPOCH_SIZE, + DRBD_A_NET_CONF_UNPLUG_WATERMARK, + DRBD_A_NET_CONF_AFTER_SB_0P, + DRBD_A_NET_CONF_AFTER_SB_1P, + DRBD_A_NET_CONF_AFTER_SB_2P, + DRBD_A_NET_CONF_RR_CONFLICT, + DRBD_A_NET_CONF_ON_CONGESTION, + DRBD_A_NET_CONF_CONG_FILL, + DRBD_A_NET_CONF_CONG_EXTENTS, + DRBD_A_NET_CONF_TWO_PRIMARIES, + DRBD_A_NET_CONF_DISCARD_MY_DATA, + DRBD_A_NET_CONF_TCP_CORK, + DRBD_A_NET_CONF_ALWAYS_ASBP, + DRBD_A_NET_CONF_TENTATIVE, + DRBD_A_NET_CONF_USE_RLE, + DRBD_A_NET_CONF_CSUMS_AFTER_CRASH_ONLY = 33, + DRBD_A_NET_CONF_SOCK_CHECK_TIMEO, + + __DRBD_A_NET_CONF_MAX, + DRBD_A_NET_CONF_MAX = (__DRBD_A_NET_CONF_MAX - 1) +}; + +enum { + DRBD_A_SET_ROLE_PARMS_ASSUME_UPTODATE = 1, + + __DRBD_A_SET_ROLE_PARMS_MAX, + DRBD_A_SET_ROLE_PARMS_MAX = (__DRBD_A_SET_ROLE_PARMS_MAX - 1) +}; + +enum { + DRBD_A_RESIZE_PARMS_RESIZE_SIZE = 1, + DRBD_A_RESIZE_PARMS_RESIZE_FORCE, + DRBD_A_RESIZE_PARMS_NO_RESYNC, + DRBD_A_RESIZE_PARMS_AL_STRIPES, + DRBD_A_RESIZE_PARMS_AL_STRIPE_SIZE, + + __DRBD_A_RESIZE_PARMS_MAX, + DRBD_A_RESIZE_PARMS_MAX = (__DRBD_A_RESIZE_PARMS_MAX - 1) +}; + +enum { + DRBD_A_STATE_INFO_SIB_REASON = 1, + DRBD_A_STATE_INFO_CURRENT_STATE, + DRBD_A_STATE_INFO_CAPACITY, + DRBD_A_STATE_INFO_ED_UUID, + DRBD_A_STATE_INFO_PREV_STATE, + DRBD_A_STATE_INFO_NEW_STATE, + DRBD_A_STATE_INFO_UUIDS, + DRBD_A_STATE_INFO_DISK_FLAGS, + DRBD_A_STATE_INFO_BITS_TOTAL, + DRBD_A_STATE_INFO_BITS_OOS, + DRBD_A_STATE_INFO_BITS_RS_TOTAL, + DRBD_A_STATE_INFO_BITS_RS_FAILED, + DRBD_A_STATE_INFO_HELPER, + DRBD_A_STATE_INFO_HELPER_EXIT_CODE, + DRBD_A_STATE_INFO_SEND_CNT, + DRBD_A_STATE_INFO_RECV_CNT, + DRBD_A_STATE_INFO_READ_CNT, + DRBD_A_STATE_INFO_WRIT_CNT, + DRBD_A_STATE_INFO_AL_WRIT_CNT, + DRBD_A_STATE_INFO_BM_WRIT_CNT, + DRBD_A_STATE_INFO_AP_BIO_CNT, + DRBD_A_STATE_INFO_AP_PENDING_CNT, + DRBD_A_STATE_INFO_RS_PENDING_CNT, + + __DRBD_A_STATE_INFO_MAX, + DRBD_A_STATE_INFO_MAX = (__DRBD_A_STATE_INFO_MAX - 1) +}; + +enum { + DRBD_A_START_OV_PARMS_OV_START_SECTOR = 1, + DRBD_A_START_OV_PARMS_OV_STOP_SECTOR, + + __DRBD_A_START_OV_PARMS_MAX, + DRBD_A_START_OV_PARMS_MAX = (__DRBD_A_START_OV_PARMS_MAX - 1) +}; + +enum { + DRBD_A_NEW_C_UUID_PARMS_CLEAR_BM = 1, + + __DRBD_A_NEW_C_UUID_PARMS_MAX, + DRBD_A_NEW_C_UUID_PARMS_MAX = (__DRBD_A_NEW_C_UUID_PARMS_MAX - 1) +}; + +enum { + DRBD_A_TIMEOUT_PARMS_TIMEOUT_TYPE = 1, + + __DRBD_A_TIMEOUT_PARMS_MAX, + DRBD_A_TIMEOUT_PARMS_MAX = (__DRBD_A_TIMEOUT_PARMS_MAX - 1) +}; + +enum { + DRBD_A_DISCONNECT_PARMS_FORCE_DISCONNECT = 1, + + __DRBD_A_DISCONNECT_PARMS_MAX, + DRBD_A_DISCONNECT_PARMS_MAX = (__DRBD_A_DISCONNECT_PARMS_MAX - 1) +}; + +enum { + DRBD_A_DETACH_PARMS_FORCE_DETACH = 1, + + __DRBD_A_DETACH_PARMS_MAX, + DRBD_A_DETACH_PARMS_MAX = (__DRBD_A_DETACH_PARMS_MAX - 1) +}; + +enum { + DRBD_A_RESOURCE_INFO_RES_ROLE = 1, + DRBD_A_RESOURCE_INFO_RES_SUSP, + DRBD_A_RESOURCE_INFO_RES_SUSP_NOD, + DRBD_A_RESOURCE_INFO_RES_SUSP_FEN, + + __DRBD_A_RESOURCE_INFO_MAX, + DRBD_A_RESOURCE_INFO_MAX = (__DRBD_A_RESOURCE_INFO_MAX - 1) +}; + +enum { + DRBD_A_DEVICE_INFO_DEV_DISK_STATE = 1, + + __DRBD_A_DEVICE_INFO_MAX, + DRBD_A_DEVICE_INFO_MAX = (__DRBD_A_DEVICE_INFO_MAX - 1) +}; + +enum { + DRBD_A_CONNECTION_INFO_CONN_CONNECTION_STATE = 1, + DRBD_A_CONNECTION_INFO_CONN_ROLE, + + __DRBD_A_CONNECTION_INFO_MAX, + DRBD_A_CONNECTION_INFO_MAX = (__DRBD_A_CONNECTION_INFO_MAX - 1) +}; + +enum { + DRBD_A_PEER_DEVICE_INFO_PEER_REPL_STATE = 1, + DRBD_A_PEER_DEVICE_INFO_PEER_DISK_STATE, + DRBD_A_PEER_DEVICE_INFO_PEER_RESYNC_SUSP_USER, + DRBD_A_PEER_DEVICE_INFO_PEER_RESYNC_SUSP_PEER, + DRBD_A_PEER_DEVICE_INFO_PEER_RESYNC_SUSP_DEPENDENCY, + + __DRBD_A_PEER_DEVICE_INFO_MAX, + DRBD_A_PEER_DEVICE_INFO_MAX = (__DRBD_A_PEER_DEVICE_INFO_MAX - 1) +}; + +enum { + DRBD_A_RESOURCE_STATISTICS_RES_STAT_WRITE_ORDERING = 1, + + __DRBD_A_RESOURCE_STATISTICS_MAX, + DRBD_A_RESOURCE_STATISTICS_MAX = (__DRBD_A_RESOURCE_STATISTICS_MAX - 1) +}; + +enum { + DRBD_A_DEVICE_STATISTICS_DEV_SIZE = 1, + DRBD_A_DEVICE_STATISTICS_DEV_READ, + DRBD_A_DEVICE_STATISTICS_DEV_WRITE, + DRBD_A_DEVICE_STATISTICS_DEV_AL_WRITES, + DRBD_A_DEVICE_STATISTICS_DEV_BM_WRITES, + DRBD_A_DEVICE_STATISTICS_DEV_UPPER_PENDING, + DRBD_A_DEVICE_STATISTICS_DEV_LOWER_PENDING, + DRBD_A_DEVICE_STATISTICS_DEV_UPPER_BLOCKED, + DRBD_A_DEVICE_STATISTICS_DEV_LOWER_BLOCKED, + DRBD_A_DEVICE_STATISTICS_DEV_AL_SUSPENDED, + DRBD_A_DEVICE_STATISTICS_DEV_EXPOSED_DATA_UUID, + DRBD_A_DEVICE_STATISTICS_DEV_CURRENT_UUID, + DRBD_A_DEVICE_STATISTICS_DEV_DISK_FLAGS, + DRBD_A_DEVICE_STATISTICS_HISTORY_UUIDS, + + __DRBD_A_DEVICE_STATISTICS_MAX, + DRBD_A_DEVICE_STATISTICS_MAX = (__DRBD_A_DEVICE_STATISTICS_MAX - 1) +}; + +enum { + DRBD_A_CONNECTION_STATISTICS_CONN_CONGESTED = 1, + + __DRBD_A_CONNECTION_STATISTICS_MAX, + DRBD_A_CONNECTION_STATISTICS_MAX = (__DRBD_A_CONNECTION_STATISTICS_MAX - 1) +}; + +enum { + DRBD_A_PEER_DEVICE_STATISTICS_PEER_DEV_RECEIVED = 1, + DRBD_A_PEER_DEVICE_STATISTICS_PEER_DEV_SENT, + DRBD_A_PEER_DEVICE_STATISTICS_PEER_DEV_PENDING, + DRBD_A_PEER_DEVICE_STATISTICS_PEER_DEV_UNACKED, + DRBD_A_PEER_DEVICE_STATISTICS_PEER_DEV_OUT_OF_SYNC, + DRBD_A_PEER_DEVICE_STATISTICS_PEER_DEV_RESYNC_FAILED, + DRBD_A_PEER_DEVICE_STATISTICS_PEER_DEV_BITMAP_UUID, + DRBD_A_PEER_DEVICE_STATISTICS_PEER_DEV_FLAGS = 9, + + __DRBD_A_PEER_DEVICE_STATISTICS_MAX, + DRBD_A_PEER_DEVICE_STATISTICS_MAX = (__DRBD_A_PEER_DEVICE_STATISTICS_MAX - 1) +}; + +enum { + DRBD_A_DRBD_NOTIFICATION_HEADER_NH_TYPE = 1, + + __DRBD_A_DRBD_NOTIFICATION_HEADER_MAX, + DRBD_A_DRBD_NOTIFICATION_HEADER_MAX = (__DRBD_A_DRBD_NOTIFICATION_HEADER_MAX - 1) +}; + +enum { + DRBD_A_DRBD_HELPER_INFO_HELPER_NAME = 1, + DRBD_A_DRBD_HELPER_INFO_HELPER_STATUS, + + __DRBD_A_DRBD_HELPER_INFO_MAX, + DRBD_A_DRBD_HELPER_INFO_MAX = (__DRBD_A_DRBD_HELPER_INFO_MAX - 1) +}; + +enum { + DRBD_ADM_EVENT = 1, + DRBD_ADM_GET_STATUS, + DRBD_ADM_NEW_MINOR = 5, + DRBD_ADM_DEL_MINOR, + DRBD_ADM_NEW_RESOURCE, + DRBD_ADM_DEL_RESOURCE, + DRBD_ADM_RESOURCE_OPTS, + DRBD_ADM_CONNECT, + DRBD_ADM_DISCONNECT, + DRBD_ADM_ATTACH, + DRBD_ADM_RESIZE, + DRBD_ADM_PRIMARY, + DRBD_ADM_SECONDARY, + DRBD_ADM_NEW_C_UUID, + DRBD_ADM_START_OV, + DRBD_ADM_DETACH, + DRBD_ADM_INVALIDATE, + DRBD_ADM_INVAL_PEER, + DRBD_ADM_PAUSE_SYNC, + DRBD_ADM_RESUME_SYNC, + DRBD_ADM_SUSPEND_IO, + DRBD_ADM_RESUME_IO, + DRBD_ADM_OUTDATE, + DRBD_ADM_GET_TIMEOUT_TYPE, + DRBD_ADM_DOWN, + DRBD_ADM_CHG_DISK_OPTS, + DRBD_ADM_CHG_NET_OPTS, + DRBD_ADM_GET_RESOURCES, + DRBD_ADM_GET_DEVICES, + DRBD_ADM_GET_CONNECTIONS, + DRBD_ADM_GET_PEER_DEVICES, + DRBD_ADM_RESOURCE_STATE, + DRBD_ADM_DEVICE_STATE, + DRBD_ADM_CONNECTION_STATE, + DRBD_ADM_PEER_DEVICE_STATE, + DRBD_ADM_GET_INITIAL_STATE, + DRBD_ADM_HELPER = 40, + DRBD_ADM_INITIAL_STATE_DONE, + + __DRBD_ADM_MAX, + DRBD_ADM_MAX = (__DRBD_ADM_MAX - 1) +}; + +#define DRBD_MCGRP_EVENTS "events" + +#endif /* _UAPI_LINUX_DRBD_GENL_H */ -- cgit v1.2.3 From 5796d9fe0b883327d629f675894c47a1c7108d41 Mon Sep 17 00:00:00 2001 From: Moshe Shemesh Date: Wed, 6 May 2026 16:32:38 +0300 Subject: net/mlx5: Make debugfs page counters by function type dynamic Make the per function type debugfs page counters dynamically added after mlx5_eswitch_init(). When page management operates in vhca_id mode, only the function acting as either eSwitch or vport manager can initialize the eSwitch structure and translate the vhca_id to function type for the functions to which it supplies pages. The next patch will add support for page management in vhca_id mode. Signed-off-by: Moshe Shemesh Reviewed-by: Akiva Goldberger Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260506133239.276237-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski --- include/linux/mlx5/driver.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index 531ce66fc8ef..d1751c5d01c7 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -1039,6 +1039,8 @@ void mlx5_pagealloc_start(struct mlx5_core_dev *dev); void mlx5_pagealloc_stop(struct mlx5_core_dev *dev); void mlx5_pages_debugfs_init(struct mlx5_core_dev *dev); void mlx5_pages_debugfs_cleanup(struct mlx5_core_dev *dev); +void mlx5_pages_by_func_type_debugfs_init(struct mlx5_core_dev *dev); +void mlx5_pages_by_func_type_debugfs_cleanup(struct mlx5_core_dev *dev); int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot); int mlx5_reclaim_startup_pages(struct mlx5_core_dev *dev); void mlx5_register_debugfs(void); -- cgit v1.2.3 From 1fba57c91416d8e06aae9f36382f6be2513c2c0f Mon Sep 17 00:00:00 2001 From: Moshe Shemesh Date: Wed, 6 May 2026 16:32:39 +0300 Subject: net/mlx5: Add VHCA_ID page management mode support Add support for VHCA_ID-based page management mode. When the device firmware advertises the icm_mng_function_id_mode capability with MLX5_ID_MODE_FUNCTION_VHCA_ID, page management operations between the driver and firmware may use vhca_id instead of function_id as the effective function identifier, and the ec_function field is ignored. Update page management commands to conditionally set ec_function field only in FUNC_ID mode. Boot page allocation always uses FUNC_ID mode semantics for backward compatibility, as the capability bit is only available after set_hca_cap(). If after set_hca_cap() VHCA_ID mode was set, modify the tracking of the boot pages in page_root_xa to use vhca_id too. Add mlx5_esw_vhca_id_to_func_type() to resolve the function type in VHCA_ID mode, enabling per-type debugfs counters. Use a dedicated vhca_type_map xarray, to provide lockless lookup. Store the resolved type on each fw_page at allocation time so reclaim and release paths read it directly without any lookup. Signed-off-by: Moshe Shemesh Reviewed-by: Akiva Goldberger Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260506133239.276237-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski --- include/linux/mlx5/driver.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index d1751c5d01c7..8b4d384125d1 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -558,6 +558,12 @@ enum mlx5_func_type { MLX5_HOST_PF, MLX5_EC_VF, MLX5_FUNC_TYPE_NUM, + MLX5_FUNC_TYPE_NONE = MLX5_FUNC_TYPE_NUM, +}; + +enum mlx5_page_mgt_mode { + MLX5_PAGE_MGT_MODE_FUNC_ID, + MLX5_PAGE_MGT_MODE_VHCA_ID, }; struct mlx5_frag_buf_node_pools; @@ -578,6 +584,7 @@ struct mlx5_priv { u32 fw_pages_alloc_failed; u32 give_pages_dropped; u32 reclaim_pages_discard; + enum mlx5_page_mgt_mode page_mgt_mode; struct mlx5_core_health health; struct list_head traps; -- cgit v1.2.3 From 928f6a0b1d88e526d5e8a6734e95ef20705fa98b Mon Sep 17 00:00:00 2001 From: Komal Bajaj Date: Tue, 28 Apr 2026 14:47:46 +0530 Subject: dt-bindings: arm: qcom,ids: Add SoC ID for Shikra IoT variants Document the IDs used by Shikra SoC IoT variants: - CQ2390M: Shikra Retail with modem - CQ2390S: Shikra Retail without modem - IQ2390S: Shikra Industrial without modem Signed-off-by: Komal Bajaj Reviewed-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260428-shikra-socid-v1-1-6ff16bad5ea2@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/arm/qcom,ids.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/arm/qcom,ids.h b/include/dt-bindings/arm/qcom,ids.h index 336f7bb7188a..c300ffb4a6a5 100644 --- a/include/dt-bindings/arm/qcom,ids.h +++ b/include/dt-bindings/arm/qcom,ids.h @@ -299,6 +299,9 @@ #define QCOM_ID_QCS615 680 #define QCOM_ID_CQ7790M 731 #define QCOM_ID_CQ7790S 732 +#define QCOM_ID_CQ2390M 756 +#define QCOM_ID_CQ2390S 758 +#define QCOM_ID_IQ2390S 759 #define QCOM_ID_IPQ5200 765 #define QCOM_ID_IPQ5210 766 #define QCOM_ID_QCF2200 767 -- cgit v1.2.3 From db6ae6650cfdf085e21a477c25386125075b2351 Mon Sep 17 00:00:00 2001 From: Nickolay Goppen Date: Wed, 29 Apr 2026 12:30:08 +0300 Subject: dt-bindings: firmware: qcom: scm: add CP_ADSP_SHARED VMID CP_ADSP_SHARED is used in FastRPC driver for older SoC's such as sdm660 for interacting with ADSP memory region [1] [1]: https://github.com/xiaomi-sdm660/android_kernel_xiaomi_sdm660/blob/11-EAS/drivers/char/adsprpc.c#L3602 Acked-by: Krzysztof Kozlowski Signed-off-by: Nickolay Goppen Link: https://lore.kernel.org/r/20260429-qcom-sdm660-cdsp-adsp-fastrpc-dts-fix-v5-1-16bc82e622ad@mainlining.org Signed-off-by: Bjorn Andersson --- include/dt-bindings/firmware/qcom,scm.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/dt-bindings/firmware/qcom,scm.h b/include/dt-bindings/firmware/qcom,scm.h index 6de8b08e1e79..0d29d8d4829c 100644 --- a/include/dt-bindings/firmware/qcom,scm.h +++ b/include/dt-bindings/firmware/qcom,scm.h @@ -35,5 +35,6 @@ #define QCOM_SCM_VMID_NAV 0x2B #define QCOM_SCM_VMID_TVM 0x2D #define QCOM_SCM_VMID_OEMVM 0x31 +#define QCOM_SCM_VMID_CP_ADSP_SHARED 0x33 #endif -- cgit v1.2.3 From 8baf66cc4ca9bb72e97254af62ec8306225bb2f5 Mon Sep 17 00:00:00 2001 From: Kathiravan Thirumoorthy Date: Wed, 8 Apr 2026 15:28:34 +0530 Subject: dt-bindings: arm: qcom,ids: add SOC IDs for IPQ9650 family Add SoC IDs for Qualcomm's IPQ9650 family. Signed-off-by: Kathiravan Thirumoorthy Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260408-ipq9650_soc_ids-v1-1-e76faac33f77@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/arm/qcom,ids.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/arm/qcom,ids.h b/include/dt-bindings/arm/qcom,ids.h index c300ffb4a6a5..bc65e233eb93 100644 --- a/include/dt-bindings/arm/qcom,ids.h +++ b/include/dt-bindings/arm/qcom,ids.h @@ -307,6 +307,12 @@ #define QCOM_ID_QCF2200 767 #define QCOM_ID_QCF3200 768 #define QCOM_ID_QCF3210 769 +#define QCOM_ID_IPQ9620 770 +#define QCOM_ID_IPQ9650 771 +#define QCOM_ID_IPQ9610 778 +#define QCOM_ID_IPQ9630 779 +#define QCOM_ID_IPQ9640 780 +#define QCOM_ID_IPQ9670 781 /* * The board type and revision information, used by Qualcomm bootloaders and -- cgit v1.2.3 From 95e3c6fe707ece757a7294779781958b35b5f3b7 Mon Sep 17 00:00:00 2001 From: Raj Aryan Date: Thu, 7 May 2026 19:27:15 +0530 Subject: soc: qcom: spmi-pmic: add SUBTYPEs for Glymur/Kaanapali/SM8750 PMICs On Glymur, Kaanapali, and SM8750, PMIC info is not being properly populated in qcom_socinfo. Its shows `unknown` as PMIC subtypes are not updated in the socinfo. root@glymur-crd:/sys/kernel/debug/qcom_socinfo# cat pmic_model unknown (92) root@glymur-crd:/sys/kernel/debug/qcom_socinfo# cat pmic_model_array unknown (92) unknown (93) unknown (98) unknown (98) unknown (97) unknown (97) unknown (96) unknown (96) Update the SUBTYPE info for PMICs present on Glymur,Kaanapali and SM8750 boards, to fix this issue. Also, there are some PMIC subtypes present in the socinfo but not present in the spmi header file, add these entries to keep both definitions aligned. Signed-off-by: Raj Aryan Link: https://lore.kernel.org/r/20260507-fury-v1-1-d24e4bb5b774@qti.qualcomm.com Signed-off-by: Bjorn Andersson --- include/soc/qcom/qcom-spmi-pmic.h | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/soc/qcom/qcom-spmi-pmic.h b/include/soc/qcom/qcom-spmi-pmic.h index 2cf9e2d8cd55..997fa18d70fe 100644 --- a/include/soc/qcom/qcom-spmi-pmic.h +++ b/include/soc/qcom/qcom-spmi-pmic.h @@ -50,9 +50,22 @@ #define PMR735B_SUBTYPE 0x34 #define PM6350_SUBTYPE 0x36 #define PM4125_SUBTYPE 0x37 +#define PM8010_SUBTYPE 0x41 +#define PM8550VS_SUBTYPE 0x45 +#define PM8550VE_SUBTYPE 0x46 +#define PMR735D_SUBTYPE 0x48 +#define PM8550_SUBTYPE 0x49 +#define PMK8550_SUBTYPE 0x4a #define PMM8650AU_SUBTYPE 0x4e #define PMM8650AU_PSAIL_SUBTYPE 0x4f - +#define PM8750B_SUBTYPE 0x56 +#define PMD8028_SUBTYPE 0x57 +#define PMK8850_SUBTYPE 0x5c +#define PMH0101_SUBTYPE 0x5d +#define SMB2370_SUBTYPE 0x5f +#define PMH0104_SUBTYPE 0x60 +#define PMH0110_SUBTYPE 0x61 +#define PMCX0102_SUBTYPE 0x62 #define PMI8998_FAB_ID_SMIC 0x11 #define PMI8998_FAB_ID_GF 0x30 -- cgit v1.2.3 From 0f90f883b340402e44ee2a9fa9f75ecb7c075a4f Mon Sep 17 00:00:00 2001 From: Raviteja Laggyshetty Date: Tue, 5 May 2026 16:41:11 +0000 Subject: dt-bindings: interconnect: document the RPM Network-On-Chip interconnect in Shikra SoC Document the RPM Network-On-Chip Interconnect for the Qualcomm Shikra platform. Co-developed-by: Odelu Kukatla Signed-off-by: Odelu Kukatla Reviewed-by: Krzysztof Kozlowski Signed-off-by: Raviteja Laggyshetty Link: https://patch.msgid.link/20260505-shikra_icc-v3-1-8e03ff27c007@oss.qualcomm.com Signed-off-by: Georgi Djakov --- include/dt-bindings/interconnect/qcom,shikra.h | 121 +++++++++++++++++++++++++ 1 file changed, 121 insertions(+) create mode 100644 include/dt-bindings/interconnect/qcom,shikra.h (limited to 'include') diff --git a/include/dt-bindings/interconnect/qcom,shikra.h b/include/dt-bindings/interconnect/qcom,shikra.h new file mode 100644 index 000000000000..a42ea22ee162 --- /dev/null +++ b/include/dt-bindings/interconnect/qcom,shikra.h @@ -0,0 +1,121 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __DT_BINDINGS_INTERCONNECT_QCOM_SHIKRA_H +#define __DT_BINDINGS_INTERCONNECT_QCOM_SHIKRA_H + +#define MASTER_QUP_CORE_0 0 +#define SLAVE_QUP_CORE_0 1 + +#define SNOC_CNOC_MAS 0 +#define MASTER_QDSS_DAP 1 +#define SLAVE_AHB2PHY_USB 2 +#define SLAVE_APSS_THROTTLE_CFG 3 +#define SLAVE_AUDIO 4 +#define SLAVE_BOOT_ROM 5 +#define SLAVE_CAMERA_NRT_THROTTLE_CFG 6 +#define SLAVE_CAMERA_CFG 7 +#define SLAVE_CDSP_THROTTLE_CFG 8 +#define SLAVE_CLK_CTL 9 +#define SLAVE_DSP_CFG 10 +#define SLAVE_RBCPR_CX_CFG 11 +#define SLAVE_RBCPR_MX_CFG 12 +#define SLAVE_CRYPTO_0_CFG 13 +#define SLAVE_DDR_SS_CFG 14 +#define SLAVE_DISPLAY_CFG 15 +#define SLAVE_EMAC0_CFG 16 +#define SLAVE_EMAC1_CFG 17 +#define SLAVE_GPU_CFG 18 +#define SLAVE_GPU_THROTTLE_CFG 19 +#define SLAVE_HWKM 20 +#define SLAVE_IMEM_CFG 21 +#define SLAVE_MAPSS 22 +#define SLAVE_MDSP_MPU_CFG 23 +#define SLAVE_MESSAGE_RAM 24 +#define SLAVE_MSS 25 +#define SLAVE_PCIE_CFG 26 +#define SLAVE_PDM 27 +#define SLAVE_PIMEM_CFG 28 +#define SLAVE_PKA_WRAPPER_CFG 29 +#define SLAVE_PMIC_ARB 30 +#define SLAVE_QDSS_CFG 31 +#define SLAVE_QM_CFG 32 +#define SLAVE_QM_MPU_CFG 33 +#define SLAVE_QPIC 34 +#define SLAVE_QUP_0 35 +#define SLAVE_RPM 36 +#define SLAVE_SDCC_1 37 +#define SLAVE_SDCC_2 38 +#define SLAVE_SECURITY 39 +#define SLAVE_SNOC_CFG 40 +#define SNOC_SF_THROTTLE_CFG 41 +#define SLAVE_TLMM 42 +#define SLAVE_TSCSS 43 +#define SLAVE_USB2 44 +#define SLAVE_USB3 45 +#define SLAVE_VENUS_CFG 46 +#define SLAVE_VENUS_THROTTLE_CFG 47 +#define SLAVE_VSENSE_CTRL_CFG 48 +#define SLAVE_SERVICE_CNOC 49 + +#define MASTER_LLCC 0 +#define SLAVE_EBI_CH0 1 + +#define MASTER_GRAPHICS_3D 0 +#define MASTER_MNOC_HF_MEM_NOC 1 +#define MASTER_ANOC_PCIE_MEM_NOC 2 +#define MASTER_SNOC_SF_MEM_NOC 3 +#define MASTER_AMPSS_M0 4 +#define MASTER_SYS_TCU 5 +#define SLAVE_LLCC 6 +#define SLAVE_MEMNOC_SNOC 7 +#define SLAVE_MEM_NOC_PCIE_SNOC 8 + +#define MASTER_CAMNOC_SF 0 +#define MASTER_VIDEO_P0 1 +#define MASTER_VIDEO_PROC 2 +#define SLAVE_MMNRT_VIRT 3 + +#define MASTER_CAMNOC_HF 0 +#define MASTER_MDP_PORT0 1 +#define MASTER_MMRT_VIRT 2 +#define SLAVE_MM_MEMNOC 3 + +#define MASTER_SNOC_CFG 0 +#define MASTER_TIC 1 +#define MASTER_ANOC_SNOC 2 +#define MASTER_MEMNOC_PCIE 3 +#define MASTER_MEMNOC_SNOC 4 +#define MASTER_PIMEM 5 +#define MASTER_PCIE2_0 6 +#define MASTER_QDSS_BAM 7 +#define MASTER_QPIC 8 +#define MASTER_QUP_0 9 +#define CNOC_SNOC_MAS 10 +#define MASTER_AUDIO 11 +#define MASTER_EMAC_0 12 +#define MASTER_EMAC_1 13 +#define MASTER_QDSS_ETR 14 +#define MASTER_SDCC_1 15 +#define MASTER_SDCC_2 16 +#define MASTER_USB2_0 17 +#define MASTER_USB3 18 +#define MASTER_CRYPTO_CORE0 19 +#define SLAVE_APPSS 20 +#define SLAVE_MCUSS 21 +#define SLAVE_WCSS 22 +#define SLAVE_MEMNOC_SF 23 +#define SNOC_CNOC_SLV 24 +#define SLAVE_BOOTIMEM 25 +#define SLAVE_OCIMEM 26 +#define SLAVE_PIMEM 27 +#define SLAVE_SERVICE_SNOC 28 +#define SLAVE_PCIE2_0 29 +#define SLAVE_QDSS_STM 30 +#define SLAVE_TCU 31 +#define SLAVE_PCIE_MEMNOC 32 +#define SLAVE_ANOC_SNOC 33 + +#endif -- cgit v1.2.3 From 8d315860b5cce17559151d04b1d85022f0bb15a2 Mon Sep 17 00:00:00 2001 From: Odelu Kukatla Date: Sun, 10 May 2026 10:06:06 +0800 Subject: dt-bindings: interconnect: Document RPMh Network-On-Chip for Qualcomm Nord SoC Add RPMh Network-On-Chip interconnect bindings for Qualcomm Nord SoC. Signed-off-by: Odelu Kukatla Reviewed-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo Link: https://patch.msgid.link/20260510020607.1129773-2-shengchao.guo@oss.qualcomm.com Signed-off-by: Georgi Djakov --- include/dt-bindings/interconnect/qcom,nord-rpmh.h | 217 ++++++++++++++++++++++ 1 file changed, 217 insertions(+) create mode 100644 include/dt-bindings/interconnect/qcom,nord-rpmh.h (limited to 'include') diff --git a/include/dt-bindings/interconnect/qcom,nord-rpmh.h b/include/dt-bindings/interconnect/qcom,nord-rpmh.h new file mode 100644 index 000000000000..5bdce6a9bab7 --- /dev/null +++ b/include/dt-bindings/interconnect/qcom,nord-rpmh.h @@ -0,0 +1,217 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __DT_BINDINGS_INTERCONNECT_QCOM_NORD_H +#define __DT_BINDINGS_INTERCONNECT_QCOM_NORD_H + +#define MASTER_QSPI_0 0 +#define MASTER_SAILSS_MD1 1 +#define MASTER_QUP_3 2 +#define SLAVE_A1NOC_SNOC 3 + +#define MASTER_QUP_2 0 +#define MASTER_CRYPTO_CORE0 1 +#define MASTER_CRYPTO_CORE1 2 +#define MASTER_CRYPTO_CORE2 3 +#define MASTER_SDCC_4 4 +#define MASTER_UFS_MEM 5 +#define MASTER_USB2 6 +#define MASTER_USB3_0 7 +#define MASTER_USB3_1 8 +#define SLAVE_A1NOC_HSCNOC 9 + +#define MASTER_IPA 0 +#define MASTER_SOCCP_AGGR_NOC 1 +#define MASTER_QDSS_ETR 2 +#define MASTER_QDSS_ETR_1 3 +#define SLAVE_A2NOC_SNOC 4 + +#define MASTER_QUP_0 0 +#define MASTER_QUP_1 1 +#define MASTER_EMAC_0 2 +#define MASTER_EMAC_1 3 +#define SLAVE_A2NOC_HSCNOC 4 + +#define MASTER_QUP_CORE_0 0 +#define MASTER_QUP_CORE_1 1 +#define MASTER_QUP_CORE_2 2 +#define MASTER_QUP_CORE_3 3 +#define SLAVE_QUP_CORE_0 4 +#define SLAVE_QUP_CORE_1 5 +#define SLAVE_QUP_CORE_2 6 +#define SLAVE_QUP_CORE_3 7 + +#define MASTER_CNOC_CFG 0 +#define SLAVE_PS_ETH_0 1 +#define SLAVE_PS_ETH_1 2 +#define SLAVE_SHS_SERVER 3 +#define SLAVE_AHB2PHY_0 4 +#define SLAVE_AHB2PHY_1 5 +#define SLAVE_AHB2PHY_2 6 +#define SLAVE_AHB2PHY_3 7 +#define SLAVE_AHB2PHY_ETH_0 8 +#define SLAVE_AHB2PHY_ETH_1 9 +#define SLAVE_CAMERA_CFG 10 +#define SLAVE_CLK_CTL 11 +#define SLAVE_CRYPTO_0_CFG 12 +#define SLAVE_CRYPTO_1_CFG 13 +#define SLAVE_CRYPTO_2_CFG 14 +#define SLAVE_DISPLAY_1_CFG 15 +#define SLAVE_DISPLAY_CFG 16 +#define SLAVE_DPRX0 17 +#define SLAVE_DPRX1 18 +#define SLAVE_EVA_CFG 19 +#define SLAVE_GFX3D_CFG 20 +#define SLAVE_GFX3D_1_CFG 21 +#define SLAVE_I2C 22 +#define SLAVE_IMEM_CFG 23 +#define SLAVE_MCW_PCIE 24 +#define SLAVE_MM_RSCC 25 +#define SLAVE_NE_CLK_CTL 26 +#define SLAVE_NSPSS0_CFG 27 +#define SLAVE_NSPSS1_CFG 28 +#define SLAVE_NSPSS2_CFG 29 +#define SLAVE_NSPSS3_CFG 30 +#define SLAVE_NW_CLK_CTL 31 +#define SLAVE_PRNG 32 +#define SLAVE_QDSS_CFG 33 +#define SLAVE_QSPI_0 34 +#define SLAVE_QUP_0 35 +#define SLAVE_QUP_3 36 +#define SLAVE_QUP_1 37 +#define SLAVE_QUP_2 38 +#define SLAVE_SAFEDMA_CFG 39 +#define SLAVE_SDCC_4 40 +#define SLAVE_SE_CLK_CTL 41 +#define SLAVE_TCSR 42 +#define SLAVE_TLMM 43 +#define SLAVE_TSC_CFG 44 +#define SLAVE_UFS_MEM_CFG 45 +#define SLAVE_USB2 46 +#define SLAVE_USB3_0 47 +#define SLAVE_USB3_1 48 +#define SLAVE_VENUS_CFG 49 +#define SLAVE_COMPUTENOC_CFG 50 +#define SLAVE_PCIE_NOC_CFG 51 +#define SLAVE_QTC_CFG 52 +#define SLAVE_QDSS_STM 53 +#define SLAVE_SYS_TCU0_CFG 54 +#define SLAVE_SYS_TCU1_CFG 55 +#define SLAVE_SYS_TCU2_CFG 56 + +#define MASTER_MM_RSCC 0 +#define MASTER_HSCNOC_CNOC 1 +#define SLAVE_AOSS 2 +#define SLAVE_HBCU 3 +#define SLAVE_IPA_CFG 4 +#define SLAVE_IPC_ROUTER_CFG 5 +#define SLAVE_SOCCP 6 +#define SLAVE_TME_CFG 7 +#define SLAVE_PCIE_DMA 8 +#define SLAVE_CNOC_CFG 9 +#define SLAVE_DDRSS_CFG 10 +#define SLAVE_IMEM 11 + +#define MASTER_HPASS_PROC_0 0 +#define MASTER_HPASS_PROC_1 1 +#define MASTER_HPASS_PROC_2 2 +#define SLAVE_HPASS_AGNOC_AUDIO 3 + +#define MASTER_GPU_TCU 0 +#define MASTER_QTC_TCU 1 +#define MASTER_SYS_TCU_0 2 +#define MASTER_SYS_TCU_1 3 +#define MASTER_SYS_TCU_2 4 +#define MASTER_APPSS_PROC 5 +#define MASTER_A1NOC_TILE_HSCNOC 6 +#define MASTER_A2NOC_TILE_HSCNOC 7 +#define MASTER_GFX3D 8 +#define MASTER_GFX3D_1 9 +#define MASTER_HPASS_ADAS_HSCNOC 10 +#define MASTER_HPASS_AUDIO_HSCNOC 11 +#define MASTER_MNOC_HF_MEM_NOC 12 +#define MASTER_MNOC_SF_MEM_NOC 13 +#define MASTER_NSP0_HSCNOC 14 +#define MASTER_NSP1_HSCNOC 15 +#define MASTER_NSP2_HSCNOC 16 +#define MASTER_NSP3_HSCNOC 17 +#define MASTER_ANOC_PCIE_GEM_NOC 18 +#define MASTER_SAILSS_MD0_HSCNOC 19 +#define MASTER_SNOC_SF_MEM_NOC 20 +#define MASTER_GIC 21 +#define SLAVE_HSCNOC_CNOC 22 +#define SLAVE_LLCC 23 +#define SLAVE_MEM_NOC_PCIE_SNOC 24 + +#define MASTER_LLCC 0 +#define SLAVE_EBI1 1 + +#define MASTER_CAMNOC_HF 0 +#define MASTER_CAMNOC_NRT_ICP_SF 1 +#define MASTER_CAMNOC_RT_CDM_SF 2 +#define MASTER_CAMNOC_SF 3 +#define MASTER_DPRX0 4 +#define MASTER_DPRX1 5 +#define MASTER_MDP0 6 +#define MASTER_MDP1 7 +#define MASTER_VIDEO_CV_PROC 8 +#define MASTER_VIDEO_EVA 9 +#define MASTER_VIDEO_MVP0 10 +#define MASTER_VIDEO_MVP1 11 +#define MASTER_VIDEO_V_PROC 12 +#define SLAVE_MNOC_HF_MEM_NOC 13 +#define SLAVE_MNOC_SF_MEM_NOC 14 + +#define MASTER_NSP0_PROC 0 +#define SLAVE_NSP0_HSC_NOC 1 + +#define MASTER_NSP1_PROC 0 +#define SLAVE_NSP1_HSC_NOC 1 + +#define MASTER_NSP2_PROC 0 +#define SLAVE_NSP2_HSC_NOC 1 + +#define MASTER_NSP3_PROC 0 +#define SLAVE_NSP3_HSC_NOC 1 + +#define MASTER_PCIE_NOC_CFG 0 +#define SLAVE_PCIE_AHB2PHY_CFG 1 +#define SLAVE_PCIE_CFG_0 2 +#define SLAVE_PCIE_CFG_1 3 +#define SLAVE_PCIE_CFG_2 4 +#define SLAVE_PCIE_CFG_3 5 +#define SLAVE_PCIE_DMA_0_CFG 6 +#define SLAVE_PCIE_DMA_1_CFG 7 +#define SLAVE_PCIE_DMA_2_CFG 8 + +#define MASTER_PCIE_DMA_0 0 +#define MASTER_PCIE_DMA_1 1 +#define MASTER_PCIE_DMA_2 2 +#define MASTER_PCIE_0 3 +#define MASTER_PCIE_1 4 +#define MASTER_PCIE_2 5 +#define MASTER_PCIE_3 6 +#define SLAVE_PCIE_HSCNOC 7 +#define SLAVE_PCIE_OBNOC_DMA 8 + +#define MASTER_CNOC_PCIE_DMA 0 +#define MASTER_ANOC_PCIE_HSCNOC 1 +#define MASTER_PCIE_IBNOC_DMA 2 +#define SLAVE_PCIE_DMA_0 3 +#define SLAVE_PCIE_DMA_1 4 +#define SLAVE_PCIE_DMA_2 5 +#define SLAVE_PCIE_0 6 +#define SLAVE_PCIE_1 7 +#define SLAVE_PCIE_2 8 +#define SLAVE_PCIE_3 9 + +#define MASTER_A1NOC_SNOC 0 +#define MASTER_A2NOC_SNOC 1 +#define MASTER_CNOC_SNOC 2 +#define MASTER_NSINOC_SNOC 3 +#define MASTER_SAFE_DMA 4 +#define SLAVE_SNOC_HSCNOC_SF 5 + +#endif -- cgit v1.2.3 From 19d584a634fe999786acfb0ac5289710cc84a5f6 Mon Sep 17 00:00:00 2001 From: Robert Ancell Date: Mon, 4 May 2026 11:53:27 +1200 Subject: drm/fourcc: Fix descriptions of 32b float formats The channels were described in reverse format, i.e. RGBA instead of ABGR Signed-off-by: Robert Ancell CC: Rob Clark Reviewed-by: Simon Ser Signed-off-by: Simon Ser Link: https://patch.msgid.link/20260503235327.92428-1-robert.ancell@canonical.com --- include/uapi/drm/drm_fourcc.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h index 15aa0a8f44b0..3a4d4dc635bf 100644 --- a/include/uapi/drm/drm_fourcc.h +++ b/include/uapi/drm/drm_fourcc.h @@ -224,9 +224,9 @@ extern "C" { * [31:0] sign:exponent:mantissa 1:8:23 */ #define DRM_FORMAT_R32F fourcc_code('R', ' ', ' ', 'F') /* [31:0] R 32 little endian */ -#define DRM_FORMAT_GR3232F fourcc_code('G', 'R', ' ', 'F') /* [63:0] R:G 32:32 little endian */ -#define DRM_FORMAT_BGR323232F fourcc_code('B', 'G', 'R', 'F') /* [95:0] R:G:B 32:32:32 little endian */ -#define DRM_FORMAT_ABGR32323232F fourcc_code('A', 'B', '8', 'F') /* [127:0] R:G:B:A 32:32:32:32 little endian */ +#define DRM_FORMAT_GR3232F fourcc_code('G', 'R', ' ', 'F') /* [63:0] G:R 32:32 little endian */ +#define DRM_FORMAT_BGR323232F fourcc_code('B', 'G', 'R', 'F') /* [95:0] B:G:R 32:32:32 little endian */ +#define DRM_FORMAT_ABGR32323232F fourcc_code('A', 'B', '8', 'F') /* [127:0] A:B:G:R 32:32:32:32 little endian */ /* * RGBA format with 10-bit components packed in 64-bit per pixel, with 6 bits -- cgit v1.2.3 From 42d99857d6f08a40a8bde7b9e68d330f18b159a0 Mon Sep 17 00:00:00 2001 From: Cezary Rojewski Date: Thu, 30 Apr 2026 16:07:52 +0200 Subject: ASoC: core: Move all users to deferrable card binding Commit a3375522bb5e2 ("ASoC: core: Complete support for card rebinding") completed the feature and at the same time divided ASoC users into two groups: 1) cards that fail to enumerate the moment one of the components is not available 2) cards that succeed to enumerate even if some of their components become available late Given the component-based nature of ASoC, approach 2) is preferred and can be used by all ASoC users. By dropping 1) the card binding code can also be simplified. Flatten code that is currently conditional based on ->devres_dev and convert snd_soc_rebind_card() to call_soc_bind_card(). The latter is a selector between managed and unmanaged card-binding behaviour to keep non-devm users happy. With rebinding being the default, devm_snd_soc_register_card() takes form of its deferrable friend - all the devm job is already done by devm_snd_soc_bind_card(). Suggested-by: Kuninori Morimoto Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20260430140752.766130-1-cezary.rojewski@intel.com Signed-off-by: Mark Brown --- include/sound/soc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/sound/soc.h b/include/sound/soc.h index 5e3eb617d832..50d1fd110a4a 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -431,7 +431,7 @@ struct snd_soc_jack_pin; int snd_soc_register_card(struct snd_soc_card *card); void snd_soc_unregister_card(struct snd_soc_card *card); int devm_snd_soc_register_card(struct device *dev, struct snd_soc_card *card); -int devm_snd_soc_register_deferrable_card(struct device *dev, struct snd_soc_card *card); +#define devm_snd_soc_register_deferrable_card(d, c) devm_snd_soc_register_card(d, c) #ifdef CONFIG_PM_SLEEP int snd_soc_suspend(struct device *dev); int snd_soc_resume(struct device *dev); -- cgit v1.2.3 From c40f5f9927b5bf6062daa1e293ae32d83afc963e Mon Sep 17 00:00:00 2001 From: Tzung-Bi Shih Date: Tue, 7 Apr 2026 10:26:15 +0000 Subject: platform/chrome: Resolve kb_wake_angle visibility race A race condition exists between the probe of cros-ec-sysfs and cros-ec-sensorhub. The `kb_wake_angle` attribute should only be visible if the sensor hub detects two or more accelerometers. If cros_ec_sysfs_probe() runs before cros_ec_sensorhub_register() completes sensor enumeration, the sysfs attributes are created while `has_kb_wake_angle` is still false, hiding `kb_wake_angle` incorrectly. Store the created attribute group pointer in `ec_dev->group`. When the sensor hub completes sensor enumeration, it checks for this group and calls sysfs_update_group() to notify the sysfs core to re-evaluate attribute visibility. This ensures the `kb_wake_angle` attribute visibility is correctly updated regardless of the driver probe order. Co-developed-by: Gwendal Grignou Signed-off-by: Gwendal Grignou Link: https://lore.kernel.org/r/20260407102615.1605317-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih --- include/linux/platform_data/cros_ec_proto.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/platform_data/cros_ec_proto.h b/include/linux/platform_data/cros_ec_proto.h index de14923720a5..6ed1c4c5ce2e 100644 --- a/include/linux/platform_data/cros_ec_proto.h +++ b/include/linux/platform_data/cros_ec_proto.h @@ -228,6 +228,7 @@ struct cros_ec_platform { /** * struct cros_ec_dev - ChromeOS EC device entry point. * @class_dev: Device structure used in sysfs. + * @group: sysfs attributes groups for this EC. * @ec_dev: cros_ec_device structure to talk to the physical device. * @dev: Pointer to the platform device. * @debug_info: cros_ec_debugfs structure for debugging information. @@ -237,6 +238,7 @@ struct cros_ec_platform { */ struct cros_ec_dev { struct device class_dev; + const struct attribute_group *group; struct cros_ec_device *ec_dev; struct device *dev; struct cros_ec_debugfs *debug_info; -- cgit v1.2.3 From fe417df954a923937c0ace237e37ce750c16a99f Mon Sep 17 00:00:00 2001 From: Albert Esteve Date: Fri, 8 May 2026 09:04:50 +0200 Subject: drm/panel: Make drm_panel_init() static Now that all panel drivers use devm_drm_panel_alloc(), there are no external callers of drm_panel_init(). Make it static to prevent new users from bypassing the refcounted allocation path. Remove stale references to drm_panel_init() in kdocs. Reviewed-by: Maxime Ripard Signed-off-by: Albert Esteve Reviewed-by: Dmitry Baryshkov Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260508-drm_panel_init_rm-v2-10-0bd4ac429971@redhat.com Signed-off-by: Maxime Ripard --- include/drm/drm_panel.h | 4 ---- 1 file changed, 4 deletions(-) (limited to 'include') diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h index 1fb9148dd095..86b3f9c65c92 100644 --- a/include/drm/drm_panel.h +++ b/include/drm/drm_panel.h @@ -320,10 +320,6 @@ void *__devm_drm_panel_alloc(struct device *dev, size_t size, size_t offset, offsetof(type, member), funcs, \ connector_type)) -void drm_panel_init(struct drm_panel *panel, struct device *dev, - const struct drm_panel_funcs *funcs, - int connector_type); - struct drm_panel *drm_panel_get(struct drm_panel *panel); void drm_panel_put(struct drm_panel *panel); -- cgit v1.2.3 From f196a86687974cfcc1e8cade99ffca4605141860 Mon Sep 17 00:00:00 2001 From: Fangyu Yu Date: Fri, 17 Apr 2026 22:07:45 +0800 Subject: iommu/riscv: Advertise Svpbmt support to generic page table The RISC-V IOMMU can optionally support Svpbmt page-based memory types in its page table format. When present,the generic page table code can use this capability to encode memory attributes (e.g. MMIO vs normal memory) in PTEs. Signed-off-by: Fangyu Yu Reviewed-by: Jason Gunthorpe Reviewed-by: Anup Patel Reviewed-by: Guo Ren Reviewed-by: Nutty Liu Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel --- include/linux/generic_pt/common.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/generic_pt/common.h b/include/linux/generic_pt/common.h index fc5d0b5edadc..2683e5b38998 100644 --- a/include/linux/generic_pt/common.h +++ b/include/linux/generic_pt/common.h @@ -188,6 +188,10 @@ enum { * Support the 64k contiguous page size following the Svnapot extension. */ PT_FEAT_RISCV_SVNAPOT_64K = PT_FEAT_FMT_START, + /* + * Support Svpbmt extension: encode page-based memory type (PBMT) in PTEs. + */ + PT_FEAT_RISCV_SVPBMT, }; -- cgit v1.2.3 From 59e5e15fef9c3045b16f73419d68b8f6da2c3bc9 Mon Sep 17 00:00:00 2001 From: Ankit Nautiyal Date: Tue, 28 Apr 2026 13:14:49 +0530 Subject: drm/dp: Rename and relocate AS SDP payload field masks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The AS SDP payload field masks were misnamed and placed under the DPRX feature enumeration list. These are not DPRX capability bits, but are payload field masks for the Adaptive Sync SDP. Relocate both masks next to the AS SDP definitions. Update users to the corrected names. No functional change. Signed-off-by: Ankit Nautiyal Reviewed-by: Ville Syrjälä Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260428074457.3566918-2-ankit.k.nautiyal@intel.com --- include/drm/display/drm_dp.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/drm/display/drm_dp.h b/include/drm/display/drm_dp.h index 8b15d3eeb716..4ea3b5b08a12 100644 --- a/include/drm/display/drm_dp.h +++ b/include/drm/display/drm_dp.h @@ -1204,8 +1204,6 @@ #define DP_DPRX_FEATURE_ENUMERATION_LIST_CONT_1 0x2214 /* 2.0 E11 */ # define DP_ADAPTIVE_SYNC_SDP_SUPPORTED (1 << 0) -# define DP_ADAPTIVE_SYNC_SDP_OPERATION_MODE GENMASK(1, 0) -# define DP_ADAPTIVE_SYNC_SDP_LENGTH GENMASK(5, 0) # define DP_AS_SDP_FIRST_HALF_LINE_OR_3840_PIXEL_CYCLE_WINDOW_NOT_SUPPORTED (1 << 1) # define DP_VSC_EXT_SDP_FRAMEWORK_VERSION_1_SUPPORTED (1 << 4) @@ -1870,4 +1868,7 @@ enum operation_mode { DP_AS_SDP_FAVT_TRR_REACHED = 0x03 }; +#define DP_AS_SDP_OPERATION_MODE_MASK GENMASK(1, 0) +#define DP_AS_SDP_LENGTH_MASK GENMASK(5, 0) + #endif /* _DRM_DP_H_ */ -- cgit v1.2.3 From f145a1cfc8850e1ced941297500fc9b9d4b3c1cc Mon Sep 17 00:00:00 2001 From: Ankit Nautiyal Date: Tue, 28 Apr 2026 13:14:50 +0530 Subject: drm/dp: Clean up DPRX feature enumeration macros MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Align the DP_DPRX feature enumeration macros for better readability and consistency, and use the BIT() macro instead of open-coded shifts. Signed-off-by: Ankit Nautiyal Reviewed-by: Ville Syrjälä Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260428074457.3566918-3-ankit.k.nautiyal@intel.com --- include/drm/display/drm_dp.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/drm/display/drm_dp.h b/include/drm/display/drm_dp.h index 4ea3b5b08a12..49f0154eb93c 100644 --- a/include/drm/display/drm_dp.h +++ b/include/drm/display/drm_dp.h @@ -1202,10 +1202,10 @@ # define DP_DPRX_SLEEP_WAKE_TIMEOUT_PERIOD_80_MS 0x04 # define DP_DPRX_SLEEP_WAKE_TIMEOUT_PERIOD_100_MS 0x05 -#define DP_DPRX_FEATURE_ENUMERATION_LIST_CONT_1 0x2214 /* 2.0 E11 */ -# define DP_ADAPTIVE_SYNC_SDP_SUPPORTED (1 << 0) -# define DP_AS_SDP_FIRST_HALF_LINE_OR_3840_PIXEL_CYCLE_WINDOW_NOT_SUPPORTED (1 << 1) -# define DP_VSC_EXT_SDP_FRAMEWORK_VERSION_1_SUPPORTED (1 << 4) +#define DP_DPRX_FEATURE_ENUMERATION_LIST_CONT_1 0x2214 /* 2.0 E11 */ +# define DP_ADAPTIVE_SYNC_SDP_SUPPORTED BIT(0) +# define DP_AS_SDP_FIRST_HALF_LINE_OR_3840_PIXEL_CYCLE_WINDOW_NOT_SUPPORTED BIT(1) +# define DP_VSC_EXT_SDP_FRAMEWORK_VERSION_1_SUPPORTED BIT(4) #define DP_128B132B_SUPPORTED_LINK_RATES 0x2215 /* 2.0 */ # define DP_UHBR10 (1 << 0) -- cgit v1.2.3 From 715e0fd96b83e6638e44d58da95c0120e3c7693d Mon Sep 17 00:00:00 2001 From: Ankit Nautiyal Date: Tue, 28 Apr 2026 13:14:51 +0530 Subject: drm/dp: Add bits for AS SDP FAVT Payload Fields Parsing support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DP v2.1 introduced support for sending AS SDP payload bytes for FAVT. Add the relavant bits for the same. Signed-off-by: Ankit Nautiyal Reviewed-by: Ville Syrjälä Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260428074457.3566918-4-ankit.k.nautiyal@intel.com --- include/drm/display/drm_dp.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/drm/display/drm_dp.h b/include/drm/display/drm_dp.h index 49f0154eb93c..8d172863eba3 100644 --- a/include/drm/display/drm_dp.h +++ b/include/drm/display/drm_dp.h @@ -1205,6 +1205,7 @@ #define DP_DPRX_FEATURE_ENUMERATION_LIST_CONT_1 0x2214 /* 2.0 E11 */ # define DP_ADAPTIVE_SYNC_SDP_SUPPORTED BIT(0) # define DP_AS_SDP_FIRST_HALF_LINE_OR_3840_PIXEL_CYCLE_WINDOW_NOT_SUPPORTED BIT(1) +# define DP_AS_SDP_FAVT_PAYLOAD_FIELDS_PARSING_SUPPORTED BIT(2) /* 2.1 */ # define DP_VSC_EXT_SDP_FRAMEWORK_VERSION_1_SUPPORTED BIT(4) #define DP_128B132B_SUPPORTED_LINK_RATES 0x2215 /* 2.0 */ -- cgit v1.2.3 From 69070f4d2d2a2e5435ae2d4db6f04e7ba429da07 Mon Sep 17 00:00:00 2001 From: Ankit Nautiyal Date: Tue, 28 Apr 2026 13:14:52 +0530 Subject: drm/dp: Add DPCD for configuring AS SDP for PR + VRR MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add additional DPCDs required to be configured to support VRR with Panel Replay. These DPCDs are specifically required for configuring Adaptive Sync SDP and are introduced in DP v2.1. v2: - Correct the shift for the bits. (Ville) - Add DP_PR_ prefix for the PR-related fields. v3: - Use macro values in their shifted form to match the convention. (Ville) v4: - Add macro for the mask. (Ville) Signed-off-by: Ankit Nautiyal Reviewed-by: Ville Syrjälä Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260428074457.3566918-5-ankit.k.nautiyal@intel.com --- include/drm/display/drm_dp.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/drm/display/drm_dp.h b/include/drm/display/drm_dp.h index 8d172863eba3..829e4d98d61c 100644 --- a/include/drm/display/drm_dp.h +++ b/include/drm/display/drm_dp.h @@ -718,6 +718,12 @@ #define DP_EXTENDED_DPRX_SLEEP_WAKE_TIMEOUT_GRANT 0x119 /* 1.4a */ # define DP_DPRX_SLEEP_WAKE_TIMEOUT_PERIOD_GRANTED (1 << 0) +#define PANEL_REPLAY_CONFIG3 0x11a /* DP 2.1 */ +# define DP_PR_AS_SDP_SETUP_TIME_MASK (3 << 6) +# define DP_PR_AS_SDP_SETUP_TIME_T1 (0 << 6) +# define DP_PR_AS_SDP_SETUP_TIME_DYNAMIC (1 << 6) /* DP 2.1 Table 2-227 */ +# define DP_PR_AS_SDP_SETUP_TIME_T2 (2 << 6) + #define DP_FEC_CONFIGURATION 0x120 /* 1.4 */ # define DP_FEC_READY (1 << 0) # define DP_FEC_ERR_COUNT_SEL_MASK (7 << 1) -- cgit v1.2.3 From e878adca8477b4f6d51dee257c2ef3d2ad0086a5 Mon Sep 17 00:00:00 2001 From: Ankit Nautiyal Date: Tue, 28 Apr 2026 13:14:54 +0530 Subject: drm/dp: Store coasting vtotal in struct drm_dp_as_sdp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add new field in struct drm_dp_as_sdp to store coasting vtotal. This is used by the sinks that support Panel Replay and Asynchronous timing during PR Active to derive refresh rate, when AS SDP transmission is stopped by the source. Signed-off-by: Ankit Nautiyal Reviewed-by: Ville Syrjälä Signed-off-by: Suraj Kandpal Link: https://patch.msgid.link/20260428074457.3566918-7-ankit.k.nautiyal@intel.com --- include/drm/display/drm_dp_helper.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/drm/display/drm_dp_helper.h b/include/drm/display/drm_dp_helper.h index 1d0acd58f486..8c2d77a032f0 100644 --- a/include/drm/display/drm_dp_helper.h +++ b/include/drm/display/drm_dp_helper.h @@ -126,6 +126,7 @@ struct drm_dp_as_sdp { int duration_decr_ms; bool target_rr_divider; enum operation_mode mode; + int coasting_vtotal; }; void drm_dp_as_sdp_log(struct drm_printer *p, -- cgit v1.2.3 From 43d2cd6f61ffc04be19f4c7542554e4d28786a17 Mon Sep 17 00:00:00 2001 From: Biju Das Date: Thu, 30 Apr 2026 10:34:06 +0100 Subject: dt-bindings: pinctrl: renesas: Document RZ/G3L SoC Add documentation for the pin controller found on the Renesas RZ/G3L (R9A08G046) SoC. The RZ/G3L PFC is similar to the RZ/G3S SoC but has more pins. Also add header file similar to RZ/G3E and RZ/V2H as it has alpha numeric ports. Document renesas,clonech property for controlling clone channel control register located on SYSC IP block on RZ/G3L SoC. Acked-by: Conor Dooley Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260430093422.74812-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven --- .../pinctrl/renesas,r9a08g046-pinctrl.h | 38 ++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 include/dt-bindings/pinctrl/renesas,r9a08g046-pinctrl.h (limited to 'include') diff --git a/include/dt-bindings/pinctrl/renesas,r9a08g046-pinctrl.h b/include/dt-bindings/pinctrl/renesas,r9a08g046-pinctrl.h new file mode 100644 index 000000000000..5ec5bfc27c7d --- /dev/null +++ b/include/dt-bindings/pinctrl/renesas,r9a08g046-pinctrl.h @@ -0,0 +1,38 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * This header provides constants for Renesas RZ/G3L family pinctrl bindings. + * + * Copyright (C) 2026 Renesas Electronics Corp. + * + */ + +#ifndef __DT_BINDINGS_PINCTRL_RENESAS_R9A08G046_PINCTRL_H__ +#define __DT_BINDINGS_PINCTRL_RENESAS_R9A08G046_PINCTRL_H__ + +#include + +/* RZG3L_Px = Offset address of PFC_P_mn - 0x22 */ +#define RZG3L_P2 2 +#define RZG3L_P3 3 +#define RZG3L_P5 5 +#define RZG3L_P6 6 +#define RZG3L_P7 7 +#define RZG3L_P8 8 +#define RZG3L_PA 10 +#define RZG3L_PB 11 +#define RZG3L_PC 12 +#define RZG3L_PD 13 +#define RZG3L_PE 14 +#define RZG3L_PF 15 +#define RZG3L_PG 16 +#define RZG3L_PH 17 +#define RZG3L_PJ 19 +#define RZG3L_PK 20 +#define RZG3L_PL 21 +#define RZG3L_PM 22 +#define RZG3L_PS 28 + +#define RZG3L_PORT_PINMUX(b, p, f) RZG2L_PORT_PINMUX(RZG3L_P##b, p, f) +#define RZG3L_GPIO(port, pin) RZG2L_GPIO(RZG3L_P##port, pin) + +#endif /* __DT_BINDINGS_PINCTRL_RENESAS_R9A08G046_PINCTRL_H__ */ -- cgit v1.2.3 From d5758c31a81bcd9d5ac8a7456549b05df3579068 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Thu, 23 Apr 2026 14:18:52 -0400 Subject: exportfs: split out the ops for layout-based block device access The support to grant layouts for direct block device access works at a very different layer than the rest of exports. Split the methods for it into a separate struct, and move that into a separate header to better split things out. The pointer to the new operation vector is kept in export_operations to avoid bloating the super_block. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260423181854.743150-3-cel@kernel.org Signed-off-by: Christian Brauner --- include/linux/exportfs.h | 25 ++++++++----------------- include/linux/exportfs_block.h | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+), 17 deletions(-) create mode 100644 include/linux/exportfs_block.h (limited to 'include') diff --git a/include/linux/exportfs.h b/include/linux/exportfs.h index 8bcdba28b406..c835bc64f4fa 100644 --- a/include/linux/exportfs.h +++ b/include/linux/exportfs.h @@ -6,9 +6,8 @@ #include struct dentry; -struct iattr; +struct exportfs_block_ops; struct inode; -struct iomap; struct super_block; struct vfsmount; @@ -260,19 +259,13 @@ struct handle_to_path_ctx { * @commit_metadata: * @commit_metadata should commit metadata changes to stable storage. * - * @get_uuid: - * Get a filesystem unique signature exposed to clients. - * - * @map_blocks: - * Map and, if necessary, allocate blocks for a layout. - * - * @commit_blocks: - * Commit blocks in a layout once the client is done with them. - * * @flags: * Allows the filesystem to communicate to nfsd that it may want to do things * differently when dealing with it. * + * @block_ops: + * Operations for layout grants to block on the underlying device. + * * Locking rules: * get_parent is called with child->d_inode->i_rwsem down * get_name is not (which is possibly inconsistent) @@ -290,12 +283,6 @@ struct export_operations { struct dentry * (*get_parent)(struct dentry *child); int (*commit_metadata)(struct inode *inode); - int (*get_uuid)(struct super_block *sb, u8 *buf, u32 *len, u64 *offset); - int (*map_blocks)(struct inode *inode, loff_t offset, - u64 len, struct iomap *iomap, - bool write, u32 *device_generation); - int (*commit_blocks)(struct inode *inode, struct iomap *iomaps, - int nr_iomaps, struct iattr *iattr); int (*permission)(struct handle_to_path_ctx *ctx, unsigned int oflags); struct file * (*open)(const struct path *path, unsigned int oflags); #define EXPORT_OP_NOWCC (0x1) /* don't collect v3 wcc data */ @@ -308,6 +295,10 @@ struct export_operations { #define EXPORT_OP_FLUSH_ON_CLOSE (0x20) /* fs flushes file data on close */ #define EXPORT_OP_NOLOCKS (0x40) /* no file locking support */ unsigned long flags; + +#ifdef CONFIG_EXPORTFS_BLOCK_OPS + const struct exportfs_block_ops *block_ops; +#endif }; /** diff --git a/include/linux/exportfs_block.h b/include/linux/exportfs_block.h new file mode 100644 index 000000000000..1f52fea8e4dc --- /dev/null +++ b/include/linux/exportfs_block.h @@ -0,0 +1,39 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2014-2026 Christoph Hellwig. + * + * Support for exportfs-based layout grants for direct block device access. + */ +#ifndef LINUX_EXPORTFS_BLOCK_H +#define LINUX_EXPORTFS_BLOCK_H 1 + +#include + +struct iattr; +struct inode; +struct iomap; +struct super_block; + +struct exportfs_block_ops { + /* + * Get the in-band device unique signature exposed to clients. + */ + int (*get_uuid)(struct super_block *sb, u8 *buf, u32 *len, u64 *offset); + + /* + * Map blocks for direct block access. + * If @write is %true, also allocate the blocks for the range if needed. + */ + int (*map_blocks)(struct inode *inode, loff_t offset, u64 len, + struct iomap *iomap, bool write, + u32 *device_generation); + + /* + * Commit blocks previously handed out by ->map_blocks and written to by + * the client. + */ + int (*commit_blocks)(struct inode *inode, struct iomap *iomaps, + int nr_iomaps, struct iattr *iattr); +}; + +#endif /* LINUX_EXPORTFS_BLOCK_H */ -- cgit v1.2.3 From 61eb48f515853937a6237e7f64dbe9d099b54613 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Thu, 23 Apr 2026 14:18:53 -0400 Subject: exportfs: don't pass struct iattr to ->commit_blocks The only thing ->commit_blocks really needs is the new size, with a magic -1 placeholder 0 for "do not change the size" because it only ever extends the size. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260423181854.743150-4-cel@kernel.org Signed-off-by: Christian Brauner --- include/linux/exportfs_block.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/exportfs_block.h b/include/linux/exportfs_block.h index 1f52fea8e4dc..d1dec4689b14 100644 --- a/include/linux/exportfs_block.h +++ b/include/linux/exportfs_block.h @@ -9,7 +9,6 @@ #include -struct iattr; struct inode; struct iomap; struct super_block; @@ -33,7 +32,7 @@ struct exportfs_block_ops { * the client. */ int (*commit_blocks)(struct inode *inode, struct iomap *iomaps, - int nr_iomaps, struct iattr *iattr); + int nr_iomaps, loff_t new_size); }; #endif /* LINUX_EXPORTFS_BLOCK_H */ -- cgit v1.2.3 From da9baa5470dcb077a7c9806f0925c60b530c470b Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Thu, 23 Apr 2026 14:18:54 -0400 Subject: exportfs,nfsd: rework checking for layout-based block device access support Currently NFSD hard codes checking support for block-style layouts. Lift the checks into a file system-helper and provide a exportfs-level helper to implement the typical checks. This prepares for supporting block layout export of multiple devices per file system. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260423181854.743150-5-cel@kernel.org Signed-off-by: Christian Brauner --- include/linux/exportfs_block.h | 52 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 51 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/exportfs_block.h b/include/linux/exportfs_block.h index d1dec4689b14..de519b7b599b 100644 --- a/include/linux/exportfs_block.h +++ b/include/linux/exportfs_block.h @@ -7,13 +7,35 @@ #ifndef LINUX_EXPORTFS_BLOCK_H #define LINUX_EXPORTFS_BLOCK_H 1 -#include +#include +#include +#include struct inode; struct iomap; struct super_block; +/* + * There are the two types of block-style layout support: + * - In-band implies a device identified by a unique cookie inside the actual + * device address space checked by the ->get_uuid method as used by the pNFS + * block layout. This is a bit dangerous and deprecated. + * - Out of band implies identification by out of band unique identifiers + * specified by the storage protocol, which is much safer and used by the + * pNFS SCSI/NVMe layouts. + */ +typedef unsigned int __bitwise expfs_block_layouts_t; +#define EXPFS_BLOCK_FLAG(__bit) \ + ((__force expfs_block_layouts_t)(1u << __bit)) +#define EXPFS_BLOCK_IN_BAND_ID EXPFS_BLOCK_FLAG(0) +#define EXPFS_BLOCK_OUT_OF_BAND_ID EXPFS_BLOCK_FLAG(1) + struct exportfs_block_ops { + /* + * Returns the EXPFS_BLOCK_* bitmap of supported layout types. + */ + expfs_block_layouts_t (*layouts_supported)(struct super_block *sb); + /* * Get the in-band device unique signature exposed to clients. */ @@ -35,4 +57,32 @@ struct exportfs_block_ops { int nr_iomaps, loff_t new_size); }; +static inline bool +exportfs_bdev_supports_out_of_band_id(struct block_device *bdev) +{ + return bdev->bd_disk->fops->pr_ops && + bdev->bd_disk->fops->get_unique_id; +} + +#ifdef CONFIG_EXPORTFS_BLOCK_OPS +static inline expfs_block_layouts_t +exportfs_layouts_supported(struct super_block *sb) +{ + const struct exportfs_block_ops *bops = sb->s_export_op->block_ops; + + if (!bops || + !bops->layouts_supported || + WARN_ON_ONCE(!bops->map_blocks) || + WARN_ON_ONCE(!bops->commit_blocks)) + return 0; + return bops->layouts_supported(sb); +} +#else +static inline expfs_block_layouts_t +exportfs_layouts_supported(struct super_block *sb) +{ + return 0; +} +#endif /* CONFIG_EXPORTFS_BLOCK_OPS */ + #endif /* LINUX_EXPORTFS_BLOCK_H */ -- cgit v1.2.3 From a4656aef98dd6f163c55063c36297d45912737f4 Mon Sep 17 00:00:00 2001 From: Jason-JH Lin Date: Wed, 25 Mar 2026 11:57:39 +0800 Subject: soc: mediatek: mtk-cmdq: Add cmdq_pkt_jump_rel_temp() for removing shift_pa Since shift_pa will be stored into the cmdq_mobx_priv of cmdq_pkt, all the shif_pa parameters in CMDQ helper APIs can be removed. Add cmdq_pkt_jump_rel_temp() for the current users of cmdq_pkt_jump_rel(), and then remove shift_pa after all users have migrated to the new APIs. Signed-off-by: Jason-JH Lin Signed-off-by: AngeloGioacchino Del Regno --- include/linux/soc/mediatek/mtk-cmdq.h | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'include') diff --git a/include/linux/soc/mediatek/mtk-cmdq.h b/include/linux/soc/mediatek/mtk-cmdq.h index a06b5a61f337..03bb85462566 100644 --- a/include/linux/soc/mediatek/mtk-cmdq.h +++ b/include/linux/soc/mediatek/mtk-cmdq.h @@ -445,6 +445,24 @@ static inline int cmdq_pkt_jump(struct cmdq_pkt *pkt, dma_addr_t addr, u8 shift_ */ int cmdq_pkt_jump_rel(struct cmdq_pkt *pkt, s32 offset, u8 shift_pa); +/** + * cmdq_pkt_jump_rel_temp() - Temporary wrapper for new CMDQ helper API + * @pkt: the CMDQ packet + * @offset: relative offset of target instruction buffer from current PC. + * @shift_pa: [DEPRECATED] shift bits of physical address in CMDQ instruction. + * This value is got by cmdq_get_shift_pa(). + * + * This function is a temporary wrapper that was introduced only for ease of + * migration of the many users of the CMDQ API located in multiple kernel + * subsystems. + * + * This has to be removed after all users are migrated to the newer CMDQ API. + */ +static inline int cmdq_pkt_jump_rel_temp(struct cmdq_pkt *pkt, s32 offset, u8 shift_pa) +{ + return cmdq_pkt_jump_rel(pkt, offset, shift_pa); +} + /** * cmdq_pkt_eoc() - Append EOC and ask GCE to generate an IRQ at end of execution * @pkt: The CMDQ packet @@ -599,6 +617,12 @@ static inline int cmdq_pkt_jump_rel(struct cmdq_pkt *pkt, s32 offset, u8 shift_p return -EINVAL; } +/* This wrapper has to be removed after all users migrated to jump_rel */ +static inline int cmdq_pkt_jump_rel_temp(struct cmdq_pkt *pkt, s32 offset, u8 shift_pa) +{ + return -EINVAL; +} + static inline int cmdq_pkt_eoc(struct cmdq_pkt *pkt) { return -EINVAL; -- cgit v1.2.3 From 4911de3145a797389577abfdf9a5185d36cc18d7 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Tue, 7 Apr 2026 18:03:13 +0200 Subject: uaccess: fix ignored_trailing logic in copy_struct_to_user() Currently all callers pass ignored_trailing=NULL, but I have code that will make use of. Now it actually behaves like documented: * If @usize < @ksize, then the kernel is trying to pass userspace a newer struct than it supports. Thus we only copy the interoperable portions (@usize) and ignore the rest (but @ignored_trailing is set to %true if any of the trailing (@ksize - @usize) bytes are non-zero). Fixes: 424a55a4a908 ("uaccess: add copy_struct_to_user helper") Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/71f69442410c1186ed8ce6d5b4b9d4a5a70edbad.1775576651.git.metze@samba.org Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner --- include/linux/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 56328601218c..09a09cc4aac2 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -510,7 +510,7 @@ copy_struct_to_user(void __user *dst, size_t usize, const void *src, return -EFAULT; } if (ignored_trailing) - *ignored_trailing = ksize < usize && + *ignored_trailing = usize < ksize && memchr_inv(src + size, 0, rest) != NULL; /* Copy the interoperable parts of the struct. */ if (copy_to_user(dst, src, size)) -- cgit v1.2.3 From db0493512931fe1e5a71612e6a358df1aa22d80c Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Tue, 7 Apr 2026 18:03:14 +0200 Subject: sockptr: fix usize check in copy_struct_from_sockptr() for user pointers copy_struct_from_user will never hit the check_zeroed_user() call and will never return -E2BIG if new userspace passed new bits in a larger structure than the current kernel structure. As far as I can there are no critical/related uapi changes in - include/net/bluetooth/bluetooth.h and net/bluetooth/sco.c after the use of copy_struct_from_sockptr in v6.13-rc3 - include/uapi/linux/tcp.h and net/ipv4/tcp_ao.c after the use of copy_struct_from_sockptr in v6.6-rc1 So that new callers will get the correct behavior from the start. Fixes: 4954f17ddefc ("net/tcp: Introduce TCP_AO setsockopt()s") Fixes: ef84703a911f ("net/tcp: Add TCP-AO getsockopt()s") Fixes: faadfaba5e01 ("net/tcp: Add TCP_AO_REPAIR") Fixes: 3e643e4efa1e ("Bluetooth: Improve setsockopt() handling of malformed user input") Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/cfaedbc33ae9d36adaabf04fa79424f30ff1efdd.1775576651.git.metze@samba.org Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner --- include/linux/sockptr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h index 3e6c8e9d67ae..ba88f4d78c1b 100644 --- a/include/linux/sockptr.h +++ b/include/linux/sockptr.h @@ -91,7 +91,7 @@ static inline int copy_struct_from_sockptr(void *dst, size_t ksize, size_t rest = max(ksize, usize) - size; if (!sockptr_is_kernel(src)) - return copy_struct_from_user(dst, ksize, src.user, size); + return copy_struct_from_user(dst, ksize, src.user, usize); if (usize < ksize) { memset(dst + size, 0, rest); -- cgit v1.2.3 From 2eef8b32e4c84caa927495f1d9bc9529d2bc5ac6 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Tue, 7 Apr 2026 18:03:15 +0200 Subject: uaccess: add copy_struct_{from,to}_bounce_buffer() helpers These are similar to copy_struct_{from,to}_user() but operate on kernel buffers instead of user buffers. They can be used when there is a temporary bounce buffer used, e.g. in msg_control or similar places. It allows us to have the same logic to handle old vs. current and current vs. new structures in the same compatible way. copy_struct_from_sockptr() will also be able to use copy_struct_from_bounce_buffer() for the kernel case as follow us patch. I'll use this in my IPPROTO_SMBDIRECT work, but maybe it will also be useful for others... IPPROTO_QUIC will likely also use it. Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/f29570914590c50b9b6f451eb3a38d0fe1d954df.1775576651.git.metze@samba.org Signed-off-by: Christian Brauner --- include/linux/uaccess.h | 63 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) (limited to 'include') diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 09a09cc4aac2..e4a64976f1c5 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -518,6 +518,69 @@ copy_struct_to_user(void __user *dst, size_t usize, const void *src, return 0; } +static __always_inline void +__copy_struct_generic_bounce_buffer(void *dst, size_t dstsize, + const void *src, size_t srcsize, + bool *ignored_trailing) +{ + size_t size = min(dstsize, srcsize); + size_t rest = max(dstsize, srcsize) - size; + + /* Deal with trailing bytes. */ + if (dstsize > srcsize) + memset(dst + size, 0, rest); + if (ignored_trailing) + *ignored_trailing = dstsize < srcsize && + memchr_inv(src + size, 0, rest) != NULL; + /* Copy the interoperable parts of the struct. */ + memcpy(dst, src, size); +} + +/** + * This is like copy_struct_from_user(), but the + * src buffer was already copied into a kernel + * bounce buffer, so it will never return -EFAULT. + */ +static __always_inline __must_check int +copy_struct_from_bounce_buffer(void *dst, size_t dstsize, + const void *src, size_t srcsize) +{ + bool ignored_trailing; + + /* Double check if ksize is larger than a known object size. */ + if (WARN_ON_ONCE(dstsize > __builtin_object_size(dst, 1))) + return -E2BIG; + + __copy_struct_generic_bounce_buffer(dst, dstsize, + src, srcsize, + &ignored_trailing); + if (unlikely(ignored_trailing)) + return -E2BIG; + + return 0; +} + +/** + * This is like copy_struct_to_user(), but the + * dst buffer is a kernel bounce buffer instead + * of a direct userspace buffer, so it will never return -EFAULT. + */ +static __always_inline __must_check int +copy_struct_to_bounce_buffer(void *dst, size_t dstsize, + const void *src, + size_t srcsize, + bool *ignored_trailing) +{ + /* Double check if srcsize is larger than a known object size. */ + if (WARN_ON_ONCE(srcsize > __builtin_object_size(src, 1))) + return -E2BIG; + + __copy_struct_generic_bounce_buffer(dst, dstsize, + src, srcsize, + ignored_trailing); + return 0; +} + bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size); long copy_from_kernel_nofault(void *dst, const void *src, size_t size); -- cgit v1.2.3 From d2c344740bf9e54c91d8d4a99bfe5fc1709a3ecc Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Tue, 7 Apr 2026 18:03:16 +0200 Subject: sockptr: let copy_struct_from_sockptr() use copy_struct_from_bounce_buffer() The world would be better without sockptr_t, but this at least simplifies copy_struct_from_sockptr() to be just a dispatcher for copy_struct_from_user() or copy_struct_from_bounce_buffer() without any special logic on its own. Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/b9b7e22664a53251d7ad099b12aead8b599c1257.1775576651.git.metze@samba.org Signed-off-by: Christian Brauner --- include/linux/sockptr.h | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) (limited to 'include') diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h index ba88f4d78c1b..706a8526cf3c 100644 --- a/include/linux/sockptr.h +++ b/include/linux/sockptr.h @@ -87,24 +87,10 @@ static inline int copy_safe_from_sockptr(void *dst, size_t ksize, static inline int copy_struct_from_sockptr(void *dst, size_t ksize, sockptr_t src, size_t usize) { - size_t size = min(ksize, usize); - size_t rest = max(ksize, usize) - size; - if (!sockptr_is_kernel(src)) return copy_struct_from_user(dst, ksize, src.user, usize); - if (usize < ksize) { - memset(dst + size, 0, rest); - } else if (usize > ksize) { - char *p = src.kernel; - - while (rest--) { - if (*p++) - return -E2BIG; - } - } - memcpy(dst, src.kernel, size); - return 0; + return copy_struct_from_bounce_buffer(dst, ksize, src.kernel, usize); } static inline int copy_to_sockptr_offset(sockptr_t dst, size_t offset, -- cgit v1.2.3 From c5ca9f85d7fe27a8c9c88195bb819e8b569fa930 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Tue, 7 Apr 2026 18:03:17 +0200 Subject: sockptr: introduce copy_struct_to_sockptr() We already have copy_struct_from_sockptr() as wrapper to copy_struct_from_user() or copy_struct_from_bounce_buffer(), so it's good to have copy_struct_to_sockptr() as well matching the behavior of copy_struct_to_user() or copy_struct_to_bounce_buffer(). The world would be better without sockptr_t, but having copy_struct_to_sockptr() is better than open code it in various places. I'll use this in my IPPROTO_SMBDIRECT work, but maybe it will also be useful for others... IPPROTO_QUIC will likely also use it. Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher Link: https://patch.msgid.link/c950ee1578cb93b4411c3731010def9c1cd82f0d.1775576651.git.metze@samba.org Signed-off-by: Christian Brauner --- include/linux/sockptr.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'include') diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h index 706a8526cf3c..9c2429c1a570 100644 --- a/include/linux/sockptr.h +++ b/include/linux/sockptr.h @@ -107,6 +107,16 @@ static inline int copy_to_sockptr(sockptr_t dst, const void *src, size_t size) return copy_to_sockptr_offset(dst, 0, src, size); } +static inline int +copy_struct_to_sockptr(sockptr_t dst, size_t usize, const void *src, + size_t ksize, bool *ignored_trailing) +{ + if (!sockptr_is_kernel(dst)) + return copy_struct_to_user(dst.user, usize, src, ksize, ignored_trailing); + + return copy_struct_to_bounce_buffer(dst.kernel, usize, src, ksize, ignored_trailing); +} + static inline void *memdup_sockptr_noprof(sockptr_t src, size_t len) { void *p = kmalloc_track_caller_noprof(len, GFP_USER | __GFP_NOWARN); -- cgit v1.2.3 From 39d260d6bc7aab6777c0d14d1e27648ca8e9252e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Mon, 11 May 2026 12:45:02 +0200 Subject: firewire: Simplify storing pointers in device id struct MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Technically it is fine (on all current Linux architectures) to store a pointer in an unsigned long variable. However this needs explicit casting which is an easy source for type mismatches. By replacing the plain unsigned long .driver_data in struct ieee1394_device_id by an anonymous union, most of the casting can be dropped. There is still some implicit casting involved (between a void * and a driver specific pointer type), but that's better than the approach to store a pointer in an unsigned long variable as this doesn't lose the information that the data being pointed to is const. All users of struct ieee1394_device_id are initialized in a way that is compatible with the new definition, so no adaptions are needed there. (The comments addressing to CHERI extension are dropped by the maintainer.) Signed-off-by: Uwe Kleine-König (The Capable Hub) Link: https://lore.kernel.org/r/e5ba45a7e386461c0b1a5001635aa008b01c2164.1778494204.git.u.kleine-koenig@baylibre.com Signed-off-by: Takashi Sakamoto --- include/linux/mod_devicetable.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h index 23ff24080dfd..3b0c9a251a2e 100644 --- a/include/linux/mod_devicetable.h +++ b/include/linux/mod_devicetable.h @@ -61,7 +61,10 @@ struct ieee1394_device_id { __u32 model_id; __u32 specifier_id; __u32 version; - kernel_ulong_t driver_data; + union { + kernel_ulong_t driver_data; + const void *driver_data_ptr; + }; }; -- cgit v1.2.3 From 29e34a882b09e9f01d0fff5e312ea0cf9499137d Mon Sep 17 00:00:00 2001 From: "Kevin Hilman (TI)" Date: Mon, 20 Apr 2026 16:51:18 -0700 Subject: pmdomain: core: add support for power-domains-child-ids Currently, PM domains can only support hierarchy for simple providers (e.g. ones with #power-domain-cells = 0). Add support for oncell providers as well by adding a new property `power-domains-child-ids` to describe the parent/child relationship. For example, an SCMI PM domain provider has multiple domains, each of which might be a child of diffeent parent domains. In this example, the parent domains are MAIN_PD and WKUP_PD: scmi_pds: protocol@11 { reg = <0x11>; #power-domain-cells = <1>; power-domains = <&MAIN_PD>, <&WKUP_PD>; power-domains-child-ids = <15>, <19>; }; With this example using the new property, SCMI PM domain 15 becomes a child domain of MAIN_PD, and SCMI domain 19 becomes a child domain of WKUP_PD. To support this feature, add two new core functions - of_genpd_add_child_ids() - of_genpd_remove_child_ids() which can be called by pmdomain providers to add/remove child domains if they support the new property power-domains-child-ids. The add function is "all or nothing". If it cannot add all of the child domains in the list, it will unwind any additions already made and report a failure. Signed-off-by: Kevin Hilman (TI) Signed-off-by: Ulf Hansson --- include/linux/pm_domain.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include') diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h index b299dc0128d6..f925614aebdb 100644 --- a/include/linux/pm_domain.h +++ b/include/linux/pm_domain.h @@ -467,6 +467,10 @@ struct generic_pm_domain *of_genpd_remove_last(struct device_node *np); int of_genpd_parse_idle_states(struct device_node *dn, struct genpd_power_state **states, int *n); void of_genpd_sync_state(struct device_node *np); +int of_genpd_add_child_ids(struct device_node *np, + struct genpd_onecell_data *data); +int of_genpd_remove_child_ids(struct device_node *np, + struct genpd_onecell_data *data); int genpd_dev_pm_attach(struct device *dev); struct device *genpd_dev_pm_attach_by_id(struct device *dev, @@ -536,6 +540,18 @@ struct generic_pm_domain *of_genpd_remove_last(struct device_node *np) { return ERR_PTR(-EOPNOTSUPP); } + +static inline int of_genpd_add_child_ids(struct device_node *np, + struct genpd_onecell_data *data) +{ + return -EOPNOTSUPP; +} + +static inline int of_genpd_remove_child_ids(struct device_node *np, + struct genpd_onecell_data *data) +{ + return -EOPNOTSUPP; +} #endif /* CONFIG_PM_GENERIC_DOMAINS_OF */ #ifdef CONFIG_PM -- cgit v1.2.3 From 8a46bd2638f1ad6d1ed73dc3ab10919e67274738 Mon Sep 17 00:00:00 2001 From: Krishna Chaitanya Chundru Date: Mon, 11 May 2026 12:55:37 +0530 Subject: gpio: Add fwnode_gpiod_get() helper Add fwnode_gpiod_get() as a convenience wrapper around fwnode_gpiod_get_index() for the common case where only the first GPIO is required. This mirrors existing gpiod_get() and devm_gpiod_get() helpers and avoids open-coding index 0 at call sites. Suggested-by: Manivannan Sadhasivam Acked-by: Manivannan Sadhasivam Reviewed-by: Linus Walleij Acked-by: Bartosz Golaszewski Signed-off-by: Krishna Chaitanya Chundru Link: https://patch.msgid.link/20260511-wakeirq_support-v10-1-c10af9c9eb8c@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski --- include/linux/gpio/consumer.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h index 3efb5cb1e1d1..e2601217a71d 100644 --- a/include/linux/gpio/consumer.h +++ b/include/linux/gpio/consumer.h @@ -598,6 +598,15 @@ static inline int gpiod_disable_hw_timestamp_ns(struct gpio_desc *desc, } #endif /* CONFIG_GPIOLIB && CONFIG_HTE */ +static inline +struct gpio_desc *fwnode_gpiod_get(struct fwnode_handle *fwnode, + const char *con_id, + enum gpiod_flags flags, + const char *label) +{ + return fwnode_gpiod_get_index(fwnode, con_id, 0, flags, label); +} + static inline struct gpio_desc *devm_fwnode_gpiod_get(struct device *dev, struct fwnode_handle *fwnode, -- cgit v1.2.3 From b5fafa01bdaade5253bd39317f5455d13e6efc7d Mon Sep 17 00:00:00 2001 From: Jie Li Date: Mon, 11 May 2026 13:37:25 +0200 Subject: gpiolib: add gpiod_is_single_ended() helper The direction of a single-ended (open-drain or open-source) GPIO line cannot always be reliably determined by reading hardware registers. In true open-drain implementations, the "high" state is achieved by entering a high-impedance mode, which many hardware controllers report as "input" even if the software intends to use it as an output. This creates issues for consumer drivers (like I2C) that rely on gpiod_get_direction() to decide if a line can be driven. Introduce gpiod_is_single_ended() to allow consumers to check the software configuration (GPIO_FLAG_OPEN_DRAIN/GPIO_FLAG_OPEN_SOURCE) of a descriptor. This provides a robust way to identify lines that are capable of being driven, regardless of their instantaneous hardware state. Signed-off-by: Jie Li Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260511113726.49041-2-jie.i.li@nokia.com Signed-off-by: Bartosz Golaszewski --- include/linux/gpio/consumer.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h index 3efb5cb1e1d1..8fb27f9aa67f 100644 --- a/include/linux/gpio/consumer.h +++ b/include/linux/gpio/consumer.h @@ -111,6 +111,7 @@ void devm_gpiod_unhinge(struct device *dev, struct gpio_desc *desc); void devm_gpiod_put_array(struct device *dev, struct gpio_descs *descs); int gpiod_get_direction(struct gpio_desc *desc); +bool gpiod_is_single_ended(struct gpio_desc *desc); int gpiod_direction_input(struct gpio_desc *desc); int gpiod_direction_output(struct gpio_desc *desc, int value); int gpiod_direction_output_raw(struct gpio_desc *desc, int value); @@ -337,6 +338,10 @@ static inline int gpiod_get_direction(const struct gpio_desc *desc) WARN_ON(desc); return -ENOSYS; } +static inline bool gpiod_is_single_ended(struct gpio_desc *desc) +{ + return false; +} static inline int gpiod_direction_input(struct gpio_desc *desc) { /* GPIO can never have been requested */ -- cgit v1.2.3 From fd3b87ff0232f46e1ad53a48609a3853c8757c6c Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Tue, 5 May 2026 17:23:08 +0200 Subject: rust: auxiliary: add registration data to auxiliary devices Add a registration_data pointer to struct auxiliary_device, allowing the registering (parent) driver to attach private data to the device at registration time and retrieve it later when called back by the auxiliary (child) driver. By tying the data to the device's registration, Rust drivers can bind the lifetime of device resources to it, since the auxiliary bus guarantees that the parent driver remains bound while the auxiliary device is bound. On the Rust side, Registration takes ownership of the data via ForeignOwnable. A TypeId is stored alongside the data for runtime type checking, making Device::registration_data() a safe method. Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260505152400.3905096-3-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/auxiliary_bus.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/auxiliary_bus.h b/include/linux/auxiliary_bus.h index bc09b55e3682..4e1ad8ccbcdd 100644 --- a/include/linux/auxiliary_bus.h +++ b/include/linux/auxiliary_bus.h @@ -62,6 +62,9 @@ * @sysfs.irqs: irqs xarray contains irq indices which are used by the device, * @sysfs.lock: Synchronize irq sysfs creation, * @sysfs.irq_dir_exists: whether "irqs" directory exists, + * @registration_data_rust: private data owned by the registering (parent) + * driver; valid for as long as the device is + * registered with the driver core, * * An auxiliary_device represents a part of its parent device's functionality. * It is given a name that, combined with the registering drivers @@ -148,6 +151,7 @@ struct auxiliary_device { struct mutex lock; /* Synchronize irq sysfs creation */ bool irq_dir_exists; } sysfs; + void *registration_data_rust; }; /** -- cgit v1.2.3 From 3661d5f403769b872482b584e658b71bbdb5f55e Mon Sep 17 00:00:00 2001 From: Miles Krause Date: Mon, 4 May 2026 21:46:02 -0400 Subject: genirq/msi: Fix typos in msi_domain_ops comment Fix spelling and possessive typos in the msi_domain_ops comment. No functional change. Signed-off-by: Miles Krause Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260505014602.5879-1-mileskrause5200@gmail.com --- include/linux/msi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/msi.h b/include/linux/msi.h index fa41eed62868..a4613de11960 100644 --- a/include/linux/msi.h +++ b/include/linux/msi.h @@ -444,7 +444,7 @@ struct msi_domain_info; * * @domain_alloc_irqs, @domain_free_irqs can be used to override the * default allocation/free functions (__msi_domain_alloc/free_irqs). This - * is initially for a wrapper around XENs seperate MSI universe which can't + * is initially for a wrapper around XEN's separate MSI universe which can't * be wrapped into the regular irq domains concepts by mere mortals. This * allows to universally use msi_domain_alloc/free_irqs without having to * special case XEN all over the place. -- cgit v1.2.3 From c2b4b6075d5155c83889bdf7b8c509df9b5b47ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Fri, 8 May 2026 17:34:11 +0300 Subject: drm/i915: Introduce intel_parent_fb_pin_get_map() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce the "fb_pin" parent interface, as the first trivial step move the *_get_map() stuff there. The whole "fb_pin" as an interface might not really make sense, and perhaps this (and other stuff) should just be collected into some kind of "bo" interface. But let's go with "fb_pin" for now to match where things are implemented, and possibly restructure it later. Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260508143426.26504-2-ville.syrjala@linux.intel.com --- include/drm/intel/display_parent_interface.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/drm/intel/display_parent_interface.h b/include/drm/intel/display_parent_interface.h index 270dc028bec2..ee2e9572bfca 100644 --- a/include/drm/intel/display_parent_interface.h +++ b/include/drm/intel/display_parent_interface.h @@ -24,6 +24,7 @@ struct intel_hdcp_gsc_context; struct intel_initial_plane_config; struct intel_panic; struct intel_stolen_node; +struct iosys_map; struct ref_tracker; struct seq_file; struct vm_area_struct; @@ -69,6 +70,10 @@ struct intel_display_dsb_interface { void (*flush_map)(struct intel_dsb_buffer *dsb_buf); }; +struct intel_display_fb_pin_interface { + void (*get_map)(struct i915_vma *vma, struct iosys_map *map); +}; + struct intel_display_frontbuffer_interface { struct intel_frontbuffer *(*get)(struct drm_gem_object *obj); void (*ref)(struct intel_frontbuffer *front); @@ -211,6 +216,9 @@ struct intel_display_parent_interface { /** @dsb: DSB buffer interface */ const struct intel_display_dsb_interface *dsb; + /** @fb_pin: Framebuffer pin interface */ + const struct intel_display_fb_pin_interface *fb_pin; + /** @frontbuffer: Frontbuffer interface */ const struct intel_display_frontbuffer_interface *frontbuffer; -- cgit v1.2.3 From 65585c16d9d9e9b96341059f8be497c5f9b8c019 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Fri, 8 May 2026 17:34:12 +0300 Subject: drm/i915: Move intel_fb_pin_params to the parent interface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit strut intel_fb_pin_params will be an important part of the fb_pin interface, so move the definition to the parent interface file. Or maybe we should have a separate header for this kind of stuff since the users of the parent interface will need the struct definition but not the parent interface vfunc struct definitions? Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260508143426.26504-3-ville.syrjala@linux.intel.com --- include/drm/intel/display_parent_interface.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/drm/intel/display_parent_interface.h b/include/drm/intel/display_parent_interface.h index ee2e9572bfca..b363d6a85dfe 100644 --- a/include/drm/intel/display_parent_interface.h +++ b/include/drm/intel/display_parent_interface.h @@ -16,6 +16,7 @@ struct drm_mode_fb_cmd2; struct drm_plane_state; struct drm_scanout_buffer; struct fb_info; +struct i915_gtt_view; struct i915_vma; struct intel_dpt; struct intel_dsb_buffer; @@ -29,6 +30,17 @@ struct ref_tracker; struct seq_file; struct vm_area_struct; +struct intel_fb_pin_params { + const struct i915_gtt_view *view; + unsigned int alignment; + unsigned int phys_alignment; + unsigned int vtd_guard; + bool needs_cpu_lmem_access; + bool needs_low_address; + bool needs_physical; + bool needs_fence; +}; + /* Keep struct definitions sorted */ struct intel_display_bo_interface { -- cgit v1.2.3 From f225861a0feee6acd5c303ff3fa8566ae2876ccf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Fri, 8 May 2026 17:34:23 +0300 Subject: drm/i915: Introduce the main fb_pin parent interface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce the main part of the new fb_pin parent interface: - intel_parent_fb_pin_ggtt_(un)pin() - intel_parent_fb_pin_dpt_(un)pin() - intel_parent_fb_pin_reuse_vma() Reviewed-by: Jani Nikula Signed-off-by: Ville Syrjälä Link: https://patch.msgid.link/20260508143426.26504-14-ville.syrjala@linux.intel.com --- include/drm/intel/display_parent_interface.h | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'include') diff --git a/include/drm/intel/display_parent_interface.h b/include/drm/intel/display_parent_interface.h index b363d6a85dfe..39991afeb173 100644 --- a/include/drm/intel/display_parent_interface.h +++ b/include/drm/intel/display_parent_interface.h @@ -83,6 +83,28 @@ struct intel_display_dsb_interface { }; struct intel_display_fb_pin_interface { + int (*ggtt_pin)(struct drm_gem_object *obj, + const struct intel_fb_pin_params *pin_params, + struct i915_vma **out_ggtt_vma, + u32 *out_offset, + int *out_fence_id); + void (*ggtt_unpin)(struct i915_vma *ggtt_vma, + int fence_id); + int (*dpt_pin)(struct drm_gem_object *obj, + struct intel_dpt *dpt, + const struct intel_fb_pin_params *pin_params, + struct i915_vma **out_dpt_vma, + struct i915_vma **out_ggtt_vma, + u32 *out_offset); + void (*dpt_unpin)(struct intel_dpt *dpt, + struct i915_vma *dpt_vma, + struct i915_vma *ggtt_vma); + struct i915_vma *(*reuse_vma)(struct i915_vma *old_ggtt_vma, + struct drm_gem_object *old_obj, + const struct i915_gtt_view *old_view, + struct drm_gem_object *new_obj, + const struct i915_gtt_view *new_view, + u32 *out_offset); void (*get_map)(struct i915_vma *vma, struct iosys_map *map); }; -- cgit v1.2.3 From 3035e4454142327ec5faee2ff57ab7cb1e9fc712 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Thu, 7 May 2026 04:52:55 -0400 Subject: fs: Add case sensitivity flags to file_kattr Enable upper layers such as NFSD to retrieve case sensitivity information from file systems by adding FS_XFLAG_CASEFOLD and FS_XFLAG_CASENONPRESERVING flags. Filesystems report case-insensitive or case-nonpreserving behavior by setting these flags directly in fa->fsx_xflags. The default (flags unset) indicates POSIX semantics: case-sensitive and case-preserving. Both flags are added to FS_XFLAG_RDONLY_MASK so FS_IOC_FSSETXATTR silently strips them, keeping the new xflags strictly a reporting interface. Callers that want to toggle casefolding continue to use FS_IOC_SETFLAGS with FS_CASEFOLD_FL, the established UAPI on filesystems that support the operation (ext4 and f2fs on empty directories). Case sensitivity information is exported to userspace via the fa_xflags field in the FS_IOC_FSGETXATTR ioctl and file_getattr() system call. Reviewed-by: "Darrick J. Wong" Reviewed-by: Jan Kara Reviewed-by: Roland Mainz Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260507-case-sensitivity-v14-2-e62cc8200435@oracle.com Signed-off-by: Christian Brauner --- include/linux/fileattr.h | 3 ++- include/uapi/linux/fs.h | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/fileattr.h b/include/linux/fileattr.h index 3780904a63a6..58044b598016 100644 --- a/include/linux/fileattr.h +++ b/include/linux/fileattr.h @@ -16,7 +16,8 @@ /* Read-only inode flags */ #define FS_XFLAG_RDONLY_MASK \ - (FS_XFLAG_PREALLOC | FS_XFLAG_HASATTR | FS_XFLAG_VERITY) + (FS_XFLAG_PREALLOC | FS_XFLAG_HASATTR | FS_XFLAG_VERITY | \ + FS_XFLAG_CASEFOLD | FS_XFLAG_CASENONPRESERVING) /* Flags to indicate valid value of fsx_ fields */ #define FS_XFLAG_VALUES_MASK \ diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h index 13f71202845e..2ea4c81df08f 100644 --- a/include/uapi/linux/fs.h +++ b/include/uapi/linux/fs.h @@ -254,6 +254,13 @@ struct file_attr { #define FS_XFLAG_DAX 0x00008000 /* use DAX for IO */ #define FS_XFLAG_COWEXTSIZE 0x00010000 /* CoW extent size allocator hint */ #define FS_XFLAG_VERITY 0x00020000 /* fs-verity enabled */ +/* + * Case handling flags (read-only, cannot be set via ioctl). + * Default (neither set) indicates POSIX semantics: case-sensitive + * lookups and case-preserving storage. + */ +#define FS_XFLAG_CASEFOLD 0x00040000 /* case-insensitive lookups */ +#define FS_XFLAG_CASENONPRESERVING 0x00080000 /* case not preserved */ #define FS_XFLAG_HASATTR 0x80000000 /* no DIFLAG for this */ /* the read-only stuff doesn't really belong here, but any other place is -- cgit v1.2.3 From 92d67628a1a91c0585e004ffce8975c7898f9ed1 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Thu, 7 May 2026 04:53:03 -0400 Subject: nfs: Implement fileattr_get for case sensitivity An NFS server re-exporting an NFS mount point needs to report the case sensitivity behavior of the underlying filesystem to its clients. NFSD's attribute encoder obtains that information by calling vfs_fileattr_get() on the lower filesystem, so the NFS client must implement fileattr_get to surface what it learned from its own server. The NFS client already retrieves case sensitivity information from servers during mount via PATHCONF (NFSv3) or the FATTR4_CASE_INSENSITIVE/FATTR4_CASE_PRESERVING attributes (NFSv4). Expose this information through fileattr_get by reporting the FS_XFLAG_CASEFOLD and FS_XFLAG_CASENONPRESERVING flags. NFSv2 lacks PATHCONF support, so mounts using that protocol version default to standard POSIX behavior: case-sensitive and case-preserving. PATHCONF is now invoked unconditionally for NFSv2 and NFSv3 mounts so the case-sensitivity capabilities are established even when the user pins server->namelen with the namlen= mount option. That option is orthogonal to case handling, and skipping PATHCONF because namelen was already known would leave the caps unset. The two capability bits carry opposite polarity because their POSIX defaults differ. Most servers are case-sensitive and case- preserving, matching "neither xflag set." NFS_CAP_CASE_INSENSITIVE is set only when the server affirms case insensitivity, so "server said no" and "server did not answer" both collapse to the case- sensitive default. NFS_CAP_CASE_NONPRESERVING follows the same pattern in the opposite direction: set only when the server affirms that it does not preserve case, so that silence or a missing attribute lands on the case-preserving default. The NFSv4 probe checks res.attr_bitmask[0] to distinguish "server said false" from "server omitted the attribute" before setting the bit. Both capability bits are cleared before each probe so a remount, an NFSv4 transparent state migration to a server with different case semantics, or a probe whose reply does not arrive does not retain stale capabilities from the prior probe. Reviewed-by: Roland Mainz Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260507-case-sensitivity-v14-10-e62cc8200435@oracle.com Signed-off-by: Christian Brauner --- include/linux/nfs_fs_sb.h | 2 +- include/linux/nfs_xdr.h | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h index 4daee27fa5eb..34d294774f8c 100644 --- a/include/linux/nfs_fs_sb.h +++ b/include/linux/nfs_fs_sb.h @@ -306,7 +306,7 @@ struct nfs_server { #define NFS_CAP_ATOMIC_OPEN (1U << 4) #define NFS_CAP_LGOPEN (1U << 5) #define NFS_CAP_CASE_INSENSITIVE (1U << 6) -#define NFS_CAP_CASE_PRESERVING (1U << 7) +#define NFS_CAP_CASE_NONPRESERVING (1U << 7) #define NFS_CAP_REBOOT_LAYOUTRETURN (1U << 8) #define NFS_CAP_OFFLOAD_STATUS (1U << 9) #define NFS_CAP_ZERO_RANGE (1U << 10) diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h index fcbd21b5685f..83ee991cde2b 100644 --- a/include/linux/nfs_xdr.h +++ b/include/linux/nfs_xdr.h @@ -182,6 +182,8 @@ struct nfs_pathconf { struct nfs_fattr *fattr; /* Post-op attributes */ __u32 max_link; /* max # of hard links */ __u32 max_namelen; /* max name length */ + bool case_insensitive; + bool case_preserving; }; struct nfs4_change_info { -- cgit v1.2.3 From 61848e9799f2543a3ea144e277b17aaec9707566 Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Sun, 3 May 2026 20:14:53 -0700 Subject: tty: synclink_gt: remove broken driver The synclink_gt driver was marked as broken in commit 426263d5fb40 ("tty: synclink_gt: mark as BROKEN") in July 2023 because it had severe structural problems and there had been no evidence of users since 2016. Since then, no meaningful improvements have been made to the driver, and it is unlikely that will ever happen due to the lack of interest. Drop the driver and references to it in comments and documentation. include/uapi/linux/synclink.h is also removed. The only use of this header I have found is the linux-raw-sys Rust crate. It generates bindings for all UAPI headers, but has a hardcoded list of headers and ioctls, including this one, so that does not indicate that anyone is using it. I have sent a pull request to remove the include and ioctl definitions for this header (see the link below). Link: https://github.com/sunfishcode/linux-raw-sys/pull/185 Signed-off-by: Ethan Nelson-Moore Acked-by: Jakub Kicinski Link: https://patch.msgid.link/20260504031519.18877-1-enelsonmoore@gmail.com Signed-off-by: Greg Kroah-Hartman --- include/linux/synclink.h | 37 ------ include/uapi/linux/synclink.h | 301 ------------------------------------------ 2 files changed, 338 deletions(-) delete mode 100644 include/linux/synclink.h delete mode 100644 include/uapi/linux/synclink.h (limited to 'include') diff --git a/include/linux/synclink.h b/include/linux/synclink.h deleted file mode 100644 index f1405b1c71ba..000000000000 --- a/include/linux/synclink.h +++ /dev/null @@ -1,37 +0,0 @@ -/* - * SyncLink Multiprotocol Serial Adapter Driver - * - * $Id: synclink.h,v 3.14 2006/07/17 20:15:43 paulkf Exp $ - * - * Copyright (C) 1998-2000 by Microgate Corporation - * - * Redistribution of this file is permitted under - * the terms of the GNU Public License (GPL) - */ -#ifndef _SYNCLINK_H_ -#define _SYNCLINK_H_ - -#include - -/* provide 32 bit ioctl compatibility on 64 bit systems */ -#ifdef CONFIG_COMPAT -#include -struct MGSL_PARAMS32 { - compat_ulong_t mode; - unsigned char loopback; - unsigned short flags; - unsigned char encoding; - compat_ulong_t clock_speed; - unsigned char addr_filter; - unsigned short crc_type; - unsigned char preamble_length; - unsigned char preamble; - compat_ulong_t data_rate; - unsigned char data_bits; - unsigned char stop_bits; - unsigned char parity; -}; -#define MGSL_IOCSPARAMS32 _IOW(MGSL_MAGIC_IOC,0,struct MGSL_PARAMS32) -#define MGSL_IOCGPARAMS32 _IOR(MGSL_MAGIC_IOC,1,struct MGSL_PARAMS32) -#endif -#endif /* _SYNCLINK_H_ */ diff --git a/include/uapi/linux/synclink.h b/include/uapi/linux/synclink.h deleted file mode 100644 index 62f32d4e1021..000000000000 --- a/include/uapi/linux/synclink.h +++ /dev/null @@ -1,301 +0,0 @@ -/* SPDX-License-Identifier: GPL-1.0+ WITH Linux-syscall-note */ -/* - * SyncLink Multiprotocol Serial Adapter Driver - * - * $Id: synclink.h,v 3.14 2006/07/17 20:15:43 paulkf Exp $ - * - * Copyright (C) 1998-2000 by Microgate Corporation - * - * Redistribution of this file is permitted under - * the terms of the GNU Public License (GPL) - */ - -#ifndef _UAPI_SYNCLINK_H_ -#define _UAPI_SYNCLINK_H_ -#define SYNCLINK_H_VERSION 3.6 - -#include - -#define BIT0 0x0001 -#define BIT1 0x0002 -#define BIT2 0x0004 -#define BIT3 0x0008 -#define BIT4 0x0010 -#define BIT5 0x0020 -#define BIT6 0x0040 -#define BIT7 0x0080 -#define BIT8 0x0100 -#define BIT9 0x0200 -#define BIT10 0x0400 -#define BIT11 0x0800 -#define BIT12 0x1000 -#define BIT13 0x2000 -#define BIT14 0x4000 -#define BIT15 0x8000 -#define BIT16 0x00010000 -#define BIT17 0x00020000 -#define BIT18 0x00040000 -#define BIT19 0x00080000 -#define BIT20 0x00100000 -#define BIT21 0x00200000 -#define BIT22 0x00400000 -#define BIT23 0x00800000 -#define BIT24 0x01000000 -#define BIT25 0x02000000 -#define BIT26 0x04000000 -#define BIT27 0x08000000 -#define BIT28 0x10000000 -#define BIT29 0x20000000 -#define BIT30 0x40000000 -#define BIT31 0x80000000 - - -#define HDLC_MAX_FRAME_SIZE 65535 -#define MAX_ASYNC_TRANSMIT 4096 -#define MAX_ASYNC_BUFFER_SIZE 4096 - -#define ASYNC_PARITY_NONE 0 -#define ASYNC_PARITY_EVEN 1 -#define ASYNC_PARITY_ODD 2 -#define ASYNC_PARITY_SPACE 3 - -#define HDLC_FLAG_UNDERRUN_ABORT7 0x0000 -#define HDLC_FLAG_UNDERRUN_ABORT15 0x0001 -#define HDLC_FLAG_UNDERRUN_FLAG 0x0002 -#define HDLC_FLAG_UNDERRUN_CRC 0x0004 -#define HDLC_FLAG_SHARE_ZERO 0x0010 -#define HDLC_FLAG_AUTO_CTS 0x0020 -#define HDLC_FLAG_AUTO_DCD 0x0040 -#define HDLC_FLAG_AUTO_RTS 0x0080 -#define HDLC_FLAG_RXC_DPLL 0x0100 -#define HDLC_FLAG_RXC_BRG 0x0200 -#define HDLC_FLAG_RXC_TXCPIN 0x8000 -#define HDLC_FLAG_RXC_RXCPIN 0x0000 -#define HDLC_FLAG_TXC_DPLL 0x0400 -#define HDLC_FLAG_TXC_BRG 0x0800 -#define HDLC_FLAG_TXC_TXCPIN 0x0000 -#define HDLC_FLAG_TXC_RXCPIN 0x0008 -#define HDLC_FLAG_DPLL_DIV8 0x1000 -#define HDLC_FLAG_DPLL_DIV16 0x2000 -#define HDLC_FLAG_DPLL_DIV32 0x0000 -#define HDLC_FLAG_HDLC_LOOPMODE 0x4000 - -#define HDLC_CRC_NONE 0 -#define HDLC_CRC_16_CCITT 1 -#define HDLC_CRC_32_CCITT 2 -#define HDLC_CRC_MASK 0x00ff -#define HDLC_CRC_RETURN_EX 0x8000 - -#define RX_OK 0 -#define RX_CRC_ERROR 1 - -#define HDLC_TXIDLE_FLAGS 0 -#define HDLC_TXIDLE_ALT_ZEROS_ONES 1 -#define HDLC_TXIDLE_ZEROS 2 -#define HDLC_TXIDLE_ONES 3 -#define HDLC_TXIDLE_ALT_MARK_SPACE 4 -#define HDLC_TXIDLE_SPACE 5 -#define HDLC_TXIDLE_MARK 6 -#define HDLC_TXIDLE_CUSTOM_8 0x10000000 -#define HDLC_TXIDLE_CUSTOM_16 0x20000000 - -#define HDLC_ENCODING_NRZ 0 -#define HDLC_ENCODING_NRZB 1 -#define HDLC_ENCODING_NRZI_MARK 2 -#define HDLC_ENCODING_NRZI_SPACE 3 -#define HDLC_ENCODING_NRZI HDLC_ENCODING_NRZI_SPACE -#define HDLC_ENCODING_BIPHASE_MARK 4 -#define HDLC_ENCODING_BIPHASE_SPACE 5 -#define HDLC_ENCODING_BIPHASE_LEVEL 6 -#define HDLC_ENCODING_DIFF_BIPHASE_LEVEL 7 - -#define HDLC_PREAMBLE_LENGTH_8BITS 0 -#define HDLC_PREAMBLE_LENGTH_16BITS 1 -#define HDLC_PREAMBLE_LENGTH_32BITS 2 -#define HDLC_PREAMBLE_LENGTH_64BITS 3 - -#define HDLC_PREAMBLE_PATTERN_NONE 0 -#define HDLC_PREAMBLE_PATTERN_ZEROS 1 -#define HDLC_PREAMBLE_PATTERN_FLAGS 2 -#define HDLC_PREAMBLE_PATTERN_10 3 -#define HDLC_PREAMBLE_PATTERN_01 4 -#define HDLC_PREAMBLE_PATTERN_ONES 5 - -#define MGSL_MODE_ASYNC 1 -#define MGSL_MODE_HDLC 2 -#define MGSL_MODE_MONOSYNC 3 -#define MGSL_MODE_BISYNC 4 -#define MGSL_MODE_RAW 6 -#define MGSL_MODE_BASE_CLOCK 7 -#define MGSL_MODE_XSYNC 8 - -#define MGSL_BUS_TYPE_ISA 1 -#define MGSL_BUS_TYPE_EISA 2 -#define MGSL_BUS_TYPE_PCI 5 - -#define MGSL_INTERFACE_MASK 0xf -#define MGSL_INTERFACE_DISABLE 0 -#define MGSL_INTERFACE_RS232 1 -#define MGSL_INTERFACE_V35 2 -#define MGSL_INTERFACE_RS422 3 -#define MGSL_INTERFACE_RTS_EN 0x10 -#define MGSL_INTERFACE_LL 0x20 -#define MGSL_INTERFACE_RL 0x40 -#define MGSL_INTERFACE_MSB_FIRST 0x80 - -typedef struct _MGSL_PARAMS -{ - /* Common */ - - unsigned long mode; /* Asynchronous or HDLC */ - unsigned char loopback; /* internal loopback mode */ - - /* HDLC Only */ - - unsigned short flags; - unsigned char encoding; /* NRZ, NRZI, etc. */ - unsigned long clock_speed; /* external clock speed in bits per second */ - unsigned char addr_filter; /* receive HDLC address filter, 0xFF = disable */ - unsigned short crc_type; /* None, CRC16-CCITT, or CRC32-CCITT */ - unsigned char preamble_length; - unsigned char preamble; - - /* Async Only */ - - unsigned long data_rate; /* bits per second */ - unsigned char data_bits; /* 7 or 8 data bits */ - unsigned char stop_bits; /* 1 or 2 stop bits */ - unsigned char parity; /* none, even, or odd */ - -} MGSL_PARAMS, *PMGSL_PARAMS; - -#define MICROGATE_VENDOR_ID 0x13c0 -#define SYNCLINK_DEVICE_ID 0x0010 -#define MGSCC_DEVICE_ID 0x0020 -#define SYNCLINK_SCA_DEVICE_ID 0x0030 -#define SYNCLINK_GT_DEVICE_ID 0x0070 -#define SYNCLINK_GT4_DEVICE_ID 0x0080 -#define SYNCLINK_AC_DEVICE_ID 0x0090 -#define SYNCLINK_GT2_DEVICE_ID 0x00A0 -#define MGSL_MAX_SERIAL_NUMBER 30 - -/* -** device diagnostics status -*/ - -#define DiagStatus_OK 0 -#define DiagStatus_AddressFailure 1 -#define DiagStatus_AddressConflict 2 -#define DiagStatus_IrqFailure 3 -#define DiagStatus_IrqConflict 4 -#define DiagStatus_DmaFailure 5 -#define DiagStatus_DmaConflict 6 -#define DiagStatus_PciAdapterNotFound 7 -#define DiagStatus_CantAssignPciResources 8 -#define DiagStatus_CantAssignPciMemAddr 9 -#define DiagStatus_CantAssignPciIoAddr 10 -#define DiagStatus_CantAssignPciIrq 11 -#define DiagStatus_MemoryError 12 - -#define SerialSignal_DCD 0x01 /* Data Carrier Detect */ -#define SerialSignal_TXD 0x02 /* Transmit Data */ -#define SerialSignal_RI 0x04 /* Ring Indicator */ -#define SerialSignal_RXD 0x08 /* Receive Data */ -#define SerialSignal_CTS 0x10 /* Clear to Send */ -#define SerialSignal_RTS 0x20 /* Request to Send */ -#define SerialSignal_DSR 0x40 /* Data Set Ready */ -#define SerialSignal_DTR 0x80 /* Data Terminal Ready */ - - -/* - * Counters of the input lines (CTS, DSR, RI, CD) interrupts - */ -struct mgsl_icount { - __u32 cts, dsr, rng, dcd, tx, rx; - __u32 frame, parity, overrun, brk; - __u32 buf_overrun; - __u32 txok; - __u32 txunder; - __u32 txabort; - __u32 txtimeout; - __u32 rxshort; - __u32 rxlong; - __u32 rxabort; - __u32 rxover; - __u32 rxcrc; - __u32 rxok; - __u32 exithunt; - __u32 rxidle; -}; - -struct gpio_desc { - __u32 state; - __u32 smask; - __u32 dir; - __u32 dmask; -}; - -#define DEBUG_LEVEL_DATA 1 -#define DEBUG_LEVEL_ERROR 2 -#define DEBUG_LEVEL_INFO 3 -#define DEBUG_LEVEL_BH 4 -#define DEBUG_LEVEL_ISR 5 - -/* -** Event bit flags for use with MgslWaitEvent -*/ - -#define MgslEvent_DsrActive 0x0001 -#define MgslEvent_DsrInactive 0x0002 -#define MgslEvent_Dsr 0x0003 -#define MgslEvent_CtsActive 0x0004 -#define MgslEvent_CtsInactive 0x0008 -#define MgslEvent_Cts 0x000c -#define MgslEvent_DcdActive 0x0010 -#define MgslEvent_DcdInactive 0x0020 -#define MgslEvent_Dcd 0x0030 -#define MgslEvent_RiActive 0x0040 -#define MgslEvent_RiInactive 0x0080 -#define MgslEvent_Ri 0x00c0 -#define MgslEvent_ExitHuntMode 0x0100 -#define MgslEvent_IdleReceived 0x0200 - -/* Private IOCTL codes: - * - * MGSL_IOCSPARAMS set MGSL_PARAMS structure values - * MGSL_IOCGPARAMS get current MGSL_PARAMS structure values - * MGSL_IOCSTXIDLE set current transmit idle mode - * MGSL_IOCGTXIDLE get current transmit idle mode - * MGSL_IOCTXENABLE enable or disable transmitter - * MGSL_IOCRXENABLE enable or disable receiver - * MGSL_IOCTXABORT abort transmitting frame (HDLC) - * MGSL_IOCGSTATS return current statistics - * MGSL_IOCWAITEVENT wait for specified event to occur - * MGSL_LOOPTXDONE transmit in HDLC LoopMode done - * MGSL_IOCSIF set the serial interface type - * MGSL_IOCGIF get the serial interface type - */ -#define MGSL_MAGIC_IOC 'm' -#define MGSL_IOCSPARAMS _IOW(MGSL_MAGIC_IOC,0,struct _MGSL_PARAMS) -#define MGSL_IOCGPARAMS _IOR(MGSL_MAGIC_IOC,1,struct _MGSL_PARAMS) -#define MGSL_IOCSTXIDLE _IO(MGSL_MAGIC_IOC,2) -#define MGSL_IOCGTXIDLE _IO(MGSL_MAGIC_IOC,3) -#define MGSL_IOCTXENABLE _IO(MGSL_MAGIC_IOC,4) -#define MGSL_IOCRXENABLE _IO(MGSL_MAGIC_IOC,5) -#define MGSL_IOCTXABORT _IO(MGSL_MAGIC_IOC,6) -#define MGSL_IOCGSTATS _IO(MGSL_MAGIC_IOC,7) -#define MGSL_IOCWAITEVENT _IOWR(MGSL_MAGIC_IOC,8,int) -#define MGSL_IOCCLRMODCOUNT _IO(MGSL_MAGIC_IOC,15) -#define MGSL_IOCLOOPTXDONE _IO(MGSL_MAGIC_IOC,9) -#define MGSL_IOCSIF _IO(MGSL_MAGIC_IOC,10) -#define MGSL_IOCGIF _IO(MGSL_MAGIC_IOC,11) -#define MGSL_IOCSGPIO _IOW(MGSL_MAGIC_IOC,16,struct gpio_desc) -#define MGSL_IOCGGPIO _IOR(MGSL_MAGIC_IOC,17,struct gpio_desc) -#define MGSL_IOCWAITGPIO _IOWR(MGSL_MAGIC_IOC,18,struct gpio_desc) -#define MGSL_IOCSXSYNC _IO(MGSL_MAGIC_IOC, 19) -#define MGSL_IOCGXSYNC _IO(MGSL_MAGIC_IOC, 20) -#define MGSL_IOCSXCTRL _IO(MGSL_MAGIC_IOC, 21) -#define MGSL_IOCGXCTRL _IO(MGSL_MAGIC_IOC, 22) - - -#endif /* _UAPI_SYNCLINK_H_ */ -- cgit v1.2.3 From 430a1386df5c98e65f6b943c15366e4ca92e3328 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Wed, 6 May 2026 14:46:43 +0200 Subject: serial: sh-sci: Remove plat_sci_port.flags The last setter of p->flags was removed in commit 37744feebc086908 ("sh: remove sh5 support") in v5.8. Link: https://lore.kernel.org/CAMuHMdXs94k3-7YD-yO7p2=+u8waYGAz8mpP5LDbMf3szt4V-w@mail.gmail.com Signed-off-by: Geert Uytterhoeven Reviewed-by: John Ogness Reviewed-by: Lad Prabhakar Link: https://patch.msgid.link/20260506124643.128021-1-geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman --- include/linux/serial_sci.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/serial_sci.h b/include/linux/serial_sci.h index 0f2f50b8d28e..36c795d61f7e 100644 --- a/include/linux/serial_sci.h +++ b/include/linux/serial_sci.h @@ -51,7 +51,6 @@ struct plat_sci_port_ops { */ struct plat_sci_port { unsigned int type; /* SCI / SCIF / IRDA / HSCIF */ - upf_t flags; /* UPF_* flags */ unsigned int sampling_rate; unsigned int scscr; /* SCSCR initialization */ -- cgit v1.2.3 From 5a78a15537d4f260275d404edf7da1dd2d7157db Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Mon, 11 May 2026 23:11:51 +0900 Subject: iomap: remove over-strict inline data boundary check The current iomap_inline_data_valid() check ensures that inline data does not cross a PAGE_SIZE boundary. However, this is an unnecessarily strict constraint. If a filesystem provides a valid iomap::inline_data pointer and iomap::length, we should trust that the caller has mapped sufficient memory for the range, even if it spans across page boundaries. Removing this check allows filesystems to point directly to their internal data structures without forced page-alignment or additional redundant allocations. This remove iomap_inline_data_valid() and its callers in buffered and direct I/O paths. Suggested-by: Matthew Wilcox Reviewed-by: Christoph Hellwig Reviewed-by: Gao Xiang Signed-off-by: Namjae Jeon Link: https://patch.msgid.link/20260511141151.6021-1-linkinjeon@kernel.org Signed-off-by: Christian Brauner --- include/linux/iomap.h | 10 ---------- 1 file changed, 10 deletions(-) (limited to 'include') diff --git a/include/linux/iomap.h b/include/linux/iomap.h index 2c5685adf3a9..52bfd6783417 100644 --- a/include/linux/iomap.h +++ b/include/linux/iomap.h @@ -142,16 +142,6 @@ static inline void *iomap_inline_data(const struct iomap *iomap, loff_t pos) return iomap->inline_data + pos - iomap->offset; } -/* - * Check if the mapping's length is within the valid range for inline data. - * This is used to guard against accessing data beyond the page inline_data - * points at. - */ -static inline bool iomap_inline_data_valid(const struct iomap *iomap) -{ - return iomap->length <= PAGE_SIZE - offset_in_page(iomap->inline_data); -} - /* * When get_folio succeeds, put_folio will always be called to do any * cleanup work necessary. put_folio is responsible for unlocking and putting -- cgit v1.2.3 From 9c7eb1c9c3e3bfecb556fc8fa1b68939385444de Mon Sep 17 00:00:00 2001 From: John Ogness Date: Wed, 6 May 2026 14:21:56 +0206 Subject: serial: core: Add dedicated uart_port field for console flow Currently the UPF_CONS_FLOW bit in the uart_port.flags field is used by serial console drivers to identify if a user has configured flow control on the console. Usually this policy is setup during early boot, but can be changed at runtime. The bits in uart_port.flags are either hardware and driver properties that are initialized before usage or are properties that can be changed via the tty layer. The UPF_CONS_FLOW bit is an exception because it is a console-only policy that can change at runtime and its setting and usage have nothing to do with the tty layer. This actually causes a problem for its usage because uart_port.flags is synchronized by a related tty_port.mutex, but a console has no relation to a tty (other than sharing the port). This is probably why console flow control is not properly available for most serial drivers. And it is hindering being able to provide a proper implementation. Commit d01f4d181c92 ("serial: core: Privatize tty->hw_stopped") addressed a similar issue to deal with software assisted CTS flow state tracking. Add a new uart_port boolean field "cons_flow" to store the user configuration for console flow control. Add getter/setter wrappers to allow for adding more policies later and/or locking constraint validation. Mark UPF_CONS_FLOW as deprecated. Signed-off-by: John Ogness Link: https://patch.msgid.link/20260506121606.5805-2-john.ogness@linutronix.de Signed-off-by: Greg Kroah-Hartman --- include/linux/serial_core.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h index 666430b47899..4f7bbdd90017 100644 --- a/include/linux/serial_core.h +++ b/include/linux/serial_core.h @@ -533,6 +533,7 @@ struct uart_port { #define UPF_HARD_FLOW ((__force upf_t) (UPF_AUTO_CTS | UPF_AUTO_RTS)) /* Port has hardware-assisted s/w flow control */ #define UPF_SOFT_FLOW ((__force upf_t) BIT_ULL(22)) +/* Deprecated: use uart_set_cons_flow_enabled()/uart_cons_flow_enabled() instead. */ #define UPF_CONS_FLOW ((__force upf_t) BIT_ULL(23)) #define UPF_SHARE_IRQ ((__force upf_t) BIT_ULL(24)) #define UPF_EXAR_EFR ((__force upf_t) BIT_ULL(25)) @@ -567,6 +568,7 @@ struct uart_port { #define UPSTAT_SYNC_FIFO ((__force upstat_t) (1 << 5)) bool hw_stopped; /* sw-assisted CTS flow state */ + bool cons_flow; /* user specified console flow control */ unsigned int mctrl; /* current modem ctrl settings */ unsigned int frame_time; /* frame timing in ns */ unsigned int type; /* port type */ @@ -1163,6 +1165,16 @@ static inline bool uart_softcts_mode(struct uart_port *uport) return ((uport->status & mask) == UPSTAT_CTS_ENABLE); } +static inline void uart_set_cons_flow_enabled(struct uart_port *uport, bool enabled) +{ + uport->cons_flow = enabled; +} + +static inline bool uart_cons_flow_enabled(const struct uart_port *uport) +{ + return uport->cons_flow; +} + /* * The following are helper functions for the low level drivers. */ -- cgit v1.2.3 From 5808ef063b5e9342cb223bb9d07a6d5f6ac8711d Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Tue, 5 May 2026 12:39:28 +0200 Subject: memstick: Constify the driver id_table Just like all other driver structures, the id_table should never be modified by core subsystem parts. Constify this member and actual data structures for increased code safety. Signed-off-by: Krzysztof Kozlowski Acked-by: Greg Kroah-Hartman Signed-off-by: Ulf Hansson --- include/linux/tifm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/tifm.h b/include/linux/tifm.h index 44073d06710f..752fcfae27fe 100644 --- a/include/linux/tifm.h +++ b/include/linux/tifm.h @@ -97,7 +97,7 @@ struct tifm_dev { }; struct tifm_driver { - struct tifm_device_id *id_table; + const struct tifm_device_id *id_table; int (*probe)(struct tifm_dev *dev); void (*remove)(struct tifm_dev *dev); int (*suspend)(struct tifm_dev *dev, -- cgit v1.2.3 From 1e5b50c78d10119be08bf8f7a11d8ea333dd113a Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Wed, 6 May 2026 14:43:23 +0200 Subject: tty: add missing tty_driver include to tty_port.h Include the definition of struct tty_driver in tty_port.h to keep the header self-contained and avoid build breakage in case anyone includes it before tty_driver.h. Fixes: eb3b0d92c9c3 ("tty: tty_port: add workqueue to flip TTY buffer") Cc: Xin Zhao Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260506124323.186703-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman --- include/linux/tty_port.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/tty_port.h b/include/linux/tty_port.h index d2a7882c0b58..23cad403bb8f 100644 --- a/include/linux/tty_port.h +++ b/include/linux/tty_port.h @@ -6,10 +6,10 @@ #include #include #include +#include #include struct attribute_group; -struct tty_driver; struct tty_port; struct tty_struct; -- cgit v1.2.3 From 4314a44564eb1565349fed7a4192344c5f46fc85 Mon Sep 17 00:00:00 2001 From: Yazhou Tang Date: Wed, 6 May 2026 17:47:12 +0800 Subject: bpf: Fix out-of-bounds read in bpf_patch_call_args() The interpreters_args array only accommodates stack depths up to MAX_BPF_STACK (512 bytes). However, do_misc_fixups() may allow a larger stack depth if JIT is requested. If JIT compilation later fails and falls back to the interpreter, the verifier invokes bpf_patch_call_args() with this oversized stack depth. This causes a load-time out-of-bounds (OOB) read when calculating the interpreter function pointer index. Fix this by changing bpf_patch_call_args() to return an int and explicitly rejecting the JIT fallback (returning -EINVAL) if the stack depth exceeds MAX_BPF_STACK. Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter") Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Signed-off-by: Yazhou Tang Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/20260506094714.419842-2-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 01e203964892..52b30e9ea431 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2917,7 +2917,7 @@ int bpf_check_uarg_tail_zero(bpfptr_t uaddr, size_t expected_size, int bpf_check(struct bpf_prog **fp, union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size); #ifndef CONFIG_BPF_JIT_ALWAYS_ON -void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth); +int bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth); #endif struct btf *bpf_get_btf_vmlinux(void); -- cgit v1.2.3 From 58a8f3e2501dc14b8e00e883d6aaf0600a239da7 Mon Sep 17 00:00:00 2001 From: Yazhou Tang Date: Wed, 6 May 2026 17:47:13 +0800 Subject: bpf: Fix s16 truncation for large bpf-to-bpf call offsets Currently, the BPF instruction set allows bpf-to-bpf calls (or internal calls, pseudo calls) to use a 32-bit imm field to represent the relative jump offset. However, when JIT is disabled or falls back to the interpreter, the verifier invokes bpf_patch_call_args() to rewrite the call instruction. In this function, the 32-bit imm is downcast to s16 and stored in the off field. void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth) { stack_depth = max_t(u32, stack_depth, 1); insn->off = (s16) insn->imm; insn->imm = interpreters_args[(round_up(stack_depth, 32) / 32) - 1] - __bpf_call_base_args; insn->code = BPF_JMP | BPF_CALL_ARGS; } If the original imm exceeds the s16 range (i.e., a jump offset greater than 32767 instructions), this downcast silently truncates the offset, resulting in an incorrect call target. Fix this by: 1. In bpf_patch_call_args(), keeping the imm field unchanged and using the off field to store the index of the interpreter function. 2. In ___bpf_prog_run() for the JMP_CALL_ARGS case, retrieving the interpreter function pointer from the interpreters_args array using the off field as the index, and passing the original imm to calculate the last argument of the interpreter function. After these changes, the truncation issue is resolved, and __bpf_call_base_args is also no longer needed and can be removed, which makes the code cleaner. Performance: In ___bpf_prog_run() for the JMP_CALL_ARGS case, changing the retrieval of the interpreter function pointer from pointer addition to direct array indexing improves performance. The possible reason is that the latter has better instruction-level parallelism. See the v5 discussion [1] for more details. [1] https://lore.kernel.org/bpf/f120c3c4-6999-414a-b514-518bb64b4758@zju.edu.cn/ To avoid requiring bpftool changes, keep the new imm/off encoding internal and restore the legacy xlated dump layout in bpf_insn_prepare_dump(). For bpf-to-bpf call offsets that do not fit in s16, export off as 0 instead of a truncated and misleading value. Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter") Fixes: 7105e828c087 ("bpf: allow for correlation of maps and helpers in dump") Suggested-by: Xu Kuohai Suggested-by: Puranjay Mohan Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Signed-off-by: Yazhou Tang Link: https://lore.kernel.org/r/20260506094714.419842-3-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 6 ++++++ include/linux/filter.h | 3 --- 2 files changed, 6 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 52b30e9ea431..cd191c5fdb0a 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2918,6 +2918,12 @@ int bpf_check(struct bpf_prog **fp, union bpf_attr *attr, bpfptr_t uattr, u32 ua #ifndef CONFIG_BPF_JIT_ALWAYS_ON int bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth); +s32 bpf_call_args_imm(s16 idx); +#else +static inline s32 bpf_call_args_imm(s16 idx) +{ + return 0; +} #endif struct btf *bpf_get_btf_vmlinux(void); diff --git a/include/linux/filter.h b/include/linux/filter.h index 1ec6d5ba64cc..88a241aac36a 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1151,9 +1151,6 @@ bool sk_filter_charge(struct sock *sk, struct sk_filter *fp); void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp); u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); -#define __bpf_call_base_args \ - ((u64 (*)(u64, u64, u64, u64, u64, const struct bpf_insn *)) \ - (void *)__bpf_call_base) struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog); void bpf_jit_compile(struct bpf_prog *prog); -- cgit v1.2.3 From 8ef6b01cee44803691c0a0c95b36f8ec710e2afb Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Thu, 30 Apr 2026 15:43:07 -0700 Subject: platform/x86/intel/vsec: allocate res with intel_vsec_dev MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use a flexible array member to combine allocations. Avoids having to free separately. Add __counted_by for extra runtime analysis. Move counting variable assignment to after allocations as is already done by kzalloc_flex for GCC 15 and above. Signed-off-by: Rosen Penev Tested-by: David E. Box Reviewed-by: David E. Box Link: https://patch.msgid.link/20260430224307.109311-1-rosenp@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen --- include/linux/intel_vsec.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/intel_vsec.h b/include/linux/intel_vsec.h index 1fe5665a9d02..07ea563f524e 100644 --- a/include/linux/intel_vsec.h +++ b/include/linux/intel_vsec.h @@ -135,8 +135,6 @@ struct intel_vsec_platform_info { * struct intel_vsec_device - Auxbus specific device information * @auxdev: auxbus device struct for auxbus access * @dev: struct device associated with the device - * @resource: PCI discovery resources (BAR windows), one per discovery - * instance. Valid only when @src == INTEL_VSEC_DISC_PCI * @acpi_disc: ACPI discovery tables, each entry is two QWORDs * in little-endian format as defined by the PMT ACPI spec. * Valid only when @src == INTEL_VSEC_DISC_ACPI. @@ -149,11 +147,12 @@ struct intel_vsec_platform_info { * @quirks: specified quirks * @base_addr: base address of entries (if specified) * @cap_id: the enumerated id of the vsec feature + * @resource: PCI discovery resources (BAR windows), one per discovery + * instance. Valid only when @src == INTEL_VSEC_DISC_PCI */ struct intel_vsec_device { struct auxiliary_device auxdev; struct device *dev; - struct resource *resource; u32 (*acpi_disc)[4]; enum intel_vsec_disc_source src; struct ida *ida; @@ -164,6 +163,7 @@ struct intel_vsec_device { unsigned long quirks; u64 base_addr; unsigned long cap_id; + struct resource resource[] __counted_by(num_resources); }; /** -- cgit v1.2.3 From 7eba000621fff223dd7bab484d48918c7c77a307 Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Mon, 11 May 2026 09:49:26 +0200 Subject: device property: initialize the remaining fields of fwnode_handle in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure. Cc: stable@vger.kernel.org Fixes: 01bb86b380a3 ("driver core: Add fwnode_init()") Reviewed-by: Sakari Ailus Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260511074927.9473-1-bartosz.golaszewski@oss.qualcomm.com [ Fix typo in commit message. - Danilo ] Signed-off-by: Danilo Krummrich --- include/linux/fwnode.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h index 80b38fbf2121..c30a9baafc0d 100644 --- a/include/linux/fwnode.h +++ b/include/linux/fwnode.h @@ -208,9 +208,12 @@ struct fwnode_operations { static inline void fwnode_init(struct fwnode_handle *fwnode, const struct fwnode_operations *ops) { + fwnode->secondary = NULL; fwnode->ops = ops; + fwnode->dev = NULL; INIT_LIST_HEAD(&fwnode->consumers); INIT_LIST_HEAD(&fwnode->suppliers); + fwnode->flags = 0; } static inline void fwnode_set_flag(struct fwnode_handle *fwnode, -- cgit v1.2.3 From a789761de3053d25f03787ac40897dbea14ee368 Mon Sep 17 00:00:00 2001 From: Benjamin Welton Date: Mon, 9 Feb 2026 00:42:00 +0800 Subject: amd/amdkfd: Add kfd_ioctl_profiler to contain profiler kernel driver changes kfd_ioctl_profiler takes a similar approach to that of kfd_ioctl_dbg_trap (which contains debugger related IOCTL services) where kfd_ioctl_profiler will contain all profiler related IOCTL services. The IOCTL is designed to be expanded as needed to support additional profiler functionality. The current functionality of the IOCTL is to allow for profilers which need PMC counters from GPU devices to both signal to other profilers that may be on the system that the device has active PMC profiling taking place on it (multiple PMC profilers on the same device can result in corrupted counter data) and to setup the device to allow for the collection of SQ PMC data on all queues on the device. For PMC data for the SQ block (such as SQ_WAVES) to be available to a profiler, mmPERFCOUNT_ENABLE must be set on the queues. When profiling a single process, the profiler can inject PM4 packets into each queue to turn on PERFCOUNT_ENABLE. When profiling system wide, the profiler does not have this option and must have a way to turn on profiling for queues in which it cannot inject packets into directly. Accomplishing this requires a few steps: 1. Checking if the user has the necessary permissions to profile system wide on the device. This check uses the same check that linux perf uses to determine if a user has the necessary permissions to profile at this scope (primarily if the process has CAP_SYS_PERFMON or is root). 2. Locking the device for profiling. This is done by setting a lock bit on the device struct and storing the process that locked the device. 3. Iterating all queues on the device and issuing an MQD Update to enable perfcounting on the queues. 4. Actions to cleanup if the process exits or releases the lock. The IOCTL also contains a link to the existing PC Sampling IOCTL as well. This is per a suggestion that we should potentially remove the PC Sampling IOCTL to have it be a part of the profiler IOCTL. This is a future change. In addition, we do expect to expand the profiler IOCTL to include additional profiler functionality in the future (which necessitates the use of a version number). v2: sqaush in proper IOCTL number Proposed userpace support: https://github.com/ROCm/rocm-systems/commit/40abc95a6463a61bb318a67efd6d9cc3e5ee8839 Signed-off-by: Benjamin Welton Signed-off-by: Perry Yuan Acked-by: Kent Russell Reviewed-by: Yifan Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher --- include/uapi/linux/kfd_ioctl.h | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h index e72359370857..cc3ed0765c83 100644 --- a/include/uapi/linux/kfd_ioctl.h +++ b/include/uapi/linux/kfd_ioctl.h @@ -1558,6 +1558,29 @@ struct kfd_ioctl_dbg_trap_args { }; }; +#define KFD_IOC_PROFILER_VERSION_NUM 1 +enum kfd_profiler_ops { + KFD_IOC_PROFILER_PMC = 0, + KFD_IOC_PROFILER_VERSION = 2, +}; + +/** + * Enables/Disables GPU Specific profiler settings + */ +struct kfd_ioctl_pmc_settings { + __u32 gpu_id; /* This is the user_gpu_id */ + __u32 lock; /* Lock GPU for Profiling */ + __u32 perfcount_enable; /* Force Perfcount Enable for queues on GPU */ +}; + +struct kfd_ioctl_profiler_args { + __u32 op; /* kfd_profiler_op */ + union { + struct kfd_ioctl_pmc_settings pmc; + __u32 version; /* KFD_IOC_PROFILER_VERSION_NUM */ + }; +}; + #define AMDKFD_IOCTL_BASE 'K' #define AMDKFD_IO(nr) _IO(AMDKFD_IOCTL_BASE, nr) #define AMDKFD_IOR(nr, type) _IOR(AMDKFD_IOCTL_BASE, nr, type) @@ -1681,7 +1704,10 @@ struct kfd_ioctl_dbg_trap_args { #define AMDKFD_IOC_CREATE_PROCESS \ AMDKFD_IO(0x27) +#define AMDKFD_IOC_PROFILER \ + AMDKFD_IOWR(0x28, struct kfd_ioctl_profiler_args) + #define AMDKFD_COMMAND_START 0x01 -#define AMDKFD_COMMAND_END 0x28 +#define AMDKFD_COMMAND_END 0x29 #endif -- cgit v1.2.3 From dd61e27535a6f5cfb32a847b282d2e3d5aebf46f Mon Sep 17 00:00:00 2001 From: Perry Yuan Date: Mon, 9 Feb 2026 00:42:07 +0800 Subject: drm/amdkfd: Add PTL control IOCTL Option and unify refcount logic Introduce a new IOCTL option to allow userspace explicit control over the Peak Tops Limiter (PTL) state for profiling Link: https://github.com/ROCm/rocm-systems/tree/develop/projects/rocprofiler-sdk Signed-off-by: Perry Yuan Reviewed-by: Yifan Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher --- include/uapi/linux/kfd_ioctl.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h index cc3ed0765c83..1a94d512df35 100644 --- a/include/uapi/linux/kfd_ioctl.h +++ b/include/uapi/linux/kfd_ioctl.h @@ -1562,6 +1562,7 @@ struct kfd_ioctl_dbg_trap_args { enum kfd_profiler_ops { KFD_IOC_PROFILER_PMC = 0, KFD_IOC_PROFILER_VERSION = 2, + KFD_IOC_PROFILER_PTL_CONTROL = 3, }; /** @@ -1573,10 +1574,16 @@ struct kfd_ioctl_pmc_settings { __u32 perfcount_enable; /* Force Perfcount Enable for queues on GPU */ }; +struct kfd_ioctl_ptl_control { + __u32 gpu_id; /* user_gpu_id */ + __u32 enable; /* set 1 to enable PTL, set 0 to disable PTL */ +}; + struct kfd_ioctl_profiler_args { __u32 op; /* kfd_profiler_op */ union { struct kfd_ioctl_pmc_settings pmc; + struct kfd_ioctl_ptl_control ptl; __u32 version; /* KFD_IOC_PROFILER_VERSION_NUM */ }; }; -- cgit v1.2.3 From c62c076d2d64ead542c961cabed0f9467d7d6026 Mon Sep 17 00:00:00 2001 From: Perry Yuan Date: Wed, 15 Apr 2026 10:34:03 +0800 Subject: drm/amdkfd: bump KFD ioctl minor version to 1.23 Bump `KFD_IOCTL_MINOR_VERSION` from 22 to 23 and document version 1.23 in `kfd_ioctl.h` so userspace can detect profiler ioctl support. Signed-off-by: Perry Yuan Suggested-by: Alex Deucher Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher --- include/uapi/linux/kfd_ioctl.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h index 1a94d512df35..9584b5aab727 100644 --- a/include/uapi/linux/kfd_ioctl.h +++ b/include/uapi/linux/kfd_ioctl.h @@ -48,9 +48,10 @@ * - 1.20 - Trap handler support for expert scheduling mode available * - 1.21 - Debugger support to subscribe to LDS out-of-address exceptions * - 1.22 - Add queue creation with metadata ring base address + * - 1.23 - Add profiler control ioctl to enable/disable profiler on a process */ #define KFD_IOCTL_MAJOR_VERSION 1 -#define KFD_IOCTL_MINOR_VERSION 22 +#define KFD_IOCTL_MINOR_VERSION 23 struct kfd_ioctl_get_version_args { __u32 major_version; /* from KFD */ -- cgit v1.2.3 From 0942cdb8f4b14cbfdc1996c2c332c6402a203bf3 Mon Sep 17 00:00:00 2001 From: Luca Leonardo Scorcia Date: Mon, 20 Apr 2026 22:30:03 +0100 Subject: dt-bindings: pinctrl: mediatek,mt65xx: Add MT6392 pinctrl Add a compatible for the pinctrl device of the MT6392 PMIC, a variant of the already supported MT6397. Signed-off-by: Luca Leonardo Scorcia Reviewed-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Linus Walleij --- .../dt-bindings/pinctrl/mediatek,mt6392-pinfunc.h | 39 ++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 include/dt-bindings/pinctrl/mediatek,mt6392-pinfunc.h (limited to 'include') diff --git a/include/dt-bindings/pinctrl/mediatek,mt6392-pinfunc.h b/include/dt-bindings/pinctrl/mediatek,mt6392-pinfunc.h new file mode 100644 index 000000000000..c65278c8103d --- /dev/null +++ b/include/dt-bindings/pinctrl/mediatek,mt6392-pinfunc.h @@ -0,0 +1,39 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +#ifndef __DTS_MT6392_PINFUNC_H +#define __DTS_MT6392_PINFUNC_H + +#include + +#define MT6392_PIN_0_INT__FUNC_GPIO0 (MTK_PIN_NO(0) | 0) +#define MT6392_PIN_0_INT__FUNC_INT (MTK_PIN_NO(0) | 1) +#define MT6392_PIN_0_INT__FUNC_TEST_CK2 (MTK_PIN_NO(0) | 5) +#define MT6392_PIN_0_INT__FUNC_TEST_IN1 (MTK_PIN_NO(0) | 6) +#define MT6392_PIN_0_INT__FUNC_TEST_OUT1 (MTK_PIN_NO(0) | 7) + +#define MT6392_PIN_1_SRCLKEN__FUNC_GPIO1 (MTK_PIN_NO(1) | 0) +#define MT6392_PIN_1_SRCLKEN__FUNC_SRCLKEN (MTK_PIN_NO(1) | 1) +#define MT6392_PIN_1_SRCLKEN__FUNC_TEST_CK0 (MTK_PIN_NO(1) | 5) +#define MT6392_PIN_1_SRCLKEN__FUNC_TEST_IN2 (MTK_PIN_NO(1) | 6) +#define MT6392_PIN_1_SRCLKEN__FUNC_TEST_OUT2 (MTK_PIN_NO(1) | 7) + +#define MT6392_PIN_2_RTC_32K1V8__FUNC_GPIO2 (MTK_PIN_NO(2) | 0) +#define MT6392_PIN_2_RTC_32K1V8__FUNC_RTC_32K1V8 (MTK_PIN_NO(2) | 1) +#define MT6392_PIN_2_RTC_32K1V8__FUNC_TEST_CK1 (MTK_PIN_NO(2) | 5) +#define MT6392_PIN_2_RTC_32K1V8__FUNC_TEST_IN3 (MTK_PIN_NO(2) | 6) +#define MT6392_PIN_2_RTC_32K1V8__FUNC_TEST_OUT3 (MTK_PIN_NO(2) | 7) + +#define MT6392_PIN_3_SPI_CLK__FUNC_GPIO3 (MTK_PIN_NO(3) | 0) +#define MT6392_PIN_3_SPI_CLK__FUNC_SPI_CLK (MTK_PIN_NO(3) | 1) + +#define MT6392_PIN_4_SPI_CSN__FUNC_GPIO4 (MTK_PIN_NO(4) | 0) +#define MT6392_PIN_4_SPI_CSN__FUNC_SPI_CSN (MTK_PIN_NO(4) | 1) + +#define MT6392_PIN_5_SPI_MOSI__FUNC_GPIO5 (MTK_PIN_NO(5) | 0) +#define MT6392_PIN_5_SPI_MOSI__FUNC_SPI_MOSI (MTK_PIN_NO(5) | 1) + +#define MT6392_PIN_6_SPI_MISO__FUNC_GPIO6 (MTK_PIN_NO(6) | 0) +#define MT6392_PIN_6_SPI_MISO__FUNC_SPI_MISO (MTK_PIN_NO(6) | 1) +#define MT6392_PIN_6_SPI_MISO__FUNC_TEST_IN4 (MTK_PIN_NO(6) | 6) +#define MT6392_PIN_6_SPI_MISO__FUNC_TEST_OUT4 (MTK_PIN_NO(6) | 7) + +#endif /* __DTS_MT6392_PINFUNC_H */ -- cgit v1.2.3 From 769e143b115a4af75ecbc6d4e39d58b3e6fe2099 Mon Sep 17 00:00:00 2001 From: Mateusz Guzik Date: Tue, 21 Apr 2026 20:25:36 +0200 Subject: fs: add icount_read_once() and stop open-coding ->i_count loads Similarly to inode_state_read_once(), it makes the caller spell out they acknowledge instability of the returned value. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20260421182538.1215894-2-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner --- include/linux/fs.h | 13 +++++++++++++ include/trace/events/filelock.h | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/fs.h b/include/linux/fs.h index 11559c513dfb..61ce251ad83e 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2218,8 +2218,21 @@ static inline void mark_inode_dirty_sync(struct inode *inode) __mark_inode_dirty(inode, I_DIRTY_SYNC); } +/* + * returns the refcount on the inode. it can change arbitrarily. + */ +static inline int icount_read_once(const struct inode *inode) +{ + return atomic_read(&inode->i_count); +} + +/* + * returns the refcount on the inode. The lock guarantees no new references + * are added, but references can be dropped as long as the result is > 0. + */ static inline int icount_read(const struct inode *inode) { + lockdep_assert_held(&inode->i_lock); return atomic_read(&inode->i_count); } diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h index 116774886244..c8c8847bb6f6 100644 --- a/include/trace/events/filelock.h +++ b/include/trace/events/filelock.h @@ -190,7 +190,7 @@ TRACE_EVENT(generic_add_lease, __entry->i_ino = inode->i_ino; __entry->wcount = atomic_read(&inode->i_writecount); __entry->rcount = atomic_read(&inode->i_readcount); - __entry->icount = icount_read(inode); + __entry->icount = icount_read_once(inode); __entry->owner = fl->c.flc_owner; __entry->flags = fl->c.flc_flags; __entry->type = fl->c.flc_type; -- cgit v1.2.3 From c678577e8896829f9da08635d6075dddefbaf684 Mon Sep 17 00:00:00 2001 From: Mateusz Guzik Date: Tue, 21 Apr 2026 20:25:38 +0200 Subject: fs: allow lockless ->i_count bumps as long as it does not transition 0->1 With this change only 0->1 and 1->0 transitions need the lock. I verified all places which look at the refcount either only care about it staying 0 (and have the lock enforce it) or don't hold the inode lock to begin with (making the above change irrelevant to their correcness or lack thereof). I also confirmed nfs and btrfs like to call into these a lot and now avoid the lock in the common case, shaving off some atomics. Signed-off-by: Mateusz Guzik Link: https://patch.msgid.link/20260421182538.1215894-4-mjguzik@gmail.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner --- include/linux/fs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/fs.h b/include/linux/fs.h index 61ce251ad83e..c5c31a6f7ed5 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2227,8 +2227,8 @@ static inline int icount_read_once(const struct inode *inode) } /* - * returns the refcount on the inode. The lock guarantees no new references - * are added, but references can be dropped as long as the result is > 0. + * returns the refcount on the inode. The lock guarantees no 0->1 or 1->0 transitions + * of the count are going to take place, otherwise it changes arbitrarily. */ static inline int icount_read(const struct inode *inode) { -- cgit v1.2.3 From 912289ee831d92b377309dc832c0c3ce5906deae Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Sun, 26 Apr 2026 00:08:42 +0200 Subject: proc: allow to mark /proc files permanent outside of fs/proc/ Add proc_make_permanent() function to mark PDE as permanent to speed up open/read/close (one alloc/free and lock/unlock less). Enable it for built-in code and for compiled-in modules. This function becomes nop magically in modular code. Note, note, note! If built-in code creates and deletes PDEs dynamically (not in init hook), then proc_make_permanent() must not be used. It is intended for simple code: static int __init xxx_module_init(void) { g_pde = proc_create_single(); proc_make_permanent(g_pde); return 0; } static void __exit xxx_module_exit(void) { remove_proc_entry(g_pde); } If module is built-in then exit hook never executed and PDE is permanent so it is OK to mark it as such. If module is module then rmmod will yank PDE, but proc_make_permanent() is nop and core /proc code will do everything right. Signed-off-by: Alexey Dobriyan Link: https://patch.msgid.link/20260425220844.1763933-2-mjguzik@gmail.com Signed-off-by: Christian Brauner --- include/linux/proc_fs.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 19d1c5e5f335..d2860c18dca9 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -248,4 +248,16 @@ static inline struct pid_namespace *proc_pid_ns(struct super_block *sb) bool proc_ns_file(const struct file *file); +#if defined CONFIG_PROC_FS && !defined MODULE +void impl_proc_make_permanent(struct proc_dir_entry *pde); +#endif + +static inline void proc_make_permanent(struct proc_dir_entry *pde) +{ + /* Don't give matches to modules. */ +#if defined CONFIG_PROC_FS && !defined MODULE + impl_proc_make_permanent(pde); +#endif +} + #endif /* _LINUX_PROC_FS_H */ -- cgit v1.2.3 From dc651e25a6d289bc08cfde032427fa17b3d1b22e Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Sun, 26 Apr 2026 00:08:43 +0200 Subject: fs: RCU-ify filesystems list The drivers list was protected by an rwlock; every mount, every open of /proc/filesystems and the legacy sysfs(2) syscall walked a hand-rolled singly-linked list under it. /proc/filesystems is especially hot because libselinux causes programs as mundane as mkdir, ls and sed to open and read it on every invocation. Convert the list to an RCU-protected hlist and switch the writer side to a plain spinlock. Writers keep their existing non-sleeping section while readers walk under rcu_read_lock() with no lock traffic: - register_filesystem()/unregister_filesystem() take file_systems_lock, publish via hlist_{add_tail,del_init}_rcu() and invalidate the cached /proc/filesystems string. unregister_filesystem() keeps its synchronize_rcu() after dropping the lock so in-flight readers are drained before the module (and its embedded file_system_type) can go away. - __get_fs_type(), list_bdev_fs_names() and the fs_index()/fs_name()/fs_maxindex() helpers walk the list under rcu_read_lock(). fs_name() continues to drop the read-side lock after try_module_get() and accesses ->name outside the RCU section; the module reference pins the embedded file_system_type across the boundary. struct file_system_type::next becomes struct hlist_node list; no in-tree caller references the old ->next field outside fs/filesystems.c. Link: https://patch.msgid.link/20260425220844.1763933-3-mjguzik@gmail.com Signed-off-by: Christian Brauner --- include/linux/fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/fs.h b/include/linux/fs.h index 11559c513dfb..c37bb3c7de8b 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2286,7 +2286,7 @@ struct file_system_type { const struct fs_parameter_spec *parameters; void (*kill_sb) (struct super_block *); struct module *owner; - struct file_system_type * next; + struct hlist_node list; struct hlist_head fs_supers; struct lock_class_key s_lock_key; -- cgit v1.2.3 From dc4edae7f41dceb236553b61cda0383895293c90 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Mon, 27 Apr 2026 10:26:03 +0200 Subject: fs: move SB_I_USERNS_VISIBLE to FS_USERNS_MOUNT_RESTRICTED Whether a filesystem's mounts need to undergo a visibility check in user namespaces is a static property of the filesystem type, not a runtime property of each superblock instance. Both proc and sysfs always set SB_I_USERNS_VISIBLE on their superblocks unconditionally (sysfs does so on first creation, and subsequent mounts reuse the same superblock). Move this flag from sb->s_iflags (SB_I_USERNS_VISIBLE) to file_system_type->fs_flags (FS_USERNS_MOUNT_RESTRICTED) so the intent is expressed at the filesystem type level where it belongs. All check sites are updated to test sb->s_type->fs_flags instead of sb->s_iflags. The SB_I_NOEXEC and SB_I_NODEV flags remain on the superblock as they are runtime properties set during fill_super. Link: https://patch.msgid.link/72887c5b6204dc3adf5a53104f0be6bd8bc4f6cd.1777278334.git.legion@kernel.org Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner --- include/linux/fs.h | 1 + include/linux/fs/super_types.h | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/fs.h b/include/linux/fs.h index c37bb3c7de8b..e7ff9f8b1485 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2281,6 +2281,7 @@ struct file_system_type { #define FS_MGTIME 64 /* FS uses multigrain timestamps */ #define FS_LBS 128 /* FS supports LBS */ #define FS_POWER_FREEZE 256 /* Always freeze on suspend/hibernate */ +#define FS_USERNS_MOUNT_RESTRICTED 512 /* Restrict mount in userns if not already visible */ #define FS_RENAME_DOES_D_MOVE 32768 /* FS will handle d_move() during rename() internally. */ int (*init_fs_context)(struct fs_context *); const struct fs_parameter_spec *parameters; diff --git a/include/linux/fs/super_types.h b/include/linux/fs/super_types.h index 383050e7fdf5..182efbeb9520 100644 --- a/include/linux/fs/super_types.h +++ b/include/linux/fs/super_types.h @@ -326,7 +326,6 @@ struct super_block { #define SB_I_STABLE_WRITES 0x00000008 /* don't modify blks until WB is done */ /* sb->s_iflags to limit user namespace mounts */ -#define SB_I_USERNS_VISIBLE 0x00000010 /* fstype already mounted */ #define SB_I_IMA_UNVERIFIABLE_SIGNATURE 0x00000020 #define SB_I_UNTRUSTED_MOUNTER 0x00000040 #define SB_I_EVM_HMAC_UNSUPPORTED 0x00000080 -- cgit v1.2.3 From a2a5eb6323a7b1987fd8048d94b9ffc7f87e3064 Mon Sep 17 00:00:00 2001 From: Alexey Gladkov Date: Mon, 27 Apr 2026 10:26:05 +0200 Subject: proc: subset=pid: Show /proc/self/net only for CAP_NET_ADMIN Cache the mounters credentials and allow access to the net directories contingent of the permissions of the mounter of proc. Do not show /proc/self/net when proc is mounted with subset=pid option and the mounter does not have CAP_NET_ADMIN. To avoid inadvertently allowing access to /proc//net, updating mounter credentials is not supported. Signed-off-by: Alexey Gladkov Link: https://patch.msgid.link/d2466fe9085367f1e24693c437ecb8cff2789660.1777278334.git.legion@kernel.org Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner --- include/linux/proc_fs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index d2860c18dca9..47d7deaeed8f 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -67,6 +67,7 @@ enum proc_pidonly { struct proc_fs_info { struct pid_namespace *pid_ns; kgid_t pid_gid; + const struct cred *mounter_cred; enum proc_hidepid hide_pid; enum proc_pidonly pidonly; struct rcu_head rcu; -- cgit v1.2.3 From 05dab768fc2dc7eb9b827201bb39bb5be54bce49 Mon Sep 17 00:00:00 2001 From: Alexey Gladkov Date: Mon, 27 Apr 2026 10:26:07 +0200 Subject: proc: handle subset=pid separately in userns visibility checks When procfs is mounted with subset=pid, only the dynamic process-related part of the filesystem remains visible. That part cannot be hidden by overmounts, so checking whether an existing procfs mount is fully visible does not make sense for this mode. At the same time, a subset=pid procfs mount must not be used as evidence that a later procfs mount would not reveal additional information. It provides a restricted view of procfs, not the full filesystem view. Mark subset=pid procfs instances as restricted variants. Ignore restricted variants when looking for an already-visible mount, and allow new restricted variants without consulting mnt_already_visible(). Signed-off-by: Alexey Gladkov Link: https://patch.msgid.link/4d5e760c3d534dd2e05578d119cc408450053a98.1777278334.git.legion@kernel.org Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner --- include/linux/fs/super_types.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/fs/super_types.h b/include/linux/fs/super_types.h index 182efbeb9520..a6cdc8f6de4e 100644 --- a/include/linux/fs/super_types.h +++ b/include/linux/fs/super_types.h @@ -326,6 +326,7 @@ struct super_block { #define SB_I_STABLE_WRITES 0x00000008 /* don't modify blks until WB is done */ /* sb->s_iflags to limit user namespace mounts */ +#define SB_I_RESTRICTED_VARIANT 0x00000010 #define SB_I_IMA_UNVERIFIABLE_SIGNATURE 0x00000020 #define SB_I_UNTRUSTED_MOUNTER 0x00000040 #define SB_I_EVM_HMAC_UNSUPPORTED 0x00000080 -- cgit v1.2.3 From f92b778251ada37dc433a7f9547c5d2e5ebcdf7d Mon Sep 17 00:00:00 2001 From: Kathiravan Thirumoorthy Date: Thu, 7 May 2026 22:38:27 +0530 Subject: dt-bindings: clock: add Qualcomm IPQ9650 GCC Add binding for the Qualcomm IPQ9650 Global Clock Controller. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kathiravan Thirumoorthy Link: https://lore.kernel.org/r/20260507-ipq9650_boot_to_shell-v3-1-62742b49c991@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/clock/qcom,ipq9650-gcc.h | 172 +++++++++++++++++++++ include/dt-bindings/reset/qcom,ipq9650-gcc.h | 215 +++++++++++++++++++++++++++ 2 files changed, 387 insertions(+) create mode 100644 include/dt-bindings/clock/qcom,ipq9650-gcc.h create mode 100644 include/dt-bindings/reset/qcom,ipq9650-gcc.h (limited to 'include') diff --git a/include/dt-bindings/clock/qcom,ipq9650-gcc.h b/include/dt-bindings/clock/qcom,ipq9650-gcc.h new file mode 100644 index 000000000000..afd17c00d96e --- /dev/null +++ b/include/dt-bindings/clock/qcom,ipq9650-gcc.h @@ -0,0 +1,172 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef _DT_BINDINGS_CLOCK_IPQ_GCC_IPQ9650_H +#define _DT_BINDINGS_CLOCK_IPQ_GCC_IPQ9650_H + +#define GCC_ADSS_PWM_CLK 0 +#define GCC_ADSS_PWM_CLK_SRC 1 +#define GCC_ANOC_PCIE0_1LANE_M_CLK 2 +#define GCC_ANOC_PCIE0_1LANE_S_CLK 3 +#define GCC_ANOC_PCIE1_2LANE_M_CLK 4 +#define GCC_ANOC_PCIE1_2LANE_S_CLK 5 +#define GCC_ANOC_PCIE2_2LANE_M_CLK 6 +#define GCC_ANOC_PCIE2_2LANE_S_CLK 7 +#define GCC_ANOC_PCIE3_2LANE_M_CLK 8 +#define GCC_ANOC_PCIE3_2LANE_S_CLK 9 +#define GCC_ANOC_PCIE4_1LANE_M_CLK 10 +#define GCC_ANOC_PCIE4_1LANE_S_CLK 11 +#define GCC_CMN_12GPLL_AHB_CLK 12 +#define GCC_CMN_12GPLL_APU_CLK 13 +#define GCC_CMN_12GPLL_SYS_CLK 14 +#define GCC_CMN_LDO_CLK 15 +#define GCC_MDIO_AHB_CLK 16 +#define GCC_NSSCC_CLK 17 +#define GCC_NSSCFG_CLK 18 +#define GCC_NSSNOC_ATB_CLK 19 +#define GCC_NSSNOC_MEMNOC_1_CLK 20 +#define GCC_NSSNOC_MEMNOC_BFDCD_CLK_SRC 21 +#define GCC_NSSNOC_MEMNOC_CLK 22 +#define GCC_NSSNOC_MEMNOC_DIV_CLK_SRC 23 +#define GCC_NSSNOC_NSSCC_CLK 24 +#define GCC_NSSNOC_PCNOC_1_CLK 25 +#define GCC_NSSNOC_QOSGEN_REF_CLK 26 +#define GCC_NSSNOC_SNOC_1_CLK 27 +#define GCC_NSSNOC_SNOC_CLK 28 +#define GCC_NSSNOC_TIMEOUT_REF_CLK 29 +#define GCC_NSSNOC_XO_DCD_CLK 30 +#define GCC_NSS_TS_CLK 31 +#define GCC_NSS_TS_CLK_SRC 32 +#define GCC_PCIE0_AHB_CLK 33 +#define GCC_PCIE0_AUX_CLK 34 +#define GCC_PCIE0_AXI_M_CLK 35 +#define GCC_PCIE0_AXI_M_CLK_SRC 36 +#define GCC_PCIE0_AXI_S_BRIDGE_CLK 37 +#define GCC_PCIE0_AXI_S_CLK 38 +#define GCC_PCIE0_AXI_S_CLK_SRC 39 +#define GCC_PCIE0_PIPE_CLK 40 +#define GCC_PCIE0_PIPE_CLK_SRC 41 +#define GCC_PCIE0_RCHNG_CLK 42 +#define GCC_PCIE0_RCHNG_CLK_SRC 43 +#define GCC_PCIE1_AHB_CLK 44 +#define GCC_PCIE1_AUX_CLK 45 +#define GCC_PCIE1_AXI_M_CLK 46 +#define GCC_PCIE1_AXI_M_CLK_SRC 47 +#define GCC_PCIE1_AXI_S_BRIDGE_CLK 48 +#define GCC_PCIE1_AXI_S_CLK 49 +#define GCC_PCIE1_AXI_S_CLK_SRC 50 +#define GCC_PCIE1_PIPE_CLK 51 +#define GCC_PCIE1_PIPE_CLK_SRC 52 +#define GCC_PCIE1_RCHNG_CLK 53 +#define GCC_PCIE1_RCHNG_CLK_SRC 54 +#define GCC_PCIE2_AHB_CLK 55 +#define GCC_PCIE2_AUX_CLK 56 +#define GCC_PCIE2_AXI_M_CLK 57 +#define GCC_PCIE2_AXI_M_CLK_SRC 58 +#define GCC_PCIE2_AXI_S_BRIDGE_CLK 59 +#define GCC_PCIE2_AXI_S_CLK 60 +#define GCC_PCIE2_AXI_S_CLK_SRC 61 +#define GCC_PCIE2_PIPE_CLK 62 +#define GCC_PCIE2_PIPE_CLK_SRC 63 +#define GCC_PCIE2_RCHNG_CLK 64 +#define GCC_PCIE2_RCHNG_CLK_SRC 65 +#define GCC_PCIE3_AHB_CLK 66 +#define GCC_PCIE3_AUX_CLK 67 +#define GCC_PCIE3_AXI_M_CLK 68 +#define GCC_PCIE3_AXI_M_CLK_SRC 69 +#define GCC_PCIE3_AXI_S_BRIDGE_CLK 70 +#define GCC_PCIE3_AXI_S_CLK 71 +#define GCC_PCIE3_AXI_S_CLK_SRC 72 +#define GCC_PCIE3_PIPE_CLK 73 +#define GCC_PCIE3_PIPE_CLK_SRC 74 +#define GCC_PCIE3_RCHNG_CLK 75 +#define GCC_PCIE3_RCHNG_CLK_SRC 76 +#define GCC_PCIE4_AHB_CLK 77 +#define GCC_PCIE4_AUX_CLK 78 +#define GCC_PCIE4_AXI_M_CLK 79 +#define GCC_PCIE4_AXI_M_CLK_SRC 80 +#define GCC_PCIE4_AXI_S_BRIDGE_CLK 81 +#define GCC_PCIE4_AXI_S_CLK 82 +#define GCC_PCIE4_AXI_S_CLK_SRC 83 +#define GCC_PCIE4_PIPE_CLK 84 +#define GCC_PCIE4_PIPE_CLK_SRC 85 +#define GCC_PCIE4_RCHNG_CLK 86 +#define GCC_PCIE4_RCHNG_CLK_SRC 87 +#define GCC_PCIE_AUX_CLK_SRC 88 +#define GCC_PCNOC_BFDCD_CLK_SRC 89 +#define GCC_QDSS_AT_CLK 90 +#define GCC_QDSS_AT_CLK_SRC 91 +#define GCC_QDSS_DAP_CLK 92 +#define GCC_QDSS_TSCTR_CLK_SRC 93 +#define GCC_QPIC_AHB_CLK 94 +#define GCC_QPIC_CLK 95 +#define GCC_QPIC_CLK_SRC 96 +#define GCC_QPIC_IO_MACRO_CLK 97 +#define GCC_QPIC_IO_MACRO_CLK_SRC 98 +#define GCC_QPIC_SLEEP_CLK 99 +#define GCC_QUPV3_2X_CORE_CLK 100 +#define GCC_QUPV3_2X_CORE_CLK_SRC 101 +#define GCC_QUPV3_AHB_MST_CLK 102 +#define GCC_QUPV3_AHB_SLV_CLK 103 +#define GCC_QUPV3_CORE_CLK 104 +#define GCC_QUPV3_SLEEP_CLK 105 +#define GCC_QUPV3_WRAP_SE0_CLK 106 +#define GCC_QUPV3_WRAP_SE0_CLK_SRC 107 +#define GCC_QUPV3_WRAP_SE1_CLK 108 +#define GCC_QUPV3_WRAP_SE1_CLK_SRC 109 +#define GCC_QUPV3_WRAP_SE2_CLK 110 +#define GCC_QUPV3_WRAP_SE2_CLK_SRC 111 +#define GCC_QUPV3_WRAP_SE3_CLK 112 +#define GCC_QUPV3_WRAP_SE3_CLK_SRC 113 +#define GCC_QUPV3_WRAP_SE4_CLK 114 +#define GCC_QUPV3_WRAP_SE4_CLK_SRC 115 +#define GCC_QUPV3_WRAP_SE5_CLK 116 +#define GCC_QUPV3_WRAP_SE5_CLK_SRC 117 +#define GCC_QUPV3_WRAP_SE6_CLK 118 +#define GCC_QUPV3_WRAP_SE6_CLK_SRC 119 +#define GCC_QUPV3_WRAP_SE7_CLK 120 +#define GCC_QUPV3_WRAP_SE7_CLK_SRC 121 +#define GCC_SDCC1_AHB_CLK 122 +#define GCC_SDCC1_APPS_CLK 123 +#define GCC_SDCC1_APPS_CLK_SRC 124 +#define GCC_SDCC1_ICE_CORE_CLK 125 +#define GCC_SDCC1_ICE_CORE_CLK_SRC 126 +#define GCC_SLEEP_CLK_SRC 127 +#define GCC_SNOC_USB_CLK 128 +#define GCC_SYSTEM_NOC_BFDCD_CLK_SRC 129 +#define GCC_TLMM_AHB_CLK 130 +#define GCC_TLMM_CLK 131 +#define GCC_UNIPHY0_AHB_CLK 132 +#define GCC_UNIPHY0_SYS_CLK 133 +#define GCC_UNIPHY1_AHB_CLK 134 +#define GCC_UNIPHY1_SYS_CLK 135 +#define GCC_UNIPHY2_AHB_CLK 136 +#define GCC_UNIPHY2_SYS_CLK 137 +#define GCC_UNIPHY_SYS_CLK_SRC 138 +#define GCC_USB0_AUX_CLK 139 +#define GCC_USB0_AUX_CLK_SRC 140 +#define GCC_USB0_EUD_AT_CLK 141 +#define GCC_USB0_MASTER_CLK 142 +#define GCC_USB0_MASTER_CLK_SRC 143 +#define GCC_USB0_MOCK_UTMI_CLK 144 +#define GCC_USB0_MOCK_UTMI_CLK_SRC 145 +#define GCC_USB0_MOCK_UTMI_DIV_CLK_SRC 146 +#define GCC_USB0_PHY_CFG_AHB_CLK 147 +#define GCC_USB0_PIPE_CLK 148 +#define GCC_USB0_PIPE_CLK_SRC 149 +#define GCC_USB0_SLEEP_CLK 150 +#define GCC_USB1_MASTER_CLK 151 +#define GCC_USB1_MOCK_UTMI_CLK 152 +#define GCC_USB1_MOCK_UTMI_CLK_SRC 153 +#define GCC_USB1_MOCK_UTMI_DIV_CLK_SRC 154 +#define GCC_USB1_PHY_CFG_AHB_CLK 155 +#define GCC_USB1_SLEEP_CLK 156 +#define GCC_XO_CLK_SRC 157 +#define GPLL0 158 +#define GPLL0_MAIN 159 +#define GPLL2 160 +#define GPLL2_OUT_MAIN 161 +#define GPLL4 162 +#endif diff --git a/include/dt-bindings/reset/qcom,ipq9650-gcc.h b/include/dt-bindings/reset/qcom,ipq9650-gcc.h new file mode 100644 index 000000000000..a2cbb114addd --- /dev/null +++ b/include/dt-bindings/reset/qcom,ipq9650-gcc.h @@ -0,0 +1,215 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef _DT_BINDINGS_RESET_IPQ_GCC_IPQ9650_H +#define _DT_BINDINGS_RESET_IPQ_GCC_IPQ9650_H + +#define GCC_ADSS_BCR 0 +#define GCC_ADSS_PWM_CLK_ARES 1 +#define GCC_APC0_VOLTAGE_DROOP_DETECTOR_BCR 2 +#define GCC_APC0_VOLTAGE_DROOP_DETECTOR_GPLL0_CLK_ARES 3 +#define GCC_APSS_AHB_CLK_ARES 4 +#define GCC_APSS_ATB_CLK_ARES 5 +#define GCC_APSS_AXI_CLK_ARES 6 +#define GCC_APSS_TS_CLK_ARES 7 +#define GCC_BOOT_ROM_AHB_CLK_ARES 8 +#define GCC_BOOT_ROM_BCR 9 +#define GCC_CMN_12GPLL_AHB_CLK_ARES 10 +#define GCC_CMN_12GPLL_APU_CLK_ARES 11 +#define GCC_CMN_12GPLL_SYS_CLK_ARES 12 +#define GCC_CMN_BLK_BCR 13 +#define GCC_CMN_LDO_CLK_ARES 14 +#define GCC_CPUSS_TRIG_CLK_ARES 15 +#define GCC_GP1_CLK_ARES 16 +#define GCC_GP2_CLK_ARES 17 +#define GCC_GP3_CLK_ARES 18 +#define GCC_MDIO_AHB_CLK_ARES 19 +#define GCC_MDIO_BCR 20 +#define GCC_NSSCC_CLK_ARES 21 +#define GCC_NSSCFG_CLK_ARES 22 +#define GCC_NSSNOC_ATB_CLK_ARES 23 +#define GCC_NSSNOC_MEMNOC_1_CLK_ARES 24 +#define GCC_NSSNOC_MEMNOC_CLK_ARES 25 +#define GCC_NSSNOC_NSSCC_CLK_ARES 26 +#define GCC_NSSNOC_PCNOC_1_CLK_ARES 27 +#define GCC_NSSNOC_QOSGEN_REF_CLK_ARES 28 +#define GCC_NSSNOC_SNOC_1_CLK_ARES 29 +#define GCC_NSSNOC_SNOC_CLK_ARES 30 +#define GCC_NSSNOC_TIMEOUT_REF_CLK_ARES 31 +#define GCC_NSSNOC_XO_DCD_CLK_ARES 32 +#define GCC_NSS_BCR 33 +#define GCC_NSS_TS_CLK_ARES 34 +#define GCC_PCIE0PHY_PHY_BCR 35 +#define GCC_PCIE0_AHB_CLK_ARES 36 +#define GCC_PCIE0_AHB_RESET 37 +#define GCC_PCIE0_AUX_CLK_ARES 38 +#define GCC_PCIE0_AUX_RESET 39 +#define GCC_PCIE0_AXI_M_CLK_ARES 40 +#define GCC_PCIE0_AXI_M_RESET 41 +#define GCC_PCIE0_AXI_M_STICKY_RESET 42 +#define GCC_PCIE0_AXI_S_BRIDGE_CLK_ARES 43 +#define GCC_PCIE0_AXI_S_CLK_ARES 44 +#define GCC_PCIE0_AXI_S_RESET 45 +#define GCC_PCIE0_AXI_S_STICKY_RESET 46 +#define GCC_PCIE0_BCR 47 +#define GCC_PCIE0_CORE_STICKY_RESET 48 +#define GCC_PCIE0_LINK_DOWN_BCR 49 +#define GCC_PCIE0_PHY_BCR 50 +#define GCC_PCIE0_PIPE_CLK_ARES 51 +#define GCC_PCIE0_PIPE_RESET 52 +#define GCC_PCIE1PHY_PHY_BCR 53 +#define GCC_PCIE1_AHB_CLK_ARES 54 +#define GCC_PCIE1_AHB_RESET 55 +#define GCC_PCIE1_AUX_CLK_ARES 56 +#define GCC_PCIE1_AUX_RESET 57 +#define GCC_PCIE1_AXI_M_CLK_ARES 58 +#define GCC_PCIE1_AXI_M_RESET 59 +#define GCC_PCIE1_AXI_M_STICKY_RESET 60 +#define GCC_PCIE1_AXI_S_BRIDGE_CLK_ARES 61 +#define GCC_PCIE1_AXI_S_CLK_ARES 62 +#define GCC_PCIE1_AXI_S_RESET 63 +#define GCC_PCIE1_AXI_S_STICKY_RESET 64 +#define GCC_PCIE1_BCR 65 +#define GCC_PCIE1_CORE_STICKY_RESET 66 +#define GCC_PCIE1_LINK_DOWN_BCR 67 +#define GCC_PCIE1_PHY_BCR 68 +#define GCC_PCIE1_PIPE_CLK_ARES 69 +#define GCC_PCIE1_PIPE_RESET 70 +#define GCC_PCIE2PHY_PHY_BCR 71 +#define GCC_PCIE2_AHB_CLK_ARES 72 +#define GCC_PCIE2_AHB_RESET 73 +#define GCC_PCIE2_AUX_CLK_ARES 74 +#define GCC_PCIE2_AUX_RESET 75 +#define GCC_PCIE2_AXI_M_CLK_ARES 76 +#define GCC_PCIE2_AXI_M_RESET 77 +#define GCC_PCIE2_AXI_M_STICKY_RESET 78 +#define GCC_PCIE2_AXI_S_BRIDGE_CLK_ARES 79 +#define GCC_PCIE2_AXI_S_CLK_ARES 80 +#define GCC_PCIE2_AXI_S_RESET 81 +#define GCC_PCIE2_AXI_S_STICKY_RESET 82 +#define GCC_PCIE2_BCR 83 +#define GCC_PCIE2_CORE_STICKY_RESET 84 +#define GCC_PCIE2_LINK_DOWN_BCR 85 +#define GCC_PCIE2_PHY_BCR 86 +#define GCC_PCIE2_PIPE_CLK_ARES 87 +#define GCC_PCIE2_PIPE_RESET 88 +#define GCC_PCIE3PHY_PHY_BCR 89 +#define GCC_PCIE3_AHB_CLK_ARES 90 +#define GCC_PCIE3_AHB_RESET 91 +#define GCC_PCIE3_AUX_CLK_ARES 92 +#define GCC_PCIE3_AUX_RESET 93 +#define GCC_PCIE3_AXI_M_CLK_ARES 94 +#define GCC_PCIE3_AXI_M_RESET 95 +#define GCC_PCIE3_AXI_M_STICKY_RESET 96 +#define GCC_PCIE3_AXI_S_BRIDGE_CLK_ARES 97 +#define GCC_PCIE3_AXI_S_CLK_ARES 98 +#define GCC_PCIE3_AXI_S_RESET 99 +#define GCC_PCIE3_AXI_S_STICKY_RESET 100 +#define GCC_PCIE3_BCR 101 +#define GCC_PCIE3_CORE_STICKY_RESET 102 +#define GCC_PCIE3_LINK_DOWN_BCR 103 +#define GCC_PCIE3_PHY_BCR 104 +#define GCC_PCIE3_PIPE_CLK_ARES 105 +#define GCC_PCIE3_PIPE_RESET 106 +#define GCC_PCIE4PHY_PHY_BCR 107 +#define GCC_PCIE4_AHB_CLK_ARES 108 +#define GCC_PCIE4_AHB_RESET 109 +#define GCC_PCIE4_AUX_CLK_ARES 110 +#define GCC_PCIE4_AUX_RESET 111 +#define GCC_PCIE4_AXI_M_CLK_ARES 112 +#define GCC_PCIE4_AXI_M_RESET 113 +#define GCC_PCIE4_AXI_M_STICKY_RESET 114 +#define GCC_PCIE4_AXI_S_BRIDGE_CLK_ARES 115 +#define GCC_PCIE4_AXI_S_CLK_ARES 116 +#define GCC_PCIE4_AXI_S_RESET 117 +#define GCC_PCIE4_AXI_S_STICKY_RESET 118 +#define GCC_PCIE4_BCR 119 +#define GCC_PCIE4_CORE_STICKY_RESET 120 +#define GCC_PCIE4_LINK_DOWN_BCR 121 +#define GCC_PCIE4_PHY_BCR 122 +#define GCC_PCIE4_PIPE_CLK_ARES 123 +#define GCC_PCIE4_PIPE_RESET 124 +#define GCC_QDSS_APB2JTAG_CLK_ARES 125 +#define GCC_QDSS_AT_CLK_ARES 126 +#define GCC_QDSS_BCR 127 +#define GCC_QDSS_CFG_AHB_CLK_ARES 128 +#define GCC_QDSS_DAP_AHB_CLK_ARES 129 +#define GCC_QDSS_DAP_CLK_ARES 130 +#define GCC_QDSS_ETR_USB_CLK_ARES 131 +#define GCC_QDSS_EUD_AT_CLK_ARES 132 +#define GCC_QDSS_STM_CLK_ARES 133 +#define GCC_QDSS_TRACECLKIN_CLK_ARES 134 +#define GCC_QDSS_TSCTR_DIV16_CLK_ARES 135 +#define GCC_QDSS_TSCTR_DIV2_CLK_ARES 136 +#define GCC_QDSS_TSCTR_DIV3_CLK_ARES 137 +#define GCC_QDSS_TSCTR_DIV4_CLK_ARES 138 +#define GCC_QDSS_TSCTR_DIV8_CLK_ARES 139 +#define GCC_QDSS_TS_CLK_ARES 140 +#define GCC_QPIC_AHB_CLK_ARES 141 +#define GCC_QPIC_BCR 142 +#define GCC_QPIC_CLK_ARES 143 +#define GCC_QPIC_IO_MACRO_CLK_ARES 144 +#define GCC_QPIC_SLEEP_CLK_ARES 145 +#define GCC_QUPV3_2X_CORE_CLK_ARES 146 +#define GCC_QUPV3_AHB_MST_CLK_ARES 147 +#define GCC_QUPV3_AHB_SLV_CLK_ARES 148 +#define GCC_QUPV3_BCR 149 +#define GCC_QUPV3_CORE_CLK_ARES 150 +#define GCC_QUPV3_WRAP_SE0_BCR 151 +#define GCC_QUPV3_WRAP_SE0_CLK_ARES 152 +#define GCC_QUPV3_WRAP_SE1_BCR 153 +#define GCC_QUPV3_WRAP_SE1_CLK_ARES 154 +#define GCC_QUPV3_WRAP_SE2_BCR 155 +#define GCC_QUPV3_WRAP_SE2_CLK_ARES 156 +#define GCC_QUPV3_WRAP_SE3_BCR 157 +#define GCC_QUPV3_WRAP_SE3_CLK_ARES 158 +#define GCC_QUPV3_WRAP_SE4_BCR 159 +#define GCC_QUPV3_WRAP_SE4_CLK_ARES 160 +#define GCC_QUPV3_WRAP_SE5_BCR 161 +#define GCC_QUPV3_WRAP_SE5_CLK_ARES 162 +#define GCC_QUPV3_WRAP_SE6_BCR 163 +#define GCC_QUPV3_WRAP_SE6_CLK_ARES 164 +#define GCC_QUPV3_WRAP_SE7_BCR 165 +#define GCC_QUPV3_WRAP_SE7_CLK_ARES 166 +#define GCC_QUSB2_0_PHY_BCR 167 +#define GCC_QUSB2_1_PHY_BCR 168 +#define GCC_SDCC1_APPS_CLK_ARES 169 +#define GCC_SDCC1_ICE_CORE_CLK_ARES 170 +#define GCC_SDCC_BCR 171 +#define GCC_TLMM_AHB_CLK_ARES 172 +#define GCC_TLMM_BCR 173 +#define GCC_TLMM_CLK_ARES 174 +#define GCC_UNIPHY0_AHB_CLK_ARES 175 +#define GCC_UNIPHY0_BCR 176 +#define GCC_UNIPHY0_PMA_BCR 177 +#define GCC_UNIPHY0_SYS_CLK_ARES 178 +#define GCC_UNIPHY0_XPCS_ARES 179 +#define GCC_UNIPHY1_AHB_CLK_ARES 180 +#define GCC_UNIPHY1_BCR 181 +#define GCC_UNIPHY1_PMA_BCR 182 +#define GCC_UNIPHY1_SYS_CLK_ARES 183 +#define GCC_UNIPHY1_XPCS_ARES 184 +#define GCC_UNIPHY2_AHB_CLK_ARES 185 +#define GCC_UNIPHY2_BCR 186 +#define GCC_UNIPHY2_PMA_BCR 187 +#define GCC_UNIPHY2_SYS_CLK_ARES 188 +#define GCC_UNIPHY2_XPCS_ARES 189 +#define GCC_USB0_AUX_CLK_ARES 190 +#define GCC_USB0_MASTER_CLK_ARES 191 +#define GCC_USB0_MOCK_UTMI_CLK_ARES 192 +#define GCC_USB0_PHY_BCR 193 +#define GCC_USB0_PHY_CFG_AHB_CLK_ARES 194 +#define GCC_USB0_PIPE_CLK_ARES 195 +#define GCC_USB0_SLEEP_CLK_ARES 196 +#define GCC_USB1_BCR 197 +#define GCC_USB1_MASTER_CLK_ARES 198 +#define GCC_USB1_MOCK_UTMI_CLK_ARES 199 +#define GCC_USB1_PHY_CFG_AHB_CLK_ARES 200 +#define GCC_USB1_SLEEP_CLK_ARES 201 +#define GCC_USB3PHY_0_PHY_BCR 202 +#define GCC_USB_BCR 203 +#define GCC_UNIPHY1_XLGPCS_ARES 204 +#define GCC_UNIPHY2_XLGPCS_ARES 205 +#endif -- cgit v1.2.3 From cb880b02117de1040b0e23a79d9c05d9a6c475b7 Mon Sep 17 00:00:00 2001 From: David Yang Date: Fri, 8 May 2026 05:40:51 +0800 Subject: net: mention the convention for .ndo_setup_tc() qdisc_offload_dump_helper(), originated from commit 602f3baf2218 ("net_sch: red: Add offload ability to RED qdisc"), is designed to that Whether RED is being offloaded is being determined every time dump action is being called because parent change of this qdisc could change its offload state but doesn't require any RED function to be called. and returning -EOPNOTSUPP (for dump queries) does not mean "I don't have any statistics", but "I don't offload this qdisc anymore". At least two existing drivers did it wrong, so it is worth mentioning. Signed-off-by: David Yang Link: https://patch.msgid.link/20260507214054.2539790-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 744ffa243501..e7af71491a47 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1223,6 +1223,12 @@ struct netdev_net_notifier { * tx queues stopped. This allows the netdevice to perform queue * management safely. * + * NB: Returning -EOPNOTSUPP for whatever commands means "this qdisc + * is not offloaded (anymore, offloading may have silently stopped)", + * and the offloading flag is cleared. Notably, this is also true for + * dump queries (e.g. TC_*_STATS commands). If the underlying device does + * not report any statistics but is still offloading, return 0 instead. + * * Fiber Channel over Ethernet (FCoE) offload functions. * int (*ndo_fcoe_enable)(struct net_device *dev); * Called when the FCoE protocol stack wants to start using LLD for FCoE -- cgit v1.2.3 From 5a643e4623238e14b03d75ca0d4eda0645720cee Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Fri, 8 May 2026 06:55:03 -0700 Subject: bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c Move xbc_snprint_cmdline() from init/main.c to lib/bootconfig.c so the function (and its xbc_namebuf scratch buffer) becomes part of the shared parser library. tools/bootconfig already compiles lib/bootconfig.c directly, which lets a follow-up patch reuse the same renderer in the userspace tool to convert a bootconfig file into a flat cmdline string at build time. No functional change. Link: https://lore.kernel.org/all/20260508-bootconfig_using_tools-v1-1-1132219aa773@debian.org/ Signed-off-by: Breno Leitao Signed-off-by: Masami Hiramatsu (Google) --- include/linux/bootconfig.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/bootconfig.h b/include/linux/bootconfig.h index 692a5acc2ffc..1c7f3b74ffcf 100644 --- a/include/linux/bootconfig.h +++ b/include/linux/bootconfig.h @@ -265,6 +265,9 @@ static inline struct xbc_node * __init xbc_node_get_subkey(struct xbc_node *node int __init xbc_node_compose_key_after(struct xbc_node *root, struct xbc_node *node, char *buf, size_t size); +/* Render key/value pairs under @root as a flat cmdline string */ +int __init xbc_snprint_cmdline(char *buf, size_t size, struct xbc_node *root); + /** * xbc_node_compose_key() - Compose full key string of the XBC node * @node: An XBC node. -- cgit v1.2.3 From 863cd78652018576c60f1b73477a15bdb0ea7551 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Sun, 10 May 2026 09:14:49 +0000 Subject: net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Helpers to increment or decrement sch->q.qlen, with appropriate WRITE_ONCE() to prevent store tearing. Add other WRITE_ONCE() when sch->q.qlen is changed. Signed-off-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260510091455.4039245-3-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/sch_generic.h | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index ccfabfac674e..dbb3ba6416e4 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -542,6 +542,16 @@ static inline int qdisc_qlen(const struct Qdisc *q) return q->q.qlen; } +static inline void qdisc_qlen_inc(struct Qdisc *q) +{ + WRITE_ONCE(q->q.qlen, q->q.qlen + 1); +} + +static inline void qdisc_qlen_dec(struct Qdisc *q) +{ + WRITE_ONCE(q->q.qlen, q->q.qlen - 1); +} + static inline int qdisc_qlen_sum(const struct Qdisc *q) { __u32 qlen = q->qstats.qlen; @@ -549,9 +559,9 @@ static inline int qdisc_qlen_sum(const struct Qdisc *q) if (qdisc_is_percpu_stats(q)) { for_each_possible_cpu(i) - qlen += per_cpu_ptr(q->cpu_qstats, i)->qlen; + qlen += READ_ONCE(per_cpu_ptr(q->cpu_qstats, i)->qlen); } else { - qlen += q->q.qlen; + qlen += READ_ONCE(q->q.qlen); } return qlen; @@ -1068,7 +1078,7 @@ static inline void __qdisc_enqueue_tail(struct sk_buff *skb, qh->tail = skb; qh->head = skb; } - qh->qlen++; + WRITE_ONCE(qh->qlen, qh->qlen + 1); } static inline int qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch) @@ -1086,7 +1096,7 @@ static inline void __qdisc_enqueue_head(struct sk_buff *skb, if (!qh->head) qh->tail = skb; qh->head = skb; - qh->qlen++; + WRITE_ONCE(qh->qlen, qh->qlen + 1); } static inline struct sk_buff *__qdisc_dequeue_head(struct qdisc_skb_head *qh) @@ -1095,7 +1105,7 @@ static inline struct sk_buff *__qdisc_dequeue_head(struct qdisc_skb_head *qh) if (likely(skb != NULL)) { qh->head = skb->next; - qh->qlen--; + WRITE_ONCE(qh->qlen, qh->qlen - 1); if (qh->head == NULL) qh->tail = NULL; skb->next = NULL; @@ -1110,7 +1120,7 @@ static inline struct sk_buff *qdisc_dequeue_internal(struct Qdisc *sch, bool dir skb = __skb_dequeue(&sch->gso_skb); if (skb) { - sch->q.qlen--; + qdisc_qlen_dec(sch); qdisc_qstats_backlog_dec(sch, skb); return skb; } @@ -1266,7 +1276,7 @@ static inline struct sk_buff *qdisc_peek_dequeued(struct Qdisc *sch) __skb_queue_head(&sch->gso_skb, skb); /* it's still part of the queue */ qdisc_qstats_backlog_inc(sch, skb); - sch->q.qlen++; + qdisc_qlen_inc(sch); } } @@ -1283,7 +1293,7 @@ static inline void qdisc_update_stats_at_dequeue(struct Qdisc *sch, } else { qdisc_qstats_backlog_dec(sch, skb); qdisc_bstats_update(sch, skb); - sch->q.qlen--; + qdisc_qlen_dec(sch); } } @@ -1295,7 +1305,7 @@ static inline void qdisc_update_stats_at_enqueue(struct Qdisc *sch, this_cpu_add(sch->cpu_qstats->backlog, pkt_len); } else { sch->qstats.backlog += pkt_len; - sch->q.qlen++; + qdisc_qlen_inc(sch); } } @@ -1311,7 +1321,7 @@ static inline struct sk_buff *qdisc_dequeue_peeked(struct Qdisc *sch) qdisc_qstats_cpu_qlen_dec(sch); } else { qdisc_qstats_backlog_dec(sch, skb); - sch->q.qlen--; + qdisc_qlen_dec(sch); } } else { skb = sch->dequeue(sch); @@ -1332,7 +1342,7 @@ static inline void __qdisc_reset_queue(struct qdisc_skb_head *qh) qh->head = NULL; qh->tail = NULL; - qh->qlen = 0; + WRITE_ONCE(qh->qlen, 0); } } -- cgit v1.2.3 From 0e5b05f44d818d1efe5154832d2e3f3c44352c02 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Sun, 10 May 2026 09:14:50 +0000 Subject: net/sched: annotate data-races around sch->qstats.backlog MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add qstats_backlog_sub() and qstats_backlog_add() helpers and use them instead of open-coding them. These helpers use WRITE_ONCE() to prevent store-tearing. Also use WRITE_ONCE() in fq_reset() and qdisc_reset() when sch->qstats.backlog is cleared. Signed-off-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260510091455.4039245-4-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/sch_generic.h | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index dbb3ba6416e4..391ee8530017 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -965,10 +965,15 @@ static inline void qdisc_bstats_update(struct Qdisc *sch, bstats_update(&sch->bstats, skb); } +static inline void qstats_backlog_sub(struct Qdisc *sch, u32 val) +{ + WRITE_ONCE(sch->qstats.backlog, sch->qstats.backlog - val); +} + static inline void qdisc_qstats_backlog_dec(struct Qdisc *sch, const struct sk_buff *skb) { - sch->qstats.backlog -= qdisc_pkt_len(skb); + qstats_backlog_sub(sch, qdisc_pkt_len(skb)); } static inline void qdisc_qstats_cpu_backlog_dec(struct Qdisc *sch, @@ -977,10 +982,15 @@ static inline void qdisc_qstats_cpu_backlog_dec(struct Qdisc *sch, this_cpu_sub(sch->cpu_qstats->backlog, qdisc_pkt_len(skb)); } +static inline void qstats_backlog_add(struct Qdisc *sch, u32 val) +{ + WRITE_ONCE(sch->qstats.backlog, sch->qstats.backlog + val); +} + static inline void qdisc_qstats_backlog_inc(struct Qdisc *sch, const struct sk_buff *skb) { - sch->qstats.backlog += qdisc_pkt_len(skb); + qstats_backlog_add(sch, qdisc_pkt_len(skb)); } static inline void qdisc_qstats_cpu_backlog_inc(struct Qdisc *sch, @@ -1304,7 +1314,7 @@ static inline void qdisc_update_stats_at_enqueue(struct Qdisc *sch, qdisc_qstats_cpu_qlen_inc(sch); this_cpu_add(sch->cpu_qstats->backlog, pkt_len); } else { - sch->qstats.backlog += pkt_len; + qstats_backlog_add(sch, pkt_len); qdisc_qlen_inc(sch); } } -- cgit v1.2.3 From 554e96a47a84e19abca8d2b1fea1de81cd2c8657 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Sun, 10 May 2026 09:14:51 +0000 Subject: net/sched: add qdisc_qlen_lockless() helper MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Used in contexts were qdisc spinlock is not held. Signed-off-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260510091455.4039245-5-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/sch_generic.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index 391ee8530017..0edf05d56862 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -542,6 +542,11 @@ static inline int qdisc_qlen(const struct Qdisc *q) return q->q.qlen; } +static inline int qdisc_qlen_lockless(const struct Qdisc *q) +{ + return READ_ONCE(q->q.qlen); +} + static inline void qdisc_qlen_inc(struct Qdisc *q) { WRITE_ONCE(q->q.qlen, q->q.qlen + 1); @@ -561,7 +566,7 @@ static inline int qdisc_qlen_sum(const struct Qdisc *q) for_each_possible_cpu(i) qlen += READ_ONCE(per_cpu_ptr(q->cpu_qstats, i)->qlen); } else { - qlen += READ_ONCE(q->q.qlen); + qlen += qdisc_qlen_lockless(q); } return qlen; -- cgit v1.2.3 From 5b12bd5c474bab896000407e6b38133121a74c07 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Sun, 10 May 2026 09:14:52 +0000 Subject: net/sched: add const qualifiers to gnet_stats helpers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In preparation of lockless qdisc dumps, add const qualifiers to: - gnet_stats_add_basic() - gnet_stats_copy_basic() - gnet_stats_copy_basic_hw() - gnet_stats_copy_queue() - gnet_stats_read_basic() - ___gnet_stats_copy_basic() - qdisc_qstats_copy() Signed-off-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260510091455.4039245-6-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/gen_stats.h | 16 ++++++++-------- include/net/sch_generic.h | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/net/gen_stats.h b/include/net/gen_stats.h index 7aa2b8e1fb29..856b5e90fbdb 100644 --- a/include/net/gen_stats.h +++ b/include/net/gen_stats.h @@ -47,19 +47,19 @@ int gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int padattr); int gnet_stats_copy_basic(struct gnet_dump *d, - struct gnet_stats_basic_sync __percpu *cpu, - struct gnet_stats_basic_sync *b, bool running); + const struct gnet_stats_basic_sync __percpu *cpu, + const struct gnet_stats_basic_sync *b, bool running); void gnet_stats_add_basic(struct gnet_stats_basic_sync *bstats, - struct gnet_stats_basic_sync __percpu *cpu, - struct gnet_stats_basic_sync *b, bool running); + const struct gnet_stats_basic_sync __percpu *cpu, + const struct gnet_stats_basic_sync *b, bool running); int gnet_stats_copy_basic_hw(struct gnet_dump *d, - struct gnet_stats_basic_sync __percpu *cpu, - struct gnet_stats_basic_sync *b, bool running); + const struct gnet_stats_basic_sync __percpu *cpu, + const struct gnet_stats_basic_sync *b, bool running); int gnet_stats_copy_rate_est(struct gnet_dump *d, struct net_rate_estimator __rcu **ptr); int gnet_stats_copy_queue(struct gnet_dump *d, - struct gnet_stats_queue __percpu *cpu_q, - struct gnet_stats_queue *q, __u32 qlen); + const struct gnet_stats_queue __percpu *cpu_q, + const struct gnet_stats_queue *q, __u32 qlen); void gnet_stats_add_queue(struct gnet_stats_queue *qstats, const struct gnet_stats_queue __percpu *cpu_q, const struct gnet_stats_queue *q); diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index 0edf05d56862..2ce84b2c9423 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -1054,7 +1054,7 @@ static inline void qdisc_qstats_overlimit(struct Qdisc *sch) WRITE_ONCE(sch->qstats.overlimits, sch->qstats.overlimits + 1); } -static inline int qdisc_qstats_copy(struct gnet_dump *d, struct Qdisc *sch) +static inline int qdisc_qstats_copy(struct gnet_dump *d, const struct Qdisc *sch) { __u32 qlen = qdisc_qlen_sum(sch); -- cgit v1.2.3 From 4f07179f4006cbb1ff199c1e6d8a91d0e8a087b6 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Sun, 10 May 2026 09:14:53 +0000 Subject: net/sched: mq: no longer acquire qdisc spinlocks in dump operations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prepare mq_dump_common() for RTNL avoidance. Use RCU instead of RTNL, and no longer acquire each children spinlock. Signed-off-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260510091455.4039245-7-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/sch_generic.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index 2ce84b2c9423..9e6ed92729d2 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -952,6 +952,15 @@ static inline void _bstats_update(struct gnet_stats_basic_sync *bstats, u64_stats_update_end(&bstats->syncp); } +static inline void _bstats_set(struct gnet_stats_basic_sync *bstats, + u64 bytes, u64 packets) +{ + u64_stats_update_begin(&bstats->syncp); + u64_stats_set(&bstats->bytes, bytes); + u64_stats_set(&bstats->packets, packets); + u64_stats_update_end(&bstats->syncp); +} + static inline void bstats_update(struct gnet_stats_basic_sync *bstats, const struct sk_buff *skb) { -- cgit v1.2.3 From 060d4e94b8d400b62453890821bd7feecd4cde2c Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Mon, 27 Apr 2026 13:09:57 +0200 Subject: rhashtable: give each instance its own lockdep class syzbot reported a possible circular locking dependency between &ht->mutex and fs_reclaim: CPU0 (kswapd0) CPU1 (kworker) -------------- -------------- fs_reclaim ht->mutex shmem_evict_inode rhashtable_rehash_alloc simple_xattrs_free bucket_table_alloc(GFP_KERNEL) rhashtable_free_and_destroy __kvmalloc_node mutex_lock(&ht->mutex) might_alloc -> fs_reclaim The two halves of the splat refer to two different events on &ht->mutex. The kswapd0 path is unambiguous: shmem_evict_inode at mm/shmem.c:1429 calls simple_xattrs_free(), which calls rhashtable_free_and_destroy() on the per-inode simple_xattrs rhashtable being torn down with the inode. The previously-recorded ht->mutex -> fs_reclaim edge comes from rht_deferred_worker -> rhashtable_rehash_alloc -> bucket_table_alloc(GFP_KERNEL) -> __kvmalloc_node -> might_alloc -> fs_reclaim. That stack stops at generic library code: there is no subsystem-specific frame above rht_deferred_worker, so the splat does not identify which rhashtable's worker recorded the edge -- only that some rhashtable in the system did. Whether or not that recording happened on the same simple_xattrs ht that is now being destroyed, the predicted deadlock cannot occur: rhashtable_free_and_destroy() does cancel_work_sync(&ht->run_work) before taking ht->mutex, so the deferred worker cannot be running on the instance being torn down. If the recording was on a different rhashtable instance, the two ht->mutex acquisitions are on distinct mutex objects and cannot deadlock either. Lockdep flags a cycle regardless because mutex_init(&ht->mutex) lives on a single source line in rhashtable_init_noprof(), so every ht->mutex in the kernel shares one static lockdep class. Lockdep matches by class, not by instance, and collapses all of these into one node. Lift the lockdep key out of rhashtable_init_noprof() and into the caller. The user-visible rhashtable_init_noprof() / rhltable_init_noprof() identifiers become macros that declare a per-call-site static lock_class_key. Link: https://patch.msgid.link/20260427-work-rhashtable-lockdep-v1-1-f69e8bd91cb2@kernel.org Fixes: c6307674ed82 ("mm: kvmalloc: add non-blocking support for vmalloc") Acked-by: Michal Hocko Reported-by: syzbot+5af806780f38a5fe691f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/69e798fe.050a0220.24bfd3.0032.GAE@google.com Signed-off-by: Christian Brauner --- include/linux/rhashtable-types.h | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/rhashtable-types.h b/include/linux/rhashtable-types.h index 015c8298bebc..841021c67d3d 100644 --- a/include/linux/rhashtable-types.h +++ b/include/linux/rhashtable-types.h @@ -131,12 +131,26 @@ struct rhashtable_iter { bool end_of_table; }; -int rhashtable_init_noprof(struct rhashtable *ht, - const struct rhashtable_params *params); +int __rhashtable_init_noprof(struct rhashtable *ht, + const struct rhashtable_params *params, + struct lock_class_key *key); +#define rhashtable_init_noprof(ht, params) \ +({ \ + static struct lock_class_key __key; \ + \ + __rhashtable_init_noprof(ht, params, &__key); \ +}) #define rhashtable_init(...) alloc_hooks(rhashtable_init_noprof(__VA_ARGS__)) -int rhltable_init_noprof(struct rhltable *hlt, - const struct rhashtable_params *params); +int __rhltable_init_noprof(struct rhltable *hlt, + const struct rhashtable_params *params, + struct lock_class_key *key); +#define rhltable_init_noprof(hlt, params) \ +({ \ + static struct lock_class_key __key; \ + \ + __rhltable_init_noprof(hlt, params, &__key); \ +}) #define rhltable_init(...) alloc_hooks(rhltable_init_noprof(__VA_ARGS__)) #endif /* _LINUX_RHASHTABLE_TYPES_H */ -- cgit v1.2.3 From 68d801eabda5219dcc25c9de98d3bbdb5b51b0a5 Mon Sep 17 00:00:00 2001 From: Linus Walleij Date: Mon, 11 May 2026 21:43:43 +0200 Subject: gpio: regmap: Support sparsed fixed direction On some regmapped GPIOs apparently only a sparser selection of the lines (not all) are actually fixed direction. Support this situation by adding an optional bitmap indicating which GPIOs are actually fixed direction and which are not. Link: https://lore.kernel.org/linux-gpio/20260501155421.3329862-10-elder@riscstar.com/ Tested-by: Alex Elder Signed-off-by: Linus Walleij Reviewed-by: Michael Walle Reviewed-by: Alex Elder Link: https://patch.msgid.link/20260511-regmap-gpio-sparse-fixed-dir-v3-1-1429ec453be7@kernel.org Signed-off-by: Bartosz Golaszewski --- include/linux/gpio/regmap.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/gpio/regmap.h b/include/linux/gpio/regmap.h index 12d154732ca9..06255756710d 100644 --- a/include/linux/gpio/regmap.h +++ b/include/linux/gpio/regmap.h @@ -38,6 +38,12 @@ struct regmap; * offset to a register/bitmask pair. If not * given the default gpio_regmap_simple_xlate() * is used. + * @fixed_direction_mask: + * (Optional) Bitmap representing the GPIO lines that + * make use of the @fixed_direction_output list to + * enforce direction of the GPIO. If this is NULL + * and @fixed_direction_output is defined, ALL GPIOs + * are assumed to be fixed direction (out or in). * @fixed_direction_output: * (Optional) Bitmap representing the fixed direction of * the GPIO lines. Useful when there are GPIO lines with a @@ -89,6 +95,7 @@ struct gpio_regmap_config { int reg_stride; int ngpio_per_reg; struct irq_domain *irq_domain; + unsigned long *fixed_direction_mask; unsigned long *fixed_direction_output; #ifdef CONFIG_REGMAP_IRQ -- cgit v1.2.3 From 3492e8b494c18028044d4a2e03db5c7331fbd789 Mon Sep 17 00:00:00 2001 From: Charles Keepax Date: Tue, 12 May 2026 11:30:05 +0100 Subject: soundwire: Add a helper function to wait for device initialisation Add a new helper function to wait for the device to enumerate and be initialised by the SoundWire core. Most of the SoundWire drivers have very similar boiler plate code in their runtime resume, and that boiler plate tends to access various internals of the SoundWire structs which is a mild layering violation. Adding a new core helper function greatly eases both of these issues. Acked-by: Vinod Koul Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260512103022.1154645-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown --- include/linux/soundwire/sdw.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/soundwire/sdw.h b/include/linux/soundwire/sdw.h index 6147eb1fb210..a46cbaec5949 100644 --- a/include/linux/soundwire/sdw.h +++ b/include/linux/soundwire/sdw.h @@ -1093,6 +1093,8 @@ int sdw_slave_get_current_bank(struct sdw_slave *sdev); int sdw_slave_get_scale_index(struct sdw_slave *slave, u8 *base); +int sdw_slave_wait_for_init(struct sdw_slave *slave, int timeout_ms); + /* messaging and data APIs */ int sdw_read(struct sdw_slave *slave, u32 addr); int sdw_write(struct sdw_slave *slave, u32 addr, u8 value); @@ -1136,6 +1138,12 @@ static inline int sdw_slave_get_current_bank(struct sdw_slave *sdev) return -EINVAL; } +static inline int sdw_slave_wait_for_init(struct sdw_slave *slave, int timeout_ms) +{ + WARN_ONCE(1, "SoundWire API is disabled"); + return -EINVAL; +} + /* messaging and data APIs */ static inline int sdw_read(struct sdw_slave *slave, u32 addr) { -- cgit v1.2.3 From b5782e2d462c028096f922abca46318cec890670 Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 12 May 2026 13:33:40 +0100 Subject: netfs: Fix missing barriers when accessing stream->subrequests locklessly The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN_PROGRESS flag is perceived to be set first if no lock is taken. Fix this by: (1) Add a new list_add_tail_release() function that uses a release barrier to set the pointer to the new member of the list. (2) Add a new list_first_entry_or_null_acquire() function that uses an acquire barrier to read the pointer to the first member in a list (or return NULL). (3) Use list_add_tail_release() when adding a subreq to ->subrequests. (4) Use list_first_entry_or_null_acquire() when initially accessing the front of the list (when an item is removed, the pointer to the new front iterm is obtained under the same lock). Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item") Fixes: 288ace2f57c9 ("netfs: New writeback implementation") Link: https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-4-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner --- include/linux/list.h | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) (limited to 'include') diff --git a/include/linux/list.h b/include/linux/list.h index 00ea8e5fb88b..09d979976b3b 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -191,6 +191,29 @@ static inline void list_add_tail(struct list_head *new, struct list_head *head) __list_add(new, head->prev, head); } +/** + * list_add_tail_release - add a new entry with release barrier + * @new: new entry to be added + * @head: list head to add it before + * + * Insert a new entry before the specified head, using a release barrier to set + * the ->next pointer that points to it. This is useful for implementing + * queues, in particular one that the elements will be walked through forwards + * locklessly. + */ +static inline void list_add_tail_release(struct list_head *new, + struct list_head *head) +{ + struct list_head *prev = head->prev; + + if (__list_add_valid(new, prev, head)) { + new->next = head; + new->prev = prev; + head->prev = new; + smp_store_release(&prev->next, new); + } +} + /* * Delete a list entry by making the prev/next entries * point to each other. @@ -644,6 +667,20 @@ static inline void list_splice_tail_init(struct list_head *list, pos__ != head__ ? list_entry(pos__, type, member) : NULL; \ }) +/** + * list_first_entry_or_null_acquire - get the first element from a list with barrier + * @ptr: the list head to take the element from. + * @type: the type of the struct this is embedded in. + * @member: the name of the list_head within the struct. + * + * Note that if the list is empty, it returns NULL. + */ +#define list_first_entry_or_null_acquire(ptr, type, member) ({ \ + struct list_head *head__ = (ptr); \ + struct list_head *pos__ = smp_load_acquire(&head__->next); \ + pos__ != head__ ? list_entry(pos__, type, member) : NULL; \ +}) + /** * list_last_entry_or_null - get the last element from a list * @ptr: the list head to take the element from. -- cgit v1.2.3 From 2c8f4742bb76117d735f92a3932d85239b16c494 Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 12 May 2026 13:33:42 +0100 Subject: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted. Fixes: 4058f742105e ("netfs: Keep track of the actual remote file size") Fixes: 100ccd18bb41 ("netfs: Optimise away reads above the point at which there can be no data") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-6-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner --- include/linux/netfs.h | 293 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 284 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/linux/netfs.h b/include/linux/netfs.h index ba17ac5bf356..4fd1d796ad73 100644 --- a/include/linux/netfs.h +++ b/include/linux/netfs.h @@ -62,8 +62,8 @@ struct netfs_inode { struct fscache_cookie *cache; #endif struct mutex wb_lock; /* Writeback serialisation */ - loff_t remote_i_size; /* Size of the remote file */ - loff_t zero_point; /* Size after which we assume there's no data + loff_t _remote_i_size; /* Size of the remote file */ + loff_t _zero_point; /* Size after which we assume there's no data * on the server */ atomic_t io_count; /* Number of outstanding reqs */ unsigned long flags; @@ -474,6 +474,254 @@ static inline struct netfs_inode *netfs_inode(struct inode *inode) return container_of(inode, struct netfs_inode, inode); } +/** + * netfs_read_remote_i_size - Read remote_i_size safely + * @inode: The inode to access + * + * Read remote_i_size safely without the potential for tearing on 32-bit + * arches. + * + * NOTE: in a 32bit arch with a preemptable kernel and an UP compile the + * i_size_read/write must be atomic with respect to the local cpu (unlike with + * preempt disabled), but they don't need to be atomic with respect to other + * cpus like in true SMP (so they need either to either locally disable irq + * around the read or for example on x86 they can be still implemented as a + * cmpxchg8b without the need of the lock prefix). For SMP compiles and 64bit + * archs it makes no difference if preempt is enabled or not. + */ +static inline unsigned long long netfs_read_remote_i_size(const struct inode *inode) +{ + const struct netfs_inode *ictx = container_of(inode, struct netfs_inode, inode); + unsigned long long remote_i_size; + +#if BITS_PER_LONG==32 && defined(CONFIG_SMP) + unsigned int seq; + + do { + seq = read_seqcount_begin(&inode->i_size_seqcount); + remote_i_size = ictx->_remote_i_size; + } while (read_seqcount_retry(&inode->i_size_seqcount, seq)); +#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPTION) + preempt_disable(); + remote_i_size = ictx->_remote_i_size; + preempt_enable(); +#else + /* Pairs with smp_store_release() in netfs_write_remote_i_size() */ + remote_i_size = smp_load_acquire(&ictx->_remote_i_size); +#endif + return remote_i_size; +} + +/* + * netfs_write_remote_i_size - Set remote_i_size safely + * @inode: The inode to access + * @remote_i_size: The new value for the size of the file on the server + * + * Set remote_i_size safely without the potential for tearing on 32-bit arches. + * + * Context: The caller must hold inode->i_lock. + * + * NOTE: unlike netfs_read_remote_i_size(), netfs_write_remote_i_size() does + * need locking around it (normally i_rwsem), otherwise on 32bit/SMP an update + * of i_size_seqcount can be lost, resulting in subsequent i_size_read() calls + * spinning forever. + */ +static inline void netfs_write_remote_i_size(struct inode *inode, + unsigned long long remote_i_size) +{ + struct netfs_inode *ictx = netfs_inode(inode); + +#if BITS_PER_LONG==32 && defined(CONFIG_SMP) + write_seqcount_begin(&inode->i_size_seqcount); + ictx->_remote_i_size = remote_i_size; + write_seqcount_end(&inode->i_size_seqcount); +#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPTION) + preempt_disable(); + ictx->_remote_i_size = remote_i_size; + preempt_enable(); +#else + /* + * Pairs with smp_load_acquire() in netfs_read_remote_i_size() to + * ensure changes related to inode size (such as page contents) are + * visible before we see the changed inode size. + */ + smp_store_release(&ictx->_remote_i_size, remote_i_size); +#endif +} + +/** + * netfs_read_zero_point - Read zero_point safely + * @inode: The inode to access + * + * Read zero_point safely without the potential for tearing on 32-bit + * arches. + * + * NOTE: in a 32bit arch with a preemptable kernel and an UP compile the + * i_size_read/write must be atomic with respect to the local cpu (unlike with + * preempt disabled), but they don't need to be atomic with respect to other + * cpus like in true SMP (so they need either to either locally disable irq + * around the read or for example on x86 they can be still implemented as a + * cmpxchg8b without the need of the lock prefix). For SMP compiles and 64bit + * archs it makes no difference if preempt is enabled or not. + */ +static inline unsigned long long netfs_read_zero_point(const struct inode *inode) +{ + struct netfs_inode *ictx = container_of(inode, struct netfs_inode, inode); + unsigned long long zero_point; + +#if BITS_PER_LONG==32 && defined(CONFIG_SMP) + unsigned int seq; + + do { + seq = read_seqcount_begin(&inode->i_size_seqcount); + zero_point = ictx->_zero_point; + } while (read_seqcount_retry(&inode->i_size_seqcount, seq)); +#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPTION) + preempt_disable(); + zero_point = ictx->_zero_point; + preempt_enable(); +#else + /* Pairs with smp_store_release() in netfs_write_zero_point() */ + zero_point = smp_load_acquire(&ictx->_zero_point); +#endif + return zero_point; +} + +/* + * netfs_write_zero_point - Set zero_point safely + * @inode: The inode to access + * @zero_point: The new value for the point beyond which the server has no data + * + * Set zero_point safely without the potential for tearing on 32-bit arches. + * + * Context: The caller must hold inode->i_lock. + * + * NOTE: unlike netfs_read_zero_point(), netfs_write_zero_point() does need + * locking around it (normally i_rwsem), otherwise on 32bit/SMP an update of + * i_size_seqcount can be lost, resulting in subsequent read calls spinning + * forever. + */ +static inline void netfs_write_zero_point(struct inode *inode, + unsigned long long zero_point) +{ + struct netfs_inode *ictx = netfs_inode(inode); + +#if BITS_PER_LONG==32 && defined(CONFIG_SMP) + write_seqcount_begin(&inode->i_size_seqcount); + ictx->_zero_point = zero_point; + write_seqcount_end(&inode->i_size_seqcount); +#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPTION) + preempt_disable(); + ictx->_zero_point = zero_point; + preempt_enable(); +#else + /* + * Pairs with smp_load_acquire() in netfs_read_zero_point() to + * ensure changes related to inode size (such as page contents) are + * visible before we see the changed inode size. + */ + smp_store_release(&ictx->_zero_point, zero_point); +#endif +} + +/** + * netfs_read_sizes - Read remote_i_size and zero_point safely + * @inode: The inode to access + * @i_size: Where to return the local file size. + * @remote_i_size: Where to return the size of the file on the server + * @zero_point: Where to return the the point beyond which the server has no data + * + * Read remote_i_size and zero_point safely without the potential for tearing + * on 32-bit arches. + * + * NOTE: in a 32bit arch with a preemptable kernel and an UP compile the + * i_size_read/write must be atomic with respect to the local cpu (unlike with + * preempt disabled), but they don't need to be atomic with respect to other + * cpus like in true SMP (so they need either to either locally disable irq + * around the read or for example on x86 they can be still implemented as a + * cmpxchg8b without the need of the lock prefix). For SMP compiles and 64bit + * archs it makes no difference if preempt is enabled or not. + */ +static inline void netfs_read_sizes(const struct inode *inode, + unsigned long long *i_size, + unsigned long long *remote_i_size, + unsigned long long *zero_point) +{ + const struct netfs_inode *ictx = container_of(inode, struct netfs_inode, inode); +#if BITS_PER_LONG==32 && defined(CONFIG_SMP) + unsigned int seq; + + do { + seq = read_seqcount_begin(&inode->i_size_seqcount); + *i_size = inode->i_size; + *remote_i_size = ictx->_remote_i_size; + *zero_point = ictx->_zero_point; + } while (read_seqcount_retry(&inode->i_size_seqcount, seq)); +#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPTION) + preempt_disable(); + *i_size = inode->i_size; + *remote_i_size = ictx->_remote_i_size; + *zero_point = ictx->_zero_point; + preempt_enable(); +#else + /* Pairs with smp_store_release() in i_size_write() */ + *i_size = smp_load_acquire(&inode->i_size); + /* Pairs with smp_store_release() in netfs_write_remote_i_size() */ + *remote_i_size = smp_load_acquire(&ictx->_remote_i_size); + /* Pairs with smp_store_release() in netfs_write_zero_point() */ + *zero_point = smp_load_acquire(&ictx->_zero_point); +#endif +} + +/* + * netfs_write_sizes - Set i_size, remote_i_size and zero_point safely + * @inode: The inode to access + * @i_size: The new value for the local size of the file + * @remote_i_size: The new value for the size of the file on the server + * @zero_point: The new value for the point beyond which the server has no data + * + * Set both remote_i_size and zero_point safely without the potential for + * tearing on 32-bit arches. + * + * Context: The caller must hold inode->i_lock. + * + * NOTE: unlike netfs_read_zero_point(), netfs_write_zero_point() does need + * locking around it (normally i_rwsem), otherwise on 32bit/SMP an update of + * i_size_seqcount can be lost, resulting in subsequent read calls spinning + * forever. + */ +static inline void netfs_write_sizes(struct inode *inode, + unsigned long long i_size, + unsigned long long remote_i_size, + unsigned long long zero_point) +{ + struct netfs_inode *ictx = netfs_inode(inode); + +#if BITS_PER_LONG==32 && defined(CONFIG_SMP) + write_seqcount_begin(&inode->i_size_seqcount); + inode->i_size = i_size; + ictx->_remote_i_size = remote_i_size; + ictx->_zero_point = zero_point; + write_seqcount_end(&inode->i_size_seqcount); +#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPTION) + preempt_disable(); + inode->i_size = i_size; + ictx->_remote_i_size = remote_i_size; + ictx->_zero_point = zero_point; + preempt_enable(); +#else + /* + * Pairs with smp_load_acquire() in i_size_read(), + * netfs_read_remote_i_size() and netfs_read_zero_point() to ensure + * changes related to inode size (such as page contents) are visible + * before we see the changed inode size. + */ + smp_store_release(&inode->i_size, i_size); + smp_store_release(&ictx->_remote_i_size, remote_i_size); + smp_store_release(&ictx->_zero_point, zero_point); +#endif +} + /** * netfs_inode_init - Initialise a netfslib inode context * @ctx: The netfs inode to initialise @@ -488,8 +736,8 @@ static inline void netfs_inode_init(struct netfs_inode *ctx, bool use_zero_point) { ctx->ops = ops; - ctx->remote_i_size = i_size_read(&ctx->inode); - ctx->zero_point = LLONG_MAX; + ctx->_remote_i_size = i_size_read(&ctx->inode); + ctx->_zero_point = LLONG_MAX; ctx->flags = 0; atomic_set(&ctx->io_count, 0); #if IS_ENABLED(CONFIG_FSCACHE) @@ -498,7 +746,7 @@ static inline void netfs_inode_init(struct netfs_inode *ctx, mutex_init(&ctx->wb_lock); /* ->releasepage() drives zero_point */ if (use_zero_point) { - ctx->zero_point = ctx->remote_i_size; + ctx->_zero_point = ctx->_remote_i_size; mapping_set_release_always(ctx->inode.i_mapping); } } @@ -511,13 +759,40 @@ static inline void netfs_inode_init(struct netfs_inode *ctx, * * Inform the netfs lib that a file got resized so that it can adjust its state. */ -static inline void netfs_resize_file(struct netfs_inode *ctx, loff_t new_i_size, +static inline void netfs_resize_file(struct netfs_inode *ictx, + unsigned long long new_i_size, bool changed_on_server) { +#if BITS_PER_LONG==32 && defined(CONFIG_SMP) + struct inode *inode = &ictx->inode; + + preempt_disable(); + write_seqcount_begin(&inode->i_size_seqcount); + if (changed_on_server) + ictx->_remote_i_size = new_i_size; + if (new_i_size < ictx->_zero_point) + ictx->_zero_point = new_i_size; + write_seqcount_end(&inode->i_size_seqcount); + preempt_enable(); +#elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPTION) + preempt_disable(); if (changed_on_server) - ctx->remote_i_size = new_i_size; - if (new_i_size < ctx->zero_point) - ctx->zero_point = new_i_size; + ictx->_remote_i_size = new_i_size; + if (new_i_size < ictx->_zero_point) + ictx->_zero_point = new_i_size; + preempt_enable(); +#else + /* + * Pairs with smp_load_acquire() in netfs_read_remote_i_size and + * netfs_read_zero_point() to ensure changes related to inode size + * (such as page contents) are visible before we see the changed inode + * size. + */ + if (changed_on_server) + smp_store_release(&ictx->_remote_i_size, new_i_size); + if (new_i_size < ictx->_zero_point) + smp_store_release(&ictx->_zero_point, new_i_size); +#endif } /** -- cgit v1.2.3 From 156ac2ec2ee77c44c4eb7439d6d165247ba12247 Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 12 May 2026 13:33:48 +0100 Subject: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfs_folio struct hung off of folio->private indicating the dirty range. Subsequently truncating the file such that the dirty data in the folio is removed, but the first part of the folio theoretically remains will cause the netfs_folio struct to be discarded... but will leave the dirty flag set. If the folio is then read via mmap(), netfs_read_folio() will see that the page is dirty and jump to netfs_read_gaps() to fill in the missing bits. netfs_read_gaps(), however, expects there to be a netfs_folio struct present and can oops because truncate removed it. Fix this by calling folio_cancel_dirty() in netfs_invalidate_folio() in the event that all the dirty data in the folio is erased (as nfs does). Also add some tracepoints to log modifications to a dirty page. This can be reproduced with something like: dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1 umount /xfstest.test mount /xfstest.test xfs_io -c "w 0xbbbf 0xf96c" \ -c "truncate 0xbbbf" \ -c "mmap -r 0xb000 0x11000" \ -c "mr 0xb000 0x11000" \ /xfstest.test/foo with fscaching disabled (otherwise streaming writes are suppressed) and a change to netfs_perform_write() to disallow streaming writes if the fd is open O_RDWR: if (//(file->f_mode & FMODE_READ) || <--- comment this out netfs_is_cache_enabled(ctx)) { It should be reproducible even without this change, but if prevents the above trivial xfs_io command from reproducing it. Note that the initial dd is important: the file must start out sufficiently large that the zero-point logic doesn't just clear the gaps because it knows there's nothing in the file to read yet. Unmounting and mounting is needed to clear the pagecache (there are other ways to do that that may also work). This was initially reproduced with the generic/522 xfstest on some patches that remove the FMODE_READ restriction. Fixes: 9ebff83e6481 ("netfs: Prep to use folio->private for write grouping and streaming write") Reported-by: Marc Dionne Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-12-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner --- include/trace/events/netfs.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h index 8c936fc575d5..0b702f74aefe 100644 --- a/include/trace/events/netfs.h +++ b/include/trace/events/netfs.h @@ -194,6 +194,10 @@ EM(netfs_folio_trace_copy_to_cache, "mark-copy") \ EM(netfs_folio_trace_end_copy, "end-copy") \ EM(netfs_folio_trace_filled_gaps, "filled-gaps") \ + EM(netfs_folio_trace_invalidate_all, "inval-all") \ + EM(netfs_folio_trace_invalidate_front, "inval-front") \ + EM(netfs_folio_trace_invalidate_middle, "inval-mid") \ + EM(netfs_folio_trace_invalidate_tail, "inval-tail") \ EM(netfs_folio_trace_kill, "kill") \ EM(netfs_folio_trace_kill_cc, "kill-cc") \ EM(netfs_folio_trace_kill_g, "kill-g") \ -- cgit v1.2.3 From 7b4dcf1b9455a6e52ac7478b4057dbe10359576d Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 12 May 2026 13:33:50 +0100 Subject: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such folios are marked dirty but may not be marked uptodate. If a folio is entirely written by a streaming write, uptodate will be set, otherwise it will have a netfs_folio struct attached to ->private recording the dirty region. In the event that a partially written streaming write page is to be overwritten entirely by a single write(), netfs_perform_write() will try to copy over it, but doesn't discard the netfs_folio if it succeeds; further, it doesn't correctly handle a partial copy that overwrites some of the dirty data. Fix this by the following: (1) If the folio is successfully overwritten, free the netfs_folio struct before marking the page uptodate. (2) If the copy to the folio partially fails, but short of the dirty data, just ignore the copy. (3) If the copy partially fails and overwrites some of the dirty data, accept the copy, update the netfs_folio struct to record the new data. If the folio is now filled, free the netfs_folio and set uptodate, otherwise return a partial write. Found with: fsx -q -N 1000000 -p 10000 -o 128000 -l 600000 \ /xfstest.test/junk --replay-ops=junk.fsxops using the following as junk.fsxops: truncate 0x0 0 0x927c0 write 0x63fb8 0x53c8 0 copy_range 0xb704 0x19b9 0x24429 0x79380 write 0x2402b 0x144a2 0x90660 * write 0x204d5 0x140a0 0x927c0 * copy_range 0x1f72c 0x137d0 0x7a906 0x927c0 * read 0x00000 0x20000 0x9157c read 0x20000 0x20000 0x9157c read 0x40000 0x20000 0x9157c read 0x60000 0x20000 0x9157c read 0x7e1a0 0xcfb9 0x9157c on cifs with the default cache option. It shows folio 0x24 misbehaving if the FMODE_READ check is commented out in netfs_perform_write(): if (//(file->f_mode & FMODE_READ) || netfs_is_cache_enabled(ctx)) { and no fscache. This was initially found with the generic/522 xfstest. Fixes: 8f52de0077ba ("netfs: Reduce number of conditional branches in netfs_perform_write()") Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-14-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner --- include/trace/events/netfs.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h index 0b702f74aefe..aa9940ba307b 100644 --- a/include/trace/events/netfs.h +++ b/include/trace/events/netfs.h @@ -177,6 +177,9 @@ EM(netfs_folio_is_uptodate, "mod-uptodate") \ EM(netfs_just_prefetch, "mod-prefetch") \ EM(netfs_whole_folio_modify, "mod-whole-f") \ + EM(netfs_whole_folio_modify_efault, "mod-whole-f!") \ + EM(netfs_whole_folio_modify_filled, "mod-whole-f+") \ + EM(netfs_whole_folio_modify_filled_efault, "mod-whole-f+!") \ EM(netfs_modify_and_clear, "mod-n-clear") \ EM(netfs_streaming_write, "mod-streamw") \ EM(netfs_streaming_write_cont, "mod-streamw+") \ -- cgit v1.2.3 From dbe556972100fabb8e5a1b3d2163831ff07b1e8e Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 12 May 2026 13:33:56 +0100 Subject: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin(). However, given that netfs_unlock_abandoned_read_pages() is called _after_ NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no_unlock_folio as ownership immediately reverts to the caller. Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs_unlock_read_folio() where the same applies. Fixes: ee4cdf7ba857 ("netfs: Speed up buffered reading") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-20-dhowells@redhat.com cc: Paulo Alcantara cc: Viacheslav Dubeyko cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner --- include/linux/netfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/netfs.h b/include/linux/netfs.h index 4fd1d796ad73..243c0f737938 100644 --- a/include/linux/netfs.h +++ b/include/linux/netfs.h @@ -252,7 +252,7 @@ struct netfs_io_request { unsigned long long collected_to; /* Point we've collected to */ unsigned long long cleaned_to; /* Position we've cleaned folios to */ unsigned long long abandon_to; /* Position to abandon folios to */ - pgoff_t no_unlock_folio; /* Don't unlock this folio after read */ + const struct folio *no_unlock_folio; /* Don't unlock this folio after read */ unsigned int direct_bv_count; /* Number of elements in direct_bv[] */ unsigned int debug_id; unsigned int rsize; /* Maximum read size (0 for none) */ -- cgit v1.2.3 From ccde2ac757c713535b224233a296de40efe5212d Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 12 May 2026 13:33:58 +0100 Subject: netfs: Fix folio->private handling in netfs_perform_write() Under some circumstances, netfs_perform_write() doesn't correctly manipulate folio->private between NULL, NETFS_FOLIO_COPY_TO_CACHE, pointing to a group and pointing to a netfs_folio struct, leading to potential multiple attachments of private data with associated folio ref leaks and also leaks of netfs_folio structs or netfs_group refs. Fix this by consolidating the place at which a folio is marked uptodate in one place and having that look at what's attached to folio->private and decide how to clean it up and then set the new group. Also, the content shouldn't be flushed if group is NULL, even if a group is specified in the netfs_group parameter, as that would be the case for a new folio. A filesystem should always specify netfs_group or never specify netfs_group. The Sashiko auto-review tool noted that it was theoretically possible that the fpos >= ctx->zero_point section might leak if it modified a streaming write folio. This is unlikely, but with a network filesystem, third party changes can happen. It also pointed out that __netfs_set_group() would leak if called multiple times on the same folio from the "whole folio modify section". Fixes: 8f52de0077ba ("netfs: Reduce number of conditional branches in netfs_perform_write()") Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260512123404.719402-22-dhowells@redhat.com cc: Paulo Alcantara cc: Matthew Wilcox cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner --- include/trace/events/netfs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/trace/events/netfs.h b/include/trace/events/netfs.h index aa9940ba307b..082cb03c6131 100644 --- a/include/trace/events/netfs.h +++ b/include/trace/events/netfs.h @@ -181,6 +181,7 @@ EM(netfs_whole_folio_modify_filled, "mod-whole-f+") \ EM(netfs_whole_folio_modify_filled_efault, "mod-whole-f+!") \ EM(netfs_modify_and_clear, "mod-n-clear") \ + EM(netfs_modify_and_clear_rm_finfo, "mod-n-clear+") \ EM(netfs_streaming_write, "mod-streamw") \ EM(netfs_streaming_write_cont, "mod-streamw+") \ EM(netfs_flush_content, "flush") \ -- cgit v1.2.3 From ecde921eb46022acbdbfff2ad4e4c6e6d0493430 Mon Sep 17 00:00:00 2001 From: Cristian Marussi Date: Fri, 8 May 2026 16:32:47 +0100 Subject: firmware: arm_scmi: Add clock determine_rate operation Add a clock operation to help determining the effective rate, closest to the required one, that a specific clock can support. Calculation is currently performed kernel side and the logic is taken directly from the SCMI Clock driver: embedding the determinate rate logic in the protocol layer enables simplifications in the SCMI Clock protocol interface and will more easily accommodate further evolutions where such determine_rate logic into is optionally delegated to the platform SCMI server. Signed-off-by: Cristian Marussi Tested-by: Florian Fainelli Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260508153300.2224715-3-cristian.marussi@arm.com Signed-off-by: Sudeep Holla --- include/linux/scmi_protocol.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h index 8d0b106caed8..984117f51695 100644 --- a/include/linux/scmi_protocol.h +++ b/include/linux/scmi_protocol.h @@ -91,6 +91,10 @@ enum scmi_clock_oem_config { * @info_get: get the information of the specified clock * @rate_get: request the current clock rate of a clock * @rate_set: set the clock rate of a clock + * @determine_rate: determine the effective rate that can be supported by a + * clock calculating the closest allowed rate. + * Note that @rate is an input/output parameter used both to + * describe the requested rate and report the closest match * @enable: enables the specified clock * @disable: disables the specified clock * @state_get: get the status of the specified clock @@ -108,6 +112,8 @@ struct scmi_clk_proto_ops { u64 *rate); int (*rate_set)(const struct scmi_protocol_handle *ph, u32 clk_id, u64 rate); + int (*determine_rate)(const struct scmi_protocol_handle *ph, u32 clk_id, + unsigned long *rate); int (*enable)(const struct scmi_protocol_handle *ph, u32 clk_id, bool atomic); int (*disable)(const struct scmi_protocol_handle *ph, u32 clk_id, -- cgit v1.2.3 From 0d76f62613cafecb7d326a5a45619024fa7e6e8e Mon Sep 17 00:00:00 2001 From: Cristian Marussi Date: Fri, 8 May 2026 16:32:49 +0100 Subject: firmware: arm_scmi: Simplify clock rates exposed interface Introduce a new internal struct scmi_clock_desc so as to be able to hide, in the future, some of the needlessly public fields currently kept inside scmi_clock_info, while keeping exposed only the two new min_rate and max_rate fields for each clock. No functional change. Reviewed-by: Peng Fan Signed-off-by: Cristian Marussi Tested-by: Florian Fainelli Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260508153300.2224715-5-cristian.marussi@arm.com Signed-off-by: Sudeep Holla --- include/linux/scmi_protocol.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h index 984117f51695..f82747adc8eb 100644 --- a/include/linux/scmi_protocol.h +++ b/include/linux/scmi_protocol.h @@ -51,6 +51,8 @@ struct scmi_clock_info { bool rate_ctrl_forbidden; bool parent_ctrl_forbidden; bool extended_config; + u64 min_rate; + u64 max_rate; union { struct { int num_rates; -- cgit v1.2.3 From 2e757f71a5ab861478204e2907bb373ccb3ca087 Mon Sep 17 00:00:00 2001 From: Cristian Marussi Date: Fri, 8 May 2026 16:32:51 +0100 Subject: firmware: arm_scmi: Drop unused clock rate interfaces Only the unified interface exposing min_rate/max_rate is now used. Reviewed-by: Peng Fan Signed-off-by: Cristian Marussi Link: https://patch.msgid.link/20260508153300.2224715-7-cristian.marussi@arm.com Signed-off-by: Sudeep Holla --- include/linux/scmi_protocol.h | 12 ------------ 1 file changed, 12 deletions(-) (limited to 'include') diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h index f82747adc8eb..9913b4f097d8 100644 --- a/include/linux/scmi_protocol.h +++ b/include/linux/scmi_protocol.h @@ -44,7 +44,6 @@ struct scmi_base_info { struct scmi_clock_info { char name[SCMI_MAX_STR_SIZE]; unsigned int enable_latency; - bool rate_discrete; bool rate_changed_notifications; bool rate_change_requested_notifications; bool state_ctrl_forbidden; @@ -53,17 +52,6 @@ struct scmi_clock_info { bool extended_config; u64 min_rate; u64 max_rate; - union { - struct { - int num_rates; - u64 rates[SCMI_MAX_NUM_RATES]; - } list; - struct { - u64 min_rate; - u64 max_rate; - u64 step_size; - } range; - }; int num_parents; u32 *parents; }; -- cgit v1.2.3 From 62ba967595e0b2599768f886851ba5e0d4bfb55b Mon Sep 17 00:00:00 2001 From: Cristian Marussi Date: Fri, 8 May 2026 16:32:52 +0100 Subject: firmware: arm_scmi: Make clock rates allocation dynamic Leveraging SCMI Clock protocol dynamic discovery capabilities, move away from the static per-clock rates allocation model in favour of a dynamic runtime allocation based on effectively discovered resources. No functional change. Reviewed-by: Peng Fan Signed-off-by: Cristian Marussi Tested-by: Florian Fainelli Tested-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260508153300.2224715-8-cristian.marussi@arm.com Signed-off-by: Sudeep Holla --- include/linux/scmi_protocol.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h index 9913b4f097d8..55db9ba8fac3 100644 --- a/include/linux/scmi_protocol.h +++ b/include/linux/scmi_protocol.h @@ -15,7 +15,6 @@ #define SCMI_MAX_STR_SIZE 64 #define SCMI_SHORT_NAME_MAX_SIZE 16 -#define SCMI_MAX_NUM_RATES 16 /** * struct scmi_base_info - version information structure -- cgit v1.2.3 From d2488ff1a257342111e1be1348d52e8b4ecfaa36 Mon Sep 17 00:00:00 2001 From: Cristian Marussi Date: Fri, 8 May 2026 16:33:00 +0100 Subject: firmware: arm_scmi: Introduce all_rates_get clock operation Add a clock operation to get the whole set of rates available to a specific clock: when needed this request could transparently trigger a full rate discovery enumeration if this specific clock-rates were previously only lazily enumerated. Reviewed-by: Peng Fan Signed-off-by: Cristian Marussi Link: https://patch.msgid.link/20260508153300.2224715-16-cristian.marussi@arm.com Signed-off-by: Sudeep Holla --- include/linux/scmi_protocol.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h index 55db9ba8fac3..5ab73b1ab9aa 100644 --- a/include/linux/scmi_protocol.h +++ b/include/linux/scmi_protocol.h @@ -40,6 +40,12 @@ struct scmi_base_info { char sub_vendor_id[SCMI_SHORT_NAME_MAX_SIZE]; }; +struct scmi_clock_rates { + bool rate_discrete; + unsigned int num_rates; + u64 *rates; +}; + struct scmi_clock_info { char name[SCMI_MAX_STR_SIZE]; unsigned int enable_latency; @@ -84,6 +90,7 @@ enum scmi_clock_oem_config { * clock calculating the closest allowed rate. * Note that @rate is an input/output parameter used both to * describe the requested rate and report the closest match + * @all_rates_get: get the list of all available rates for the specified clock. * @enable: enables the specified clock * @disable: disables the specified clock * @state_get: get the status of the specified clock @@ -103,6 +110,8 @@ struct scmi_clk_proto_ops { u64 rate); int (*determine_rate)(const struct scmi_protocol_handle *ph, u32 clk_id, unsigned long *rate); + const struct scmi_clock_rates __must_check *(*all_rates_get) + (const struct scmi_protocol_handle *ph, u32 clk_id); int (*enable)(const struct scmi_protocol_handle *ph, u32 clk_id, bool atomic); int (*disable)(const struct scmi_protocol_handle *ph, u32 clk_id, -- cgit v1.2.3 From f28771c0691bcb7f477a0f35550b17b88c32dea8 Mon Sep 17 00:00:00 2001 From: Leon Hwang Date: Tue, 12 May 2026 23:31:50 +0800 Subject: bpf: Extend BPF syscall with common attributes support Add generic BPF syscall support for passing common attributes. The initial set of common attributes includes: 1. 'log_buf': User-provided buffer for storing logs. 2. 'log_size': Size of the log buffer. 3. 'log_level': Log verbosity level. 4. 'log_true_size': Actual log size reported by kernel. The common-attribute pointer and its size are passed as the 4th and 5th syscall arguments. A new command bit, 'BPF_COMMON_ATTRS' ('1 << 16'), indicates that common attributes are supplied. This commit adds syscall and uapi plumbing. Command-specific handling is added in follow-up patches. Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260512153157.28382-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/syscalls.h | 3 ++- include/uapi/linux/bpf.h | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index f5639d5ac331..50055ab73649 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -936,7 +936,8 @@ asmlinkage long sys_seccomp(unsigned int op, unsigned int flags, asmlinkage long sys_getrandom(char __user *buf, size_t count, unsigned int flags); asmlinkage long sys_memfd_create(const char __user *uname_ptr, unsigned int flags); -asmlinkage long sys_bpf(int cmd, union bpf_attr __user *attr, unsigned int size); +asmlinkage long sys_bpf(int cmd, union bpf_attr __user *attr, unsigned int size, + struct bpf_common_attr __user *attr_common, unsigned int size_common); asmlinkage long sys_execveat(int dfd, const char __user *filename, const char __user *const __user *argv, const char __user *const __user *envp, int flags); diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 552bc5d9afbd..aec171ccb6ef 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -994,6 +994,7 @@ enum bpf_cmd { BPF_PROG_STREAM_READ_BY_FD, BPF_PROG_ASSOC_STRUCT_OPS, __MAX_BPF_CMD, + BPF_COMMON_ATTRS = 1 << 16, /* Indicate carrying syscall common attrs. */ }; enum bpf_map_type { @@ -1500,6 +1501,13 @@ struct bpf_stack_build_id { }; }; +struct bpf_common_attr { + __aligned_u64 log_buf; + __u32 log_size; + __u32 log_level; + __u32 log_true_size; +}; + #define BPF_OBJ_NAME_LEN 16U enum { -- cgit v1.2.3 From 503c039ffeca7530ce9d6446a07b4bb776180b45 Mon Sep 17 00:00:00 2001 From: Leon Hwang Date: Tue, 12 May 2026 23:31:52 +0800 Subject: bpf: Refactor reporting log_true_size for prog_load The next commit will add support for reporting logs via extended common attributes, including 'log_true_size'. To prepare for that, refactor the 'log_true_size' reporting logic by introducing a new struct bpf_log_attr to encapsulate log-related behavior: * bpf_log_attr_init(): initialize log fields, which will support extended common attributes in the next commit. * bpf_log_attr_finalize(): handle log finalization and write back 'log_true_size' to userspace. Acked-by: Andrii Nakryiko Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260512153157.28382-4-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 4 +++- include/linux/bpf_verifier.h | 12 ++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 14759972f148..9e16e91647d3 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2919,7 +2919,9 @@ int bpf_check_uarg_tail_zero(bpfptr_t uaddr, size_t expected_size, size_t actual_size); /* verify correctness of eBPF program */ -int bpf_check(struct bpf_prog **fp, union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size); +struct bpf_log_attr; +int bpf_check(struct bpf_prog **fp, union bpf_attr *attr, bpfptr_t uattr, + struct bpf_log_attr *attr_log); #ifndef CONFIG_BPF_JIT_ALWAYS_ON void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth); diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 976e2b2f40e8..8d27ad1f9f94 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -755,6 +755,18 @@ static inline bool bpf_verifier_log_needed(const struct bpf_verifier_log *log) return log && log->level; } +struct bpf_log_attr { + char __user *ubuf; + u32 size; + u32 level; + u32 offsetof_true_size; + bpfptr_t uattr; +}; + +int bpf_log_attr_init(struct bpf_log_attr *log, u64 log_buf, u32 log_size, u32 log_level, + u32 offsetof_log_true_size, bpfptr_t uattr); +int bpf_log_attr_finalize(struct bpf_log_attr *attr, struct bpf_verifier_log *log); + #define BPF_MAX_SUBPROGS 256 struct bpf_subprog_arg_info { -- cgit v1.2.3 From ac89d33fdd8183df39fe92ffa525be7af6feb9d1 Mon Sep 17 00:00:00 2001 From: Leon Hwang Date: Tue, 12 May 2026 23:31:53 +0800 Subject: bpf: Add syscall common attributes support for prog_load BPF_PROG_LOAD can now take log parameters from both union bpf_attr and struct bpf_common_attr. The merge rules are: - if both sides provide a complete log tuple (buf/size/level) and they match, use it; - if only one side provides log parameters, use that one; - if both sides provide complete tuples but they differ, return -EINVAL. Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260512153157.28382-5-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 8d27ad1f9f94..8433430dedb7 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -764,7 +764,8 @@ struct bpf_log_attr { }; int bpf_log_attr_init(struct bpf_log_attr *log, u64 log_buf, u32 log_size, u32 log_level, - u32 offsetof_log_true_size, bpfptr_t uattr); + u32 offsetof_log_true_size, bpfptr_t uattr, struct bpf_common_attr *common, + bpfptr_t uattr_common, u32 size_common); int bpf_log_attr_finalize(struct bpf_log_attr *attr, struct bpf_verifier_log *log); #define BPF_MAX_SUBPROGS 256 -- cgit v1.2.3 From ceeb7eda94a3548958b30818495ef7eb12898727 Mon Sep 17 00:00:00 2001 From: Leon Hwang Date: Tue, 12 May 2026 23:31:54 +0800 Subject: bpf: Add syscall common attributes support for btf_load BPF_BTF_LOAD can now take log parameters from both union bpf_attr and struct bpf_common_attr, with the same merge rules as BPF_PROG_LOAD: - if both sides provide a complete log tuple (buf/size/level) and they match, use it; - if only one side provides log parameters, use that one; - if both sides provide complete tuples but they differ, return -EINVAL. Acked-by: Andrii Nakryiko Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260512153157.28382-6-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/btf.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/btf.h b/include/linux/btf.h index c82d0d689059..240401d9b25b 100644 --- a/include/linux/btf.h +++ b/include/linux/btf.h @@ -145,7 +145,8 @@ const char *btf_get_name(const struct btf *btf); void btf_get(struct btf *btf); void btf_put(struct btf *btf); const struct btf_header *btf_header(const struct btf *btf); -int btf_new_fd(const union bpf_attr *attr, bpfptr_t uattr, u32 uattr_sz); +struct bpf_log_attr; +int btf_new_fd(const union bpf_attr *attr, bpfptr_t uattr, struct bpf_log_attr *attr_log); struct btf *btf_get_by_fd(int fd); int btf_get_info_by_fd(const struct btf *btf, const union bpf_attr *attr, -- cgit v1.2.3 From 49f9b2b2a18c5ce06b21fc2b3399352d80dee0c6 Mon Sep 17 00:00:00 2001 From: Leon Hwang Date: Tue, 12 May 2026 23:31:55 +0800 Subject: bpf: Add syscall common attributes support for map_create Many BPF_MAP_CREATE validation failures currently return -EINVAL without any explanation to userspace. Plumb common syscall log attributes into map_create(), create a verifier log from bpf_common_attr::log_buf/log_size/log_level, and report map-creation failure reasons through that buffer. This improves debuggability by allowing userspace to inspect why map creation failed and read back log_true_size from common attributes. Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260512153157.28382-7-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 8433430dedb7..c15a4c26a43b 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -766,6 +766,9 @@ struct bpf_log_attr { int bpf_log_attr_init(struct bpf_log_attr *log, u64 log_buf, u32 log_size, u32 log_level, u32 offsetof_log_true_size, bpfptr_t uattr, struct bpf_common_attr *common, bpfptr_t uattr_common, u32 size_common); +struct bpf_verifier_log *bpf_log_attr_create_vlog(struct bpf_log_attr *attr_log, + struct bpf_common_attr *common, bpfptr_t uattr, + u32 size); int bpf_log_attr_finalize(struct bpf_log_attr *attr, struct bpf_verifier_log *log); #define BPF_MAX_SUBPROGS 256 -- cgit v1.2.3 From 35e3509b632b197f1842f5547c36138b29ac18ee Mon Sep 17 00:00:00 2001 From: Luo Jie Date: Tue, 6 Jan 2026 21:35:11 -0800 Subject: dt-bindings: clock: qcom: Add CMN PLL support for IPQ5332 SoC Add device tree bindings for the CMN PLL block in IPQ5332 SoC, which shares similarities with IPQ9574 but has different output clock frequencies. Add a new header file to export CMN PLL output clock specifiers for IPQ5332 SoC. Acked-by: Krzysztof Kozlowski Signed-off-by: Luo Jie Link: https://lore.kernel.org/r/20260106-qcom_ipq5332_cmnpll-v2-2-f9f7e4efbd79@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/clock/qcom,ipq5332-cmn-pll.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 include/dt-bindings/clock/qcom,ipq5332-cmn-pll.h (limited to 'include') diff --git a/include/dt-bindings/clock/qcom,ipq5332-cmn-pll.h b/include/dt-bindings/clock/qcom,ipq5332-cmn-pll.h new file mode 100644 index 000000000000..172330e43669 --- /dev/null +++ b/include/dt-bindings/clock/qcom,ipq5332-cmn-pll.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef _DT_BINDINGS_CLK_QCOM_IPQ5332_CMN_PLL_H +#define _DT_BINDINGS_CLK_QCOM_IPQ5332_CMN_PLL_H + +/* CMN PLL core clock. */ +#define IPQ5332_CMN_PLL_CLK 0 + +/* The output clocks from CMN PLL of IPQ5332. */ +#define IPQ5332_XO_24MHZ_CLK 1 +#define IPQ5332_SLEEP_32KHZ_CLK 2 +#define IPQ5332_PCS_31P25MHZ_CLK 3 +#define IPQ5332_NSS_300MHZ_CLK 4 +#define IPQ5332_PPE_200MHZ_CLK 5 +#define IPQ5332_ETH_50MHZ_CLK 6 +#endif -- cgit v1.2.3 From b588019e85f490696bf19f0747e93f14b1563927 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Mon, 11 May 2026 07:02:44 +0000 Subject: rtnetlink: add RTEXT_FILTER_NAME_ONLY support iproute2 can spend considerable amount of time in ll_init_map() or ll_link_get() to dump verbose netdev attributes, contributing to RTNL pressure. Add RTEXT_FILTER_NAME_ONLY new flag so that rtnl_fill_ifinfo() limits its output to: - struct nlmsghdr - IFLA_IFNAME - IFLA_PROP_LIST (alternate names) We can later avoid using RTNL when RTEXT_FILTER_NAME_ONLY is requested, as none of these attributes need RTNL. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260511070244.971028-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/uapi/linux/rtnetlink.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h index dab9493c791b..27265fd31e5f 100644 --- a/include/uapi/linux/rtnetlink.h +++ b/include/uapi/linux/rtnetlink.h @@ -840,6 +840,7 @@ enum { #define RTEXT_FILTER_CFM_CONFIG (1 << 5) #define RTEXT_FILTER_CFM_STATUS (1 << 6) #define RTEXT_FILTER_MST (1 << 7) +#define RTEXT_FILTER_NAME_ONLY (1 << 8) /* End of information exported to user level */ -- cgit v1.2.3 From 5c4b709b5fc1929ed3e9d3ef48c089d7df8b8dff Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Mon, 11 May 2026 07:23:08 +0000 Subject: net: constify sk_skb_reason_drop() sock parameter sk_skb_reason_drop() does not change sock parameter, make it const so that we can call it from TCP stack without a cast on a (const) listener socket. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260511072310.1094859-2-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/skbuff.h | 3 ++- include/trace/events/skb.h | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 2bcf78a4de7b..746e741a8ef9 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1313,7 +1313,8 @@ static inline bool skb_data_unref(const struct sk_buff *skb, return true; } -void __fix_address sk_skb_reason_drop(struct sock *sk, struct sk_buff *skb, +void __fix_address sk_skb_reason_drop(const struct sock *sk, + struct sk_buff *skb, enum skb_drop_reason reason); static inline void diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h index b877133cd93a..2945aa7fe9a7 100644 --- a/include/trace/events/skb.h +++ b/include/trace/events/skb.h @@ -24,14 +24,14 @@ DEFINE_DROP_REASON(FN, FN) TRACE_EVENT(kfree_skb, TP_PROTO(struct sk_buff *skb, void *location, - enum skb_drop_reason reason, struct sock *rx_sk), + enum skb_drop_reason reason, const struct sock *rx_sk), TP_ARGS(skb, location, reason, rx_sk), TP_STRUCT__entry( __field(void *, skbaddr) __field(void *, location) - __field(void *, rx_sk) + __field(const void *, rx_sk) __field(unsigned short, protocol) __field(enum skb_drop_reason, reason) ), -- cgit v1.2.3 From 9c11fcb2e9a54d0f1467380831e2e4bb68f7498d Mon Sep 17 00:00:00 2001 From: Ivan Vecera Date: Mon, 11 May 2026 17:58:15 +0200 Subject: dpll: add fractional frequency offset to pin-parent-device Add both fractional-frequency-offset (PPM) and fractional-frequency-offset-ppt (PPT) attributes to the pin-parent-device nested attribute set, alongside the existing top-level pin attributes. Both carry the same measurement at different precisions. Introduce enum dpll_ffo_type and struct dpll_ffo_param to distinguish FFO contexts: DPLL_FFO_PORT_RXTX_RATE for the RX vs TX symbol rate offset reported at the top level, and DPLL_FFO_PIN_DEVICE for the pin vs parent DPLL offset reported in the pin-parent-device nest. Add a supported_ffo bitmask to struct dpll_pin_ops so drivers declare which FFO types they support. The core only calls ffo_get for types the driver has opted into, eliminating the need for per-driver NULL pointer guards. Validate at pin registration time that supported_ffo is not set without an ffo_get callback. Update mlx5 (DPLL_FFO_PORT_RXTX_RATE) and zl3073x (DPLL_FFO_PORT_RXTX_RATE) drivers to use the new API. Add documentation for both FFO types to dpll.rst. Changes v3 -> v4: - Replace dpll=NULL overloading with enum dpll_ffo_type and struct dpll_ffo_param (Jakub Kicinski) - Add supported_ffo opt-in bitmask in dpll_pin_ops for fail-close driver validation (Jakub Kicinski) - Add WARN_ON in dpll_pin_register for supported_ffo without ffo_get callback Reviewed-by: Jiri Pirko Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20260511155816.99936-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski --- include/linux/dpll.h | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/dpll.h b/include/linux/dpll.h index 193abfb6ce66..82dfadd9f593 100644 --- a/include/linux/dpll.h +++ b/include/linux/dpll.h @@ -60,7 +60,20 @@ struct dpll_device_ops { struct netlink_ext_ack *extack); }; +enum dpll_ffo_type { + DPLL_FFO_PORT_RXTX_RATE, + DPLL_FFO_PIN_DEVICE, + + __DPLL_FFO_TYPE_MAX, +}; + +struct dpll_ffo_param { + enum dpll_ffo_type type; + s64 ffo; +}; + struct dpll_pin_ops { + unsigned long supported_ffo; int (*frequency_set)(const struct dpll_pin *pin, void *pin_priv, const struct dpll_device *dpll, void *dpll_priv, const u64 frequency, @@ -121,7 +134,8 @@ struct dpll_pin_ops { struct netlink_ext_ack *extack); int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, const struct dpll_device *dpll, void *dpll_priv, - s64 *ffo, struct netlink_ext_ack *extack); + struct dpll_ffo_param *ffo, + struct netlink_ext_ack *extack); int (*measured_freq_get)(const struct dpll_pin *pin, void *pin_priv, const struct dpll_device *dpll, void *dpll_priv, u64 *measured_freq, -- cgit v1.2.3 From 97d272699e06bb60883333447cb628b6e846cbcf Mon Sep 17 00:00:00 2001 From: "Gustavo A. R. Silva" Date: Sun, 10 May 2026 15:10:31 -0600 Subject: stddef: Document designated initializer semantics for __TRAILING_OVERLAP() Document the designated initializer behavior for overlapping storage between NAME and MEMBERS, and clarify the implications for static initialization to help avoid unintended overwrites. Signed-off-by: Gustavo A. R. Silva Link: https://patch.msgid.link/agD0R-kNbg9YMOCT@kspp Signed-off-by: Kees Cook --- include/linux/stddef.h | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) (limited to 'include') diff --git a/include/linux/stddef.h b/include/linux/stddef.h index 80b6bfb944f0..e1851c50c89b 100644 --- a/include/linux/stddef.h +++ b/include/linux/stddef.h @@ -100,6 +100,71 @@ enum { * Creates a union between a flexible-array member (FAM) in a struct and a set * of additional members that would otherwise follow it. * + * Beware that, as this helper encloses TYPE NAME and MEMBERS in the same + * union, designated initializers for MEMBERS may overwrite portions + * previously initialized through NAME. + * + * For example:: + * + * struct flex { + * size_t count; + * u8 fam[]; + * }; + * + * struct composite { + * ... + * __TRAILING_OVERLAP(struct flex, flex, fam, __packed, + * u8 data; + * ); + * } __packed; + * + * static struct composite comp = { + * .flex = { + * .count = 1, + * }, + * .data = 2, + * }; + * + * In the example above, .flex and .data initialize different views of the same + * union storage. Since .data is initialized last, it _may_ overwrite portions + * previously initialized through .flex, leading to .flex.count being zeroed + * out. + * + * A couple of alternatives are shown below. + * + * a) Initialize only one view of the overlapped storage and assign the rest + * at runtime:: + * + * static struct composite comp = { + * .flex = { + * .count = 1, + * }, + * }; + * + * static void foo(void) + * { + * comp.data = 2; + * ... + * } + * + * b) Alternatively, replace designated initializers with runtime assignments:: + * + * static void foo(void) + * { + * struct composite comp; + * + * comp.flex.count = 1; + * comp.data = 2; + * ... + * } + * + * Compiler Explorer test code: https://godbolt.org/z/voM4E36dT + * + * For another example of the above see commit 5e54510a9389 ("acpi: nfit: + * intel: avoid multiple -Wflex-array-member-not-at-end warnings") + * + * Link: https://git.kernel.org/linus/5e54510a9389caa9 + * * @TYPE: Flexible structure type name, including "struct" keyword. * @NAME: Name for a variable to define. * @FAM: The flexible-array member within @TYPE -- cgit v1.2.3 From d5607f1fafd7eb72ed693b6a033d96221e870edd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christoph=20B=C3=B6hmwalder?= Date: Wed, 13 May 2026 13:03:42 +0200 Subject: drbd: clean up UAPI headers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit b1798910fc7f ("drbd: move UAPI headers to include/uapi/linux/") broke compilation on targets without a hosted libc: ./usr/include/linux/drbd.h:18:10: fatal error: sys/types.h: No such file or directory The underlying issue is that there were some constructs left over in those headers that don't belong in uapi. Drop the __KERNEL__-gated split in drbd.h. The !__KERNEL__ branch pulls in , and for symbols that the header does not actually reference; they were carried over from when this lived in include/linux/. Replace and the entire #ifdef block with the standard UAPI combo + , which provides __u32/__u64/__s32 and __{LITTLE,BIG}_ENDIAN_BITFIELD in both kernel and userspace contexts. drbd_limits.h references some enum values and the DRBD_PROT_C define from drbd.h, but does not include it. Add the missing include while we're here. Drop the unprefixed DEBUG_RANGE_CHECK from drbd_limits.h. It has no in-kernel users and pollutes the userspace namespace. Switch the drbd.h and drbd_limits.h include guards to the _UAPI_LINUX_* convention already used by drbd_genl.h. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605101346.V2wwJqv1-lkp@intel.com/ Fixes: b1798910fc7f ("drbd: move UAPI headers to include/uapi/linux/") Signed-off-by: Christoph Böhmwalder Link: https://patch.msgid.link/20260513110343.3170338-1-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe --- include/uapi/linux/drbd.h | 28 +++------------------------- include/uapi/linux/drbd_limits.h | 8 ++++---- 2 files changed, 7 insertions(+), 29 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/drbd.h b/include/uapi/linux/drbd.h index 5d4d677cf1ad..cf1ec3eb872f 100644 --- a/include/uapi/linux/drbd.h +++ b/include/uapi/linux/drbd.h @@ -11,32 +11,10 @@ */ -#ifndef DRBD_H -#define DRBD_H -#include - -#ifdef __KERNEL__ +#ifndef _UAPI_LINUX_DRBD_H +#define _UAPI_LINUX_DRBD_H #include #include -#else -#include -#include -#include - -/* Although the Linux source code makes a difference between - generic endianness and the bitfields' endianness, there is no - architecture as of Linux-2.6.24-rc4 where the bitfields' endianness - does not match the generic endianness. */ - -#if __BYTE_ORDER == __LITTLE_ENDIAN -#define __LITTLE_ENDIAN_BITFIELD -#elif __BYTE_ORDER == __BIG_ENDIAN -#define __BIG_ENDIAN_BITFIELD -#else -# error "sorry, weird endianness on this box" -#endif - -#endif enum drbd_io_error_p { EP_PASS_ON, /* FIXME should the better be named "Ignore"? */ @@ -432,4 +410,4 @@ enum drbd_state_info_bcast_reason { SIB_SYNC_PROGRESS = 5, }; -#endif +#endif /* _UAPI_LINUX_DRBD_H */ diff --git a/include/uapi/linux/drbd_limits.h b/include/uapi/linux/drbd_limits.h index a72a102d1ca7..acefe84bc602 100644 --- a/include/uapi/linux/drbd_limits.h +++ b/include/uapi/linux/drbd_limits.h @@ -11,10 +11,10 @@ * feedback about nonsense settings for certain configurable values. */ -#ifndef DRBD_LIMITS_H -#define DRBD_LIMITS_H 1 +#ifndef _UAPI_LINUX_DRBD_LIMITS_H +#define _UAPI_LINUX_DRBD_LIMITS_H -#define DEBUG_RANGE_CHECK 0 +#include #define DRBD_MINOR_COUNT_MIN 1U #define DRBD_MINOR_COUNT_MAX 255U @@ -248,4 +248,4 @@ #define DRBD_RS_DISCARD_GRANULARITY_DEF 0U /* disabled by default */ #define DRBD_RS_DISCARD_GRANULARITY_SCALE '1' /* bytes */ -#endif +#endif /* _UAPI_LINUX_DRBD_LIMITS_H */ -- cgit v1.2.3 From d989f135f71699294bb2ffd4726b526456e2db68 Mon Sep 17 00:00:00 2001 From: Felix Kuehling Date: Wed, 13 May 2026 09:12:53 -0500 Subject: drm/ttm: Support 52-bit PAs in ttm_place MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit fpfn and lpfn in struct ttm_place are 32-bit page numbers. With 4KB page size this can support up to 44-bit physical addressing. Grow these to 64-bit (uint64_t) to support larger physical addresses. Signed-off-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Arunpravin Paneer Selvam Link: https://patch.msgid.link/20260513141253.20410-1-felix.kuehling@amd.com --- include/drm/ttm/ttm_placement.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/drm/ttm/ttm_placement.h b/include/drm/ttm/ttm_placement.h index b510a4812609..ab2639e42c54 100644 --- a/include/drm/ttm/ttm_placement.h +++ b/include/drm/ttm/ttm_placement.h @@ -81,8 +81,8 @@ * Structure indicating a possible place to put an object. */ struct ttm_place { - unsigned fpfn; - unsigned lpfn; + uint64_t fpfn; + uint64_t lpfn; uint32_t mem_type; uint32_t flags; }; -- cgit v1.2.3 From ede2dc5c6b571ce6d3aacf5a81933f8c5d5e6c7d Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Tue, 12 May 2026 21:49:54 -0700 Subject: bpf: Convert bpf_get_spilled_reg macro to static inline function Convert the bpf_get_spilled_reg() macro to a static inline function for better type safety and readability. This also simplifies the macro definition in preparation for upcoming stack argument support which will introduce additional macros. No functional change. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513044954.2382693-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index c15a4c26a43b..203fb751eeae 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -552,10 +552,14 @@ struct bpf_verifier_state { u32 may_goto_depth; }; -#define bpf_get_spilled_reg(slot, frame, mask) \ - (((slot < frame->allocated_stack / BPF_REG_SIZE) && \ - ((1 << frame->stack[slot].slot_type[BPF_REG_SIZE - 1]) & (mask))) \ - ? &frame->stack[slot].spilled_ptr : NULL) +static inline struct bpf_reg_state * +bpf_get_spilled_reg(int slot, struct bpf_func_state *frame, u32 mask) +{ + if (slot < frame->allocated_stack / BPF_REG_SIZE && + (1 << frame->stack[slot].slot_type[BPF_REG_SIZE - 1]) & mask) + return &frame->stack[slot].spilled_ptr; + return NULL; +} /* Iterate over 'frame', setting 'reg' to either NULL or a spilled register. */ #define bpf_for_each_spilled_reg(iter, frame, reg, mask) \ -- cgit v1.2.3 From 78bbe61632f11b1091c03259f92b6559489222ae Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Tue, 12 May 2026 21:50:05 -0700 Subject: bpf: Add helper functions for r11-based stack argument insns MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add three static inline helper functions — is_stack_arg_ldx(), is_stack_arg_st(), and is_stack_arg_stx() — that identify r11-based (BPF_REG_PARAMS) instructions used for stack argument passing. These helpers encapsulate the detailed encoding requirements (operand size, register, offset alignment and sign) and hide raw BPF_REG_PARAMS usage from the verifier, making call sites more readable and explicit. A later patch ("bpf: Enable r11 based insns") will wire these helpers into the verifier. Until then, check_and_resolve_insns() rejects any r11-based registers. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513045005.2383881-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/filter.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'include') diff --git a/include/linux/filter.h b/include/linux/filter.h index b77d0b06db6e..918d9b34eac6 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -749,6 +749,27 @@ static inline u32 bpf_prog_run_pin_on_cpu(const struct bpf_prog *prog, return ret; } +static inline bool is_stack_arg_ldx(const struct bpf_insn *insn) +{ + return insn->code == (BPF_LDX | BPF_MEM | BPF_DW) && + insn->src_reg == BPF_REG_PARAMS && + insn->off > 0 && insn->off % 8 == 0; +} + +static inline bool is_stack_arg_st(const struct bpf_insn *insn) +{ + return insn->code == (BPF_ST | BPF_MEM | BPF_DW) && + insn->dst_reg == BPF_REG_PARAMS && + insn->off < 0 && insn->off % 8 == 0; +} + +static inline bool is_stack_arg_stx(const struct bpf_insn *insn) +{ + return insn->code == (BPF_STX | BPF_MEM | BPF_DW) && + insn->dst_reg == BPF_REG_PARAMS && + insn->off < 0 && insn->off % 8 == 0; +} + #define BPF_SKB_CB_LEN QDISC_CB_PRIV_LEN struct bpf_skb_data_end { -- cgit v1.2.3 From 0f6bd5e7a804af27e7f34b8306afde7a6b269318 Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Tue, 12 May 2026 21:50:15 -0700 Subject: bpf: Support stack arguments for bpf functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently BPF functions (subprogs) are limited to 5 register arguments. With [1], the compiler can emit code that passes additional arguments via a dedicated stack area through bpf register BPF_REG_PARAMS (r11), introduced in an earlier patch ([2]). The compiler uses positive r11 offsets for incoming (callee-side) args and negative r11 offsets for outgoing (caller-side) args, following the x86_64/arm64 calling convention direction. There is an 8-byte gap at offset 0 separating two regions: Incoming (callee reads): r11+8 (arg6), r11+16 (arg7), ... Outgoing (caller writes): r11-8 (arg6), r11-16 (arg7), ... The following is an example to show how stack arguments are saved and transferred between caller and callee: int foo(int a1, int a2, int a3, int a4, int a5, int a6, int a7) { ... bar(a1, a2, a3, a4, a5, a6, a7, a8); ... } Caller (foo) Callee (bar) ============ ============ Incoming (positive offsets): Incoming (positive offsets): r11+8: [incoming arg 6] r11+8: [incoming arg 6] <-+ r11+16: [incoming arg 7] r11+16: [incoming arg 7] <-|+ r11+24: [incoming arg 8] <-||+ Outgoing (negative offsets): ||| r11-8: [outgoing arg 6 to bar] -------->-------------------------+|| r11-16: [outgoing arg 7 to bar] -------->--------------------------+| r11-24: [outgoing arg 8 to bar] -------->---------------------------+ If the bpf function has more than one call: int foo(int a1, int a2, int a3, int a4, int a5, int a6, int a7) { ... bar1(a1, a2, a3, a4, a5, a6, a7, a8); ... bar2(a1, a2, a3, a4, a5, a6, a7, a8, a9); ... } Caller (foo) Callee (bar2) ============ ============== Incoming (positive offsets): Incoming (positive offsets): r11+8: [incoming arg 6] r11+8: [incoming arg 6] <+ r11+16: [incoming arg 7] r11+16: [incoming arg 7] <|+ r11+24: [incoming arg 8] <||+ Outgoing for bar2 (negative offsets): r11+32: [incoming arg 9] <|||+ r11-8: [outgoing arg 6] ---->----------->-------------------------+||| r11-16: [outgoing arg 7] ---->----------->--------------------------+|| r11-24: [outgoing arg 8] ---->----------->---------------------------+| r11-32: [outgoing arg 9] ---->----------->----------------------------+ The verifier tracks outgoing stack arguments in stack_arg_regs[] and out_stack_arg_cnt in bpf_func_state, separately from the regular r10 stack. The callee does not copy incoming args — it reads them directly from the caller's outgoing slots at positive r11 offsets. Similar to stacksafe(), introduce stack_arg_safe() to do pruning check. Outgoing stack arg slots are invalidated when the callee returns (e.g. in prepare_func_exit), not at call time. This allows the callee to read incoming args from the caller's outgoing slots during verification. The following are a few examples. Example 1: *(u64 *)(r11 - 8) = r6; *(u64 *)(r11 - 16) = r7; call bar1; // arg6 = r6, arg7 = r7 call bar2; // expected with 2 stack arguments, failed Example 2: To fix the Example 1: *(u64 *)(r11 - 8) = r6; *(u64 *)(r11 - 16) = r7; call bar1; // arg6 = r6, arg7 = r7 *(u64 *)(r11 - 8) = r8; *(u64 *)(r11 - 16) = r9; call bar2; // arg6 = r8, arg7 = r9 Example 3: The compiler can hoist the shared stack arg stores above the branch: *(u64 *)(r11 - 16) = r7; if cond goto else; *(u64 *)(r11 - 8) = r8; call bar1; // arg6 = r8, arg7 = r7 goto end; else: *(u64 *)(r11 - 8) = r9; call bar2; // arg6 = r9, arg7 = r7 end: Example 4: Within a loop: loop: *(u64 *)(r11 - 8) = r6; // arg6, before loop call bar; // reuses arg6 each iteration if ... goto loop; A separate max_out_stack_arg_cnt field in bpf_subprog_info tracks the deepest outgoing slot actually written. This intends to reject programs that write to slots beyond what any callee expects. It is necessary for JIT. Similar to typical compiler generated code, enforce the following orderings: - all stack arg reads must be ahead of any stack arg write - all stack arg reads must be before any bpf func, kfunc and helpers This is needed as JIT may emit 'mov' insns for read/write with the same register and bpf function, kfunc and helper will invalidate all arguments immediately after the call. Callback functions with stack arguments need kernel setup parameter types (including stack parameters) properly and then callback function can retrieve such information for verification purpose. Global subprogs and freplace with >5 args are not yet supported. [1] https://github.com/llvm/llvm-project/pull/189060 [2] https://lore.kernel.org/bpf/20260423033506.2542005-1-yonghong.song@linux.dev/ Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513045015.2385013-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 43 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 39 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 203fb751eeae..5398a02a1280 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -402,6 +402,7 @@ struct bpf_func_state { bool in_callback_fn; bool in_async_callback_fn; bool in_exception_callback_fn; + bool no_stack_arg_load; /* For callback calling functions that limit number of possible * callback executions (e.g. bpf_loop) keeps track of current * simulated iteration number. @@ -427,6 +428,9 @@ struct bpf_func_state { * `stack`. allocated_stack is always a multiple of BPF_REG_SIZE. */ int allocated_stack; + + u16 out_stack_arg_cnt; /* Number of outgoing on-stack argument slots */ + struct bpf_reg_state *stack_arg_regs; /* Outgoing on-stack arguments */ }; #define MAX_CALL_FRAMES 8 @@ -465,8 +469,10 @@ struct bpf_jmp_history_entry { u64 linked_regs; }; -/* Maximum number of register states that can exist at once */ -#define BPF_ID_MAP_SIZE ((MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE) * MAX_CALL_FRAMES) +/* Maximum number of bpf_reg_state objects that can exist at once */ +#define MAX_STACK_ARG_SLOTS (MAX_BPF_FUNC_ARGS - MAX_BPF_FUNC_REG_ARGS) +#define BPF_ID_MAP_SIZE ((MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE + \ + MAX_STACK_ARG_SLOTS) * MAX_CALL_FRAMES) struct bpf_verifier_state { /* call stack tracking */ struct bpf_func_state *frame[MAX_CALL_FRAMES]; @@ -561,12 +567,27 @@ bpf_get_spilled_reg(int slot, struct bpf_func_state *frame, u32 mask) return NULL; } +static inline struct bpf_reg_state * +bpf_get_spilled_stack_arg(int slot, struct bpf_func_state *frame) +{ + if (slot < frame->out_stack_arg_cnt && + frame->stack_arg_regs[slot].type != NOT_INIT) + return &frame->stack_arg_regs[slot]; + return NULL; +} + /* Iterate over 'frame', setting 'reg' to either NULL or a spilled register. */ #define bpf_for_each_spilled_reg(iter, frame, reg, mask) \ for (iter = 0, reg = bpf_get_spilled_reg(iter, frame, mask); \ iter < frame->allocated_stack / BPF_REG_SIZE; \ iter++, reg = bpf_get_spilled_reg(iter, frame, mask)) +/* Iterate over 'frame', setting 'reg' to either NULL or a spilled stack arg. */ +#define bpf_for_each_spilled_stack_arg(iter, frame, reg) \ + for (iter = 0, reg = bpf_get_spilled_stack_arg(iter, frame); \ + iter < frame->out_stack_arg_cnt; \ + iter++, reg = bpf_get_spilled_stack_arg(iter, frame)) + #define bpf_for_each_reg_in_vstate_mask(__vst, __state, __reg, __mask, __expr) \ ({ \ struct bpf_verifier_state *___vstate = __vst; \ @@ -584,6 +605,11 @@ bpf_get_spilled_reg(int slot, struct bpf_func_state *frame, u32 mask) continue; \ (void)(__expr); \ } \ + bpf_for_each_spilled_stack_arg(___j, __state, __reg) { \ + if (!__reg) \ + continue; \ + (void)(__expr); \ + } \ } \ }) @@ -815,12 +841,21 @@ struct bpf_subprog_info { bool keep_fastcall_stack: 1; bool changes_pkt_data: 1; bool might_sleep: 1; - u8 arg_cnt:3; + u8 arg_cnt:4; enum priv_stack_mode priv_stack_mode; - struct bpf_subprog_arg_info args[MAX_BPF_FUNC_REG_ARGS]; + struct bpf_subprog_arg_info args[MAX_BPF_FUNC_ARGS]; + u16 stack_arg_cnt; /* incoming + max outgoing */ + u16 max_out_stack_arg_cnt; }; +static inline u16 bpf_in_stack_arg_cnt(const struct bpf_subprog_info *sub) +{ + if (sub->arg_cnt > MAX_BPF_FUNC_REG_ARGS) + return sub->arg_cnt - MAX_BPF_FUNC_REG_ARGS; + return 0; +} + struct bpf_verifier_env; struct backtrack_state { -- cgit v1.2.3 From 3a656670fd6da624f6241038ca4cf350f24fd5e8 Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Tue, 12 May 2026 21:50:20 -0700 Subject: bpf: Refactor jmp history to use dedicated spi/frame fields Move stack slot index (spi) and frame number out of the flags field in bpf_jmp_history_entry into dedicated bitfields. This simplifies the encoding and makes room for new flags. Previously, spi and frame were packed into the lower 9 bits of the 12-bit flags field (3 bits frame + 6 bits spi), with INSN_F_STACK_ACCESS at BIT(9) and INSN_F_DST/SRC_REG_STACK at BIT(10)/BIT(11). But this has no room for an INSN_F_* flag for stack arguments. To resolve this issue, bpf_jmp_history_entry field idx is narrowed to 20 bits (sufficient for insn indices up to 1M), and the freed bits hold spi (6 bits) and frame (3 bits) as dedicated struct fields. The flags enum is simplified accordingly: INSN_F_STACK_ACCESS -> BIT(0) INSN_F_DST_REG_STACK -> BIT(1) INSN_F_SRC_REG_STACK -> BIT(2) which allows more room for additional INSN_F_* flags. bpf_push_jmp_history() now takes explicit spi and frame parameters instead of encoding them into flags. The insn_stack_access_flags(), insn_stack_access_spi(), and insn_stack_access_frameno() helpers are removed. No functional change. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513045020.2385962-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 37 ++++++++++++++++--------------------- 1 file changed, 16 insertions(+), 21 deletions(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 5398a02a1280..3ec338169981 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -435,40 +435,35 @@ struct bpf_func_state { #define MAX_CALL_FRAMES 8 -/* instruction history flags, used in bpf_jmp_history_entry.flags field */ +/* instruction history flags, used in bpf_jmp_history_entry.flags field. + * Frame number and SPI are stored in dedicated fields of bpf_jmp_history_entry. + */ enum { - /* instruction references stack slot through PTR_TO_STACK register; - * we also store stack's frame number in lower 3 bits (MAX_CALL_FRAMES is 8) - * and accessed stack slot's index in next 6 bits (MAX_BPF_STACK is 512, - * 8 bytes per slot, so slot index (spi) is [0, 63]) - */ - INSN_F_FRAMENO_MASK = 0x7, /* 3 bits */ - - INSN_F_SPI_MASK = 0x3f, /* 6 bits */ - INSN_F_SPI_SHIFT = 3, /* shifted 3 bits to the left */ + INSN_F_STACK_ACCESS = BIT(0), - INSN_F_STACK_ACCESS = BIT(9), - - INSN_F_DST_REG_STACK = BIT(10), /* dst_reg is PTR_TO_STACK */ - INSN_F_SRC_REG_STACK = BIT(11), /* src_reg is PTR_TO_STACK */ - /* total 12 bits are used now. */ + INSN_F_DST_REG_STACK = BIT(1), /* dst_reg is PTR_TO_STACK */ + INSN_F_SRC_REG_STACK = BIT(2), /* src_reg is PTR_TO_STACK */ }; -static_assert(INSN_F_FRAMENO_MASK + 1 >= MAX_CALL_FRAMES); -static_assert(INSN_F_SPI_MASK + 1 >= MAX_BPF_STACK / 8); - struct bpf_jmp_history_entry { - u32 idx; /* insn idx can't be bigger than 1 million */ + u32 idx : 20; + u32 frame : 3; /* stack access frame number */ + u32 spi : 6; /* stack slot index (0..63) */ + u32 : 3; u32 prev_idx : 20; /* special INSN_F_xxx flags */ - u32 flags : 12; + u32 flags : 4; + u32 : 8; /* additional registers that need precision tracking when this * jump is backtracked, vector of six 10-bit records */ u64 linked_regs; }; +static_assert(MAX_CALL_FRAMES <= (1 << 3)); +static_assert(MAX_BPF_STACK / 8 <= (1 << 6)); + /* Maximum number of bpf_reg_state objects that can exist at once */ #define MAX_STACK_ARG_SLOTS (MAX_BPF_FUNC_ARGS - MAX_BPF_FUNC_REG_ARGS) #define BPF_ID_MAP_SIZE ((MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE + \ @@ -1198,7 +1193,7 @@ struct list_head *bpf_explored_state(struct bpf_verifier_env *env, int idx); void bpf_free_verifier_state(struct bpf_verifier_state *state, bool free_self); void bpf_free_backedges(struct bpf_scc_visit *visit); int bpf_push_jmp_history(struct bpf_verifier_env *env, struct bpf_verifier_state *cur, - int insn_flags, u64 linked_regs); + int insn_flags, int spi, int frame, u64 linked_regs); void bpf_bt_sync_linked_regs(struct backtrack_state *bt, struct bpf_jmp_history_entry *hist); void bpf_mark_reg_not_init(const struct bpf_verifier_env *env, struct bpf_reg_state *reg); -- cgit v1.2.3 From 0a0fdc64b68c28dab40f9deb0cffdf544e04b0ba Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Tue, 12 May 2026 21:50:25 -0700 Subject: bpf: Add precision marking and backtracking for stack argument slots Extend the precision marking and backtracking infrastructure to support stack argument slots (r11-based accesses). Without this, precision demands for scalar values passed through stack arguments are silently dropped, which could allow the verifier to incorrectly prune states with different constant values in stack arg slots. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513045025.2387526-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 3ec338169981..6f12fc40b682 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -443,6 +443,8 @@ enum { INSN_F_DST_REG_STACK = BIT(1), /* dst_reg is PTR_TO_STACK */ INSN_F_SRC_REG_STACK = BIT(2), /* src_reg is PTR_TO_STACK */ + + INSN_F_STACK_ARG_ACCESS = BIT(3), }; struct bpf_jmp_history_entry { @@ -858,6 +860,7 @@ struct backtrack_state { u32 frame; u32 reg_masks[MAX_CALL_FRAMES]; u64 stack_masks[MAX_CALL_FRAMES]; + u8 stack_arg_masks[MAX_CALL_FRAMES]; }; struct bpf_id_pair { @@ -1256,6 +1259,11 @@ static inline void bpf_bt_set_frame_slot(struct backtrack_state *bt, u32 frame, bt->stack_masks[frame] |= 1ull << slot; } +static inline void bt_set_frame_stack_arg_slot(struct backtrack_state *bt, u32 frame, u32 slot) +{ + bt->stack_arg_masks[frame] |= 1 << slot; +} + static inline bool bt_is_frame_reg_set(struct backtrack_state *bt, u32 frame, u32 reg) { return bt->reg_masks[frame] & (1 << reg); -- cgit v1.2.3 From 848d624acf668ae0d71b128f163d1d18d2ac6b90 Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Tue, 12 May 2026 21:50:54 -0700 Subject: bpf: Prepare architecture JIT support for stack arguments Add bpf_jit_supports_stack_args() as a weak function defaulting to false. Architectures that implement JIT support for stack arguments override it to return true. Reject BPF functions with more than 5 parameters at verification time if the architecture does not support stack arguments. Acked-by: Puranjay Mohan Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513045054.2390945-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/filter.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/filter.h b/include/linux/filter.h index 918d9b34eac6..a515a9769078 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1184,6 +1184,7 @@ bool bpf_jit_inlines_helper_call(s32 imm); bool bpf_jit_supports_subprog_tailcalls(void); bool bpf_jit_supports_percpu_insn(void); bool bpf_jit_supports_kfunc_call(void); +bool bpf_jit_supports_stack_args(void); bool bpf_jit_supports_far_kfunc_call(void); bool bpf_jit_supports_exceptions(void); bool bpf_jit_supports_ptr_xchg(void); -- cgit v1.2.3 From 324c3ca6eed6fb7ec4e50f31d537953038b13c5f Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Tue, 12 May 2026 21:51:19 -0700 Subject: bpf,x86: Implement JIT support for stack arguments Add x86_64 JIT support for BPF functions and kfuncs with more than 5 arguments. The extra arguments are passed through a stack area addressed by register r11 (BPF_REG_PARAMS) in BPF bytecode, which the JIT translates to native code. The JIT follows the x86-64 calling convention for both BPF-to-BPF and kfunc calls: - Arg 6 is passed in the R9 register - Args 7+ are passed on the stack Incoming arg 6 (BPF r11+8) is translated to a MOV from R9 rather than a memory load. Incoming args 7+ (BPF r11+16, r11+24, ...) map directly to [rbp + 16], [rbp + 24], ..., matching the x86-64 stack layout after CALL + PUSH RBP, so no offset adjustment is needed. tail_call_reachable is rejected by the verifier and priv_stack is disabled by the JIT when stack args exist, so R9 is always available. When BPF bytecode writes to the arg-6 stack slot (offset -8), the JIT emits a MOV into R9 instead of a memory store. Outgoing args 7+ are placed at [rsp] in a pre-allocated area below callee-saved registers, using: native_off = outgoing_arg_base - outgoing_rsp - bpf_off - 16 The native x86_64 stack layout with stack arguments: high address +-------------------------+ | incoming stack arg N | [rbp + 16 + (N-7)*8] (from caller) | ... | | incoming stack arg 7 | [rbp + 16] +-------------------------+ | return address | [rbp + 8] | saved rbp | [rbp] +-------------------------+ | BPF program stack | (round_up(stack_depth, 8) bytes) +-------------------------+ | callee-saved regs | (r12, rbx, r13, r14, r15 as needed) +-------------------------+ | outgoing arg M | [rsp + (M-7)*8] | ... | | outgoing arg 7 | [rsp] +-------------------------+ rsp low address Acked-by: Puranjay Mohan Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260513045122.2393118-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 9e16e91647d3..242f9597d9ab 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1548,6 +1548,7 @@ void bpf_jit_uncharge_modmem(u32 size); bool bpf_prog_has_trampoline(const struct bpf_prog *prog); bool bpf_insn_is_indirect_target(const struct bpf_verifier_env *env, const struct bpf_prog *prog, int insn_idx); +u16 bpf_out_stack_arg_cnt(const struct bpf_verifier_env *env, const struct bpf_prog *prog); #else static inline int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr, -- cgit v1.2.3 From ac23106a9b9a0f6ed90002ae3d6fe7c14e97e6bf Mon Sep 17 00:00:00 2001 From: Francisco Munoz Ruiz Date: Tue, 7 Apr 2026 14:51:48 -0700 Subject: soc: qcom: llcc-qcom: get SCT descriptors from fw-populated memory Retrieve System Cache Table (SCT) descriptors from a shared memory region populated by firmware. SCT initialization and programming are performed entirely by firmware outside of Linux. The LLCC driver only consumes the pre-initialized descriptor data and does not configure SCT itself. Support this mechanism for future SoCs that provide SCT programming via firmware. Signed-off-by: Francisco Munoz Ruiz Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260407-external_llcc_changes2set-v2-2-b5017ce2020b@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/llcc-qcom.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/soc/qcom/llcc-qcom.h b/include/linux/soc/qcom/llcc-qcom.h index 227125d84318..b5e917154998 100644 --- a/include/linux/soc/qcom/llcc-qcom.h +++ b/include/linux/soc/qcom/llcc-qcom.h @@ -90,11 +90,13 @@ /** * struct llcc_slice_desc - Cache slice descriptor * @slice_id: llcc slice id + * @uid: Unique ID associated with the llcc device * @slice_size: Size allocated for the llcc slice * @refcount: Atomic counter to track activate/deactivate calls */ struct llcc_slice_desc { u32 slice_id; + u32 uid; size_t slice_size; refcount_t refcount; }; @@ -147,6 +149,7 @@ struct llcc_edac_reg_offset { /** * struct llcc_drv_data - Data associated with the llcc driver + * @dev: device back-pointer for this llcc instance * @regmaps: regmaps associated with the llcc device * @bcast_regmap: regmap associated with llcc broadcast OR offset * @bcast_and_regmap: regmap associated with llcc broadcast AND offset @@ -157,10 +160,11 @@ struct llcc_edac_reg_offset { * @num_banks: Number of llcc banks * @ecc_irq: interrupt for llcc cache error detection and reporting * @ecc_irq_configured: 'True' if firmware has already configured the irq propagation - * @desc: Array pointer of pre-allocated LLCC slice descriptors * @version: Indicates the LLCC version + * @desc: Array pointer of pre-allocated LLCC slice descriptors */ struct llcc_drv_data { + struct device *dev; struct regmap **regmaps; struct regmap *bcast_regmap; struct regmap *bcast_and_regmap; @@ -183,7 +187,7 @@ struct llcc_drv_data { struct llcc_slice_desc *llcc_slice_getd(u32 uid); /** - * llcc_slice_putd - llcc slice descritpor + * llcc_slice_putd - llcc slice descriptor * @desc: Pointer to llcc slice descriptor */ void llcc_slice_putd(struct llcc_slice_desc *desc); -- cgit v1.2.3 From 06a84c2d3ca4b9b54724e79717c2cfd9a59947d9 Mon Sep 17 00:00:00 2001 From: Francisco Munoz Ruiz Date: Tue, 7 Apr 2026 14:51:49 -0700 Subject: soc: qcom: llcc-qcom: Capitalize LLCC/EDAC in comments and diagnostics Capitalize occurrences of the acronym "LLCC" and "EDAC" in comments and diagnostic text to improve consistency and readability. Signed-off-by: Francisco Munoz Ruiz Reviewed-by: Konrad Dybcio Reviewed-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260407-external_llcc_changes2set-v2-3-b5017ce2020b@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/llcc-qcom.h | 42 +++++++++++++++++++------------------- 1 file changed, 21 insertions(+), 21 deletions(-) (limited to 'include') diff --git a/include/linux/soc/qcom/llcc-qcom.h b/include/linux/soc/qcom/llcc-qcom.h index b5e917154998..f3ed63e475ab 100644 --- a/include/linux/soc/qcom/llcc-qcom.h +++ b/include/linux/soc/qcom/llcc-qcom.h @@ -89,9 +89,9 @@ /** * struct llcc_slice_desc - Cache slice descriptor - * @slice_id: llcc slice id - * @uid: Unique ID associated with the llcc device - * @slice_size: Size allocated for the llcc slice + * @slice_id: LLCC slice id + * @uid: Unique ID associated with the LLCC device + * @slice_size: Size allocated for the LLCC slice * @refcount: Atomic counter to track activate/deactivate calls */ struct llcc_slice_desc { @@ -102,7 +102,7 @@ struct llcc_slice_desc { }; /** - * struct llcc_edac_reg_data - llcc edac registers data for each error type + * struct llcc_edac_reg_data - LLCC EDAC registers data for each error type * @name: Name of the error * @reg_cnt: Number of registers * @count_mask: Mask value to get the error count @@ -148,17 +148,17 @@ struct llcc_edac_reg_offset { }; /** - * struct llcc_drv_data - Data associated with the llcc driver - * @dev: device back-pointer for this llcc instance - * @regmaps: regmaps associated with the llcc device - * @bcast_regmap: regmap associated with llcc broadcast OR offset - * @bcast_and_regmap: regmap associated with llcc broadcast AND offset + * struct llcc_drv_data - Data associated with the LLCC driver + * @dev: device back-pointer for this LLCC instance + * @regmaps: regmaps associated with the LLCC device + * @bcast_regmap: regmap associated with LLCC broadcast OR offset + * @bcast_and_regmap: regmap associated with LLCC broadcast AND offset * @cfg: pointer to the data structure for slice configuration * @edac_reg_offset: Offset of the LLCC EDAC registers * @lock: mutex associated with each slice * @cfg_size: size of the config data table - * @num_banks: Number of llcc banks - * @ecc_irq: interrupt for llcc cache error detection and reporting + * @num_banks: Number of LLCC banks + * @ecc_irq: interrupt for LLCC cache error detection and reporting * @ecc_irq_configured: 'True' if firmware has already configured the irq propagation * @version: Indicates the LLCC version * @desc: Array pointer of pre-allocated LLCC slice descriptors @@ -181,38 +181,38 @@ struct llcc_drv_data { #if IS_ENABLED(CONFIG_QCOM_LLCC) /** - * llcc_slice_getd - get llcc slice descriptor + * llcc_slice_getd - get LLCC slice descriptor * @uid: usecase_id of the client */ struct llcc_slice_desc *llcc_slice_getd(u32 uid); /** - * llcc_slice_putd - llcc slice descriptor - * @desc: Pointer to llcc slice descriptor + * llcc_slice_putd - LLCC slice descriptor + * @desc: Pointer to LLCC slice descriptor */ void llcc_slice_putd(struct llcc_slice_desc *desc); /** * llcc_get_slice_id - get slice id - * @desc: Pointer to llcc slice descriptor + * @desc: Pointer to LLCC slice descriptor */ int llcc_get_slice_id(struct llcc_slice_desc *desc); /** - * llcc_get_slice_size - llcc slice size - * @desc: Pointer to llcc slice descriptor + * llcc_get_slice_size - LLCC slice size + * @desc: Pointer to LLCC slice descriptor */ size_t llcc_get_slice_size(struct llcc_slice_desc *desc); /** - * llcc_slice_activate - Activate the llcc slice - * @desc: Pointer to llcc slice descriptor + * llcc_slice_activate - Activate the LLCC slice + * @desc: Pointer to LLCC slice descriptor */ int llcc_slice_activate(struct llcc_slice_desc *desc); /** - * llcc_slice_deactivate - Deactivate the llcc slice - * @desc: Pointer to llcc slice descriptor + * llcc_slice_deactivate - Deactivate the LLCC slice + * @desc: Pointer to LLCC slice descriptor */ int llcc_slice_deactivate(struct llcc_slice_desc *desc); -- cgit v1.2.3 From bc984356520cea884229dc6ff044d9bf0049aa19 Mon Sep 17 00:00:00 2001 From: Vivek Aknurwar Date: Wed, 6 May 2026 09:50:40 -0700 Subject: dt-bindings: clock: qcom-rpmhcc: Add RPMHCC bindings for Hawi Update documentation for the RPMH clock controller on the Qualcomm Hawi SoC. Acked-by: Rob Herring (Arm) Reviewed-by: Mike Tipton Signed-off-by: Vivek Aknurwar Link: https://lore.kernel.org/r/20260506-clk-hawi-v3-1-530b538679f1@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/clock/qcom,rpmh.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/clock/qcom,rpmh.h b/include/dt-bindings/clock/qcom,rpmh.h index 0a7d1be0d124..2d62d5d0b08d 100644 --- a/include/dt-bindings/clock/qcom,rpmh.h +++ b/include/dt-bindings/clock/qcom,rpmh.h @@ -33,5 +33,7 @@ #define RPMH_HWKM_CLK 24 #define RPMH_QLINK_CLK 25 #define RPMH_QLINK_CLK_A 26 +#define RPMH_LN_BB_CLK4 27 +#define RPMH_LN_BB_CLK4_A 28 #endif -- cgit v1.2.3 From eb340b092d124d9e6592b2e58634e0ddb59dddbe Mon Sep 17 00:00:00 2001 From: Vivek Aknurwar Date: Wed, 6 May 2026 09:50:41 -0700 Subject: dt-bindings: clock: qcom: Add Hawi TCSR clock controller Add bindings documentation for TCSR clock controller on the Qualcomm Hawi SoC. Acked-by: Rob Herring (Arm) Reviewed-by: Mike Tipton Signed-off-by: Vivek Aknurwar Link: https://lore.kernel.org/r/20260506-clk-hawi-v3-2-530b538679f1@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/clock/qcom,hawi-tcsrcc.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 include/dt-bindings/clock/qcom,hawi-tcsrcc.h (limited to 'include') diff --git a/include/dt-bindings/clock/qcom,hawi-tcsrcc.h b/include/dt-bindings/clock/qcom,hawi-tcsrcc.h new file mode 100644 index 000000000000..957bc5f75bb7 --- /dev/null +++ b/include/dt-bindings/clock/qcom,hawi-tcsrcc.h @@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef _DT_BINDINGS_CLK_QCOM_TCSR_CC_HAWI_H +#define _DT_BINDINGS_CLK_QCOM_TCSR_CC_HAWI_H + +/* TCSR_CC clocks */ +#define TCSR_PCIE_0_CLKREF_EN 0 +#define TCSR_PCIE_1_CLKREF_EN 1 +#define TCSR_UFS_CLKREF_EN 2 +#define TCSR_USB2_CLKREF_EN 3 +#define TCSR_USB3_CLKREF_EN 4 + +#endif -- cgit v1.2.3 From d6cd9d5692babcdc697cb55736cb9ab2df87805e Mon Sep 17 00:00:00 2001 From: Vivek Aknurwar Date: Wed, 6 May 2026 09:50:42 -0700 Subject: dt-bindings: clock: qcom: Add Hawi global clock controller Add device tree bindings for the global clock controller on the Qualcomm Hawi SoC. Acked-by: Rob Herring (Arm) Reviewed-by: Mike Tipton Signed-off-by: Vivek Aknurwar Link: https://lore.kernel.org/r/20260506-clk-hawi-v3-3-530b538679f1@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/clock/qcom,hawi-gcc.h | 253 ++++++++++++++++++++++++++++++ 1 file changed, 253 insertions(+) create mode 100644 include/dt-bindings/clock/qcom,hawi-gcc.h (limited to 'include') diff --git a/include/dt-bindings/clock/qcom,hawi-gcc.h b/include/dt-bindings/clock/qcom,hawi-gcc.h new file mode 100644 index 000000000000..6cd7fa0884f5 --- /dev/null +++ b/include/dt-bindings/clock/qcom,hawi-gcc.h @@ -0,0 +1,253 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef _DT_BINDINGS_CLK_QCOM_GCC_HAWI_H +#define _DT_BINDINGS_CLK_QCOM_GCC_HAWI_H + +/* GCC clocks */ +#define GCC_AGGRE_NOC_PCIE_AXI_CLK 0 +#define GCC_AGGRE_STARDUSTNOC_USB3_PRIM_AXI_CLK 1 +#define GCC_AGGRE_UFS_PHY_AXI_CLK 2 +#define GCC_BOOT_ROM_AHB_CLK 3 +#define GCC_CAM_BIST_MCLK_AHB_CLK 4 +#define GCC_CAMERA_AHB_CLK 5 +#define GCC_CAMERA_HF_AXI_CLK 6 +#define GCC_CAMERA_RSC_CORE_CLK 7 +#define GCC_CAMERA_SF_AXI_CLK 8 +#define GCC_CAMERA_XO_CLK 9 +#define GCC_CFG_NOC_PCIE_ANOC_AHB_CLK 10 +#define GCC_CFG_NOC_USB3_PRIM_AXI_CLK 11 +#define GCC_CNOC_PCIE_SF_AXI_CLK 12 +#define GCC_EVA_AHB_CLK 13 +#define GCC_EVA_AXI0_CLK 14 +#define GCC_EVA_AXI0C_CLK 15 +#define GCC_EVA_XO_CLK 16 +#define GCC_GP1_CLK 17 +#define GCC_GP1_CLK_SRC 18 +#define GCC_GP2_CLK 19 +#define GCC_GP2_CLK_SRC 20 +#define GCC_GP3_CLK 21 +#define GCC_GP3_CLK_SRC 22 +#define GCC_GPLL0 23 +#define GCC_GPLL0_OUT_EVEN 24 +#define GCC_GPLL4 25 +#define GCC_GPLL5 26 +#define GCC_GPLL7 27 +#define GCC_GPLL9 28 +#define GCC_GPU_CFG_AHB_CLK 29 +#define GCC_GPU_GEMNOC_GFX_CLK 30 +#define GCC_GPU_GPLL0_CLK_SRC 31 +#define GCC_GPU_GPLL0_DIV_CLK_SRC 32 +#define GCC_GPU_RSC_CORE_CLK 33 +#define GCC_GPU_SMMU_VOTE_CLK 34 +#define GCC_MMU_TCU_VOTE_CLK 35 +#define GCC_PCIE_0_AUX_CLK 36 +#define GCC_PCIE_0_AUX_CLK_SRC 37 +#define GCC_PCIE_0_CFG_AHB_CLK 38 +#define GCC_PCIE_0_MSTR_AXI_CLK 39 +#define GCC_PCIE_0_PHY_AUX_CLK 40 +#define GCC_PCIE_0_PHY_AUX_CLK_SRC 41 +#define GCC_PCIE_0_PHY_RCHNG_CLK 42 +#define GCC_PCIE_0_PHY_RCHNG_CLK_SRC 43 +#define GCC_PCIE_0_PIPE_CLK 44 +#define GCC_PCIE_0_PIPE_CLK_SRC 45 +#define GCC_PCIE_0_PIPE_DIV2_CLK 46 +#define GCC_PCIE_0_PIPE_DIV_CLK_SRC 47 +#define GCC_PCIE_0_SLV_AXI_CLK 48 +#define GCC_PCIE_0_SLV_Q2A_AXI_CLK 49 +#define GCC_PCIE_1_AUX_CLK 50 +#define GCC_PCIE_1_AUX_CLK_SRC 51 +#define GCC_PCIE_1_CFG_AHB_CLK 52 +#define GCC_PCIE_1_MSTR_AXI_CLK 53 +#define GCC_PCIE_1_PHY_AUX_CLK 54 +#define GCC_PCIE_1_PHY_AUX_CLK_SRC 55 +#define GCC_PCIE_1_PHY_RCHNG_CLK 56 +#define GCC_PCIE_1_PHY_RCHNG_CLK_SRC 57 +#define GCC_PCIE_1_PIPE_CLK 58 +#define GCC_PCIE_1_PIPE_CLK_SRC 59 +#define GCC_PCIE_1_PIPE_DIV2_CLK 60 +#define GCC_PCIE_1_PIPE_DIV_CLK_SRC 61 +#define GCC_PCIE_1_RSC_CORE_CLK 62 +#define GCC_PCIE_1_SLV_AXI_CLK 63 +#define GCC_PCIE_1_SLV_Q2A_AXI_CLK 64 +#define GCC_PCIE_RSC_CORE_CLK 65 +#define GCC_PCIE_RSCC_CFG_AHB_CLK 66 +#define GCC_PCIE_RSCC_XO_CLK 67 +#define GCC_PDM2_CLK 68 +#define GCC_PDM2_CLK_SRC 69 +#define GCC_PDM_AHB_CLK 70 +#define GCC_PDM_XO4_CLK 71 +#define GCC_QUPV3_I2C_CORE_CLK 72 +#define GCC_QUPV3_I2C_S0_CLK 73 +#define GCC_QUPV3_I2C_S0_CLK_SRC 74 +#define GCC_QUPV3_I2C_S1_CLK 75 +#define GCC_QUPV3_I2C_S1_CLK_SRC 76 +#define GCC_QUPV3_I2C_S2_CLK 77 +#define GCC_QUPV3_I2C_S2_CLK_SRC 78 +#define GCC_QUPV3_I2C_S3_CLK 79 +#define GCC_QUPV3_I2C_S3_CLK_SRC 80 +#define GCC_QUPV3_I2C_S4_CLK 81 +#define GCC_QUPV3_I2C_S4_CLK_SRC 82 +#define GCC_QUPV3_I2C_S_AHB_CLK 83 +#define GCC_QUPV3_WRAP1_CORE_2X_CLK 84 +#define GCC_QUPV3_WRAP1_CORE_CLK 85 +#define GCC_QUPV3_WRAP1_QSPI_REF_CLK 86 +#define GCC_QUPV3_WRAP1_QSPI_REF_CLK_SRC 87 +#define GCC_QUPV3_WRAP1_S0_CLK 88 +#define GCC_QUPV3_WRAP1_S0_CLK_SRC 89 +#define GCC_QUPV3_WRAP1_S1_CLK 90 +#define GCC_QUPV3_WRAP1_S1_CLK_SRC 91 +#define GCC_QUPV3_WRAP1_S2_CLK 92 +#define GCC_QUPV3_WRAP1_S2_CLK_SRC 93 +#define GCC_QUPV3_WRAP1_S3_CLK 94 +#define GCC_QUPV3_WRAP1_S3_CLK_SRC 95 +#define GCC_QUPV3_WRAP1_S4_CLK 96 +#define GCC_QUPV3_WRAP1_S4_CLK_SRC 97 +#define GCC_QUPV3_WRAP1_S5_CLK 98 +#define GCC_QUPV3_WRAP1_S5_CLK_SRC 99 +#define GCC_QUPV3_WRAP1_S6_CLK 100 +#define GCC_QUPV3_WRAP1_S6_CLK_SRC 101 +#define GCC_QUPV3_WRAP1_S7_CLK 102 +#define GCC_QUPV3_WRAP1_S7_CLK_SRC 103 +#define GCC_QUPV3_WRAP2_CORE_2X_CLK 104 +#define GCC_QUPV3_WRAP2_CORE_CLK 105 +#define GCC_QUPV3_WRAP2_S0_CLK 106 +#define GCC_QUPV3_WRAP2_S0_CLK_SRC 107 +#define GCC_QUPV3_WRAP2_S1_CLK 108 +#define GCC_QUPV3_WRAP2_S1_CLK_SRC 109 +#define GCC_QUPV3_WRAP2_S2_CLK 110 +#define GCC_QUPV3_WRAP2_S2_CLK_SRC 111 +#define GCC_QUPV3_WRAP2_S3_CLK 112 +#define GCC_QUPV3_WRAP2_S3_CLK_SRC 113 +#define GCC_QUPV3_WRAP2_S4_CLK 114 +#define GCC_QUPV3_WRAP2_S4_CLK_SRC 115 +#define GCC_QUPV3_WRAP3_CORE_2X_CLK 116 +#define GCC_QUPV3_WRAP3_CORE_CLK 117 +#define GCC_QUPV3_WRAP3_QSPI_REF_CLK 118 +#define GCC_QUPV3_WRAP3_QSPI_REF_CLK_SRC 119 +#define GCC_QUPV3_WRAP3_S0_CLK 120 +#define GCC_QUPV3_WRAP3_S0_CLK_SRC 121 +#define GCC_QUPV3_WRAP3_S1_CLK 122 +#define GCC_QUPV3_WRAP3_S1_CLK_SRC 123 +#define GCC_QUPV3_WRAP3_S2_CLK 124 +#define GCC_QUPV3_WRAP3_S2_CLK_SRC 125 +#define GCC_QUPV3_WRAP3_S3_CLK 126 +#define GCC_QUPV3_WRAP3_S3_CLK_SRC 127 +#define GCC_QUPV3_WRAP3_S4_CLK 128 +#define GCC_QUPV3_WRAP3_S4_CLK_SRC 129 +#define GCC_QUPV3_WRAP3_S5_CLK 130 +#define GCC_QUPV3_WRAP3_S5_CLK_SRC 131 +#define GCC_QUPV3_WRAP4_CORE_2X_CLK 132 +#define GCC_QUPV3_WRAP4_CORE_CLK 133 +#define GCC_QUPV3_WRAP4_S0_CLK 134 +#define GCC_QUPV3_WRAP4_S0_CLK_SRC 135 +#define GCC_QUPV3_WRAP4_S1_CLK 136 +#define GCC_QUPV3_WRAP4_S1_CLK_SRC 137 +#define GCC_QUPV3_WRAP4_S2_CLK 138 +#define GCC_QUPV3_WRAP4_S2_CLK_SRC 139 +#define GCC_QUPV3_WRAP4_S3_CLK 140 +#define GCC_QUPV3_WRAP4_S3_CLK_SRC 141 +#define GCC_QUPV3_WRAP4_S4_CLK 142 +#define GCC_QUPV3_WRAP4_S4_CLK_SRC 143 +#define GCC_QUPV3_WRAP_1_M_AXI_CLK 144 +#define GCC_QUPV3_WRAP_1_S_AHB_CLK 145 +#define GCC_QUPV3_WRAP_2_M_AHB_CLK 146 +#define GCC_QUPV3_WRAP_2_S_AHB_CLK 147 +#define GCC_QUPV3_WRAP_3_M_AHB_CLK 148 +#define GCC_QUPV3_WRAP_3_S_AHB_CLK 149 +#define GCC_QUPV3_WRAP_4_M_AHB_CLK 150 +#define GCC_QUPV3_WRAP_4_S_AHB_CLK 151 +#define GCC_SDCC2_AHB_CLK 152 +#define GCC_SDCC2_APPS_CLK 153 +#define GCC_SDCC2_APPS_CLK_SRC 154 +#define GCC_SDCC4_AHB_CLK 155 +#define GCC_SDCC4_APPS_CLK 156 +#define GCC_SDCC4_APPS_CLK_SRC 157 +#define GCC_UFS_PHY_AHB_CLK 158 +#define GCC_UFS_PHY_AXI_CLK 159 +#define GCC_UFS_PHY_AXI_CLK_SRC 160 +#define GCC_UFS_PHY_ICE_CORE_CLK 161 +#define GCC_UFS_PHY_ICE_CORE_CLK_SRC 162 +#define GCC_UFS_PHY_PHY_AUX_CLK 163 +#define GCC_UFS_PHY_PHY_AUX_CLK_SRC 164 +#define GCC_UFS_PHY_RX_SYMBOL_0_CLK 165 +#define GCC_UFS_PHY_RX_SYMBOL_0_CLK_SRC 166 +#define GCC_UFS_PHY_RX_SYMBOL_1_CLK 167 +#define GCC_UFS_PHY_RX_SYMBOL_1_CLK_SRC 168 +#define GCC_UFS_PHY_TX_SYMBOL_0_CLK 169 +#define GCC_UFS_PHY_TX_SYMBOL_0_CLK_SRC 170 +#define GCC_UFS_PHY_UNIPRO_5_CORE_CLK 171 +#define GCC_UFS_PHY_UNIPRO_5_CORE_CLK_SRC 172 +#define GCC_USB30_PRIM_MASTER_CLK 173 +#define GCC_USB30_PRIM_MASTER_CLK_SRC 174 +#define GCC_USB30_PRIM_MOCK_UTMI_CLK 175 +#define GCC_USB30_PRIM_MOCK_UTMI_CLK_SRC 176 +#define GCC_USB30_PRIM_MOCK_UTMI_POSTDIV_CLK_SRC 177 +#define GCC_USB30_PRIM_SLEEP_CLK 178 +#define GCC_USB3_PRIM_PHY_AUX_CLK 179 +#define GCC_USB3_PRIM_PHY_AUX_CLK_SRC 180 +#define GCC_USB3_PRIM_PHY_COM_AUX_CLK 181 +#define GCC_USB3_PRIM_PHY_PIPE_CLK 182 +#define GCC_USB3_PRIM_PHY_PIPE_CLK_SRC 183 +#define GCC_VIDEO_AHB_CLK 184 +#define GCC_VIDEO_AXI0_CLK 185 +#define GCC_VIDEO_AXI0C_CLK 186 +#define GCC_VIDEO_XO_CLK 187 + +/* GCC power domains */ +#define GCC_PCIE_0_GDSC 0 +#define GCC_PCIE_0_PHY_GDSC 1 +#define GCC_PCIE_1_GDSC 2 +#define GCC_PCIE_1_PHY_GDSC 3 +#define GCC_UFS_MEM_PHY_GDSC 4 +#define GCC_UFS_PHY_GDSC 5 +#define GCC_USB30_PRIM_GDSC 6 +#define GCC_USB3_PHY_GDSC 7 + +/* GCC resets */ +#define GCC_CAMERA_BCR 0 +#define GCC_EVA_AXI0_CLK_ARES 1 +#define GCC_EVA_AXI0C_CLK_ARES 2 +#define GCC_EVA_BCR 3 +#define GCC_GPU_BCR 4 +#define GCC_PCIE_0_BCR 5 +#define GCC_PCIE_0_LINK_DOWN_BCR 6 +#define GCC_PCIE_0_NOCSR_COM_PHY_BCR 7 +#define GCC_PCIE_0_PHY_BCR 8 +#define GCC_PCIE_0_PHY_NOCSR_COM_PHY_BCR 9 +#define GCC_PCIE_1_BCR 10 +#define GCC_PCIE_1_LINK_DOWN_BCR 11 +#define GCC_PCIE_1_NOCSR_COM_PHY_BCR 12 +#define GCC_PCIE_1_PHY_BCR 13 +#define GCC_PCIE_1_PHY_NOCSR_COM_PHY_BCR 14 +#define GCC_PCIE_PHY_BCR 15 +#define GCC_PCIE_PHY_CFG_AHB_BCR 16 +#define GCC_PCIE_PHY_COM_BCR 17 +#define GCC_PCIE_RSCC_BCR 18 +#define GCC_PDM_BCR 19 +#define GCC_QUPV3_WRAPPER_1_BCR 20 +#define GCC_QUPV3_WRAPPER_2_BCR 21 +#define GCC_QUPV3_WRAPPER_3_BCR 22 +#define GCC_QUPV3_WRAPPER_4_BCR 23 +#define GCC_QUPV3_WRAPPER_I2C_BCR 24 +#define GCC_QUSB2PHY_PRIM_BCR 25 +#define GCC_QUSB2PHY_SEC_BCR 26 +#define GCC_SDCC2_BCR 27 +#define GCC_SDCC4_BCR 28 +#define GCC_TCSR_PCIE_BCR 29 +#define GCC_UFS_PHY_BCR 30 +#define GCC_USB30_PRIM_BCR 31 +#define GCC_USB3_DP_PHY_PRIM_BCR 32 +#define GCC_USB3_DP_PHY_SEC_BCR 33 +#define GCC_USB3_PHY_PRIM_BCR 34 +#define GCC_USB3_PHY_SEC_BCR 35 +#define GCC_USB3PHY_PHY_PRIM_BCR 36 +#define GCC_USB3PHY_PHY_SEC_BCR 37 +#define GCC_VIDEO_AXI0_CLK_ARES 38 +#define GCC_VIDEO_AXI0C_CLK_ARES 39 +#define GCC_VIDEO_BCR 40 +#define GCC_VIDEO_XO_CLK_ARES 41 + +#endif -- cgit v1.2.3 From 190cc5370a8b6eb2894f1e958058b0c6589c582e Mon Sep 17 00:00:00 2001 From: Takahiro Itazuri Date: Mon, 20 Apr 2026 15:46:04 +0000 Subject: KVM: Rename invalidate_begin to invalidate_start for consistency Rename kvm_mmu_invalidate_begin() to kvm_mmu_invalidate_start() to align with mmu_notifier_ops.invalidate_range_start(), which is the callback that ultimately drives KVM's MMU invalidation. While the naming within KVM itself is a close split between "_begin" and "_start": $ git grep -E "invalidate(_range)?_begin" **/kvm* | wc -l 12 $ git grep -E "invalidate(_range)?_start" **/kvm* | wc -l 21 All two of the begin() uses are in KVM: $ git grep -E "invalidate(_range)?_begin" * | wc -l 14 And those two holdouts are bugs in invalidate_range_start()'s comment, i.e. will also be fixed sooner or later[*]. On the other hand, use of _start() is pervasive throughout the kernel: $ git grep -E "invalidate(_range)?_start" * | wc -l 117 Even if that weren't the case, conforming to the mmu_notifier_ops naming is the right call since invalidate_range_start() is the external API that KVM hooks into. No functional change intended. Link: https://lore.kernel.org/all/20260513163546.1176742-1-seanjc@google.com [*] Signed-off-by: Takahiro Itazuri Link: https://patch.msgid.link/20260420154720.29012-4-itazur@amazon.com [sean: massage changelog to provide more (accurate) numbers] Signed-off-by: Sean Christopherson --- include/linux/kvm_host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 4c14aee1fb06..7b231a1e63ba 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -1562,7 +1562,7 @@ void kvm_mmu_free_memory_cache(struct kvm_mmu_memory_cache *mc); void *kvm_mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc); #endif -void kvm_mmu_invalidate_begin(struct kvm *kvm); +void kvm_mmu_invalidate_start(struct kvm *kvm); void kvm_mmu_invalidate_range_add(struct kvm *kvm, gfn_t start, gfn_t end); void kvm_mmu_invalidate_end(struct kvm *kvm); bool kvm_mmu_unmap_gfn_range(struct kvm *kvm, struct kvm_gfn_range *range); -- cgit v1.2.3 From 4b28f0846ef6521b47ee95ea7d77c9d40a7baf29 Mon Sep 17 00:00:00 2001 From: Tycho Andersen Date: Thu, 16 Apr 2026 16:23:24 -0700 Subject: crypto/ccp: export firmware supported vm types In some configurations, the firmware does not support all VM types. The SEV firmware has an entry in the TCB_VERSION structure referred to as the Security Version Number in the SEV-SNP firmware specification and referred to as the "SPL" in SEV firmware release notes. The SEV firmware release notes say: On every SEV firmware release where a security mitigation has been added, the SNP SPL gets increased by 1. This is to let users know that it is important to update to this version. The SEV firmware release that fixed CVE-2025-48514 by disabling SEV-ES support on vulnerable platforms has this SVN increased to reflect the fix. The SVN is platform-specific, as is the structure of TCB_VERSION. Check CURRENT_TCB instead of REPORTED_TCB, since the firmware behaves with the CURRENT_TCB SVN level and will reject SEV-ES VMs accordingly. Parse the SVN, and mask off the SEV_ES supported VM type from the list of supported types if it is above the per-platform threshold for the relevant platforms. Signed-off-by: Tycho Andersen (AMD) Acked-by: Herbert Xu Reviewed-by: Tom Lendacky Tested-by: Tycho Andersen (AMD) Link: https://patch.msgid.link/20260416232329.3408497-3-seanjc@google.com Signed-off-by: Sean Christopherson --- include/linux/psp-sev.h | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) (limited to 'include') diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h index d5099a2baca5..ce16bbc0b308 100644 --- a/include/linux/psp-sev.h +++ b/include/linux/psp-sev.h @@ -902,6 +902,42 @@ struct snp_feature_info { /* Feature bits in EBX */ #define SNP_SEV_TIO_SUPPORTED BIT(1) +/** + * struct sev_snp_tcb_version_genoa_milan + * + * @boot_loader: SVN of PSP bootloader + * @tee: SVN of PSP operating system + * @reserved: reserved + * @snp: SVN of SNP firmware + * @microcode: Lowest current patch level of all cores + */ +struct sev_snp_tcb_version_genoa_milan { + u8 boot_loader; + u8 tee; + u8 reserved[4]; + u8 snp; + u8 microcode; +}; + +/** + * struct sev_snp_tcb_version_turin + * + * @fmc: SVN of FMC firmware + * @boot_loader: SVN of PSP bootloader + * @tee: SVN of PSP operating system + * @snp: SVN of SNP firmware + * @reserved: reserved + * @microcode: Lowest current patch level of all cores + */ +struct sev_snp_tcb_version_turin { + u8 fmc; + u8 boot_loader; + u8 tee; + u8 snp; + u8 reserved[3]; + u8 microcode; +}; + #ifdef CONFIG_CRYPTO_DEV_SP_PSP /** @@ -1048,6 +1084,7 @@ void snp_free_firmware_page(void *addr); void sev_platform_shutdown(void); bool sev_is_snp_ciphertext_hiding_supported(void); u64 sev_get_snp_policy_bits(void); +int sev_firmware_supported_vm_types(void); #else /* !CONFIG_CRYPTO_DEV_SP_PSP */ -- cgit v1.2.3 From ccd6c77223bbdea352190956f5e00e3b07119fc3 Mon Sep 17 00:00:00 2001 From: Peter Fang Date: Tue, 7 Apr 2026 17:11:28 -0700 Subject: KVM: Fix kvm_vcpu_map[_readonly]() function prototypes kvm_vcpu_map() and kvm_vcpu_map_readonly() should take a gfn instead of a gpa. This appears to be a result of the original kvm_vcpu_map() being declared with the wrong function prototype in kvm_host.h, even though it was correct in the actual implementation in kvm_main.c. No actual harm has been done yet as all of the call sites are correctly passing in a gfn. Plus, both gfn_t and gpa_t are typedef'd to u64 so this change shouldn't have any functional impact. Compile-tested on x86 and ppc, which are the current users of these interfaces. Fixes: e45adf665a53 ("KVM: Introduce a new guest mapping API") Cc: KarimAllah Ahmed Cc: Konrad Rzeszutek Wilk Signed-off-by: Peter Fang Reviewed-by: Yosry Ahmed Link: https://patch.msgid.link/20260408001137.3290444-2-peter.fang@intel.com Signed-off-by: Sean Christopherson --- include/linux/kvm_host.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 7b231a1e63ba..61a3430957f2 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -1390,20 +1390,20 @@ void mark_page_dirty_in_slot(struct kvm *kvm, const struct kvm_memory_slot *mems void mark_page_dirty(struct kvm *kvm, gfn_t gfn); void kvm_vcpu_mark_page_dirty(struct kvm_vcpu *vcpu, gfn_t gfn); -int __kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, struct kvm_host_map *map, +int __kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map, bool writable); void kvm_vcpu_unmap(struct kvm_vcpu *vcpu, struct kvm_host_map *map); -static inline int kvm_vcpu_map(struct kvm_vcpu *vcpu, gpa_t gpa, +static inline int kvm_vcpu_map(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map) { - return __kvm_vcpu_map(vcpu, gpa, map, true); + return __kvm_vcpu_map(vcpu, gfn, map, true); } -static inline int kvm_vcpu_map_readonly(struct kvm_vcpu *vcpu, gpa_t gpa, +static inline int kvm_vcpu_map_readonly(struct kvm_vcpu *vcpu, gfn_t gfn, struct kvm_host_map *map) { - return __kvm_vcpu_map(vcpu, gpa, map, false); + return __kvm_vcpu_map(vcpu, gfn, map, false); } static inline void kvm_vcpu_map_mark_dirty(struct kvm_vcpu *vcpu, -- cgit v1.2.3 From cfb5dc0f60fbe95a10cb307cc6dae5c47f160abb Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Tue, 5 May 2026 13:47:01 +0200 Subject: thermal: hwmon: Use extra_groups for adding temperature attributes Instead of passing NULL as the last argument to __hwmon_device_register() in hwmon_device_register_for_thermal() and then adding each temperature sysfs attribute to the hwmon device via device_create_file(), redefine hwmon_device_register_for_thermal() to take an extra_groups argument that will be passed to __hwmon_device_register(), define an attribute group with a proper .is_visible() callback for the temperature attributes and a related attribute groups pointer, and pass the latter to hwmon_device_register_for_thermal(). This causes the code to be way more straightforward and closer to what the other users of the hwmon subsystem do. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/8704209.T7Z3S40VBb@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki --- include/linux/hwmon.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h index 301a83afbd66..a578a10baff2 100644 --- a/include/linux/hwmon.h +++ b/include/linux/hwmon.h @@ -477,7 +477,8 @@ hwmon_device_register_with_info(struct device *dev, const struct attribute_group **extra_groups); struct device * hwmon_device_register_for_thermal(struct device *dev, const char *name, - void *drvdata); + void *drvdata, + const struct attribute_group **extra_groups); struct device * devm_hwmon_device_register_with_info(struct device *dev, const char *name, void *drvdata, -- cgit v1.2.3 From 4c26e162947f91aa78ba57dd4fddd38fc80e7d60 Mon Sep 17 00:00:00 2001 From: Dmitry Osipenko Date: Fri, 1 May 2026 03:00:43 +0300 Subject: drm/virtio: Extend blob UAPI with deferred-mapping hinting If userspace never maps GEM object, then BO wastes hostmem space because VirtIO-GPU driver maps VRAM BO at the BO's creating time. Make mappings on-demand by adding new RESOURCE_CREATE_BLOB IOCTL/UAPI hinting flag telling that host mapping should be deferred until first mapping is made when the flag is set by userspace. Signed-off-by: Dmitry Osipenko Reviewed-by: Rob Clark Link: https://patch.msgid.link/20260501000043.2483678-1-dmitry.osipenko@collabora.com --- include/uapi/drm/virtgpu_drm.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/uapi/drm/virtgpu_drm.h b/include/uapi/drm/virtgpu_drm.h index 9debb320c34b..ba09a4ee3e77 100644 --- a/include/uapi/drm/virtgpu_drm.h +++ b/include/uapi/drm/virtgpu_drm.h @@ -200,6 +200,10 @@ struct drm_virtgpu_resource_create_blob { __u32 cmd_size; __u64 cmd; __u64 blob_id; + +#define DRM_VIRTGPU_BLOB_FLAG_HINT_DEFER_MAPPING 0x0001 + __u32 blob_hints; + __u32 pad2; }; #define VIRTGPU_CONTEXT_PARAM_CAPSET_ID 0x0001 -- cgit v1.2.3 From c5c3ef8d49e15d2fc1cec4ad7c91d81b99977440 Mon Sep 17 00:00:00 2001 From: Michael Kelley Date: Tue, 17 Feb 2026 10:23:34 -0800 Subject: Drivers: hv: vmbus: Provide option to skip VMBus unload on panic Currently, VMBus code initiates a VMBus unload in the panic path so that if a kdump kernel is loaded, it can start fresh in setting up its own VMBus connection. However, a driver for the VMBus virtual frame buffer may need to flush dirty portions of the frame buffer back to the Hyper-V host so that panic information is visible in the graphics console. To support such flushing, provide exported functions for the frame buffer driver to specify that the VMBus unload should not be done by the VMBus driver, and to initiate the VMBus unload itself. Together these allow a frame buffer driver to delay the VMBus unload until after it has completed the flush. Ideally, the VMBus driver could use its own panic-path callback to do the unload after all frame buffer drivers have finished. But DRM frame buffer drivers use the kmsg dump callback, and there are no callbacks after that in the panic path. Hence this somewhat messy approach to properly sequencing the frame buffer flush and the VMBus unload. Fixes: 3671f3777758 ("drm/hyperv: Add support for drm_panic") Signed-off-by: Michael Kelley Reviewed-by: Long Li Signed-off-by: Wei Liu --- include/linux/hyperv.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h index 964f1be8150c..41a3d82f0722 100644 --- a/include/linux/hyperv.h +++ b/include/linux/hyperv.h @@ -1336,6 +1336,9 @@ int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj, bool fb_overlap_ok); void vmbus_free_mmio(resource_size_t start, resource_size_t size); +void vmbus_initiate_unload(bool crash); +void vmbus_set_skip_unload(bool skip); + /* * GUID definitions of various offer types - services offered to the guest. */ -- cgit v1.2.3 From 620072fd783290ad92c2d445a47b0a61b161f352 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Sun, 26 Apr 2026 12:31:17 -0700 Subject: mm/damon: fix damos_stat tracepoint format for sz_applied The print format is wrongly marking sz_applied as sz_tried. Fix it. Link: https://lore.kernel.org/20260426193119.88095-1-sj@kernel.org Fixes: 804c26b961da ("mm/damon/core: add trace point for damos stat per apply interval") Signed-off-by: SeongJae Park Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: # 7.0.x Signed-off-by: Andrew Morton --- include/trace/events/damon.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/trace/events/damon.h b/include/trace/events/damon.h index 24fc402ab3c8..7e25f4469b81 100644 --- a/include/trace/events/damon.h +++ b/include/trace/events/damon.h @@ -41,7 +41,7 @@ TRACE_EVENT(damos_stat_after_apply_interval, ), TP_printk("ctx_idx=%u scheme_idx=%u nr_tried=%lu sz_tried=%lu " - "nr_applied=%lu sz_tried=%lu sz_ops_filter_passed=%lu " + "nr_applied=%lu sz_applied=%lu sz_ops_filter_passed=%lu " "qt_exceeds=%lu nr_snapshots=%lu", __entry->context_idx, __entry->scheme_idx, __entry->nr_tried, __entry->sz_tried, -- cgit v1.2.3 From 6a288a4ddb4a994490505ab5f41c445f8e6b6467 Mon Sep 17 00:00:00 2001 From: "David Hildenbrand (Arm)" Date: Tue, 21 Apr 2026 17:39:07 +0200 Subject: mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free __GFP_ZEROTAGS semantics are currently a bit weird, but effectively this flag is only ever set alongside __GFP_ZERO and __GFP_SKIP_KASAN. If we run with init_on_free, we will zero out pages during __free_pages_prepare(), to skip zeroing on the allocation path. However, when allocating with __GFP_ZEROTAG set, post_alloc_hook() will consequently not only skip clearing page content, but also skip clearing tag memory. Not clearing tags through __GFP_ZEROTAGS is irrelevant for most pages that will get mapped to user space through set_pte_at() later: set_pte_at() and friends will detect that the tags have not been initialized yet (PG_mte_tagged not set), and initialize them. However, for the huge zero folio, which will be mapped through a PMD marked as special, this initialization will not be performed, ending up exposing whatever tags were still set for the pages. The docs (Documentation/arch/arm64/memory-tagging-extension.rst) state that allocation tags are set to 0 when a page is first mapped to user space. That no longer holds with the huge zero folio when init_on_free is enabled. Fix it by decoupling __GFP_ZEROTAGS from __GFP_ZERO, passing to tag_clear_highpages() whether we want to also clear page content. Invert the meaning of the tag_clear_highpages() return value to have clearer semantics. Reproduced with the huge zero folio by modifying the check_buffer_fill arm64/mte selftest to use a 2 MiB area, after making sure that pages have a non-0 tag set when freeing (note that, during boot, we will not actually initialize tags, but only set KASAN_TAG_KERNEL in the page flags). $ ./check_buffer_fill 1..20 ... not ok 17 Check initial tags with private mapping, sync error mode and mmap memory not ok 18 Check initial tags with private mapping, sync error mode and mmap/mprotect memory ... This code needs more cleanups; we'll tackle that next, like decoupling __GFP_ZEROTAGS from __GFP_SKIP_KASAN. [akpm@linux-foundation.org: s/__GPF_ZERO/__GFP_ZERO/, per David] Link: https://lore.kernel.org/20260421-zerotags-v2-1-05cb1035482e@kernel.org Fixes: adfb6609c680 ("mm/huge_memory: initialise the tags of the huge zero folio") Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Catalin Marinas Tested-by: Lance Yang Cc: Brendan Jackman Cc: Dev Jain Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Mark Brown Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Will Deacon Cc: Zi Yan Cc: Signed-off-by: Andrew Morton --- include/linux/gfp_types.h | 10 +++++----- include/linux/highmem.h | 7 ++++--- 2 files changed, 9 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/gfp_types.h b/include/linux/gfp_types.h index 6c75df30a281..cd4972a7c97c 100644 --- a/include/linux/gfp_types.h +++ b/include/linux/gfp_types.h @@ -273,11 +273,11 @@ enum { * * %__GFP_ZERO returns a zeroed page on success. * - * %__GFP_ZEROTAGS zeroes memory tags at allocation time if the memory itself - * is being zeroed (either via __GFP_ZERO or via init_on_alloc, provided that - * __GFP_SKIP_ZERO is not set). This flag is intended for optimization: setting - * memory tags at the same time as zeroing memory has minimal additional - * performance impact. + * %__GFP_ZEROTAGS zeroes memory tags at allocation time. Setting memory tags at + * the same time as zeroing memory (e.g., with __GFP_ZERO) has minimal + * additional performance impact. However, __GFP_ZEROTAGS also zeroes the tags + * even if memory is not getting zeroed at allocation time (e.g., + * with init_on_free). * * %__GFP_SKIP_KASAN makes KASAN skip unpoisoning on page allocation. * Used for userspace and vmalloc pages; the latter are unpoisoned by diff --git a/include/linux/highmem.h b/include/linux/highmem.h index af03db851a1d..d7aac9de1c8a 100644 --- a/include/linux/highmem.h +++ b/include/linux/highmem.h @@ -347,10 +347,11 @@ static inline void clear_highpage_kasan_tagged(struct page *page) #ifndef __HAVE_ARCH_TAG_CLEAR_HIGHPAGES -/* Return false to let people know we did not initialize the pages */ -static inline bool tag_clear_highpages(struct page *page, int numpages) +/* Returns true if the caller has to initialize the pages */ +static inline bool tag_clear_highpages(struct page *page, int numpages, + bool clear_pages) { - return false; + return clear_pages; } #endif -- cgit v1.2.3 From 5d03a4f357100c6ba369ec8c2432d755d006d0dc Mon Sep 17 00:00:00 2001 From: Zhang Yi Date: Wed, 13 May 2026 11:15:49 +0800 Subject: ASoC: sdw_utils: add soc_sdw_es9356 Add a utility program for handling ES9356 in the universal machine driver Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20260513031554.5422-2-zhangyi@everest-semi.com Signed-off-by: Mark Brown --- include/sound/soc_sdw_utils.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'include') diff --git a/include/sound/soc_sdw_utils.h b/include/sound/soc_sdw_utils.h index d713ab2f6620..79c21966220b 100644 --- a/include/sound/soc_sdw_utils.h +++ b/include/sound/soc_sdw_utils.h @@ -223,6 +223,17 @@ int asoc_sdw_cs42l43_spk_init(struct snd_soc_card *card, struct asoc_sdw_codec_info *info, bool playback); +/* es9356 codec support */ +int asoc_sdw_es9356_init(struct snd_soc_card *card, + struct snd_soc_dai_link *dai_links, + struct asoc_sdw_codec_info *info, + bool playback); +int asoc_sdw_es9356_amp_init(struct snd_soc_card *card, + struct snd_soc_dai_link *dai_links, + struct asoc_sdw_codec_info *info, + bool playback); +int asoc_sdw_es9356_exit(struct snd_soc_card *card, struct snd_soc_dai_link *dai_link); + /* CS AMP support */ int asoc_sdw_bridge_cs35l56_count_sidecar(struct snd_soc_card *card, int *num_dais, int *num_devs); @@ -278,5 +289,8 @@ int asoc_sdw_ti_amp_initial_settings(struct snd_soc_card *card, const char *name_prefix); int asoc_sdw_ti_dmic_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai); int asoc_sdw_ti_sdca_jack_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai); +int asoc_sdw_es9356_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai); +int asoc_sdw_es9356_spk_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai); +int asoc_sdw_es9356_dmic_rtd_init(struct snd_soc_pcm_runtime *rtd, struct snd_soc_dai *dai); #endif -- cgit v1.2.3 From baf808fe4fcd35767ab732b4ab2ea80dabfd97a6 Mon Sep 17 00:00:00 2001 From: Simon Schippers Date: Sun, 10 May 2026 17:15:27 +0200 Subject: vhost-net: wake queue of tun/tap after ptr_ring consume Add tun_wake_queue() to tun.c and export it for use by vhost-net. The function validates that the file belongs to a tun/tap device and that the tfile exists, dereferences the tun_struct under RCU, and delegates to __tun_wake_queue(). vhost_net_buf_produce() now calls tun_wake_queue() after a successful batched consume of the ring to allow the netdev subqueue to be woken up. The point is to allow the queue to be stopped when it gets full, which is required for traffic shaping - implemented by the following "avoid ptr_ring tail-drop when a qdisc is present". Without the corresponding queue stopping, this patch alone causes no throughput regression for a tap+vhost-net setup sending to a qemu VM: 3.857 Mpps to 3.891 Mpps. Details: AMD Ryzen 5 5600X at 4.3 GHz, 3200 MHz RAM, isolated QEMU threads, XDP drop program active in VM, pktgen sender; Avg over 50 runs @ 100,000,000 packets. SRSO and spectre v2 mitigations disabled. Co-developed-by: Tim Gebauer Signed-off-by: Tim Gebauer Signed-off-by: Simon Schippers Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260510151529.43895-3-simon.schippers@tu-dortmund.de Signed-off-by: Jakub Kicinski --- include/linux/if_tun.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h index 80166eb62f41..5f3e206c7a73 100644 --- a/include/linux/if_tun.h +++ b/include/linux/if_tun.h @@ -22,6 +22,7 @@ struct tun_msg_ctl { #if defined(CONFIG_TUN) || defined(CONFIG_TUN_MODULE) struct socket *tun_get_socket(struct file *); struct ptr_ring *tun_get_tx_ring(struct file *file); +void tun_wake_queue(struct file *file, int consumed); static inline bool tun_is_xdp_frame(void *ptr) { @@ -55,6 +56,8 @@ static inline struct ptr_ring *tun_get_tx_ring(struct file *f) return ERR_PTR(-EINVAL); } +static inline void tun_wake_queue(struct file *f, int consumed) {} + static inline bool tun_is_xdp_frame(void *ptr) { return false; -- cgit v1.2.3 From fba362c17d9d9211fc51f272156bb84fc23bdf98 Mon Sep 17 00:00:00 2001 From: Simon Schippers Date: Sun, 10 May 2026 17:15:28 +0200 Subject: ptr_ring: move free-space check into separate helper This patch moves the check for available free space for a new entry into a separate function. Existing callers that only check for a non-zero return value are unaffected; __ptr_ring_produce() now returns -EINVAL for a zero-size ring and -ENOSPC when full, whereas before both cases returned -ENOSPC. The new helper allows callers to determine in advance whether subsequent __ptr_ring_produce() calls will succeed. This information can, for example, be used to temporarily stop producing until __ptr_ring_check_produce() indicates that space is available again. Co-developed-by: Tim Gebauer Signed-off-by: Tim Gebauer Signed-off-by: Simon Schippers Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260510151529.43895-4-simon.schippers@tu-dortmund.de Signed-off-by: Jakub Kicinski --- include/linux/ptr_ring.h | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h index d2c3629bbe45..c95e891903f0 100644 --- a/include/linux/ptr_ring.h +++ b/include/linux/ptr_ring.h @@ -96,6 +96,20 @@ static inline bool ptr_ring_full_bh(struct ptr_ring *r) return ret; } +/* Note: callers invoking this in a loop must use a compiler barrier, + * for example cpu_relax(). Callers must hold producer_lock. + */ +static inline int __ptr_ring_check_produce(struct ptr_ring *r) +{ + if (unlikely(!r->size)) + return -EINVAL; + + if (data_race(r->queue[r->producer])) + return -ENOSPC; + + return 0; +} + /* Note: callers invoking this in a loop must use a compiler barrier, * for example cpu_relax(). Callers must hold producer_lock. * Callers are responsible for making sure pointer that is being queued @@ -103,8 +117,10 @@ static inline bool ptr_ring_full_bh(struct ptr_ring *r) */ static inline int __ptr_ring_produce(struct ptr_ring *r, void *ptr) { - if (unlikely(!r->size) || data_race(r->queue[r->producer])) - return -ENOSPC; + int p = __ptr_ring_check_produce(r); + + if (p) + return p; /* Make sure the pointer we are storing points to a valid data. */ /* Pairs with the dependency ordering in __ptr_ring_consume. */ -- cgit v1.2.3 From 06baf87e219fa7f396c7dc149d6f5ffde922dfa2 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:34 -0700 Subject: netpoll: expose UDP packet builder helpers for netconsole Promote each from file-static to EXPORT_SYMBOL_GPL and forward- declare them in include/linux/netpoll.h so netconsole can call them once netpoll_send_udp() moves out. These exports are kept until the end of the series, when al of them move into netconsole. No functional change. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-1-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index f22eec466040..e68c80b32941 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -74,6 +74,12 @@ void __netpoll_free(struct netpoll *np); void netpoll_cleanup(struct netpoll *np); void do_netpoll_cleanup(struct netpoll *np); netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb); +struct sk_buff *find_skb(struct netpoll *np, int len, int reserve); +void netpoll_udp_checksum(struct netpoll *np, struct sk_buff *skb, int len); +void push_ipv6(struct netpoll *np, struct sk_buff *skb, int len); +void push_ipv4(struct netpoll *np, struct sk_buff *skb, int len); +void push_udp(struct netpoll *np, struct sk_buff *skb, int len); +void push_eth(struct netpoll *np, struct sk_buff *skb); #ifdef CONFIG_NETPOLL static inline void *netpoll_poll_lock(struct napi_struct *napi) -- cgit v1.2.3 From d3345a61e4ae50119d20cfa6a54cb8df0cc47dfa Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:35 -0700 Subject: netconsole: move netpoll_send_udp() from netpoll Move netpoll_send_udp() from net/core/netpoll.c into drivers/net/netconsole.c as a static helper, drop EXPORT_SYMBOL(), and remove the prototype from include/linux/netpoll.h. netconsole was the only in-tree caller of this entry point. Every other netpoll consumer (bonding, team, vlan, bridge, macvlan, dsa) already builds its own sk_buff and hands it to netpoll_send_skb(), so the netpoll send-side interface is now skb-only. The helpers it depends on (find_skb(), push_ipv6(), push_ipv4(), push_udp(), push_eth(), netpoll_udp_checksum()) were exposed in the previous patches and stay in net/core/netpoll.c for now. Subsequent patches move each of them into netconsole one at a time and drop the corresponding EXPORT_SYMBOL_GPL. Pull , and into netconsole.c so the moved code can name the header structures. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-2-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index e68c80b32941..57be72bb82dc 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -67,7 +67,6 @@ static inline void netpoll_poll_disable(struct net_device *dev) { return; } static inline void netpoll_poll_enable(struct net_device *dev) { return; } #endif -int netpoll_send_udp(struct netpoll *np, const char *msg, int len); int __netpoll_setup(struct netpoll *np, struct net_device *ndev); int netpoll_setup(struct netpoll *np); void __netpoll_free(struct netpoll *np); -- cgit v1.2.3 From c411baa463e85a779a7e68a00ba6298770b58c4c Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:36 -0700 Subject: netconsole: move push_ipv6() from netpoll push_ipv6() builds the IPv6 header for netconsole's UDP packets. Its only caller, netpoll_send_udp(), now lives in netconsole, so the helper can move there as a file-static function. Drop its EXPORT_SYMBOL_GPL and remove the prototype from include/linux/netpoll.h. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-3-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index 57be72bb82dc..7f57bd0eac66 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -75,7 +75,6 @@ void do_netpoll_cleanup(struct netpoll *np); netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb); struct sk_buff *find_skb(struct netpoll *np, int len, int reserve); void netpoll_udp_checksum(struct netpoll *np, struct sk_buff *skb, int len); -void push_ipv6(struct netpoll *np, struct sk_buff *skb, int len); void push_ipv4(struct netpoll *np, struct sk_buff *skb, int len); void push_udp(struct netpoll *np, struct sk_buff *skb, int len); void push_eth(struct netpoll *np, struct sk_buff *skb); -- cgit v1.2.3 From 5664c3908b7083e5905bbaff2dd6566a81c367b1 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:37 -0700 Subject: netconsole: move push_ipv4() from netpoll push_ipv4() builds the IPv4 header for netconsole's UDP packets. Move it into drivers/net/netconsole.c as a file-static helper; drop its EXPORT_SYMBOL_GPL and remove the prototype from include/linux/netpoll.h. put_unaligned() is no longer used in net/core/netpoll.c, so drop the now-stale include from there. Pull it into netconsole.c so the moved code keeps building. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-4-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index 7f57bd0eac66..1fcde9c87b8c 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -75,7 +75,6 @@ void do_netpoll_cleanup(struct netpoll *np); netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb); struct sk_buff *find_skb(struct netpoll *np, int len, int reserve); void netpoll_udp_checksum(struct netpoll *np, struct sk_buff *skb, int len); -void push_ipv4(struct netpoll *np, struct sk_buff *skb, int len); void push_udp(struct netpoll *np, struct sk_buff *skb, int len); void push_eth(struct netpoll *np, struct sk_buff *skb); -- cgit v1.2.3 From 6a44c82a48c74bf98b3d5adf8c4e9ef7a7dfe300 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:38 -0700 Subject: netconsole: move push_eth() from netpoll push_eth() builds the Ethernet header for netconsole's UDP packets. Move it into drivers/net/netconsole.c as a file-static helper; drop its EXPORT_SYMBOL_GPL and remove the prototype from include/linux/netpoll.h. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-5-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index 1fcde9c87b8c..11eb95b3248e 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -76,7 +76,6 @@ netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb); struct sk_buff *find_skb(struct netpoll *np, int len, int reserve); void netpoll_udp_checksum(struct netpoll *np, struct sk_buff *skb, int len); void push_udp(struct netpoll *np, struct sk_buff *skb, int len); -void push_eth(struct netpoll *np, struct sk_buff *skb); #ifdef CONFIG_NETPOLL static inline void *netpoll_poll_lock(struct napi_struct *napi) -- cgit v1.2.3 From df82899714b125172702437ad8bd066c565a98e9 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:39 -0700 Subject: netconsole: move push_udp() from netpoll push_udp() builds the UDP header (and triggers the checksum) for netconsole's UDP packets. Move it into drivers/net/netconsole.c as a file-static helper; drop its EXPORT_SYMBOL_GPL and remove the prototype from include/linux/netpoll.h. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-6-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index 11eb95b3248e..03a49953a3d8 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -75,7 +75,6 @@ void do_netpoll_cleanup(struct netpoll *np); netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb); struct sk_buff *find_skb(struct netpoll *np, int len, int reserve); void netpoll_udp_checksum(struct netpoll *np, struct sk_buff *skb, int len); -void push_udp(struct netpoll *np, struct sk_buff *skb, int len); #ifdef CONFIG_NETPOLL static inline void *netpoll_poll_lock(struct napi_struct *napi) -- cgit v1.2.3 From 597bfa943131511e668235f112c70e806ca36e5d Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:40 -0700 Subject: netconsole: move netpoll_udp_checksum() from netpoll netpoll_udp_checksum() computes the UDP checksum for netconsole's packets. Move it into drivers/net/netconsole.c as a file-static helper; drop its EXPORT_SYMBOL_GPL and remove the prototype from include/linux/netpoll.h. This was the last csum_ipv6_magic() consumer in net/core/netpoll.c, so drop the now-stale include there. Pull it into netconsole.c so the moved code keeps building. It was also the last udp_hdr() consumer in net/core/netpoll.c. The file no longer needs anything from (the UDP socket-layer helpers); MAX_SKB_SIZE only needs struct udphdr, which is provided by the lighter . Swap the include accordingly. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-7-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index 03a49953a3d8..1877d42ccbcc 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -74,7 +74,6 @@ void netpoll_cleanup(struct netpoll *np); void do_netpoll_cleanup(struct netpoll *np); netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb); struct sk_buff *find_skb(struct netpoll *np, int len, int reserve); -void netpoll_udp_checksum(struct netpoll *np, struct sk_buff *skb, int len); #ifdef CONFIG_NETPOLL static inline void *netpoll_poll_lock(struct napi_struct *napi) -- cgit v1.2.3 From 7bb1daff3612276357b28d0dee2a32301be97dfd Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:41 -0700 Subject: netpoll: rename and export netpoll_zap_completion_queue() zap_completion_queue() drains the per-CPU softnet completion queue. Rename it with the netpoll_ prefix shared by the rest of the subsystem's public API, and promote it from file-static to EXPORT_SYMBOL_NS_GPL in the NETDEV_INTERNAL namespace so the upcoming netconsole-side find_skb() can call it once the function moves out. A forward declaration is added to include/linux/netpoll.h, and the old file-static forward declaration is dropped. No functional change. Suggested-by: Jakub Kicinski Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-8-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index 1877d42ccbcc..f986f7486cb8 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -74,6 +74,7 @@ void netpoll_cleanup(struct netpoll *np); void do_netpoll_cleanup(struct netpoll *np); netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb); struct sk_buff *find_skb(struct netpoll *np, int len, int reserve); +void netpoll_zap_completion_queue(void); #ifdef CONFIG_NETPOLL static inline void *netpoll_poll_lock(struct napi_struct *napi) -- cgit v1.2.3 From f35422ed3664d2a40161c38f53ba69cb99387af7 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Tue, 12 May 2026 03:46:42 -0700 Subject: netconsole: move find_skb() from netpoll find_skb() is the netconsole-specific entry into the netpoll skb pool: every other netpoll consumer (bonding, team, vlan, bridge, macvlan, dsa) builds its own sk_buff and never touches the pool. With netpoll_send_udp() (its only caller) now living in netconsole, find_skb() can join it. Move find_skb() into drivers/net/netconsole.c as a file-static helper, drop EXPORT_SYMBOL_GPL(find_skb) and remove its prototype from include/linux/netpoll.h. find_skb() drains TX completions via netpoll_zap_completion_queue(), which is already exported in the NETDEV_INTERNAL namespace, so netconsole picks up MODULE_IMPORT_NS("NETDEV_INTERNAL") to consume it. The skb pool's lifecycle (np->skb_pool, np->refill_wq, refill_skbs(), refill_skbs_work_handler(), skb_pool_flush()) stays in netpoll: it is initialised in __netpoll_setup() and torn down in __netpoll_cleanup(), both of which remain netpoll's responsibility. The refill work queued via schedule_work(&np->refill_wq) from the moved find_skb() runs refill_skbs_work_handler() in netpoll without any further plumbing. This is pure code motion: the function body is unchanged and its sole caller (netpoll_send_udp(), already moved by an earlier patch) keeps invoking it the same way. Pre-existing concerns about find_skb() running from NMI/printk context (zap_completion_queue() re-entry, skb_pool spinlocks, GFP_ATOMIC allocation, fallback skb sizing vs. MAX_SKB_SIZE, PREEMPT_RT semantics of __kfree_skb()) are inherited as-is and are not addressed here; they predate this series and are out of scope. Fixing them is left for follow-up work. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260512-netconsole_split-v2-9-1191d14ad66d@debian.org Signed-off-by: Jakub Kicinski --- include/linux/netpoll.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index f986f7486cb8..e4b8f1f91e54 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -73,7 +73,6 @@ void __netpoll_free(struct netpoll *np); void netpoll_cleanup(struct netpoll *np); void do_netpoll_cleanup(struct netpoll *np); netdev_tx_t netpoll_send_skb(struct netpoll *np, struct sk_buff *skb); -struct sk_buff *find_skb(struct netpoll *np, int len, int reserve); void netpoll_zap_completion_queue(void); #ifdef CONFIG_NETPOLL -- cgit v1.2.3 From f41f34ec64748e16e5a90ab391cec39e30942f32 Mon Sep 17 00:00:00 2001 From: Paul Chaignon Date: Wed, 13 May 2026 21:34:50 +0200 Subject: bpf: Report maximum combined stack depth We've hit the 512 bytes limit on stack depth a few times in Cilium recently. As a result, we started reporting in CI our current maximum stack depth across all configurations for each BPF program. Unfortunately, that is not trivial to compute in userspace. The verifier reports the stack depths of individual subprogs at the end of the logs. However the maximum combined stack depth also depends on the callgraph of those subprogs (the max combined stack depth is the height of the callgraph weighted by per-subprog stack depths). We can compute a callgraph in userspace from the loaded instructions, but it often doesn't match the verifier's own callgraph because of dead code elimination. Our current approach relies on dumping the BPF_LOG_LEVEL2 logs, but this feels overkill considering the verifier already has the information we need. The patch lets the verifier dump the maximum combined stack depth in the logs, on the same line as the per-subprog stack depths: stack depth 16+256 max 272 The per-subprog stack depths and the new max stack depth are not directly comparable. The former is sometimes updated during fixups, while the latter is not. As a result, even with a single subprog, we may end up with two slightly different values. The aim of the new max value is to be closest to what is actually enforced by the verifier. Signed-off-by: Paul Chaignon Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/d3d23a0410f87f116f3bbaa98a815dbae113bda2.1778700777.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 6f12fc40b682..20c421b43849 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -989,6 +989,8 @@ struct bpf_verifier_env { u32 prev_insn_processed, insn_processed; /* number of jmps, calls, exits analyzed so far */ u32 prev_jmps_processed, jmps_processed; + /* maximum combined stack depth */ + u32 max_stack_depth; /* total verification time */ u64 verification_time; /* maximum number of verifier states kept in 'branching' instructions */ -- cgit v1.2.3 From f0de88303d5e7e04a1224bc7a00512b5a1c4fe7a Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 12 May 2026 09:48:58 +0000 Subject: net: make is_skb_wmem() available to modules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Following patch will use is_skb_wmem() from fq_codel. Provide __sock_wfree() only if CONFIG_INET=y Signed-off-by: Eric Dumazet Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260512094859.3673997-2-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/sock.h | 12 +++++++++++- include/net/tcp.h | 1 - 2 files changed, 11 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/sock.h b/include/net/sock.h index dccd3738c368..219917959b54 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1850,8 +1850,18 @@ static inline struct sock *sk_clone_lock(const struct sock *sk, const gfp_t prio struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force, gfp_t priority); -void __sock_wfree(struct sk_buff *skb); void sock_wfree(struct sk_buff *skb); +#ifdef CONFIG_INET +void __sock_wfree(struct sk_buff *skb); +void tcp_wfree(struct sk_buff *skb); +#endif +static inline bool is_skb_wmem(const struct sk_buff *skb) +{ + return skb->destructor == sock_wfree || + (IS_ENABLED(CONFIG_INET) && skb->destructor == __sock_wfree) || + (IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree); +} + struct sk_buff *sock_omalloc(struct sock *sk, unsigned long size, gfp_t priority); void skb_orphan_partial(struct sk_buff *skb); diff --git a/include/net/tcp.h b/include/net/tcp.h index 3c4e6adb0dbd..5715e60c519a 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -390,7 +390,6 @@ static inline bool tcp_release_cb_cond(struct sock *sk) return false; } -void tcp_wfree(struct sk_buff *skb); void tcp_write_timer_handler(struct sock *sk); void tcp_delack_timer_handler(struct sock *sk); int tcp_ioctl(struct sock *sk, int cmd, int *karg); -- cgit v1.2.3 From feb662d9168b63e1d4c02671ec96005410c6f3ce Mon Sep 17 00:00:00 2001 From: Marco Elver Date: Mon, 11 May 2026 22:00:48 +0200 Subject: slab: support for compiler-assisted type-based slab cache partitioning Rework the general infrastructure around RANDOM_KMALLOC_CACHES into more flexible KMALLOC_PARTITION_CACHES, with the former being a partitioning mode of the latter. Introduce a new mode, KMALLOC_PARTITION_TYPED, which leverages a feature available in Clang 22 and later, called "allocation tokens" via __builtin_infer_alloc_token() [1]. Unlike KMALLOC_PARTITION_RANDOM (formerly RANDOM_KMALLOC_CACHES), this mode deterministically assigns a slab cache to an allocation of type T, regardless of allocation site. The builtin __builtin_infer_alloc_token(, ...) instructs the compiler to infer an allocation type from arguments commonly passed to memory-allocating functions and returns a type-derived token ID. The implementation passes kmalloc-args to the builtin: the compiler performs best-effort type inference, and then recognizes common patterns such as `kmalloc(sizeof(T), ...)`, `kmalloc(sizeof(T) * n, ...)`, but also `(T *)kmalloc(...)`. Where the compiler fails to infer a type the fallback token (default: 0) is chosen. Note: kmalloc_obj(..) APIs fix the pattern how size and result type are expressed, and therefore ensures there's not much drift in which patterns the compiler needs to recognize. Specifically, kmalloc_obj() and friends expand to `(TYPE *)KMALLOC(__obj_size, GFP)`, which the compiler recognizes via the cast to TYPE*. Clang's default token ID calculation is described as [1]: typehashpointersplit: This mode assigns a token ID based on the hash of the allocated type's name, where the top half ID-space is reserved for types that contain pointers and the bottom half for types that do not contain pointers. Separating pointer-containing objects from pointerless objects and data allocations can help mitigate certain classes of memory corruption exploits [2]: attackers who gains a buffer overflow on a primitive buffer cannot use it to directly corrupt pointers or other critical metadata in an object residing in a different, isolated heap region. It is important to note that heap isolation strategies offer a best-effort approach, and do not provide a 100% security guarantee, albeit achievable at relatively low performance cost. Note that this also does not prevent cross-cache attacks: while waiting for future features like SLAB_VIRTUAL [3] to provide physical page isolation, this feature should be deployed alongside SHUFFLE_PAGE_ALLOCATOR and init_on_free=1 to mitigate cross-cache attacks and page-reuse attacks as much as possible today. With all that, my kernel (x86 defconfig) shows me a histogram of slab cache object distribution per /proc/slabinfo (after boot): kmalloc-part-15 1465 ++++++++++++++ kmalloc-part-14 2988 +++++++++++++++++++++++++++++ kmalloc-part-13 1656 ++++++++++++++++ kmalloc-part-12 1045 ++++++++++ kmalloc-part-11 1697 ++++++++++++++++ kmalloc-part-10 1489 ++++++++++++++ kmalloc-part-09 965 +++++++++ kmalloc-part-08 710 +++++++ kmalloc-part-07 100 + kmalloc-part-06 217 ++ kmalloc-part-05 105 + kmalloc-part-04 4047 ++++++++++++++++++++++++++++++++++++++++ kmalloc-part-03 183 + kmalloc-part-02 283 ++ kmalloc-part-01 316 +++ kmalloc 1422 ++++++++++++++ The above /proc/slabinfo snapshot shows me there are 6673 allocated objects (slabs 00 - 07) that the compiler claims contain no pointers or it was unable to infer the type of, and 12015 objects that contain pointers (slabs 08 - 15). On a whole, this looks relatively sane. Additionally, when I compile my kernel with -Rpass=alloc-token, which provides diagnostics where (after dead-code elimination) type inference failed, I see 186 allocation sites where the compiler failed to identify a type (down from 966 when I sent the RFC [4]). Some initial review confirms these are mostly variable sized buffers, but also include structs with trailing flexible length arrays. Link: https://clang.llvm.org/docs/AllocToken.html [1] Link: https://blog.dfsec.com/ios/2025/05/30/blasting-past-ios-18/ [2] Link: https://lwn.net/Articles/944647/ [3] Link: https://lore.kernel.org/all/20250825154505.1558444-1-elver@google.com/ [4] Link: https://discourse.llvm.org/t/rfc-a-framework-for-allocator-partitioning-hints/87434 Acked-by: GONG Ruiqi Co-developed-by: Harry Yoo (Oracle) Signed-off-by: Harry Yoo (Oracle) Signed-off-by: Marco Elver Reviewed-by: Harry Yoo (Oracle) Link: https://patch.msgid.link/20260511200136.3201646-1-elver@google.com Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/percpu.h | 2 +- include/linux/slab.h | 136 ++++++++++++++++++++++++++++++++----------------- 2 files changed, 89 insertions(+), 49 deletions(-) (limited to 'include') diff --git a/include/linux/percpu.h b/include/linux/percpu.h index 85bf8dd9f087..bdb721dac0e3 100644 --- a/include/linux/percpu.h +++ b/include/linux/percpu.h @@ -36,7 +36,7 @@ #define PCPU_BITMAP_BLOCK_BITS (PCPU_BITMAP_BLOCK_SIZE >> \ PCPU_MIN_ALLOC_SHIFT) -#ifdef CONFIG_RANDOM_KMALLOC_CACHES +#ifdef CONFIG_KMALLOC_PARTITION_CACHES # if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PAGE_SIZE_4KB) # define PERCPU_DYNAMIC_SIZE_SHIFT 13 # else diff --git a/include/linux/slab.h b/include/linux/slab.h index 15a60b501b95..795455256329 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -499,14 +499,38 @@ int kmem_cache_shrink(struct kmem_cache *s); .usersize = sizeof_field(struct __struct, __field), \ }, (__flags)) +#ifdef CONFIG_KMALLOC_PARTITION_CACHES +typedef struct { unsigned long v; } kmalloc_token_t; +#ifdef CONFIG_KMALLOC_PARTITION_RANDOM +extern unsigned long random_kmalloc_seed; +#define __kmalloc_token(...) ((kmalloc_token_t){ .v = _RET_IP_ }) +#elif defined(CONFIG_KMALLOC_PARTITION_TYPED) +#define __kmalloc_token(...) ((kmalloc_token_t){ .v = __builtin_infer_alloc_token(__VA_ARGS__) }) +#endif +#define DECL_TOKEN_PARAM(_token) , kmalloc_token_t (_token) +#define _PASS_TOKEN_PARAM(_token) , (_token) +#define PASS_TOKEN_PARAM(_token) (_token) +#define DECL_TOKEN_PARAMS(_size, _token) size_t (_size), kmalloc_token_t (_token) +#define PASS_TOKEN_PARAMS(_size, _token) (_size), (_token) +#else /* !CONFIG_KMALLOC_PARTITION_CACHES */ +typedef struct {} kmalloc_token_t; +#define __kmalloc_token(...) ((kmalloc_token_t){}) /* no-op */ +#define DECL_TOKEN_PARAM(_token) +#define _PASS_TOKEN_PARAM(_token) +#define PASS_TOKEN_PARAM(_token) ((kmalloc_token_t){}) +#define DECL_TOKEN_PARAMS(_size, _token) size_t (_size) +#define PASS_TOKEN_PARAMS(_size, _token) (_size) +#endif /* CONFIG_KMALLOC_PARTITION_CACHES */ + /* * Common kmalloc functions provided by all allocators */ -void * __must_check krealloc_node_align_noprof(const void *objp, size_t new_size, +void * __must_check krealloc_node_align_noprof(const void *objp, + DECL_TOKEN_PARAMS(new_size, token), unsigned long align, gfp_t flags, int nid) __realloc_size(2); -#define krealloc_noprof(_o, _s, _f) krealloc_node_align_noprof(_o, _s, 1, _f, NUMA_NO_NODE) -#define krealloc_node_align(...) alloc_hooks(krealloc_node_align_noprof(__VA_ARGS__)) +#define krealloc_noprof(_o, _s, _f) krealloc_node_align_noprof(_o, PASS_TOKEN_PARAMS(_s, __kmalloc_token(_s)), 1, _f, NUMA_NO_NODE) +#define krealloc_node_align(_o, _s, _a, _f, _n) alloc_hooks(krealloc_node_align_noprof(_o, PASS_TOKEN_PARAMS(_s, __kmalloc_token(_s)), _a, _f, _n)) #define krealloc_node(_o, _s, _f, _n) krealloc_node_align(_o, _s, 1, _f, _n) #define krealloc(...) krealloc_node(__VA_ARGS__, NUMA_NO_NODE) @@ -612,10 +636,10 @@ static inline unsigned int arch_slab_minalign(void) #define SLAB_OBJ_MIN_SIZE (KMALLOC_MIN_SIZE < 16 ? \ (KMALLOC_MIN_SIZE) : 16) -#ifdef CONFIG_RANDOM_KMALLOC_CACHES -#define RANDOM_KMALLOC_CACHES_NR 15 // # of cache copies +#ifdef CONFIG_KMALLOC_PARTITION_CACHES +#define KMALLOC_PARTITION_CACHES_NR 15 // # of cache copies #else -#define RANDOM_KMALLOC_CACHES_NR 0 +#define KMALLOC_PARTITION_CACHES_NR 0 #endif /* @@ -634,8 +658,8 @@ enum kmalloc_cache_type { #ifndef CONFIG_MEMCG KMALLOC_CGROUP = KMALLOC_NORMAL, #endif - KMALLOC_RANDOM_START = KMALLOC_NORMAL, - KMALLOC_RANDOM_END = KMALLOC_RANDOM_START + RANDOM_KMALLOC_CACHES_NR, + KMALLOC_PARTITION_START = KMALLOC_NORMAL, + KMALLOC_PARTITION_END = KMALLOC_PARTITION_START + KMALLOC_PARTITION_CACHES_NR, #ifdef CONFIG_SLUB_TINY KMALLOC_RECLAIM = KMALLOC_NORMAL, #else @@ -662,19 +686,19 @@ extern kmem_buckets kmalloc_caches[NR_KMALLOC_TYPES]; (IS_ENABLED(CONFIG_ZONE_DMA) ? __GFP_DMA : 0) | \ (IS_ENABLED(CONFIG_MEMCG) ? __GFP_ACCOUNT : 0)) -extern unsigned long random_kmalloc_seed; - -static __always_inline enum kmalloc_cache_type kmalloc_type(gfp_t flags, unsigned long caller) +static __always_inline enum kmalloc_cache_type kmalloc_type(gfp_t flags, kmalloc_token_t token) { /* * The most common case is KMALLOC_NORMAL, so test for it * with a single branch for all the relevant flags. */ if (likely((flags & KMALLOC_NOT_NORMAL_BITS) == 0)) -#ifdef CONFIG_RANDOM_KMALLOC_CACHES - /* RANDOM_KMALLOC_CACHES_NR (=15) copies + the KMALLOC_NORMAL */ - return KMALLOC_RANDOM_START + hash_64(caller ^ random_kmalloc_seed, - ilog2(RANDOM_KMALLOC_CACHES_NR + 1)); +#ifdef CONFIG_KMALLOC_PARTITION_RANDOM + /* KMALLOC_PARTITION_CACHES_NR (=15) copies + the KMALLOC_NORMAL */ + return KMALLOC_PARTITION_START + hash_64(token.v ^ random_kmalloc_seed, + ilog2(KMALLOC_PARTITION_CACHES_NR + 1)); +#elif defined(CONFIG_KMALLOC_PARTITION_TYPED) + return KMALLOC_PARTITION_START + token.v; #else return KMALLOC_NORMAL; #endif @@ -858,16 +882,22 @@ unsigned int kmem_cache_sheaf_size(struct slab_sheaf *sheaf); #define PASS_BUCKET_PARAM(_b) NULL #endif +#define DECL_KMALLOC_PARAMS(_size, _b, _token) DECL_BUCKET_PARAMS(_size, _b) \ + DECL_TOKEN_PARAM(_token) + +#define PASS_KMALLOC_PARAMS(_size, _b, _token) PASS_BUCKET_PARAMS(_size, _b) \ + _PASS_TOKEN_PARAM(_token) + /* * The following functions are not to be used directly and are intended only * for internal use from kmalloc() and kmalloc_node() * with the exception of kunit tests */ -void *__kmalloc_noprof(size_t size, gfp_t flags) +void *__kmalloc_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t flags) __assume_kmalloc_alignment __alloc_size(1); -void *__kmalloc_node_noprof(DECL_BUCKET_PARAMS(size, b), gfp_t flags, int node) +void *__kmalloc_node_noprof(DECL_KMALLOC_PARAMS(size, b, token), gfp_t flags, int node) __assume_kmalloc_alignment __alloc_size(1); void *__kmalloc_cache_noprof(struct kmem_cache *s, gfp_t flags, size_t size) @@ -938,7 +968,7 @@ void *__kmalloc_large_node_noprof(size_t size, gfp_t flags, int node) * Try really hard to succeed the allocation but fail * eventually. */ -static __always_inline __alloc_size(1) void *kmalloc_noprof(size_t size, gfp_t flags) +static __always_inline __alloc_size(1) void *_kmalloc_noprof(size_t size, gfp_t flags, kmalloc_token_t token) { if (__builtin_constant_p(size) && size) { unsigned int index; @@ -948,14 +978,16 @@ static __always_inline __alloc_size(1) void *kmalloc_noprof(size_t size, gfp_t f index = kmalloc_index(size); return __kmalloc_cache_noprof( - kmalloc_caches[kmalloc_type(flags, _RET_IP_)][index], + kmalloc_caches[kmalloc_type(flags, token)][index], flags, size); } - return __kmalloc_noprof(size, flags); + return __kmalloc_noprof(PASS_TOKEN_PARAMS(size, token), flags); } +#define kmalloc_noprof(...) _kmalloc_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) #define kmalloc(...) alloc_hooks(kmalloc_noprof(__VA_ARGS__)) -void *kmalloc_nolock_noprof(size_t size, gfp_t gfp_flags, int node); +void *_kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags, int node); +#define kmalloc_nolock_noprof(_s, _f, _n) _kmalloc_nolock_noprof(PASS_TOKEN_PARAMS(_s, __kmalloc_token(_s)), _f, _n) #define kmalloc_nolock(...) alloc_hooks(kmalloc_nolock_noprof(__VA_ARGS__)) /** @@ -1060,12 +1092,12 @@ void *kmalloc_nolock_noprof(size_t size, gfp_t gfp_flags, int node); __alloc_flex(kvzalloc, default_gfp(__VA_ARGS__), typeof(P), FAM, COUNT) #define kmem_buckets_alloc(_b, _size, _flags) \ - alloc_hooks(__kmalloc_node_noprof(PASS_BUCKET_PARAMS(_size, _b), _flags, NUMA_NO_NODE)) + alloc_hooks(__kmalloc_node_noprof(PASS_KMALLOC_PARAMS(_size, _b, __kmalloc_token(_size)), _flags, NUMA_NO_NODE)) #define kmem_buckets_alloc_track_caller(_b, _size, _flags) \ - alloc_hooks(__kmalloc_node_track_caller_noprof(PASS_BUCKET_PARAMS(_size, _b), _flags, NUMA_NO_NODE, _RET_IP_)) + alloc_hooks(__kmalloc_node_track_caller_noprof(PASS_KMALLOC_PARAMS(_size, _b, __kmalloc_token(_size)), _flags, NUMA_NO_NODE, _RET_IP_)) -static __always_inline __alloc_size(1) void *kmalloc_node_noprof(size_t size, gfp_t flags, int node) +static __always_inline __alloc_size(1) void *_kmalloc_node_noprof(size_t size, gfp_t flags, int node, kmalloc_token_t token) { if (__builtin_constant_p(size) && size) { unsigned int index; @@ -1075,11 +1107,12 @@ static __always_inline __alloc_size(1) void *kmalloc_node_noprof(size_t size, gf index = kmalloc_index(size); return __kmalloc_cache_node_noprof( - kmalloc_caches[kmalloc_type(flags, _RET_IP_)][index], + kmalloc_caches[kmalloc_type(flags, token)][index], flags, node, size); } - return __kmalloc_node_noprof(PASS_BUCKET_PARAMS(size, NULL), flags, node); + return __kmalloc_node_noprof(PASS_KMALLOC_PARAMS(size, NULL, token), flags, node); } +#define kmalloc_node_noprof(...) _kmalloc_node_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) #define kmalloc_node(...) alloc_hooks(kmalloc_node_noprof(__VA_ARGS__)) /** @@ -1088,14 +1121,15 @@ static __always_inline __alloc_size(1) void *kmalloc_node_noprof(size_t size, gf * @size: element size. * @flags: the type of memory to allocate (see kmalloc). */ -static inline __alloc_size(1, 2) void *kmalloc_array_noprof(size_t n, size_t size, gfp_t flags) +static inline __alloc_size(1, 2) void *_kmalloc_array_noprof(size_t n, size_t size, gfp_t flags, kmalloc_token_t token) { size_t bytes; if (unlikely(check_mul_overflow(n, size, &bytes))) return NULL; - return kmalloc_noprof(bytes, flags); + return _kmalloc_noprof(bytes, flags, token); } +#define kmalloc_array_noprof(...) _kmalloc_array_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) #define kmalloc_array(...) alloc_hooks(kmalloc_array_noprof(__VA_ARGS__)) /** @@ -1115,18 +1149,19 @@ static inline __alloc_size(1, 2) void *kmalloc_array_noprof(size_t n, size_t siz * In any case, the contents of the object pointed to are preserved up to the * lesser of the new and old sizes. */ -static inline __realloc_size(2, 3) void * __must_check krealloc_array_noprof(void *p, +static inline __realloc_size(2, 3) void * __must_check _krealloc_array_noprof(void *p, size_t new_n, size_t new_size, - gfp_t flags) + gfp_t flags, kmalloc_token_t token) { size_t bytes; if (unlikely(check_mul_overflow(new_n, new_size, &bytes))) return NULL; - return krealloc_noprof(p, bytes, flags); + return krealloc_node_align_noprof(p, PASS_TOKEN_PARAMS(bytes, token), 1, flags, NUMA_NO_NODE); } +#define krealloc_array_noprof(...) _krealloc_array_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) #define krealloc_array(...) alloc_hooks(krealloc_array_noprof(__VA_ARGS__)) /** @@ -1137,10 +1172,10 @@ static inline __realloc_size(2, 3) void * __must_check krealloc_array_noprof(voi */ #define kcalloc(n, size, flags) kmalloc_array(n, size, (flags) | __GFP_ZERO) -void *__kmalloc_node_track_caller_noprof(DECL_BUCKET_PARAMS(size, b), gfp_t flags, int node, +void *__kmalloc_node_track_caller_noprof(DECL_KMALLOC_PARAMS(size, b, token), gfp_t flags, int node, unsigned long caller) __alloc_size(1); #define kmalloc_node_track_caller_noprof(size, flags, node, caller) \ - __kmalloc_node_track_caller_noprof(PASS_BUCKET_PARAMS(size, NULL), flags, node, caller) + __kmalloc_node_track_caller_noprof(PASS_KMALLOC_PARAMS(size, NULL, __kmalloc_token(size)), flags, node, caller) #define kmalloc_node_track_caller(...) \ alloc_hooks(kmalloc_node_track_caller_noprof(__VA_ARGS__, _RET_IP_)) @@ -1157,17 +1192,18 @@ void *__kmalloc_node_track_caller_noprof(DECL_BUCKET_PARAMS(size, b), gfp_t flag #define kmalloc_track_caller_noprof(...) \ kmalloc_node_track_caller_noprof(__VA_ARGS__, NUMA_NO_NODE, _RET_IP_) -static inline __alloc_size(1, 2) void *kmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags, - int node) +static inline __alloc_size(1, 2) void *_kmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags, + int node, kmalloc_token_t token) { size_t bytes; if (unlikely(check_mul_overflow(n, size, &bytes))) return NULL; if (__builtin_constant_p(n) && __builtin_constant_p(size)) - return kmalloc_node_noprof(bytes, flags, node); - return __kmalloc_node_noprof(PASS_BUCKET_PARAMS(bytes, NULL), flags, node); + return _kmalloc_node_noprof(bytes, flags, node, token); + return __kmalloc_node_noprof(PASS_KMALLOC_PARAMS(bytes, NULL, token), flags, node); } +#define kmalloc_array_node_noprof(...) _kmalloc_array_node_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) #define kmalloc_array_node(...) alloc_hooks(kmalloc_array_node_noprof(__VA_ARGS__)) #define kcalloc_node(_n, _size, _flags, _node) \ @@ -1183,39 +1219,43 @@ static inline __alloc_size(1, 2) void *kmalloc_array_node_noprof(size_t n, size_ * @size: how many bytes of memory are required. * @flags: the type of memory to allocate (see kmalloc). */ -static inline __alloc_size(1) void *kzalloc_noprof(size_t size, gfp_t flags) +static inline __alloc_size(1) void *_kzalloc_noprof(size_t size, gfp_t flags, kmalloc_token_t token) { - return kmalloc_noprof(size, flags | __GFP_ZERO); + return _kmalloc_noprof(size, flags | __GFP_ZERO, token); } +#define kzalloc_noprof(...) _kzalloc_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) #define kzalloc(...) alloc_hooks(kzalloc_noprof(__VA_ARGS__)) #define kzalloc_node(_size, _flags, _node) kmalloc_node(_size, (_flags)|__GFP_ZERO, _node) -void *__kvmalloc_node_noprof(DECL_BUCKET_PARAMS(size, b), unsigned long align, +void *__kvmalloc_node_noprof(DECL_KMALLOC_PARAMS(size, b, token), unsigned long align, gfp_t flags, int node) __alloc_size(1); #define kvmalloc_node_align_noprof(_size, _align, _flags, _node) \ - __kvmalloc_node_noprof(PASS_BUCKET_PARAMS(_size, NULL), _align, _flags, _node) + __kvmalloc_node_noprof(PASS_KMALLOC_PARAMS(_size, NULL, __kmalloc_token(_size)), _align, _flags, _node) #define kvmalloc_node_align(...) \ alloc_hooks(kvmalloc_node_align_noprof(__VA_ARGS__)) #define kvmalloc_node(_s, _f, _n) kvmalloc_node_align(_s, 1, _f, _n) +#define kvmalloc_node_noprof(size, flags, node) \ + kvmalloc_node_align_noprof(size, 1, flags, node) #define kvmalloc(...) kvmalloc_node(__VA_ARGS__, NUMA_NO_NODE) +#define kvmalloc_noprof(_size, _flags) kvmalloc_node_noprof(_size, _flags, NUMA_NO_NODE) #define kvzalloc(_size, _flags) kvmalloc(_size, (_flags)|__GFP_ZERO) #define kvzalloc_node(_size, _flags, _node) kvmalloc_node(_size, (_flags)|__GFP_ZERO, _node) #define kmem_buckets_valloc(_b, _size, _flags) \ - alloc_hooks(__kvmalloc_node_noprof(PASS_BUCKET_PARAMS(_size, _b), 1, _flags, NUMA_NO_NODE)) + alloc_hooks(__kvmalloc_node_noprof(PASS_KMALLOC_PARAMS(_size, _b, __kmalloc_token(_size)), 1, _flags, NUMA_NO_NODE)) static inline __alloc_size(1, 2) void * -kvmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags, int node) +_kvmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags, int node, kmalloc_token_t token) { size_t bytes; if (unlikely(check_mul_overflow(n, size, &bytes))) return NULL; - return kvmalloc_node_align_noprof(bytes, 1, flags, node); + return __kvmalloc_node_noprof(PASS_KMALLOC_PARAMS(bytes, NULL, token), 1, flags, node); } - +#define kvmalloc_array_node_noprof(...) _kvmalloc_array_node_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) #define kvmalloc_array_noprof(...) kvmalloc_array_node_noprof(__VA_ARGS__, NUMA_NO_NODE) #define kvcalloc_node_noprof(_n,_s,_f,_node) kvmalloc_array_node_noprof(_n,_s,(_f)|__GFP_ZERO,_node) #define kvcalloc_noprof(...) kvcalloc_node_noprof(__VA_ARGS__, NUMA_NO_NODE) @@ -1224,10 +1264,10 @@ kvmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags, int node) #define kvcalloc_node(...) alloc_hooks(kvcalloc_node_noprof(__VA_ARGS__)) #define kvcalloc(...) alloc_hooks(kvcalloc_noprof(__VA_ARGS__)) -void *kvrealloc_node_align_noprof(const void *p, size_t size, unsigned long align, +void *kvrealloc_node_align_noprof(const void *p, DECL_TOKEN_PARAMS(size, token), unsigned long align, gfp_t flags, int nid) __realloc_size(2); -#define kvrealloc_node_align(...) \ - alloc_hooks(kvrealloc_node_align_noprof(__VA_ARGS__)) +#define kvrealloc_node_align(_p, _s, _a, _f, _n) \ + alloc_hooks(kvrealloc_node_align_noprof(_p, PASS_TOKEN_PARAMS(_s, __kmalloc_token(_s)), _a, _f, _n)) #define kvrealloc_node(_p, _s, _f, _n) kvrealloc_node_align(_p, _s, 1, _f, _n) #define kvrealloc(...) kvrealloc_node(__VA_ARGS__, NUMA_NO_NODE) -- cgit v1.2.3 From 0fc1bd38a19c108395d8338fb034f90c2d3fbe55 Mon Sep 17 00:00:00 2001 From: Marco Elver Date: Mon, 11 May 2026 22:00:49 +0200 Subject: slab: improve KMALLOC_PARTITION_RANDOM randomness When using CONFIG_KMALLOC_PARTITION_RANDOM, _RET_IP_ was previously used to identify the allocation site. _RET_IP_, however, evaluates to the caller's parent's instruction pointer rather than the actual allocation site; this would lead to collisions where a function performs multiple allocations. With the generalization to kmalloc_token_t, we now generate the token at the outermost macro, and using _THIS_IP_ would fix this for all cases. Unfortunately, the generic implementation of _THIS_IP_ relies on taking the address of a local label, which is considered broken by both GCC [1] and Clang [2] because label addresses are only expected to be used with computed gotos. While the generic version more or less works today, it is known to be brittle. For example, Clang -O2 always returns 1 when this function is inlined: static inline unsigned long get_ip(void) { return ({ __label__ __here; __here: (unsigned long)&&__here; }); } To provide a reliable unique identifier without breaking architectures relying on the generic _THIS_IP_, introduce _CODE_LOCATION_: it resolves to _THIS_IP_ where architectures provide a safe implementation, and falls back to a zero-cost static marker where _THIS_IP_ is broken. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=120071 [1] Link: https://github.com/llvm/llvm-project/issues/138272 [2] Signed-off-by: Marco Elver Reviewed-by: Harry Yoo (Oracle) Link: https://patch.msgid.link/20260511200136.3201646-2-elver@google.com Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/instruction_pointer.h | 24 ++++++++++++++++++++++++ include/linux/slab.h | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/instruction_pointer.h b/include/linux/instruction_pointer.h index aa0b3ffea935..ea5bc756bd99 100644 --- a/include/linux/instruction_pointer.h +++ b/include/linux/instruction_pointer.h @@ -8,6 +8,30 @@ #ifndef _THIS_IP_ #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; }) +/* + * The current generic definition of _THIS_IP_ is considered broken by GCC [1] + * and Clang [2]. In particular, the address of a label is only expected to be + * used with a computed goto. + * + * [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=120071 + * [2] https://github.com/llvm/llvm-project/issues/138272 + * + * Mark it as broken, so that appropriate fallback options can be implemented + * for architectures that do not define their own _THIS_IP_. + */ +#define HAS_BROKEN_THIS_IP +#endif + +/* + * _CODE_LOCATION_ provides a unique identifier for the current code location. + * When _THIS_IP_ is broken (generic version), we fall back to a static marker + * which guarantees uniqueness and resolves to a constant address at link time, + * avoiding runtime overhead and compiler optimizations breaking it. + */ +#ifdef HAS_BROKEN_THIS_IP +#define _CODE_LOCATION_ ({ static const char __here; (unsigned long)&__here; }) +#else +#define _CODE_LOCATION_ _THIS_IP_ #endif #endif /* _LINUX_INSTRUCTION_POINTER_H */ diff --git a/include/linux/slab.h b/include/linux/slab.h index 795455256329..90a0b9e9a766 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -503,7 +503,7 @@ int kmem_cache_shrink(struct kmem_cache *s); typedef struct { unsigned long v; } kmalloc_token_t; #ifdef CONFIG_KMALLOC_PARTITION_RANDOM extern unsigned long random_kmalloc_seed; -#define __kmalloc_token(...) ((kmalloc_token_t){ .v = _RET_IP_ }) +#define __kmalloc_token(...) ((kmalloc_token_t){ .v = _CODE_LOCATION_ }) #elif defined(CONFIG_KMALLOC_PARTITION_TYPED) #define __kmalloc_token(...) ((kmalloc_token_t){ .v = __builtin_infer_alloc_token(__VA_ARGS__) }) #endif -- cgit v1.2.3 From e0f54249a491c62ef8196b9f13bd7d95dba47c6f Mon Sep 17 00:00:00 2001 From: Marco Elver Date: Mon, 11 May 2026 22:00:50 +0200 Subject: slab: fix kernel-docs for mm-api The mm-api kernel-docs have been disconnected from their symbols. While the scripts were previously taught to handle the _noprof suffix added by allocation tagging (in 51a7bf0238c2 "scripts/kernel-doc: drop "_noprof" on function prototypes"), this does not handle cases where the internal implementation function has an additional leading underscore. The added optional parameters (via DECL_KMALLOC_PARAMS) further complicate parsing the internal signatures. When the kernel-doc block remains above the internal implementation function but uses the public API name, the documentation generator fails to associate the documented symbol. Simply moving the docs to the macros in slab.h fixes the association but causes loss of types in the generated documentation (rendering as e.g. untyped 'kmalloc(size, flags)' macro). Fix this by: 1. Moving the kernel-doc comment blocks from slub.c to slab.h, placing them directly above the user-facing macros. 2. Providing explicit, typed C prototypes for the documented APIs inside '#if 0 /* kernel-doc */' blocks. 3. Converting the variadic macros for the documented APIs to use explicit arguments to match the documentation. No functional change intended. Signed-off-by: Marco Elver Link: https://patch.msgid.link/20260511200136.3201646-3-elver@google.com Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/slab.h | 216 +++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 168 insertions(+), 48 deletions(-) (limited to 'include') diff --git a/include/linux/slab.h b/include/linux/slab.h index 90a0b9e9a766..07f13e3363a9 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -530,7 +530,49 @@ void * __must_check krealloc_node_align_noprof(const void *objp, unsigned long align, gfp_t flags, int nid) __realloc_size(2); #define krealloc_noprof(_o, _s, _f) krealloc_node_align_noprof(_o, PASS_TOKEN_PARAMS(_s, __kmalloc_token(_s)), 1, _f, NUMA_NO_NODE) -#define krealloc_node_align(_o, _s, _a, _f, _n) alloc_hooks(krealloc_node_align_noprof(_o, PASS_TOKEN_PARAMS(_s, __kmalloc_token(_s)), _a, _f, _n)) +#if 0 /* kernel-doc */ +/** + * krealloc_node_align - reallocate memory. The contents will remain unchanged. + * @p: object to reallocate memory for. + * @new_size: how many bytes of memory are required. + * @align: desired alignment. + * @flags: the type of memory to allocate. + * @nid: NUMA node or NUMA_NO_NODE + * + * If @p is %NULL, krealloc() behaves exactly like kmalloc(). If @new_size + * is 0 and @p is not a %NULL pointer, the object pointed to is freed. + * + * Only alignments up to those guaranteed by kmalloc() will be honored. Please see + * Documentation/core-api/memory-allocation.rst for more details. + * + * If __GFP_ZERO logic is requested, callers must ensure that, starting with the + * initial memory allocation, every subsequent call to this API for the same + * memory allocation is flagged with __GFP_ZERO. Otherwise, it is possible that + * __GFP_ZERO is not fully honored by this API. + * + * When slub_debug_orig_size() is off, krealloc() only knows about the bucket + * size of an allocation (but not the exact size it was allocated with) and + * hence implements the following semantics for shrinking and growing buffers + * with __GFP_ZERO:: + * + * new bucket + * 0 size size + * |--------|----------------| + * | keep | zero | + * + * Otherwise, the original allocation size 'orig_size' could be used to + * precisely clear the requested size, and the new size will also be stored + * as the new 'orig_size'. + * + * In any case, the contents of the object pointed to are preserved up to the + * lesser of the new and old sizes. + * + * Return: pointer to the allocated memory or %NULL in case of error + */ +void *krealloc_node_align(const void *p, size_t new_size, unsigned long align, gfp_t flags, int nid); +#endif +#define krealloc_node_align(p, new_size, align, flags, nid) \ + alloc_hooks(krealloc_node_align_noprof(p, PASS_TOKEN_PARAMS(new_size, __kmalloc_token(new_size)), align, flags, nid)) #define krealloc_node(_o, _s, _f, _n) krealloc_node_align(_o, _s, 1, _f, _n) #define krealloc(...) krealloc_node(__VA_ARGS__, NUMA_NO_NODE) @@ -913,6 +955,23 @@ void *__kmalloc_large_noprof(size_t size, gfp_t flags) void *__kmalloc_large_node_noprof(size_t size, gfp_t flags, int node) __assume_page_alignment __alloc_size(1); +static __always_inline __alloc_size(1) void *_kmalloc_noprof(size_t size, gfp_t flags, kmalloc_token_t token) +{ + if (__builtin_constant_p(size) && size) { + unsigned int index; + + if (size > KMALLOC_MAX_CACHE_SIZE) + return __kmalloc_large_noprof(size, flags); + + index = kmalloc_index(size); + return __kmalloc_cache_noprof( + kmalloc_caches[kmalloc_type(flags, token)][index], + flags, size); + } + return __kmalloc_noprof(PASS_TOKEN_PARAMS(size, token), flags); +} +#define kmalloc_noprof(...) _kmalloc_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) +#if 0 /* kernel-doc */ /** * kmalloc - allocate kernel memory * @size: how many bytes of memory are required. @@ -968,27 +1027,27 @@ void *__kmalloc_large_node_noprof(size_t size, gfp_t flags, int node) * Try really hard to succeed the allocation but fail * eventually. */ -static __always_inline __alloc_size(1) void *_kmalloc_noprof(size_t size, gfp_t flags, kmalloc_token_t token) -{ - if (__builtin_constant_p(size) && size) { - unsigned int index; - - if (size > KMALLOC_MAX_CACHE_SIZE) - return __kmalloc_large_noprof(size, flags); - - index = kmalloc_index(size); - return __kmalloc_cache_noprof( - kmalloc_caches[kmalloc_type(flags, token)][index], - flags, size); - } - return __kmalloc_noprof(PASS_TOKEN_PARAMS(size, token), flags); -} -#define kmalloc_noprof(...) _kmalloc_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) -#define kmalloc(...) alloc_hooks(kmalloc_noprof(__VA_ARGS__)) +void *kmalloc(size_t size, gfp_t flags); +#endif +#define kmalloc(size, flags) alloc_hooks(kmalloc_noprof(size, flags)) void *_kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags, int node); #define kmalloc_nolock_noprof(_s, _f, _n) _kmalloc_nolock_noprof(PASS_TOKEN_PARAMS(_s, __kmalloc_token(_s)), _f, _n) -#define kmalloc_nolock(...) alloc_hooks(kmalloc_nolock_noprof(__VA_ARGS__)) +#if 0 /* kernel-doc */ +/** + * kmalloc_nolock - Allocate an object of given size from any context. + * @size: size to allocate + * @gfp_flags: GFP flags. Only __GFP_ACCOUNT, __GFP_ZERO, __GFP_NO_OBJ_EXT + * allowed. + * @node: node number of the target node. + * + * Return: pointer to the new object or NULL in case of error. + * NULL does not mean EBUSY or EAGAIN. It means ENOMEM. + * There is no reason to call it again and expect !NULL. + */ +void *kmalloc_nolock(size_t size, gfp_t gfp_flags, int node); +#endif +#define kmalloc_nolock(size, gfp_flags, node) alloc_hooks(kmalloc_nolock_noprof(size, gfp_flags, node)) /** * __alloc_objs - Allocate objects of a given type using @@ -1115,23 +1174,40 @@ static __always_inline __alloc_size(1) void *_kmalloc_node_noprof(size_t size, g #define kmalloc_node_noprof(...) _kmalloc_node_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) #define kmalloc_node(...) alloc_hooks(kmalloc_node_noprof(__VA_ARGS__)) +static inline __alloc_size(1, 2) void *_kmalloc_array_noprof(size_t n, size_t size, gfp_t flags, kmalloc_token_t token) +{ + size_t bytes; + + if (unlikely(check_mul_overflow(n, size, &bytes))) + return NULL; + return _kmalloc_noprof(bytes, flags, token); +} +#define kmalloc_array_noprof(...) _kmalloc_array_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) +#if 0 /* kernel-doc */ /** * kmalloc_array - allocate memory for an array. * @n: number of elements. * @size: element size. * @flags: the type of memory to allocate (see kmalloc). */ -static inline __alloc_size(1, 2) void *_kmalloc_array_noprof(size_t n, size_t size, gfp_t flags, kmalloc_token_t token) +void *kmalloc_array(size_t n, size_t size, gfp_t flags); +#endif +#define kmalloc_array(n, size, flags) alloc_hooks(kmalloc_array_noprof(n, size, flags)) + +static inline __realloc_size(2, 3) void * __must_check _krealloc_array_noprof(void *p, + size_t new_n, + size_t new_size, + gfp_t flags, kmalloc_token_t token) { size_t bytes; - if (unlikely(check_mul_overflow(n, size, &bytes))) + if (unlikely(check_mul_overflow(new_n, new_size, &bytes))) return NULL; - return _kmalloc_noprof(bytes, flags, token); -} -#define kmalloc_array_noprof(...) _kmalloc_array_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) -#define kmalloc_array(...) alloc_hooks(kmalloc_array_noprof(__VA_ARGS__)) + return krealloc_node_align_noprof(p, PASS_TOKEN_PARAMS(bytes, token), 1, flags, NUMA_NO_NODE); +} +#define krealloc_array_noprof(...) _krealloc_array_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) +#if 0 /* kernel-doc */ /** * krealloc_array - reallocate memory for an array. * @p: pointer to the memory chunk to reallocate @@ -1149,20 +1225,9 @@ static inline __alloc_size(1, 2) void *_kmalloc_array_noprof(size_t n, size_t si * In any case, the contents of the object pointed to are preserved up to the * lesser of the new and old sizes. */ -static inline __realloc_size(2, 3) void * __must_check _krealloc_array_noprof(void *p, - size_t new_n, - size_t new_size, - gfp_t flags, kmalloc_token_t token) -{ - size_t bytes; - - if (unlikely(check_mul_overflow(new_n, new_size, &bytes))) - return NULL; - - return krealloc_node_align_noprof(p, PASS_TOKEN_PARAMS(bytes, token), 1, flags, NUMA_NO_NODE); -} -#define krealloc_array_noprof(...) _krealloc_array_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) -#define krealloc_array(...) alloc_hooks(krealloc_array_noprof(__VA_ARGS__)) +void *krealloc_array(void *p, size_t new_n, size_t new_size, gfp_t flags); +#endif +#define krealloc_array(p, new_n, new_size, flags) alloc_hooks(krealloc_array_noprof(p, new_n, new_size, flags)) /** * kcalloc - allocate memory for an array. The memory is set to zero. @@ -1214,17 +1279,20 @@ static inline __alloc_size(1, 2) void *_kmalloc_array_node_noprof(size_t n, size */ #define kmem_cache_zalloc(_k, _flags) kmem_cache_alloc(_k, (_flags)|__GFP_ZERO) -/** - * kzalloc - allocate memory. The memory is set to zero. - * @size: how many bytes of memory are required. - * @flags: the type of memory to allocate (see kmalloc). - */ static inline __alloc_size(1) void *_kzalloc_noprof(size_t size, gfp_t flags, kmalloc_token_t token) { return _kmalloc_noprof(size, flags | __GFP_ZERO, token); } #define kzalloc_noprof(...) _kzalloc_noprof(__VA_ARGS__, __kmalloc_token(__VA_ARGS__)) -#define kzalloc(...) alloc_hooks(kzalloc_noprof(__VA_ARGS__)) +#if 0 /* kernel-doc */ +/** + * kzalloc - allocate memory. The memory is set to zero. + * @size: how many bytes of memory are required. + * @flags: the type of memory to allocate (see kmalloc). + */ +void *kzalloc(size_t size, gfp_t flags); +#endif +#define kzalloc(size, flags) alloc_hooks(kzalloc_noprof(size, flags)) #define kzalloc_node(_size, _flags, _node) kmalloc_node(_size, (_flags)|__GFP_ZERO, _node) void *__kvmalloc_node_noprof(DECL_KMALLOC_PARAMS(size, b, token), unsigned long align, @@ -1233,7 +1301,29 @@ void *__kvmalloc_node_noprof(DECL_KMALLOC_PARAMS(size, b, token), unsigned long __kvmalloc_node_noprof(PASS_KMALLOC_PARAMS(_size, NULL, __kmalloc_token(_size)), _align, _flags, _node) #define kvmalloc_node_align(...) \ alloc_hooks(kvmalloc_node_align_noprof(__VA_ARGS__)) -#define kvmalloc_node(_s, _f, _n) kvmalloc_node_align(_s, 1, _f, _n) +#if 0 /* kernel-doc */ +/** + * kvmalloc_node - attempt to allocate physically contiguous memory, but upon + * failure, fall back to non-contiguous (vmalloc) allocation. + * @size: size of the request. + * @flags: gfp mask for the allocation - must be compatible (superset) with GFP_KERNEL. + * @node: numa node to allocate from + * + * Only alignments up to those guaranteed by kmalloc() will be honored. Please see + * Documentation/core-api/memory-allocation.rst for more details. + * + * Uses kmalloc to get the memory but if the allocation fails then falls back + * to the vmalloc allocator. Use kvfree for freeing the memory. + * + * GFP_NOWAIT and GFP_ATOMIC are supported, the __GFP_NORETRY modifier is not. + * __GFP_RETRY_MAYFAIL is supported, and it should be used only if kmalloc is + * preferable to the vmalloc fallback, due to visible performance drawbacks. + * + * Return: pointer to the allocated memory of %NULL in case of failure + */ +void *kvmalloc_node(size_t size, gfp_t flags, int node); +#endif +#define kvmalloc_node(size, flags, node) kvmalloc_node_align(size, 1, flags, node) #define kvmalloc_node_noprof(size, flags, node) \ kvmalloc_node_align_noprof(size, 1, flags, node) #define kvmalloc(...) kvmalloc_node(__VA_ARGS__, NUMA_NO_NODE) @@ -1266,8 +1356,38 @@ _kvmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags, int node, kmallo void *kvrealloc_node_align_noprof(const void *p, DECL_TOKEN_PARAMS(size, token), unsigned long align, gfp_t flags, int nid) __realloc_size(2); -#define kvrealloc_node_align(_p, _s, _a, _f, _n) \ - alloc_hooks(kvrealloc_node_align_noprof(_p, PASS_TOKEN_PARAMS(_s, __kmalloc_token(_s)), _a, _f, _n)) +#if 0 /* kernel-doc */ +/** + * kvrealloc_node_align - reallocate memory; contents remain unchanged + * @p: object to reallocate memory for + * @size: the size to reallocate + * @align: desired alignment + * @flags: the flags for the page level allocator + * @nid: NUMA node id + * + * If @p is %NULL, kvrealloc() behaves exactly like kvmalloc(). If @size is 0 + * and @p is not a %NULL pointer, the object pointed to is freed. + * + * Only alignments up to those guaranteed by kmalloc() will be honored. Please see + * Documentation/core-api/memory-allocation.rst for more details. + * + * If __GFP_ZERO logic is requested, callers must ensure that, starting with the + * initial memory allocation, every subsequent call to this API for the same + * memory allocation is flagged with __GFP_ZERO. Otherwise, it is possible that + * __GFP_ZERO is not fully honored by this API. + * + * In any case, the contents of the object pointed to are preserved up to the + * lesser of the new and old sizes. + * + * This function must not be called concurrently with itself or kvfree() for the + * same memory allocation. + * + * Return: pointer to the allocated memory or %NULL in case of error + */ +void *kvrealloc_node_align(const void *p, size_t size, unsigned long align, gfp_t flags, int nid); +#endif +#define kvrealloc_node_align(p, size, align, flags, nid) \ + alloc_hooks(kvrealloc_node_align_noprof(p, PASS_TOKEN_PARAMS(size, __kmalloc_token(size)), align, flags, nid)) #define kvrealloc_node(_p, _s, _f, _n) kvrealloc_node_align(_p, _s, 1, _f, _n) #define kvrealloc(...) kvrealloc_node(__VA_ARGS__, NUMA_NO_NODE) -- cgit v1.2.3 From a2f6ed7b4873288d9e90e69199012857bed4bfa4 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Sat, 9 May 2026 10:03:26 -0700 Subject: net/sched: netem: add per-impairment extended statistics Add 64-bit counters for each impairment netem applies (delay, loss, ECN marking, corruption, duplication, reordering) and for skb allocation failures during enqueue. Exposed through TCA_STATS_APP as struct tc_netem_xstats. Counters increment when an impairment is occurs, independent of later events that may mask its on-wire effect. Added allocation_errors (similar to sch_fq) to account for when impairment could not be applied due to memory pressure, etc. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20260509171123.307549-6-stephen@networkplumber.org Signed-off-by: Paolo Abeni --- include/uapi/linux/pkt_sched.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h index 66e8072f44df..490efd288526 100644 --- a/include/uapi/linux/pkt_sched.h +++ b/include/uapi/linux/pkt_sched.h @@ -569,6 +569,16 @@ struct tc_netem_gemodel { #define NETEM_DIST_SCALE 8192 #define NETEM_DIST_MAX 16384 +struct tc_netem_xstats { + __u64 delayed; /* packets delayed */ + __u64 dropped; /* packets dropped by loss model */ + __u64 corrupted; /* packets with bit errors injected */ + __u64 duplicated; /* duplicate packets generated */ + __u64 reordered; /* packets sent out of order */ + __u64 ecn_marked; /* packets ECN CE-marked (not dropped)*/ + __u64 allocation_errors; +}; + /* DRR */ enum { -- cgit v1.2.3 From 0c32db0761fef3d98d6e4d6d8ce02c40e914f4d8 Mon Sep 17 00:00:00 2001 From: Danielle Ratson Date: Mon, 11 May 2026 09:59:31 +0300 Subject: bridge: uapi: Add neigh_forward_grat netlink attributes Add netlink attributes for controlling gratuitous ARP and unsolicited NA forwarding when neighbor suppression is enabled. Add IFLA_BRPORT_NEIGH_FORWARD_GRAT for port-level control and BRIDGE_VLANDB_ENTRY_NEIGH_FORWARD_GRAT for per-VLAN control. The new attributes provide independent control of gratuitous ARP and unsolicited NA packets. Operators can enable forwarding for those packets for fast mobility across VTEPs while keeping general neighbor suppression active. Reviewed-by: Ido Schimmel Signed-off-by: Danielle Ratson Link: https://patch.msgid.link/20260511065936.4173106-2-danieller@nvidia.com Signed-off-by: Paolo Abeni --- include/uapi/linux/if_bridge.h | 1 + include/uapi/linux/if_link.h | 17 +++++++++++++++++ 2 files changed, 18 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h index e52f8207ab27..21a700c02ef7 100644 --- a/include/uapi/linux/if_bridge.h +++ b/include/uapi/linux/if_bridge.h @@ -526,6 +526,7 @@ enum { BRIDGE_VLANDB_ENTRY_MCAST_N_GROUPS, BRIDGE_VLANDB_ENTRY_MCAST_MAX_GROUPS, BRIDGE_VLANDB_ENTRY_NEIGH_SUPPRESS, + BRIDGE_VLANDB_ENTRY_NEIGH_FORWARD_GRAT, __BRIDGE_VLANDB_ENTRY_MAX, }; #define BRIDGE_VLANDB_ENTRY_MAX (__BRIDGE_VLANDB_ENTRY_MAX - 1) diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 79ce4bc24cba..46413392b402 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -1085,6 +1085,22 @@ enum { * Note that this option only takes effect when *IFLA_BRPORT_NEIGH_SUPPRESS* * is enabled for a given port. * + * @IFLA_BRPORT_NEIGH_FORWARD_GRAT + * Controls whether gratuitous ARP packets and unsolicited Neighbor + * Advertisement packets are forwarded on a given port even when neighbor + * suppression is enabled. + * By default this flag is off, meaning gratuitous ARP and unsolicited NA + * packets will be suppressed when neighbor suppression is enabled. + * Setting this flag to on allows these packets to be forwarded even + * when *IFLA_BRPORT_NEIGH_SUPPRESS* or *IFLA_BRPORT_NEIGH_VLAN_SUPPRESS* + * is enabled. + * + * Note that this option only takes effect when *IFLA_BRPORT_NEIGH_SUPPRESS* + * or *IFLA_BRPORT_NEIGH_VLAN_SUPPRESS* is enabled for a given port. + * When *IFLA_BRPORT_NEIGH_VLAN_SUPPRESS* is set, this port-level flag is + * ignored and per-VLAN control is available via + * *BRIDGE_VLANDB_ENTRY_NEIGH_FORWARD_GRAT*. + * * @IFLA_BRPORT_BACKUP_NHID * The FDB nexthop object ID to attach to packets being redirected to a * backup port that has VLAN tunnel mapping enabled (via the @@ -1137,6 +1153,7 @@ enum { IFLA_BRPORT_MCAST_MAX_GROUPS, IFLA_BRPORT_NEIGH_VLAN_SUPPRESS, IFLA_BRPORT_BACKUP_NHID, + IFLA_BRPORT_NEIGH_FORWARD_GRAT, __IFLA_BRPORT_MAX }; #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1) -- cgit v1.2.3 From 3a28ccb9dd47d1b6f64c64a94c958a968299aa1d Mon Sep 17 00:00:00 2001 From: Danielle Ratson Date: Mon, 11 May 2026 09:59:32 +0300 Subject: bridge: Add internal flags for neigh_forward_grat Add internal flags for the neigh_forward_grat feature: - BR_NEIGH_FORWARD_GRAT: Port-level flag - BR_VLFLAG_NEIGH_FORWARD_GRAT_ENABLED: Per-VLAN flag These will be used to control whether gratuitous ARP and unsolicited NA packets are forwarded when neighbor suppression is enabled. Reviewed-by: Petr Machata Reviewed-by: Ido Schimmel Signed-off-by: Danielle Ratson Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260511065936.4173106-3-danieller@nvidia.com Signed-off-by: Paolo Abeni --- include/linux/if_bridge.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h index c5fe3b2a53e8..ec9ffea1e46e 100644 --- a/include/linux/if_bridge.h +++ b/include/linux/if_bridge.h @@ -61,6 +61,7 @@ struct br_ip_list { #define BR_PORT_LOCKED BIT(21) #define BR_PORT_MAB BIT(22) #define BR_NEIGH_VLAN_SUPPRESS BIT(23) +#define BR_NEIGH_FORWARD_GRAT BIT(24) #define BR_DEFAULT_AGEING_TIME (300 * HZ) -- cgit v1.2.3 From c8d32a0389fb97873285327ef4543a1431e54733 Mon Sep 17 00:00:00 2001 From: Gitle Mikkelsen Date: Fri, 1 May 2026 19:06:16 +0200 Subject: timers: Fix flseep() typo in kernel-doc comment Signed-off-by: Gitle Mikkelsen Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260501170616.1402-1-gitlem@gmail.com --- include/linux/delay.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/delay.h b/include/linux/delay.h index 46412c00033a..68b2a69dd24d 100644 --- a/include/linux/delay.h +++ b/include/linux/delay.h @@ -110,7 +110,7 @@ static const unsigned int max_slack_shift = 2; * fsleep - flexible sleep which autoselects the best mechanism * @usecs: requested sleep duration in microseconds * - * flseep() selects the best mechanism that will provide maximum 25% slack + * fsleep() selects the best mechanism that will provide maximum 25% slack * to the requested sleep duration. Therefore it uses: * * * udelay() loop for sleep durations <= 10 microseconds to avoid hrtimer -- cgit v1.2.3 From 899bea8248cee35d54760a5e7d61a76af8e64411 Mon Sep 17 00:00:00 2001 From: Shouvik Kar Date: Tue, 12 May 2026 16:32:42 +0530 Subject: io_uring/net: allow filtering on IORING_OP_CONNECT This adds custom filtering for IORING_OP_CONNECT, where the target family is always exposed, and (for AF_INET / AF_INET6) port and address are exposed. port and v4_addr are in network byte order so filter authors can compare against on-wire constants. Skip population unless addr_len covers the populated fields, to avoid leaking stale io_async_msghdr data on short connects. Signed-off-by: Shouvik Kar Link: https://patch.msgid.link/20260512110242.26219-1-auxcorelabs@gmail.com Signed-off-by: Jens Axboe --- include/uapi/linux/io_uring/bpf_filter.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/io_uring/bpf_filter.h b/include/uapi/linux/io_uring/bpf_filter.h index 1b461d792a7b..ce7d78ab13b3 100644 --- a/include/uapi/linux/io_uring/bpf_filter.h +++ b/include/uapi/linux/io_uring/bpf_filter.h @@ -27,6 +27,22 @@ struct io_uring_bpf_ctx { __u64 mode; __u64 resolve; } open; + /* + * For CONNECT: fields are populated only when addr_len covers + * them; unpopulated fields are zero from the caller-side memset + * in io_uring_populate_bpf_ctx(). port and v4_addr are network + * byte order. Filters may only issue BPF_LD|BPF_W|BPF_ABS at + * 4-byte aligned offsets; load + mask for sub-word fields. + */ + struct { + __u32 family; /* sa_family_t zero-extended */ + __be16 port; + __u8 pad[2]; + union { + __be32 v4_addr; + __u8 v6_addr[16]; + }; + } connect; }; }; -- cgit v1.2.3 From e83f5e24da741fa9405aeeff00b08c5ee7c37b88 Mon Sep 17 00:00:00 2001 From: Jiexun Wang Date: Wed, 6 May 2026 19:43:30 +0800 Subject: Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket. Fixes: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Jann Horn Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Jiexun Wang Signed-off-by: Ren Wei Signed-off-by: Jiexun Wang Reviewed-by: Jann Horn Signed-off-by: Luiz Augusto von Dentz --- include/net/bluetooth/bluetooth.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h index 69eed69f7f26..3faea66b1979 100644 --- a/include/net/bluetooth/bluetooth.h +++ b/include/net/bluetooth/bluetooth.h @@ -398,6 +398,7 @@ void baswap(bdaddr_t *dst, const bdaddr_t *src); struct bt_sock { struct sock sk; struct list_head accept_q; + spinlock_t accept_q_lock; /* protects accept_q */ struct sock *parent; unsigned long flags; void (*skb_msg_name)(struct sk_buff *, void *, int *); -- cgit v1.2.3 From df0a52537c0f95d5441eb0ba1bdbd2d864e6def9 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Sat, 24 Jan 2026 10:02:41 -0700 Subject: io_uring/rsrc: add huge page accounting for registered buffers Track huge page references in a per-ring xarray to prevent double accounting when the same huge page is used by multiple registered buffers, either within the same ring or across cloned rings. When registering buffers backed by huge pages, we need to account for RLIMIT_MEMLOCK. But if multiple buffers share the same huge page (common with cloned buffers), we must not account for the same page multiple times. Similarly, we must only unaccount when the last reference to a huge page is released. Maintain a per-ring xarray (hpage_acct) that tracks reference counts for each huge page. When registering a buffer, for each unique huge page, increment its accounting reference count, and only account pages that are newly added. When unregistering a buffer, for each unique huge page, decrement its refcount. Once the refcount hits zero, the page is unaccounted. Note: any account is done against the ctx->user that was assigned when the ring was setup. As before, if root is running the operation, no accounting is done. With these changes, any use of imu->acct_pages is also dead, hence kill it from struct io_mapped_ubuf. This shrinks it from 56b to 48b on a 64-bit arch. Additionally, hpage_already_acct() is gone, which was an O(M*M) scan over current + previous registrations. Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index 244392026c6d..23b8891d5704 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -446,6 +446,9 @@ struct io_ring_ctx { /* Stores zcrx object pointers of type struct io_zcrx_ifq */ struct xarray zcrx_ctxs; + /* Used for accounting references on pages in registered buffers */ + struct xarray hpage_acct; + u32 pers_next; struct xarray personalities; -- cgit v1.2.3 From 85347718ab0dd7ede9c3e1dcff2d604c7073df05 Mon Sep 17 00:00:00 2001 From: Alessandro Carminati Date: Thu, 14 May 2026 13:06:37 +0200 Subject: bug/kunit: Core support for suppressing warning backtraces Some unit tests intentionally trigger warning backtraces by passing bad parameters to kernel API functions. Such unit tests typically check the return value from such calls, not the existence of the warning backtrace. Such intentionally generated warning backtraces are neither desirable nor useful for a number of reasons: - They can result in overlooked real problems. - A warning that suddenly starts to show up in unit tests needs to be investigated and has to be marked to be ignored, for example by adjusting filter scripts. Such filters are ad hoc because there is no real standard format for warnings. On top of that, such filter scripts would require constant maintenance. Solve the problem by providing a means to suppress warning backtraces originating from the current kthread while executing test code. Since each KUnit test runs in its own kthread, this effectively scopes suppression to the test that enabled it. Limit changes to generic code to the absolute minimum. Implementation details: Suppression is integrated into the existing KUnit hooks infrastructure in test-bug.h, reusing the kunit_running static branch for zero overhead when no tests are running. Suppression is checked at three points in the warning path: - In warn_slowpath_fmt(), the check runs before any output, fully suppressing both message and backtrace. This covers architectures without __WARN_FLAGS. - In __warn_printk(), the check suppresses the warning message text. This covers architectures that define __WARN_FLAGS but not their own __WARN_printf (arm64, loongarch, parisc, powerpc, riscv, sh), where the message is printed before the trap enters __report_bug(). - In __report_bug(), the check runs before __warn() is called, suppressing the backtrace and stack dump. To avoid double-counting on architectures where both __warn_printk() and __report_bug() run for the same warning, kunit_is_suppressed_warning() takes a bool parameter: true to increment the suppression counter (used in warn_slowpath_fmt and __report_bug), false to check only (used in __warn_printk). The suppression state is dynamically allocated via kunit_kzalloc() and tied to the KUnit test lifecycle via kunit_add_action(), ensuring automatic cleanup at test exit. Writer-side access to the global suppression list is serialized with a spinlock; readers use RCU. Two API forms are provided: - kunit_warning_suppress(test) { ... }: scoped, uses __cleanup for automatic teardown on scope exit, kunit_add_action() as safety net for abnormal exits (e.g. kthread_exit from failed assertions). Suppression handle is only accessible inside the block. - kunit_start/end_suppress_warning(test): direct functions returning an explicit handle, for retaining the handle within the test, or for cross-function usage. Link: https://lore.kernel.org/r/20260514-kunit_add_support-v11-1-b36a530a6d8f@redhat.com Signed-off-by: Guenter Roeck Signed-off-by: Alessandro Carminati Reviewed-by: Kees Cook Reviewed-by: David Gow Signed-off-by: Albert Esteve Signed-off-by: Shuah Khan --- include/kunit/test-bug.h | 26 +++++++++++++ include/kunit/test.h | 98 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 124 insertions(+) (limited to 'include') diff --git a/include/kunit/test-bug.h b/include/kunit/test-bug.h index 47aa8f21ccce..99869029fc68 100644 --- a/include/kunit/test-bug.h +++ b/include/kunit/test-bug.h @@ -10,6 +10,7 @@ #define _KUNIT_TEST_BUG_H #include /* for NULL */ +#include /* for bool */ #if IS_ENABLED(CONFIG_KUNIT) @@ -23,6 +24,7 @@ DECLARE_STATIC_KEY_FALSE(kunit_running); extern struct kunit_hooks_table { __printf(3, 4) void (*fail_current_test)(const char*, int, const char*, ...); void *(*get_static_stub_address)(struct kunit *test, void *real_fn_addr); + bool (*is_suppressed_warning)(bool count); } kunit_hooks; /** @@ -60,9 +62,33 @@ static inline struct kunit *kunit_get_current_test(void) } \ } while (0) +/** + * kunit_is_suppressed_warning() - Check if warnings are being suppressed + * by the current KUnit test. + * @count: if true, increment the suppression counter on match. + * + * Returns true if the current task has active warning suppression. + * Uses the kunit_running static branch for zero overhead when no tests run. + * + * A single WARN*() may traverse multiple call sites in the warning path + * (e.g., __warn_printk() and __report_bug()). Pass @count = true at the + * primary suppression point to count each warning exactly once, and + * @count = false at secondary points to suppress output without + * inflating the count. + */ +static inline bool kunit_is_suppressed_warning(bool count) +{ + if (!static_branch_unlikely(&kunit_running)) + return false; + + return kunit_hooks.is_suppressed_warning && + kunit_hooks.is_suppressed_warning(count); +} + #else static inline struct kunit *kunit_get_current_test(void) { return NULL; } +static inline bool kunit_is_suppressed_warning(bool count) { return false; } #define kunit_fail_current_test(fmt, ...) do {} while (0) diff --git a/include/kunit/test.h b/include/kunit/test.h index 9cd1594ab697..be71612f6165 100644 --- a/include/kunit/test.h +++ b/include/kunit/test.h @@ -1795,4 +1795,102 @@ do { \ // include resource.h themselves if they need it. #include +/* + * Warning backtrace suppression API. + * + * Suppresses WARN*() backtraces on the current task while active. Two forms + * are provided: + * + * - Scoped: kunit_warning_suppress(test) { ... } + * Suppression is active for the duration of the block. On normal exit, + * the for-loop increment deactivates suppression. On early exit (break, + * return, goto), the __cleanup attribute fires. On kthread_exit() (e.g., + * a failed KUnit assertion), kunit_add_action() cleans up at test + * teardown. The suppression handle is only accessible inside the block, + * so warning counts must be checked before the block exits. + * + * - Direct: kunit_start_suppress_warning() / kunit_end_suppress_warning() + * The underlying functions, returning an explicit handle pointer. Use + * when the handle needs to be retained (e.g., for post-suppression + * count checks) or passed across helper functions. + */ +struct kunit_suppressed_warning; + +struct kunit_suppressed_warning * +kunit_start_suppress_warning(struct kunit *test); +void kunit_end_suppress_warning(struct kunit *test, + struct kunit_suppressed_warning *w); +int kunit_suppressed_warning_count(struct kunit_suppressed_warning *w); +void __kunit_suppress_auto_cleanup(struct kunit_suppressed_warning **wp); +bool kunit_has_active_suppress_warning(void); + +/** + * kunit_warning_suppress() - Suppress WARN*() backtraces for the duration + * of a block. + * @test: The test context object. + * + * Scoped form of the suppression API. Suppression starts when the block is + * entered and ends automatically when the block exits through any path. See + * the section comment above for the cleanup guarantees on each exit path. + * Fails the test if suppression is already active; nesting is not supported. + * + * The warning count can be checked inside the block via + * KUNIT_EXPECT_SUPPRESSED_WARNING_COUNT(). The handle is not accessible + * after the block exits. + * + * Example:: + * + * kunit_warning_suppress(test) { + * trigger_warning(); + * KUNIT_EXPECT_SUPPRESSED_WARNING_COUNT(test, 1); + * } + */ +#define kunit_warning_suppress(test) \ + for (struct kunit_suppressed_warning *__kunit_suppress \ + __cleanup(__kunit_suppress_auto_cleanup) = \ + kunit_start_suppress_warning(test); \ + __kunit_suppress; \ + kunit_end_suppress_warning(test, __kunit_suppress), \ + __kunit_suppress = NULL) + +/** + * KUNIT_SUPPRESSED_WARNING_COUNT() - Returns the suppressed warning count. + * + * Returns the number of WARN*() calls suppressed since the current + * suppression block started, or 0 if the handle is NULL. Usable inside a + * kunit_warning_suppress() block. + */ +#define KUNIT_SUPPRESSED_WARNING_COUNT() \ + kunit_suppressed_warning_count(__kunit_suppress) + +/** + * KUNIT_EXPECT_SUPPRESSED_WARNING_COUNT() - Sets an expectation that the + * suppressed warning count equals + * @expected. + * @test: The test context object. + * @expected: an expression that evaluates to the expected warning count. + * + * Sets an expectation that the number of suppressed WARN*() calls equals + * @expected. This is semantically equivalent to + * KUNIT_EXPECT_EQ(@test, KUNIT_SUPPRESSED_WARNING_COUNT(), @expected). + * See KUNIT_EXPECT_EQ() for more information. + */ +#define KUNIT_EXPECT_SUPPRESSED_WARNING_COUNT(test, expected) \ + KUNIT_EXPECT_EQ(test, KUNIT_SUPPRESSED_WARNING_COUNT(), expected) + +/** + * KUNIT_ASSERT_SUPPRESSED_WARNING_COUNT() - Sets an assertion that the + * suppressed warning count equals + * @expected. + * @test: The test context object. + * @expected: an expression that evaluates to the expected warning count. + * + * Sets an assertion that the number of suppressed WARN*() calls equals + * @expected. This is the same as KUNIT_EXPECT_SUPPRESSED_WARNING_COUNT(), + * except it causes an assertion failure (see KUNIT_ASSERT_TRUE()) when the + * assertion is not met. + */ +#define KUNIT_ASSERT_SUPPRESSED_WARNING_COUNT(test, expected) \ + KUNIT_ASSERT_EQ(test, KUNIT_SUPPRESSED_WARNING_COUNT(), expected) + #endif /* _KUNIT_TEST_H */ -- cgit v1.2.3 From 009bcbd0b201d4dc125eb960a61cb6d4d9fdfc72 Mon Sep 17 00:00:00 2001 From: Tao Cui Date: Thu, 14 May 2026 14:50:32 +0800 Subject: cgroup/rdma: add rdma.events to track resource limit exhaustion Add per-device hierarchical event counters to track when RDMA resource limits are exceeded. The rdma.events file reports max event counts propagated upward from the cgroup whose limit was hit to all ancestors. This mirrors the design of pids.events, where events are attributed to the cgroup that imposed the limit, not necessarily the cgroup where the allocation was attempted. Userspace can monitor this file via poll/epoll for real-time notification of resource exhaustion. Signed-off-by: Tao Cui Signed-off-by: Tejun Heo --- include/linux/cgroup_rdma.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/cgroup_rdma.h b/include/linux/cgroup_rdma.h index 80edae03c313..ac691fe7d3f5 100644 --- a/include/linux/cgroup_rdma.h +++ b/include/linux/cgroup_rdma.h @@ -24,6 +24,9 @@ struct rdma_cgroup { * that belongs to this cgroup. */ struct list_head rpools; + + /* Handle for rdma.events */ + struct cgroup_file events_file; }; struct rdmacg_device { -- cgit v1.2.3 From aefe4847f0891e2e71bedf5478d1cf350f86fc61 Mon Sep 17 00:00:00 2001 From: Tao Cui Date: Thu, 14 May 2026 14:50:33 +0800 Subject: cgroup/rdma: add rdma.events.local for per-cgroup allocation failure attribution Add per-cgroup local event counters to track RDMA resource limit exhaustion from the perspective of individual cgroups. The rdma.events.local file reports two per-resource counters: - max: number of times this cgroup's limit was the one that blocked an allocation in the subtree - alloc_fail: number of allocation attempts originating from this cgroup that failed due to an ancestor's limit This mirrors the design of pids.events.local, where events are attributed to the cgroup that imposed the limit, not necessarily the cgroup where the allocation was attempted. Also extend rdma.events with a hierarchical alloc_fail counter that tracks allocation failures propagating upward from the requesting cgroup, complementing the existing max counter, so that rdma.events and rdma.events.local share the same output format. Signed-off-by: Tao Cui Signed-off-by: Tejun Heo --- include/linux/cgroup_rdma.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/cgroup_rdma.h b/include/linux/cgroup_rdma.h index ac691fe7d3f5..404e746552ca 100644 --- a/include/linux/cgroup_rdma.h +++ b/include/linux/cgroup_rdma.h @@ -25,8 +25,9 @@ struct rdma_cgroup { */ struct list_head rpools; - /* Handle for rdma.events */ + /* Handles for rdma.events[.local] */ struct cgroup_file events_file; + struct cgroup_file events_local_file; }; struct rdmacg_device { -- cgit v1.2.3 From ff205bf8c55451f95300bceed9779b647205a850 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 12 May 2026 15:52:44 +0000 Subject: netlink: add one debug check in nla_nest_end() Add a DEBUG_NET_WARN_ON_ONCE(diff > U16_MAX) to warn if the kernel sends corrupted nested attribute to user space. Offenders can be converted to nla_nest_end_safe(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260512155244.4137851-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/netlink.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/netlink.h b/include/net/netlink.h index 546d10586576..b5048dd1d511 100644 --- a/include/net/netlink.h +++ b/include/net/netlink.h @@ -2260,7 +2260,10 @@ static inline struct nlattr *nla_nest_start(struct sk_buff *skb, int attrtype) */ static inline int nla_nest_end(struct sk_buff *skb, struct nlattr *start) { - start->nla_len = skb_tail_pointer(skb) - (unsigned char *)start; + unsigned long diff = skb_tail_pointer(skb) - (unsigned char *)start; + + DEBUG_NET_WARN_ON_ONCE(diff > U16_MAX); + start->nla_len = diff; return skb->len; } -- cgit v1.2.3 From 72a1795999df1a5cb9296343202f8679151a5ea2 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 13 May 2026 08:08:51 +0000 Subject: net/sched: qdisc_qstats_qlen_backlog() runs locklessly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit qdisc_qstats_qlen_backlog() can be called without qdisc spinlock being held. Use qdisc_qlen_lockless() instead of qdisc_qlen(). Add a const qualifier to its first parameter (struct Qdisc *sch). Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260513080853.1383975-2-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/sch_generic.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index 9e6ed92729d2..d0ca932b1871 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -1070,13 +1070,13 @@ static inline int qdisc_qstats_copy(struct gnet_dump *d, const struct Qdisc *sch return gnet_stats_copy_queue(d, sch->cpu_qstats, &sch->qstats, qlen); } -static inline void qdisc_qstats_qlen_backlog(struct Qdisc *sch, __u32 *qlen, - __u32 *backlog) +static inline void qdisc_qstats_qlen_backlog(const struct Qdisc *sch, + u32 *qlen, u32 *backlog) { struct gnet_stats_queue qstats = { 0 }; gnet_stats_add_queue(&qstats, sch->cpu_qstats, &sch->qstats); - *qlen = qstats.qlen + qdisc_qlen(sch); + *qlen = qstats.qlen + qdisc_qlen_lockless(sch); *backlog = qstats.backlog; } -- cgit v1.2.3 From 4987a5763fd5ab72afde7493216d944d976a0b15 Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Tue, 12 May 2026 16:02:03 +0200 Subject: net: block MSG_NO_SHARED_FRAGS in sendmsg() This change should cause no difference in behavior; it just cleans up some hazardous code that could have become a problem in the future. MSG_NO_SHARED_FRAGS is a kernel-internal flag that cancels the effect of MSG_SPLICE_PAGES, another kernel-internal flag that influences the data-sharing semantics of SKBs. Prevent passing this flag in from userspace via sendmsg() by adding it to MSG_INTERNAL_SENDMSG_FLAGS. This is not currently an observable problem because MSG_NO_SHARED_FRAGS only has an effect if kernel code adds MSG_SPLICE_PAGES to it. The only codepath that adds MSG_SPLICE_PAGES to user-supplied flags from which MSG_NO_SHARED_FRAGS hasn't been cleared is the path tcp_bpf_sendmsg -> tcp_bpf_send_verdict -> tcp_bpf_push, and that is not a problem because tcp_bpf_sendmsg always intentionally sets MSG_NO_SHARED_FRAGS anyway. Signed-off-by: Jann Horn Link: https://patch.msgid.link/20260512-msg_no_shared_frags-v1-1-55ea46760331@google.com Signed-off-by: Jakub Kicinski --- include/linux/socket.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/socket.h b/include/linux/socket.h index ec4a0a025793..1a4d0d128a13 100644 --- a/include/linux/socket.h +++ b/include/linux/socket.h @@ -357,7 +357,7 @@ struct ucred { /* Flags to be cleared on entry by sendmsg and sendmmsg syscalls */ #define MSG_INTERNAL_SENDMSG_FLAGS \ - (MSG_SPLICE_PAGES | MSG_SENDPAGE_NOPOLICY | MSG_SENDPAGE_DECRYPTED) + (MSG_SPLICE_PAGES | MSG_SENDPAGE_NOPOLICY | MSG_SENDPAGE_DECRYPTED | MSG_NO_SHARED_FRAGS) /* Setsockoptions(2) level. Thanks to BSD these must match IPPROTO_xxx */ #define SOL_IP 0 -- cgit v1.2.3 From cb02416507bc0c31415f1527aefc280ae96260bd Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 11 May 2026 00:54:47 -0700 Subject: ALSA: seq: Use flexible array for MIDI channels Store MIDI channel entries in the MIDI channel set allocation instead of allocating them separately. This ties the channel array lifetime directly to the channel set, removes a separate allocation failure path, and lets __counted_by() describe the array bounds. Move the embedded emux channel set to the end of its containing structure so it can carry the flexible array. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20260511075447.445350-1-rosenp@gmail.com Signed-off-by: Takashi Iwai --- include/sound/emux_synth.h | 2 +- include/sound/seq_midi_emul.h | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/sound/emux_synth.h b/include/sound/emux_synth.h index 3f7f365ed248..2c0a976e00ab 100644 --- a/include/sound/emux_synth.h +++ b/include/sound/emux_synth.h @@ -125,7 +125,6 @@ struct snd_emux { */ struct snd_emux_port { - struct snd_midi_channel_set chset; struct snd_emux *emu; char port_mode; /* operation mode */ @@ -138,6 +137,7 @@ struct snd_emux_port { #if IS_ENABLED(CONFIG_SND_SEQUENCER_OSS) struct snd_seq_oss_arg *oss_arg; #endif + struct snd_midi_channel_set chset; }; /* port_mode */ diff --git a/include/sound/seq_midi_emul.h b/include/sound/seq_midi_emul.h index 88799d1e1f53..afc765437870 100644 --- a/include/sound/seq_midi_emul.h +++ b/include/sound/seq_midi_emul.h @@ -55,14 +55,14 @@ struct snd_midi_channel_set { int client; /* Client for this port */ int port; /* The port number */ - int max_channels; /* Size of the channels array */ - struct snd_midi_channel *channels; - unsigned char midi_mode; /* MIDI operating mode */ unsigned char gs_master_volume; /* SYSEX master volume: 0-127 */ unsigned char gs_chorus_mode; unsigned char gs_reverb_mode; + int max_channels; /* Size of the channels array */ + struct snd_midi_channel channels[] __counted_by(max_channels); + }; struct snd_midi_op { -- cgit v1.2.3 From 8549642259cdb405e9815c4d55a7bb32114d42e6 Mon Sep 17 00:00:00 2001 From: Abel Vesa Date: Thu, 14 May 2026 16:36:23 +0300 Subject: dt-bindings: interconnect: qcom,eliza-rpmh: Add SDCC1 slave The Eliza RPMh interconnect binding is missing the SDCC1 CNOC CFG slave ID. Add it so SDCC1 consumer can describe the corresponding interconnect path. Append the new ID to preserve the existing ABI values. Signed-off-by: Abel Vesa Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260514-eliza-interconnect-add-missing-sdcc1-slave-node-v2-1-13c03bc890cb@oss.qualcomm.com Signed-off-by: Georgi Djakov --- include/dt-bindings/interconnect/qcom,eliza-rpmh.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/dt-bindings/interconnect/qcom,eliza-rpmh.h b/include/dt-bindings/interconnect/qcom,eliza-rpmh.h index 95db2fe647de..dfe99feefb27 100644 --- a/include/dt-bindings/interconnect/qcom,eliza-rpmh.h +++ b/include/dt-bindings/interconnect/qcom,eliza-rpmh.h @@ -57,6 +57,7 @@ #define SLAVE_PCIE_ANOC_CFG 27 #define SLAVE_QDSS_STM 28 #define SLAVE_TCU 29 +#define SLAVE_SDCC_1 30 #define MASTER_GEM_NOC_CNOC 0 #define MASTER_GEM_NOC_PCIE_SNOC 1 -- cgit v1.2.3 From 2abdc3dcf9780d070e55a99fdf8f93440c798b84 Mon Sep 17 00:00:00 2001 From: Marek Vasut Date: Sat, 2 May 2026 20:55:42 +0200 Subject: dt-bindings: clock: renesas,cpg-clocks: Document ZT/ZTR trace clock on R-Mobile APE6 Document the ZT trace bus and ZTR trace clocks on R-Mobile APE6. These clocks supply the coresight tracing modules, PTM, TPIU, ETB and replicator. Without these clocks, coresight tracing can not be operated. While this does change the ABI, it does so by extending the existing clock-output-names, therefore if old software is used with new DT, the coresight tracing parts will likely fail to probe, otherwise if new software is used with an old DT, there is no impact. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20260502185557.93061-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven --- include/dt-bindings/clock/r8a73a4-clock.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/clock/r8a73a4-clock.h b/include/dt-bindings/clock/r8a73a4-clock.h index 655440a3e7c6..028ecef81451 100644 --- a/include/dt-bindings/clock/r8a73a4-clock.h +++ b/include/dt-bindings/clock/r8a73a4-clock.h @@ -23,6 +23,8 @@ #define R8A73A4_CLK_ZX 13 #define R8A73A4_CLK_ZS 14 #define R8A73A4_CLK_HP 15 +#define R8A73A4_CLK_ZTR 16 +#define R8A73A4_CLK_ZT 17 /* MSTP1 */ #define R8A73A4_CLK_TMU0 25 -- cgit v1.2.3 From 34fc7eedc3a0e150086024c450218aba6efaf4cd Mon Sep 17 00:00:00 2001 From: Svyatoslav Ryhel Date: Wed, 6 May 2026 09:48:45 +0300 Subject: media: i2c: lm3560: Convert to use OF bindings Since there are no users of this driver via platform data, remove the platform data support and switch to using Device Tree bindings. Converting to Device Tree assumes dynamic and independent registration of LEDs. To monitor the configured LEDs, a bitmap has been added. This makes LED cleanup more robust and less context dependent. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Sakari Ailus --- include/media/i2c/lm3560.h | 15 --------------- 1 file changed, 15 deletions(-) (limited to 'include') diff --git a/include/media/i2c/lm3560.h b/include/media/i2c/lm3560.h index 770d8c72c94a..b56c1ff8fd49 100644 --- a/include/media/i2c/lm3560.h +++ b/include/media/i2c/lm3560.h @@ -66,19 +66,4 @@ enum lm3560_peak_current { LM3560_PEAK_3600mA = 0x60 }; -/* struct lm3560_platform_data - * - * @peak : peak current - * @max_flash_timeout: flash timeout - * @max_flash_brt: flash mode led brightness - * @max_torch_brt: torch mode led brightness - */ -struct lm3560_platform_data { - enum lm3560_peak_current peak; - - u32 max_flash_timeout; - u32 max_flash_brt[LM3560_LED_MAX]; - u32 max_torch_brt[LM3560_LED_MAX]; -}; - #endif /* __LM3560_H__ */ -- cgit v1.2.3 From dd9a02fc75cefc84024eb658c9e528cc97ca4eda Mon Sep 17 00:00:00 2001 From: Svyatoslav Ryhel Date: Wed, 6 May 2026 09:48:47 +0300 Subject: media: i2c: lm3560: Add proper support for LM3559 The LM3559 is very similar to the LM3560, but it operates at much lower currents. This may result in incorrect current selection if LM3560 ranges are applied to the LM3559. Implement driver data matching to use device-specific current configurations. Since the driver no longer supports platform data and device configuration is performed more granularly, move the remaining enums from the header into the driver file and remove the header. Signed-off-by: Svyatoslav Ryhel Signed-off-by: Sakari Ailus --- include/media/i2c/lm3560.h | 69 ---------------------------------------------- 1 file changed, 69 deletions(-) delete mode 100644 include/media/i2c/lm3560.h (limited to 'include') diff --git a/include/media/i2c/lm3560.h b/include/media/i2c/lm3560.h deleted file mode 100644 index b56c1ff8fd49..000000000000 --- a/include/media/i2c/lm3560.h +++ /dev/null @@ -1,69 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * include/media/i2c/lm3560.h - * - * Copyright (C) 2013 Texas Instruments - * - * Contact: Daniel Jeong - * Ldd-Mlp - */ - -#ifndef __LM3560_H__ -#define __LM3560_H__ - -#include - -#define LM3559_NAME "lm3559" -#define LM3560_NAME "lm3560" -#define LM3560_I2C_ADDR (0x53) - -/* FLASH Brightness - * min 62500uA, step 62500uA, max 1000000uA - */ -#define LM3560_FLASH_BRT_MIN 62500 -#define LM3560_FLASH_BRT_STEP 62500 -#define LM3560_FLASH_BRT_MAX 1000000 -#define LM3560_FLASH_BRT_uA_TO_REG(a) \ - ((a) < LM3560_FLASH_BRT_MIN ? 0 : \ - (((a) - LM3560_FLASH_BRT_MIN) / LM3560_FLASH_BRT_STEP)) -#define LM3560_FLASH_BRT_REG_TO_uA(a) \ - ((a) * LM3560_FLASH_BRT_STEP + LM3560_FLASH_BRT_MIN) - -/* FLASH TIMEOUT DURATION - * min 32ms, step 32ms, max 1024ms - */ -#define LM3560_FLASH_TOUT_MIN 32 -#define LM3560_FLASH_TOUT_STEP 32 -#define LM3560_FLASH_TOUT_MAX 1024 -#define LM3560_FLASH_TOUT_ms_TO_REG(a) \ - ((a) < LM3560_FLASH_TOUT_MIN ? 0 : \ - (((a) - LM3560_FLASH_TOUT_MIN) / LM3560_FLASH_TOUT_STEP)) -#define LM3560_FLASH_TOUT_REG_TO_ms(a) \ - ((a) * LM3560_FLASH_TOUT_STEP + LM3560_FLASH_TOUT_MIN) - -/* TORCH BRT - * min 31250uA, step 31250uA, max 250000uA - */ -#define LM3560_TORCH_BRT_MIN 31250 -#define LM3560_TORCH_BRT_STEP 31250 -#define LM3560_TORCH_BRT_MAX 250000 -#define LM3560_TORCH_BRT_uA_TO_REG(a) \ - ((a) < LM3560_TORCH_BRT_MIN ? 0 : \ - (((a) - LM3560_TORCH_BRT_MIN) / LM3560_TORCH_BRT_STEP)) -#define LM3560_TORCH_BRT_REG_TO_uA(a) \ - ((a) * LM3560_TORCH_BRT_STEP + LM3560_TORCH_BRT_MIN) - -enum lm3560_led_id { - LM3560_LED0 = 0, - LM3560_LED1, - LM3560_LED_MAX -}; - -enum lm3560_peak_current { - LM3560_PEAK_1600mA = 0x00, - LM3560_PEAK_2300mA = 0x20, - LM3560_PEAK_3000mA = 0x40, - LM3560_PEAK_3600mA = 0x60 -}; - -#endif /* __LM3560_H__ */ -- cgit v1.2.3 From 64cf531f9900c011afe97a28c8ef464d551cec1b Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Fri, 15 May 2026 06:55:30 +0200 Subject: block: remove zero_fill_bio_iter Only used to implement zero_fill_bio, so directly implement that. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260515045547.3790129-2-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/bio.h | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/bio.h b/include/linux/bio.h index 97d747320b35..84643fc0fb08 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -482,13 +482,8 @@ extern void bio_copy_data_iter(struct bio *dst, struct bvec_iter *dst_iter, struct bio *src, struct bvec_iter *src_iter); extern void bio_copy_data(struct bio *dst, struct bio *src); extern void bio_free_pages(struct bio *bio); +void zero_fill_bio(struct bio *bio); void guard_bio_eod(struct bio *bio); -void zero_fill_bio_iter(struct bio *bio, struct bvec_iter iter); - -static inline void zero_fill_bio(struct bio *bio) -{ - zero_fill_bio_iter(bio, bio->bi_iter); -} static inline void bio_release_pages(struct bio *bio, bool mark_dirty) { -- cgit v1.2.3 From 8d57b5876d39679c81d479485422e88319f17418 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Fri, 15 May 2026 06:55:31 +0200 Subject: block: remove bio_copy_data_iter Only used by bio_copy_data, so implement that directly. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260515045547.3790129-3-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/bio.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/bio.h b/include/linux/bio.h index 84643fc0fb08..85463981d0f5 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -478,8 +478,6 @@ extern void bio_check_pages_dirty(struct bio *bio); int bio_iov_iter_bounce(struct bio *bio, struct iov_iter *iter, size_t maxlen); void bio_iov_iter_unbounce(struct bio *bio, bool is_error, bool mark_dirty); -extern void bio_copy_data_iter(struct bio *dst, struct bvec_iter *dst_iter, - struct bio *src, struct bvec_iter *src_iter); extern void bio_copy_data(struct bio *dst, struct bio *src); extern void bio_free_pages(struct bio *bio); void zero_fill_bio(struct bio *bio); -- cgit v1.2.3 From 82aaa55a3162acaad10baced6f87126a4454a0d7 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Fri, 15 May 2026 06:55:33 +0200 Subject: block: unexport blk_status_to_str Only used in core block code, so unexport and move the prototype to blk.h. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260515045547.3790129-5-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/blkdev.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 890128cdea1c..17270a28c66d 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -1040,7 +1040,6 @@ extern const char *blk_op_str(enum req_op op); int blk_status_to_errno(blk_status_t status); blk_status_t errno_to_blk_status(int errno); -const char *blk_status_to_str(blk_status_t status); /* only poll the hardware once, don't continue until a completion was found */ #define BLK_POLL_ONESHOT (1 << 0) -- cgit v1.2.3 From 5de2759f2b7c925f187e552cae47775acd5f4b40 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Thu, 14 May 2026 08:07:18 -0600 Subject: eventpoll: export is_file_epoll() Make is_file_epoll() available outside of epoll. This is in preparation from using it from io_uring. Signed-off-by: Jens Axboe Link: https://patch.msgid.link/20260514140817.623026-3-axboe@kernel.dk Reviewed-by: Christian Brauner Signed-off-by: Christian Brauner --- include/linux/eventpoll.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h index 728fb5dee5ed..7bf30e9f90d7 100644 --- a/include/linux/eventpoll.h +++ b/include/linux/eventpoll.h @@ -63,6 +63,7 @@ static inline void eventpoll_release(struct file *file) int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, bool nonblock); +int is_file_epoll(struct file *f); /* Tells if the epoll_ctl(2) operation needs an event copy from userspace */ static inline int ep_op_has_event(int op) -- cgit v1.2.3 From 0995baf261ce8fc141768911d97ba76e854e26cf Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Thu, 14 May 2026 08:07:19 -0600 Subject: eventpoll: add file based control interface Add do_epoll_ctl_file(), which takes a pre-resolved epoll file and a struct epoll_filefd for the target rather than two integer file descriptors. do_epoll_ctl() remains as a thin wrapper. In preparation for using the file based interface from io_uring. Signed-off-by: Jens Axboe Link: https://patch.msgid.link/20260514140817.623026-4-axboe@kernel.dk Signed-off-by: Christian Brauner --- include/linux/eventpoll.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h index 7bf30e9f90d7..4a6fe989810b 100644 --- a/include/linux/eventpoll.h +++ b/include/linux/eventpoll.h @@ -61,6 +61,13 @@ static inline void eventpoll_release(struct file *file) eventpoll_release_file(file); } +struct epoll_filefd { + struct file *file; + int fd; +} __packed; + +int do_epoll_ctl_file(struct file *f, int op, struct epoll_filefd *tf, + struct epoll_event *epds, bool nonblock); int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, bool nonblock); int is_file_epoll(struct file *f); -- cgit v1.2.3 From 463aba8090738bcd956297f7341b6874e76ae664 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Thu, 14 May 2026 08:07:20 -0600 Subject: eventpoll: rename struct epoll_filefd to epoll_key This more accurately describes what purpose this structure serves, as a lookup key. Suggested-by: Christian Brauner Signed-off-by: Jens Axboe Link: https://patch.msgid.link/20260514140817.623026-5-axboe@kernel.dk Signed-off-by: Christian Brauner --- include/linux/eventpoll.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h index 4a6fe989810b..c214c374fefc 100644 --- a/include/linux/eventpoll.h +++ b/include/linux/eventpoll.h @@ -61,12 +61,12 @@ static inline void eventpoll_release(struct file *file) eventpoll_release_file(file); } -struct epoll_filefd { +struct epoll_key { struct file *file; int fd; } __packed; -int do_epoll_ctl_file(struct file *f, int op, struct epoll_filefd *tf, +int do_epoll_ctl_file(struct file *f, int op, struct epoll_key *tf, struct epoll_event *epds, bool nonblock); int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, bool nonblock); -- cgit v1.2.3 From 45e57cfb7b10b64fb0d38d671d26ec935fc7efce Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Fri, 15 May 2026 11:35:12 -0400 Subject: fs: Clarify FS_CASEFOLD_FL semantics in UAPI header The existing one-liner "Folder is case insensitive" leaves the impression that FS_CASEFOLD_FL is reserved for directories. That impression is wrong: filesystems that derive case-insensitivity from mount or volume state report the bit on non-directory inodes via i_op->fileattr_get, so userspace inspecting FS_IOC_GETFLAGS can see it on any inode type. Replace the one-liner with a block comment that names directories as the typical case, records that non-directory inodes may also report the bit, and notes FS_XFLAG_CASEFOLD as the read-only companion exposed through FS_IOC_FSGETXATTR. Reported-by: sashiko-bot Closes: https://sashiko.dev/#/patchset/20260507-case-sensitivity-v14-0-e62cc8200435@oracle.com?part=3 Signed-off-by: Chuck Lever Link: https://patch.msgid.link/20260515153515.362266-5-cel@kernel.org Signed-off-by: Christian Brauner --- include/uapi/linux/fs.h | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h index 2ea4c81df08f..bd87262f2e34 100644 --- a/include/uapi/linux/fs.h +++ b/include/uapi/linux/fs.h @@ -395,7 +395,16 @@ struct file_attr { #define FS_DAX_FL 0x02000000 /* Inode is DAX */ #define FS_INLINE_DATA_FL 0x10000000 /* Reserved for ext4 */ #define FS_PROJINHERIT_FL 0x20000000 /* Create with parents projid */ -#define FS_CASEFOLD_FL 0x40000000 /* Folder is case insensitive */ +/* + * FS_CASEFOLD_FL indicates case-insensitive name lookup. The + * bit is most often reported on directories, where it controls + * lookups of entries within. Filesystems that derive + * case-insensitivity from mount or volume state may also report + * it on non-directory inodes; userspace must not assume the bit + * is directory-only. FS_XFLAG_CASEFOLD reports the same + * information read-only via FS_IOC_FSGETXATTR. + */ +#define FS_CASEFOLD_FL 0x40000000 #define FS_RESERVED_FL 0x80000000 /* reserved for ext2 lib */ #define FS_FL_USER_VISIBLE 0x0003DFFF /* User visible flags */ -- cgit v1.2.3 From 3360a5c16d87933fb74b530f5e016eb3dfffee5d Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Mon, 4 May 2026 14:51:17 -1000 Subject: cgroup: Inline cgroup_has_tasks() in cgroup.h cpuset reads cs->css.cgroup->nr_populated_csets directly in two places to test whether a cgroup has tasks. cgroup.c already has a matching helper, cgroup_has_tasks(). Move it to cgroup.h as static inline and use that instead. This is to prepare for relocation of cgroup->nr_populated_csets. No semantic change. Signed-off-by: Tejun Heo --- include/linux/cgroup.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index e52160e85af4..ceb87507667e 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -639,6 +639,11 @@ static inline bool task_under_cgroup_hierarchy(struct task_struct *task, return cgroup_is_descendant(cset->dfl_cgrp, ancestor); } +static inline bool cgroup_has_tasks(struct cgroup *cgrp) +{ + return cgrp->nr_populated_csets; +} + /* no synchronization, the result can only be used as a hint */ static inline bool cgroup_is_populated(struct cgroup *cgrp) { -- cgit v1.2.3 From 44fabf05634ce9e90b3fb179ea962995b7bbaa09 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Mon, 4 May 2026 14:51:18 -1000 Subject: cgroup: Annotate unlocked nr_populated_* accesses with READ_ONCE/WRITE_ONCE cgroup_update_populated() updates nr_populated_csets, nr_populated_domain_children, and nr_populated_threaded_children under css_set_lock, but cgroup_has_tasks(), cgroup_is_populated(), and cgroup_can_be_thread_root() read them without holding it. Use READ_ONCE/WRITE_ONCE. Signed-off-by: Tejun Heo --- include/linux/cgroup.h | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index ceb87507667e..9f8bef8f3a60 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -639,16 +639,29 @@ static inline bool task_under_cgroup_hierarchy(struct task_struct *task, return cgroup_is_descendant(cset->dfl_cgrp, ancestor); } +/* + * Populated counters: writes happen under css_set_lock. The accessors below + * may read unlocked. What an unpopulated result means depends on context: + * + * - No lock held. Just a snapshot. May race with concurrent updates and is + * useful only as a hint. + * + * - cgroup_mutex held. Migration into the cgroup is blocked, so an observed + * !populated stays !populated until cgroup_mutex is dropped. + * + * - CSS_DYING set. The css can no longer be repopulated, so !populated is + * sticky once observed. + */ static inline bool cgroup_has_tasks(struct cgroup *cgrp) { - return cgrp->nr_populated_csets; + return READ_ONCE(cgrp->nr_populated_csets); } -/* no synchronization, the result can only be used as a hint */ static inline bool cgroup_is_populated(struct cgroup *cgrp) { - return cgrp->nr_populated_csets + cgrp->nr_populated_domain_children + - cgrp->nr_populated_threaded_children; + return READ_ONCE(cgrp->nr_populated_csets) + + READ_ONCE(cgrp->nr_populated_domain_children) + + READ_ONCE(cgrp->nr_populated_threaded_children); } /* returns ino associated with a cgroup */ -- cgit v1.2.3 From c4799253a3ee74ebb27be72fb991c597a5902c01 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Mon, 4 May 2026 14:51:19 -1000 Subject: cgroup: Move populated counters to cgroup_subsys_state Later patches replace the cgroup-level finish_destroy_work deferral added by 93618edf7538 ("cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated") with a per-subsys-css deferral. That needs each subsystem css to track its own populated count. Move the populated counters from cgroup onto cgroup_subsys_state. cgroup->self is itself a cgroup_subsys_state and self.parent walks the same chain as cgroup_parent(), so cgroup_update_populated() generalizes to a single css_update_populated() taking a css. The cgroup-side bookkeeping runs only when the walk started from a self css. Keep nr_populated_{domain,threaded}_children on cgroup. Both sum to self.nr_populated_children, but staying as dedicated fields to allow readers like cgroup_can_be_thread_root() unlocked access. css_set_update_populated() also walks the per-subsys-css chain so each subsystem css's hierarchical populated count is maintained. No reader consumes those counts yet. Signed-off-by: Tejun Heo --- include/linux/cgroup-defs.h | 24 ++++++++++++++---------- include/linux/cgroup.h | 11 +++++++---- 2 files changed, 21 insertions(+), 14 deletions(-) (limited to 'include') diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h index 50a784da7a81..c4929f7bbe5a 100644 --- a/include/linux/cgroup-defs.h +++ b/include/linux/cgroup-defs.h @@ -253,6 +253,15 @@ struct cgroup_subsys_state { */ int nr_descendants; + /* + * Hierarchical populated state. For cgroup->self, nr_populated_csets + * counts populated csets linked via cgrp_cset_link. + * nr_populated_children counts immediate-child csses whose own + * populated state is nonzero. Protected by css_set_lock. + */ + int nr_populated_csets; + int nr_populated_children; + /* * A singly-linked list of css structures to be rstat flushed. * This is a scratch field to be used exclusively by @@ -504,17 +513,12 @@ struct cgroup { int max_descendants; /* - * Each non-empty css_set associated with this cgroup contributes - * one to nr_populated_csets. The counter is zero iff this cgroup - * doesn't have any tasks. - * - * All children which have non-zero nr_populated_csets and/or - * nr_populated_children of their own contribute one to either - * nr_populated_domain_children or nr_populated_threaded_children - * depending on their type. Each counter is zero iff all cgroups - * of the type in the subtree proper don't have any tasks. + * Domain/threaded split of self.nr_populated_children: each counts + * immediate-child cgroups whose subtree is populated and sums to + * self.nr_populated_children. Kept as separate fields to allow readers + * like cgroup_can_be_thread_root() unlocked access. Protected by + * css_set_lock; updated by css_update_populated(). */ - int nr_populated_csets; int nr_populated_domain_children; int nr_populated_threaded_children; diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index 9f8bef8f3a60..c2a8c38d8206 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -654,14 +654,17 @@ static inline bool task_under_cgroup_hierarchy(struct task_struct *task, */ static inline bool cgroup_has_tasks(struct cgroup *cgrp) { - return READ_ONCE(cgrp->nr_populated_csets); + return READ_ONCE(cgrp->self.nr_populated_csets); +} + +static inline bool css_is_populated(struct cgroup_subsys_state *css) +{ + return READ_ONCE(css->nr_populated_csets) || READ_ONCE(css->nr_populated_children); } static inline bool cgroup_is_populated(struct cgroup *cgrp) { - return READ_ONCE(cgrp->nr_populated_csets) + - READ_ONCE(cgrp->nr_populated_domain_children) + - READ_ONCE(cgrp->nr_populated_threaded_children); + return css_is_populated(&cgrp->self); } /* returns ino associated with a cgroup */ -- cgit v1.2.3 From cfc1da7e1127b4c8787f4dc25d59987c10c9107f Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Mon, 4 May 2026 14:51:20 -1000 Subject: cgroup: Add per-subsys-css kill_css_finish deferral 93618edf7538 ("cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated") deferred kill_css_finish() at the cgroup level: rmdir waits for the entire cgroup's populated count to drop to zero, then fires kill_css_finish() on every subsystem css at once. Replace that with per-subsys-css deferral. Each subsystem css now tracks its own hierarchical populated count and independently defers its kill_css_finish() until its own subtree drains. The rmdir-race fix carries through unchanged in shape. The dying css's ->css_offline() still waits until no PF_EXITING task references it, and v2's cgroup-level machinery goes away. cgroup_apply_control_disable() has the same race shape (PF_EXITING tasks pinning a css whose ->css_offline() is about to run) and stays synchronous here. This patch lays the groundwork for fixing it - per-cgroup waiting can't gate one subsys css being killed while the rest of the cgroup stays live, but per-css can. Subtree-wide invariant preserved: a dying ancestor css stays populated through nr_populated_children until every dying descendant's task drains, so the walker fires the ancestor's kill_finish_work only after all descendants have drained. Add paired smp_mb()s in kill_css_sync() and css_update_populated() to fence the StoreLoad on (CSS_DYING, populated counter), guaranteeing that either the walker queues kill_finish_work or the caller fires synchronously. cgroup_destroy_locked() was implicitly fenced by an unrelated css_set_lock pair; cgroup_apply_control_disable() in the next patch is not. Signed-off-by: Tejun Heo --- include/linux/cgroup-defs.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h index c4929f7bbe5a..de2cd6238c2a 100644 --- a/include/linux/cgroup-defs.h +++ b/include/linux/cgroup-defs.h @@ -262,6 +262,9 @@ struct cgroup_subsys_state { int nr_populated_csets; int nr_populated_children; + /* deferred kill_css_finish() queued by css_update_populated() */ + struct work_struct kill_finish_work; + /* * A singly-linked list of css structures to be rstat flushed. * This is a scratch field to be used exclusively by @@ -615,9 +618,6 @@ struct cgroup { /* used to wait for offlining of csses */ wait_queue_head_t offline_waitq; - /* defers killing csses after removal until cgroup is depopulated */ - struct work_struct finish_destroy_work; - /* used to schedule release agent */ struct work_struct release_agent_work; -- cgit v1.2.3 From 24cbf43337f46329ddda5983bc3c585174a020ee Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 28 Apr 2026 08:09:46 +0100 Subject: filelock: add support for ignoring deleg breaks for dir change events If a NFS client requests a directory delegation with a notification bitmask covering directory change events, the server shouldn't recall the delegation. Instead the client will be notified of the change after the fact. Add support for ignoring lease breaks on directory changes. Add a new flags parameter to try_break_deleg() and teach __break_lease how to ignore certain types of delegation break events. Reviewed-by: Jan Kara Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260428-dir-deleg-v3-2-5a0780ba9def@kernel.org Acked-by: Chuck Lever Signed-off-by: Christian Brauner --- include/linux/filelock.h | 53 ++++++++++++++++++++++++++++------------- include/trace/events/filelock.h | 5 +++- 2 files changed, 41 insertions(+), 17 deletions(-) (limited to 'include') diff --git a/include/linux/filelock.h b/include/linux/filelock.h index 5f0a2fb31450..9dd4e67a6f30 100644 --- a/include/linux/filelock.h +++ b/include/linux/filelock.h @@ -4,19 +4,22 @@ #include -#define FL_POSIX 1 -#define FL_FLOCK 2 -#define FL_DELEG 4 /* NFSv4 delegation */ -#define FL_ACCESS 8 /* not trying to lock, just looking */ -#define FL_EXISTS 16 /* when unlocking, test for existence */ -#define FL_LEASE 32 /* lease held on this file */ -#define FL_CLOSE 64 /* unlock on close */ -#define FL_SLEEP 128 /* A blocking lock */ -#define FL_DOWNGRADE_PENDING 256 /* Lease is being downgraded */ -#define FL_UNLOCK_PENDING 512 /* Lease is being broken */ -#define FL_OFDLCK 1024 /* lock is "owned" by struct file */ -#define FL_LAYOUT 2048 /* outstanding pNFS layout */ -#define FL_RECLAIM 4096 /* reclaiming from a reboot server */ +#define FL_POSIX BIT(0) /* POSIX lock */ +#define FL_FLOCK BIT(1) /* BSD lock */ +#define FL_DELEG BIT(2) /* NFSv4 delegation */ +#define FL_ACCESS BIT(3) /* not trying to lock, just looking */ +#define FL_EXISTS BIT(4) /* when unlocking, test for existence */ +#define FL_LEASE BIT(5) /* file lease */ +#define FL_CLOSE BIT(6) /* unlock on close */ +#define FL_SLEEP BIT(7) /* A blocking lock */ +#define FL_DOWNGRADE_PENDING BIT(8) /* Lease is being downgraded */ +#define FL_UNLOCK_PENDING BIT(9) /* Lease is being broken */ +#define FL_OFDLCK BIT(10) /* POSIX lock "owned" by struct file */ +#define FL_LAYOUT BIT(11) /* outstanding pNFS layout */ +#define FL_RECLAIM BIT(12) /* reclaiming from a reboot server */ +#define FL_IGN_DIR_CREATE BIT(13) /* ignore DIR_CREATE events */ +#define FL_IGN_DIR_DELETE BIT(14) /* ignore DIR_DELETE events */ +#define FL_IGN_DIR_RENAME BIT(15) /* ignore DIR_RENAME events */ #define FL_CLOSE_POSIX (FL_POSIX | FL_CLOSE) @@ -222,6 +225,10 @@ struct file_lease *locks_alloc_lease(void); #define LEASE_BREAK_LAYOUT BIT(2) // break layouts only #define LEASE_BREAK_NONBLOCK BIT(3) // non-blocking break #define LEASE_BREAK_OPEN_RDONLY BIT(4) // readonly open event +#define LEASE_BREAK_DIR_CREATE BIT(5) // dir deleg create event +#define LEASE_BREAK_DIR_DELETE BIT(6) // dir deleg delete event +#define LEASE_BREAK_DIR_RENAME BIT(7) // dir deleg rename event + int __break_lease(struct inode *inode, unsigned int flags); void lease_get_mtime(struct inode *, struct timespec64 *time); @@ -516,12 +523,26 @@ static inline bool is_delegated(struct delegated_inode *di) return di->di_inode; } -static inline int try_break_deleg(struct inode *inode, +/** + * try_break_deleg - do a non-blocking delegation break + * @inode: inode that should have its delegations broken + * @flags: extra LEASE_BREAK_* flags to pass to break_deleg() + * @di: returns pointer to delegated inode (may be NULL) + * + * Break delegations in a non-blocking fashion. If there are + * outstanding delegations and @di is set, then an extra reference + * will be taken on @inode and @di->di_inode will be populated so + * that it may be waited upon. + * + * Returns 0 if there is no need to wait or an error. If -EWOULDBLOCK + * is returned, then @di will be populated (if non-NULL). + */ +static inline int try_break_deleg(struct inode *inode, unsigned int flags, struct delegated_inode *di) { int ret; - ret = break_deleg(inode, LEASE_BREAK_NONBLOCK); + ret = break_deleg(inode, flags | LEASE_BREAK_NONBLOCK); if (ret == -EWOULDBLOCK && di) { di->di_inode = inode; ihold(inode); @@ -574,7 +595,7 @@ static inline int break_deleg(struct inode *inode, unsigned int flags) return 0; } -static inline int try_break_deleg(struct inode *inode, +static inline int try_break_deleg(struct inode *inode, unsigned int flags, struct delegated_inode *delegated_inode) { return 0; diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h index 116774886244..718b5c3f1737 100644 --- a/include/trace/events/filelock.h +++ b/include/trace/events/filelock.h @@ -28,7 +28,10 @@ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \ { FL_OFDLCK, "FL_OFDLCK" }, \ - { FL_RECLAIM, "FL_RECLAIM"}) + { FL_RECLAIM, "FL_RECLAIM" }, \ + { FL_IGN_DIR_CREATE, "FL_IGN_DIR_CREATE" }, \ + { FL_IGN_DIR_DELETE, "FL_IGN_DIR_DELETE" }, \ + { FL_IGN_DIR_RENAME, "FL_IGN_DIR_RENAME" }) #define show_fl_type(val) \ __print_symbolic(val, \ -- cgit v1.2.3 From e39026a86b485b052ddff1145f5601fc0d04305f Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 28 Apr 2026 08:09:47 +0100 Subject: filelock: add a tracepoint to start of break_lease() ...mostly to show the LEASE_BREAK_* flags. Reviewed-by: Jan Kara Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260428-dir-deleg-v3-3-5a0780ba9def@kernel.org Acked-by: Chuck Lever Signed-off-by: Christian Brauner --- include/trace/events/filelock.h | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) (limited to 'include') diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h index 718b5c3f1737..f2bb6b7aa281 100644 --- a/include/trace/events/filelock.h +++ b/include/trace/events/filelock.h @@ -120,6 +120,39 @@ DEFINE_EVENT(filelock_lock, flock_lock_inode, TP_PROTO(struct inode *inode, struct file_lock *fl, int ret), TP_ARGS(inode, fl, ret)); +#define show_lease_break_flags(val) \ + __print_flags(val, "|", \ + { LEASE_BREAK_LEASE, "LEASE" }, \ + { LEASE_BREAK_DELEG, "DELEG" }, \ + { LEASE_BREAK_LAYOUT, "LAYOUT" }, \ + { LEASE_BREAK_NONBLOCK, "NONBLOCK" }, \ + { LEASE_BREAK_OPEN_RDONLY, "OPEN_RDONLY" }, \ + { LEASE_BREAK_DIR_CREATE, "DIR_CREATE" }, \ + { LEASE_BREAK_DIR_DELETE, "DIR_DELETE" }, \ + { LEASE_BREAK_DIR_RENAME, "DIR_RENAME" }) + +TRACE_EVENT(break_lease, + TP_PROTO(struct inode *inode, unsigned int flags), + + TP_ARGS(inode, flags), + + TP_STRUCT__entry( + __field(unsigned long, i_ino) + __field(dev_t, s_dev) + __field(unsigned int, flags) + ), + + TP_fast_assign( + __entry->s_dev = inode->i_sb->s_dev; + __entry->i_ino = inode->i_ino; + __entry->flags = flags; + ), + + TP_printk("dev=0x%x:0x%x ino=0x%lx flags=%s", + MAJOR(__entry->s_dev), MINOR(__entry->s_dev), + __entry->i_ino, show_lease_break_flags(__entry->flags)) +); + DECLARE_EVENT_CLASS(filelock_lease, TP_PROTO(struct inode *inode, struct file_lease *fl), -- cgit v1.2.3 From 95825fdcc0b0e868571d1c755f6a6971caf9b7cb Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 28 Apr 2026 08:09:48 +0100 Subject: filelock: add an inode_lease_ignore_mask helper Add a new routine that returns a mask of all dir change events that are currently ignored by any leases. nfsd will use this to determine how to configure the fsnotify_mark mask. Reviewed-by: Jan Kara Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260428-dir-deleg-v3-4-5a0780ba9def@kernel.org Acked-by: Chuck Lever Signed-off-by: Christian Brauner --- include/linux/filelock.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/filelock.h b/include/linux/filelock.h index 9dd4e67a6f30..6e125902c58a 100644 --- a/include/linux/filelock.h +++ b/include/linux/filelock.h @@ -236,6 +236,7 @@ int generic_setlease(struct file *, int, struct file_lease **, void **priv); int kernel_setlease(struct file *, int, struct file_lease **, void **); int vfs_setlease(struct file *, int, struct file_lease **, void **); int lease_modify(struct file_lease *, int, struct list_head *); +u32 inode_lease_ignore_mask(struct inode *inode); struct notifier_block; int lease_register_notifier(struct notifier_block *); -- cgit v1.2.3 From ad4489dcd08dcfbc32ea6e6a4f558cdd459bd80c Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 28 Apr 2026 08:09:49 +0100 Subject: fsnotify: new tracepoint in fsnotify() Add a tracepoint so we can see exactly how this is being called. Reviewed-by: Jan Kara Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260428-dir-deleg-v3-5-5a0780ba9def@kernel.org Acked-by: Chuck Lever Signed-off-by: Christian Brauner --- include/trace/events/fsnotify.h | 51 +++++++++++++++++++++++++++++++++++++++++ include/trace/misc/fsnotify.h | 35 ++++++++++++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 include/trace/events/fsnotify.h create mode 100644 include/trace/misc/fsnotify.h (limited to 'include') diff --git a/include/trace/events/fsnotify.h b/include/trace/events/fsnotify.h new file mode 100644 index 000000000000..341bbd57a39b --- /dev/null +++ b/include/trace/events/fsnotify.h @@ -0,0 +1,51 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#undef TRACE_SYSTEM +#define TRACE_SYSTEM fsnotify + +#if !defined(_TRACE_FSNOTIFY_H) || defined(TRACE_HEADER_MULTI_READ) +#define _TRACE_FSNOTIFY_H + +#include + +#include + +TRACE_EVENT(fsnotify, + TP_PROTO(__u32 mask, const void *data, int data_type, + struct inode *dir, const struct qstr *file_name, + struct inode *inode, u32 cookie), + + TP_ARGS(mask, data, data_type, dir, file_name, inode, cookie), + + TP_STRUCT__entry( + __field(__u32, mask) + __field(unsigned long, dir_ino) + __field(unsigned long, ino) + __field(dev_t, s_dev) + __field(int, data_type) + __field(u32, cookie) + __string(file_name, file_name ? (const char *)file_name->name : "") + ), + + TP_fast_assign( + __entry->mask = mask; + __entry->dir_ino = dir ? dir->i_ino : 0; + __entry->ino = inode ? inode->i_ino : 0; + __entry->s_dev = dir ? dir->i_sb->s_dev : + inode ? inode->i_sb->s_dev : 0; + __entry->data_type = data_type; + __entry->cookie = cookie; + __assign_str(file_name); + ), + + TP_printk("dev=%d:%d dir=%lu ino=%lu data_type=%d cookie=0x%x mask=0x%x %s name=%s", + MAJOR(__entry->s_dev), MINOR(__entry->s_dev), + __entry->dir_ino, __entry->ino, + __entry->data_type, __entry->cookie, + __entry->mask, show_fsnotify_mask(__entry->mask), + __get_str(file_name)) +); + +#endif /* _TRACE_FSNOTIFY_H */ + +/* This part must be outside protection */ +#include diff --git a/include/trace/misc/fsnotify.h b/include/trace/misc/fsnotify.h new file mode 100644 index 000000000000..a201e1bd6d8c --- /dev/null +++ b/include/trace/misc/fsnotify.h @@ -0,0 +1,35 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Display helpers for fsnotify events + */ + +#include + +#define show_fsnotify_mask(mask) \ + __print_flags(mask, "|", \ + { FS_ACCESS, "ACCESS" }, \ + { FS_MODIFY, "MODIFY" }, \ + { FS_ATTRIB, "ATTRIB" }, \ + { FS_CLOSE_WRITE, "CLOSE_WRITE" }, \ + { FS_CLOSE_NOWRITE, "CLOSE_NOWRITE" }, \ + { FS_OPEN, "OPEN" }, \ + { FS_MOVED_FROM, "MOVED_FROM" }, \ + { FS_MOVED_TO, "MOVED_TO" }, \ + { FS_CREATE, "CREATE" }, \ + { FS_DELETE, "DELETE" }, \ + { FS_DELETE_SELF, "DELETE_SELF" }, \ + { FS_MOVE_SELF, "MOVE_SELF" }, \ + { FS_OPEN_EXEC, "OPEN_EXEC" }, \ + { FS_UNMOUNT, "UNMOUNT" }, \ + { FS_Q_OVERFLOW, "Q_OVERFLOW" }, \ + { FS_ERROR, "ERROR" }, \ + { FS_OPEN_PERM, "OPEN_PERM" }, \ + { FS_ACCESS_PERM, "ACCESS_PERM" }, \ + { FS_OPEN_EXEC_PERM, "OPEN_EXEC_PERM" }, \ + { FS_PRE_ACCESS, "PRE_ACCESS" }, \ + { FS_MNT_ATTACH, "MNT_ATTACH" }, \ + { FS_MNT_DETACH, "MNT_DETACH" }, \ + { FS_EVENT_ON_CHILD, "EVENT_ON_CHILD" }, \ + { FS_RENAME, "RENAME" }, \ + { FS_DN_MULTISHOT, "DN_MULTISHOT" }, \ + { FS_ISDIR, "ISDIR" }) -- cgit v1.2.3 From 12ffbb117b64d9f4b1b02521010a5f2953a1972a Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 28 Apr 2026 08:09:50 +0100 Subject: fsnotify: add fsnotify_modify_mark_mask() nfsd needs to be able to modify the mask on an existing mark when new directory delegations are set or unset. Add an exported function that allows the caller to set and clear bits in the mark->mask, and does the recalculation if something changed. Suggested-by: Jan Kara Reviewed-by: Jan Kara Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260428-dir-deleg-v3-6-5a0780ba9def@kernel.org Acked-by: Jan Kara Acked-by: Chuck Lever Signed-off-by: Christian Brauner --- include/linux/fsnotify_backend.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h index 95985400d3d8..66e185bd1b1b 100644 --- a/include/linux/fsnotify_backend.h +++ b/include/linux/fsnotify_backend.h @@ -917,6 +917,7 @@ extern void fsnotify_get_mark(struct fsnotify_mark *mark); extern void fsnotify_put_mark(struct fsnotify_mark *mark); extern void fsnotify_finish_user_wait(struct fsnotify_iter_info *iter_info); extern bool fsnotify_prepare_user_wait(struct fsnotify_iter_info *iter_info); +extern void fsnotify_modify_mark_mask(struct fsnotify_mark *mark, u32 set, u32 clear); static inline void fsnotify_init_event(struct fsnotify_event *event) { -- cgit v1.2.3 From 010043003c0c81c0cedde267076cbe1e0911db49 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 28 Apr 2026 08:09:51 +0100 Subject: fsnotify: add FSNOTIFY_EVENT_RENAME data type Add a new fsnotify_rename_data struct and FSNOTIFY_EVENT_RENAME data type that carries both the moved dentry and the inode that was overwritten by the rename (if any). Update fsnotify_data_inode(), fsnotify_data_dentry(), and fsnotify_data_sb() to handle the new type, and add a new fsnotify_data_rename_target() helper for extracting the overwritten target inode. Update fsnotify_move() to use the new data type for FS_RENAME and FS_MOVED_TO events, passing the overwritten target inode through the event data. FS_MOVED_FROM is unchanged since the source directory doesn't need overwrite information. This is done so that fsnotify consumers like nfsd can atomically observe the overwritten file when a rename replaces an existing entry, without needing a separate FS_DELETE event. Assisted-by: Claude (Anthropic Claude Code) Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260428-dir-deleg-v3-7-5a0780ba9def@kernel.org Acked-by: Chuck Lever Signed-off-by: Christian Brauner --- include/linux/fsnotify.h | 8 ++++++-- include/linux/fsnotify_backend.h | 20 ++++++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h index 079c18bcdbde..bda798bc67bc 100644 --- a/include/linux/fsnotify.h +++ b/include/linux/fsnotify.h @@ -257,6 +257,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir, __u32 new_dir_mask = FS_MOVED_TO; __u32 rename_mask = FS_RENAME; const struct qstr *new_name = &moved->d_name; + struct fsnotify_rename_data rd = { + .moved = moved, + .target = target, + }; if (isdir) { old_dir_mask |= FS_ISDIR; @@ -265,12 +269,12 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir, } /* Event with information about both old and new parent+name */ - fsnotify_name(rename_mask, moved, FSNOTIFY_EVENT_DENTRY, + fsnotify_name(rename_mask, &rd, FSNOTIFY_EVENT_RENAME, old_dir, old_name, 0); fsnotify_name(old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_dir, old_name, fs_cookie); - fsnotify_name(new_dir_mask, source, FSNOTIFY_EVENT_INODE, + fsnotify_name(new_dir_mask, &rd, FSNOTIFY_EVENT_RENAME, new_dir, new_name, fs_cookie); if (target) diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h index 66e185bd1b1b..f8c8fb7f34ae 100644 --- a/include/linux/fsnotify_backend.h +++ b/include/linux/fsnotify_backend.h @@ -311,6 +311,7 @@ enum fsnotify_data_type { FSNOTIFY_EVENT_DENTRY, FSNOTIFY_EVENT_MNT, FSNOTIFY_EVENT_ERROR, + FSNOTIFY_EVENT_RENAME, }; struct fs_error_report { @@ -335,6 +336,11 @@ struct fsnotify_mnt { u64 mnt_id; }; +struct fsnotify_rename_data { + struct dentry *moved; /* the dentry that was renamed */ + struct inode *target; /* inode overwritten by rename, or NULL */ +}; + static inline struct inode *fsnotify_data_inode(const void *data, int data_type) { switch (data_type) { @@ -348,6 +354,8 @@ static inline struct inode *fsnotify_data_inode(const void *data, int data_type) return d_inode(file_range_path(data)->dentry); case FSNOTIFY_EVENT_ERROR: return ((struct fs_error_report *)data)->inode; + case FSNOTIFY_EVENT_RENAME: + return d_inode(((const struct fsnotify_rename_data *)data)->moved); default: return NULL; } @@ -363,6 +371,8 @@ static inline struct dentry *fsnotify_data_dentry(const void *data, int data_typ return ((const struct path *)data)->dentry; case FSNOTIFY_EVENT_FILE_RANGE: return file_range_path(data)->dentry; + case FSNOTIFY_EVENT_RENAME: + return ((struct fsnotify_rename_data *)data)->moved; default: return NULL; } @@ -395,6 +405,8 @@ static inline struct super_block *fsnotify_data_sb(const void *data, return file_range_path(data)->dentry->d_sb; case FSNOTIFY_EVENT_ERROR: return ((struct fs_error_report *) data)->sb; + case FSNOTIFY_EVENT_RENAME: + return ((const struct fsnotify_rename_data *)data)->moved->d_sb; default: return NULL; } @@ -430,6 +442,14 @@ static inline struct fs_error_report *fsnotify_data_error_report( } } +static inline struct inode *fsnotify_data_rename_target(const void *data, + int data_type) +{ + if (data_type == FSNOTIFY_EVENT_RENAME) + return ((const struct fsnotify_rename_data *)data)->target; + return NULL; +} + static inline const struct file_range *fsnotify_data_file_range( const void *data, int data_type) -- cgit v1.2.3 From e758acedce4e344e6ce290b4a422bb695dc53117 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 14 May 2026 09:55:06 +0000 Subject: net: always declare __sock_wfree() and tcp_wfree() Even if guarded by IS_ENABLED(CONFIG_INET) compilers need to know what __sock_wfree() and tcp_wfree() are: include/net/sock.h:1861:63: note: each undeclared identifier is reported only once for each function it appears in include/net/sock.h:1862:63: error: 'tcp_wfree' undeclared (first use in this function); did you mean 'sock_wfree'? 1862 | (IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree); Fixes: f0de88303d5e ("net: make is_skb_wmem() available to modules") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605141607.mDXnYFKY-lkp@intel.com/ Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260514095506.3919094-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/sock.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/sock.h b/include/net/sock.h index 219917959b54..e0263bae8da9 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1851,10 +1851,9 @@ static inline struct sock *sk_clone_lock(const struct sock *sk, const gfp_t prio struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force, gfp_t priority); void sock_wfree(struct sk_buff *skb); -#ifdef CONFIG_INET void __sock_wfree(struct sk_buff *skb); void tcp_wfree(struct sk_buff *skb); -#endif + static inline bool is_skb_wmem(const struct sk_buff *skb) { return skb->destructor == sock_wfree || -- cgit v1.2.3 From 5522d65d81a711c60a9969d37a485d48d0ad1496 Mon Sep 17 00:00:00 2001 From: Julian Anastasov Date: Sun, 10 May 2026 13:46:05 +0300 Subject: ipvs: avoid possible loop in ip_vs_dst_event on resizing Sashiko points out that unprivileged user can frequently call ip_vs_flush() or ip_vs_del_service() to trigger svc_table_changes updates that can lead to infinite loop in ip_vs_dst_event(). This can also happen if the user triggers frequent table resizing without deleting all services. We should also consider the possible effects if the user triggers many NETDEV_DOWN events. One way to solve it is to hold svc_resize_sem in ip_vs_dst_event() but this can block the dev notifier during the whole resizing process. Instead, use new rw_semaphore svc_replace_sem to protect just the svc_table replacement which is a short code section. Then hold svc_replace_sem in ip_vs_dst_event() to serialize with replacing the svc_table. As result, loop is avoided as there is no need to repeat the table walking from the start. By this way changes in svc_table_changes can happen only when all services are removed and all dev references dropped which allows us to abort the table walking. As IP_VS_WORK_SVC_NORESIZE is the flag used to stop the svc_resize_work under service_mutex, we should check only this flag often but not while under service_mutex. To remove the mutex_trylock() for service_mutex in the second phase where the resizer installs the new table after rehashing, we will avoid holding the service_mutex there. As result, the code in configuration context which is under service_mutex should access ipvs->svc_table under RCU because it can be replaced at anytime and released after a RCU grace period. As for ip_vs_zero_all(), it needs different solution as a table walker which can escape single RCU read-side critical section: to hold the svc_replace_sem to prevent table to be replaced. In ip_vs_status_show() prefer to hold svc_replace_sem to avoid many loops, just detect if the svc_table is removed. Prefer the newly attached table for the u_thresh/l_thresh checks to know when to grow/shrink while adding or deleting services because the new table size is based on the latest parameters. Link: https://sashiko.dev/#/patchset/20260505001648.360569-1-pablo%40netfilter.org Fixes: 840aac3d900d ("ipvs: use resizable hash table for services") Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso --- include/net/ip_vs.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h index 02762ce73a0c..a02e569813d2 100644 --- a/include/net/ip_vs.h +++ b/include/net/ip_vs.h @@ -1186,8 +1186,9 @@ struct netns_ipvs { struct timer_list dest_trash_timer; /* expiration timer */ struct mutex service_mutex; /* service reconfig */ struct rw_semaphore svc_resize_sem; /* svc_table resizing */ + struct rw_semaphore svc_replace_sem; /* svc_table replace */ struct delayed_work svc_resize_work; /* resize svc_table */ - atomic_t svc_table_changes;/* ++ on new table */ + atomic_t svc_table_changes;/* ++ on table changes */ /* Service counters */ atomic_t num_services[IP_VS_AF_MAX]; /* Services */ atomic_t fwm_services[IP_VS_AF_MAX]; /* Services */ -- cgit v1.2.3 From b2870fc21601db9133bc70c48c603b487614fa3b Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Thu, 14 May 2026 16:46:38 +0200 Subject: netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() neigh_hh_bridge() assumes the skb always has sufficient headroom to copy the aligned L2 header. This assumption can trigger the crash reported below using the following netfilter setup: $modprobe br_netfilter $sysctl -w net.bridge.bridge-nf-call-iptables=1 $root@OpenWrt:~# nft list ruleset table ip nat { chain prerouting { type nat hook prerouting priority dstnat; policy accept; ip daddr 192.168.83.123 dnat to 192.168.83.120 } } - iperf3 client (192.168.83.119) --> bridge (192.168.83.118) --> iperf3 server (192.168.83.120) the iperf3 client is sending packet for 192.168.83.123 to the bridge device. [ 1579.036575] Unable to handle kernel write to read-only memory at virtual address ffffff8004d76ffe [ 1579.045482] Mem abort info: [ 1579.048273] ESR = 0x000000009600004f [ 1579.052024] EC = 0x25: DABT (current EL), IL = 32 bits [ 1579.057363] SET = 0, FnV = 0 [ 1579.060417] EA = 0, S1PTW = 0 [ 1579.063550] FSC = 0x0f: level 3 permission fault [ 1579.068345] Data abort info: [ 1579.071224] ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000 [ 1579.076720] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 1579.081770] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1579.087092] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000080dc4000 [ 1579.093794] [ffffff8004d76ffe] pgd=180000009ffff003, p4d=180000009ffff003, pud=180000009ffff003, pmd=180000009ffe3003, pte=0060000084d76787 [ 1579.106343] Internal error: Oops: 000000009600004f [#1] SMP [ 1579.193824] CPU: 0 UID: 0 PID: 235 Comm: napi/qdma_eth-3 Tainted: G O 6.12.57 #0 [ 1579.202614] Tainted: [O]=OOT_MODULE [ 1579.206102] Hardware name: Airoha AN7581 Evaluation Board (DT) [ 1579.211929] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1579.218889] pc : br_nf_pre_routing_finish_bridge+0x1ac/0xcc8 [br_netfilter] [ 1579.225859] lr : br_nf_pre_routing_finish_bridge+0x18c/0xcc8 [br_netfilter] [ 1579.232822] sp : ffffffc0817cba20 [ 1579.236128] x29: ffffffc0817cba20 x28: 0000000000000000 x27: ffffff8002b89000 [ 1579.243273] x26: ffffff8004d7700e x25: 0000000000000008 x24: 0000000000000000 [ 1579.250416] x23: ffffffc08179d4c0 x22: 0000000000000000 x21: ffffffc08179d4c0 [ 1579.257561] x20: ffffff8004d9b800 x19: ffffff8015010000 x18: 0000000000000014 [ 1579.264704] x17: ffffffbf9e930000 x16: ffffffc0817c8000 x15: 0000000000000070 [ 1579.271848] x14: 0000000000000080 x13: 0000000000000001 x12: 0000000000000000 [ 1579.278993] x11: ffffffc0798caae0 x10: ffffff8014db6fd8 x9 : 0000000000000000 [ 1579.286136] x8 : 0000000000000003 x7 : ffffffc08171f628 x6 : 000000001a3b83d3 [ 1579.293281] x5 : 0000000000000000 x4 : 1beb76f22fee0000 x3 : ffffff8004d7700e [ 1579.300425] x2 : 0000000000000000 x1 : ffffff8004d9b8bc x0 : ffffff80026ed000 [ 1579.307570] Call trace: [ 1579.310018] br_nf_pre_routing_finish_bridge+0x1ac/0xcc8 [br_netfilter] [ 1579.316632] br_nf_hook_thresh+0xd4/0x14bc [br_netfilter] [ 1579.322032] br_nf_hook_thresh+0x250/0x14bc [br_netfilter] [ 1579.327517] br_nf_hook_thresh+0x76c/0x14bc [br_netfilter] [ 1579.333003] br_handle_frame+0x180/0x480 [ 1579.336935] __netif_receive_skb_core.constprop.0+0x540/0xf40 [ 1579.342682] __netif_receive_skb_one_core+0x28/0x50 [ 1579.347561] process_backlog+0x98/0x1e0 [ 1579.351398] __napi_poll+0x34/0x1c4 [ 1579.354887] net_rx_action+0x178/0x330 [ 1579.358638] handle_softirqs+0x108/0x2d4 [ 1579.362560] __do_softirq+0x10/0x18 [ 1579.366051] ____do_softirq+0xc/0x20 [ 1579.369627] call_on_irq_stack+0x30/0x4c [ 1579.373550] do_softirq_own_stack+0x18/0x20 [ 1579.377734] do_softirq+0x4c/0x60 [ 1579.381050] __local_bh_enable_ip+0x88/0x98 [ 1579.385234] napi_threaded_poll_loop+0x188/0x21c [ 1579.389853] napi_threaded_poll+0x70/0x80 [ 1579.393863] kthread+0xd8/0xdc [ 1579.396918] ret_from_fork+0x10/0x20 [ 1579.400499] Code: 88dffc22 3707ffc2 f9406663 f9406684 (f81f0064) [ 1579.406589] ---[ end trace 0000000000000000 ]--- [ 1579.411209] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 1579.418083] SMP: stopping secondary CPUs [ 1579.422012] Kernel Offset: disabled Fix the issue reallocating the skb headroom if necessary in neigh_hh_bridge routine. Fixes: e179e6322ac33 ("netfilter: bridge-netfilter: Fix MAC header handling with IP DNAT") Reviewed-by: Ido Schimmel Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso --- include/net/neighbour.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/neighbour.h b/include/net/neighbour.h index 2dfee6d4258a..8860cc2175fc 100644 --- a/include/net/neighbour.h +++ b/include/net/neighbour.h @@ -489,11 +489,15 @@ static inline int neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) static inline int neigh_hh_bridge(struct hh_cache *hh, struct sk_buff *skb) { - unsigned int seq, hh_alen; + unsigned int seq, hh_alen = HH_DATA_ALIGN(ETH_HLEN); + int err; + + err = skb_cow_head(skb, hh_alen); + if (err) + return err; do { seq = read_seqbegin(&hh->hh_lock); - hh_alen = HH_DATA_ALIGN(ETH_HLEN); memcpy(skb->data - hh_alen, hh->hh_data, ETH_ALEN + hh_alen - ETH_HLEN); } while (read_seqretry(&hh->hh_lock, seq)); return 0; -- cgit v1.2.3 From e196115ec330a18de415bdb9f5071aa9f08e53ce Mon Sep 17 00:00:00 2001 From: Haoze Xie Date: Fri, 15 May 2026 11:19:02 +0800 Subject: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection. When the verdict is reinjected later, br_netif_receive_skb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free. Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEV_DOWN handling. Fixes: ac2863445686 ("netfilter: bridge: add nf_afinfo to enable queuing to userspace") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Haoze Xie Signed-off-by: Ren Wei Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_queue.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h index d17035d14d96..3978c3174cdb 100644 --- a/include/net/netfilter/nf_queue.h +++ b/include/net/netfilter/nf_queue.h @@ -14,6 +14,7 @@ struct nf_queue_entry { struct list_head list; struct rhash_head hash_node; struct sk_buff *skb; + struct net_device *skb_dev; unsigned int id; unsigned int hook_index; /* index in hook_entries->hook[] */ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) -- cgit v1.2.3 From 246bc86d0fd891273a8502314f158eab23af823c Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Sat, 16 May 2026 07:11:23 -0400 Subject: filelock: move LEASE_BREAK_* flags out of #ifdef CONFIG_FILE_LOCKING This was causing a build break when CONFIG_FILE_LOCKING was disabled. Move the LEASE_BREAK_* flags into the non-#ifdef'ed part of the file. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605161232.1lY6pZoM-lkp@intel.com/ Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260516-dir-deleg-fix-v1-1-1b68f0aa990a@kernel.org Signed-off-by: Christian Brauner --- include/linux/filelock.h | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/linux/filelock.h b/include/linux/filelock.h index 6e125902c58a..7a7a6e8a9a08 100644 --- a/include/linux/filelock.h +++ b/include/linux/filelock.h @@ -29,6 +29,15 @@ */ #define FILE_LOCK_DEFERRED 1 +#define LEASE_BREAK_LEASE BIT(0) // break leases and delegations +#define LEASE_BREAK_DELEG BIT(1) // break delegations only +#define LEASE_BREAK_LAYOUT BIT(2) // break layouts only +#define LEASE_BREAK_NONBLOCK BIT(3) // non-blocking break +#define LEASE_BREAK_OPEN_RDONLY BIT(4) // readonly open event +#define LEASE_BREAK_DIR_CREATE BIT(5) // dir deleg create event +#define LEASE_BREAK_DIR_DELETE BIT(6) // dir deleg delete event +#define LEASE_BREAK_DIR_RENAME BIT(7) // dir deleg rename event + struct file_lock; struct file_lease; @@ -219,17 +228,6 @@ int locks_lock_inode_wait(struct inode *inode, struct file_lock *fl); void locks_init_lease(struct file_lease *); void locks_free_lease(struct file_lease *fl); struct file_lease *locks_alloc_lease(void); - -#define LEASE_BREAK_LEASE BIT(0) // break leases and delegations -#define LEASE_BREAK_DELEG BIT(1) // break delegations only -#define LEASE_BREAK_LAYOUT BIT(2) // break layouts only -#define LEASE_BREAK_NONBLOCK BIT(3) // non-blocking break -#define LEASE_BREAK_OPEN_RDONLY BIT(4) // readonly open event -#define LEASE_BREAK_DIR_CREATE BIT(5) // dir deleg create event -#define LEASE_BREAK_DIR_DELETE BIT(6) // dir deleg delete event -#define LEASE_BREAK_DIR_RENAME BIT(7) // dir deleg rename event - - int __break_lease(struct inode *inode, unsigned int flags); void lease_get_mtime(struct inode *, struct timespec64 *time); int generic_setlease(struct file *, int, struct file_lease **, void **priv); -- cgit v1.2.3 From 7fe2ec9fb8e9a78dad8d6b1e551cb4d126e36f1e Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Fri, 8 May 2026 18:54:17 +0100 Subject: firmware: arm_ffa: Set the core device as FF-A device parent Pass a parent device into ffa_device_register() and use the synthetic arm-ffa platform device as the parent for each registered FF-A device. This keeps the enumerated FF-A partition devices anchored below the FF-A core device in the driver model, matching the platform-driver conversion of the core transport. Suggested-by: Yeoreum Yun Reviewed-by: Yeoreum Yun Link: https://patch.msgid.link/20260508-b4-ffa_plat_dev-v1-3-c5a30f8cf7b8@kernel.org Signed-off-by: Sudeep Holla --- include/linux/arm_ffa.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/arm_ffa.h b/include/linux/arm_ffa.h index 81e603839c4a..17eca3dfc59e 100644 --- a/include/linux/arm_ffa.h +++ b/include/linux/arm_ffa.h @@ -173,7 +173,7 @@ struct ffa_partition_info; #if IS_REACHABLE(CONFIG_ARM_FFA_TRANSPORT) struct ffa_device * ffa_device_register(const struct ffa_partition_info *part_info, - const struct ffa_ops *ops); + const struct ffa_ops *ops, struct device *parent); void ffa_device_unregister(struct ffa_device *ffa_dev); int ffa_driver_register(struct ffa_driver *driver, struct module *owner, const char *mod_name); @@ -184,7 +184,7 @@ bool ffa_device_is_valid(struct ffa_device *ffa_dev); #else static inline struct ffa_device * ffa_device_register(const struct ffa_partition_info *part_info, - const struct ffa_ops *ops) + const struct ffa_ops *ops, struct device *parent) { return NULL; } -- cgit v1.2.3 From 3d562d35a044ae798cab421c65a116f8cedfa5d4 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Sun, 17 May 2026 09:55:28 +0200 Subject: bpf: Check global subprog exception paths Global subprogs are verified independently and are not descended into when their callers are symbolically executed. This means a caller can hold references or locks across a global subprog call that may throw, while the verifier only checks the non-exceptional return path at the call site. Record whether a subprog might throw in the CFG summary pass, alongside the existing might_sleep and packet-data-changing summaries, and propagate that effect through reachable callees. When a global subprog is marked as possibly throwing, push the normal continuation and validate the exceptional path immediately at the call site, avoiding a synthetic exception state and associated special case in the pruning checks. Fixes: f18b03fabaa9 ("bpf: Implement BPF exceptions") Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260517075530.3461166-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index b148f816f25b..185b2aa43a42 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -729,6 +729,7 @@ struct bpf_subprog_info { */ s16 fastcall_stack_off; bool has_tail_call: 1; + bool might_throw: 1; bool tail_call_reachable: 1; bool has_ld_abs: 1; bool is_cb: 1; @@ -1308,6 +1309,7 @@ void bpf_fmt_stack_mask(char *buf, ssize_t buf_sz, u64 stack_mask); bool bpf_subprog_is_global(const struct bpf_verifier_env *env, int subprog); int bpf_find_subprog(struct bpf_verifier_env *env, int off); +bool bpf_is_throw_kfunc(struct bpf_insn *insn); int bpf_compute_const_regs(struct bpf_verifier_env *env); int bpf_prune_dead_branches(struct bpf_verifier_env *env); int bpf_check_cfg(struct bpf_verifier_env *env); -- cgit v1.2.3 From 18a37465b0ab5237a1d0ebf93a2a3b6a2da540b3 Mon Sep 17 00:00:00 2001 From: Yonghong Song Date: Sun, 17 May 2026 08:07:02 -0700 Subject: bpf,x86: Fix exception unwinding with outgoing stack arguments When a main program with exception_boundary has outgoing stack arguments (e.g. from calling subprogs with >5 args), bpf_throw() fails to correctly restore callee-saved registers, causing a kernel crash. The x86 JIT allocates the outgoing stack arg area below the callee-saved registers via 'sub rsp, outgoing_rsp' in the prologue. When bpf_throw() unwinds, it captures the main program's sp (which includes this outgoing area) and passes it to the exception callback. The callback gets rsp and rbp, followed by pop_callee_regs, but rsp points into the outgoing arg area rather than the callee-saved registers, so the pops restore garbage values. Returning to the kernel with corrupted callee-saved registers causes a crash. Fix this by adjusting the sp (adding stack_arg_sp_adjust) passed to the exception callback, so it points to the bottom of the callee-saved registers instead of the outgoing arg area. When stack_arg_sp_adjust is 0 (the common case), this is a no-op. Fixes: 324c3ca6eed6 ("bpf,x86: Implement JIT support for stack arguments") Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20260517150702.288031-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 242f9597d9ab..1b28cacc3075 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1736,6 +1736,7 @@ struct bpf_prog_aux { struct bpf_map *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]; char name[BPF_OBJ_NAME_LEN]; u64 (*bpf_exception_cb)(u64 cookie, u64 sp, u64 bp, u64, u64); + u16 stack_arg_sp_adjust; #ifdef CONFIG_SECURITY void *security; #endif -- cgit v1.2.3 From 4002ccd266b665f1097e20addbe8f3baeb2136f9 Mon Sep 17 00:00:00 2001 From: Prathamesh Shete Date: Thu, 14 May 2026 12:48:34 +0000 Subject: dt-bindings: gpio: Add Tegra238 support Extend the existing Tegra186 GPIO controller device tree bindings with support for the GPIO controllers found on Tegra238. Tegra238 has two GPIO controllers: the main controller and always-on (AON) controller. The number of pins is slightly different, but the programming model remains the same. Add a new header, include/dt-bindings/gpio/nvidia,tegra238-gpio.h, that defines port IDs as well as the TEGRA238_MAIN_GPIO() helper, both of which are used in conjunction to create a unique specifier for each pin. Signed-off-by: Prathamesh Shete Acked-by: Conor Dooley Link: https://patch.msgid.link/20260514124835.108532-1-pshete@nvidia.com Signed-off-by: Bartosz Golaszewski --- include/dt-bindings/gpio/nvidia,tegra238-gpio.h | 58 +++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 include/dt-bindings/gpio/nvidia,tegra238-gpio.h (limited to 'include') diff --git a/include/dt-bindings/gpio/nvidia,tegra238-gpio.h b/include/dt-bindings/gpio/nvidia,tegra238-gpio.h new file mode 100644 index 000000000000..8a616a1df54c --- /dev/null +++ b/include/dt-bindings/gpio/nvidia,tegra238-gpio.h @@ -0,0 +1,58 @@ +/* SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause */ +/* Copyright (c) 2026, NVIDIA CORPORATION. All rights reserved. */ + +/* + * This header provides constants for binding nvidia,tegra238-gpio*. + * + * The first cell in Tegra's GPIO specifier is the GPIO ID. The macros below + * provide names for this. + * + * The second cell contains standard flag values specified in gpio.h. + */ + +#ifndef _DT_BINDINGS_GPIO_TEGRA238_GPIO_H +#define _DT_BINDINGS_GPIO_TEGRA238_GPIO_H + +#include + +/* GPIOs implemented by main GPIO controller */ +#define TEGRA238_MAIN_GPIO_PORT_A 0 +#define TEGRA238_MAIN_GPIO_PORT_B 1 +#define TEGRA238_MAIN_GPIO_PORT_C 2 +#define TEGRA238_MAIN_GPIO_PORT_D 3 +#define TEGRA238_MAIN_GPIO_PORT_E 4 +#define TEGRA238_MAIN_GPIO_PORT_F 5 +#define TEGRA238_MAIN_GPIO_PORT_G 6 +#define TEGRA238_MAIN_GPIO_PORT_H 7 +#define TEGRA238_MAIN_GPIO_PORT_J 8 +#define TEGRA238_MAIN_GPIO_PORT_K 9 +#define TEGRA238_MAIN_GPIO_PORT_L 10 +#define TEGRA238_MAIN_GPIO_PORT_M 11 +#define TEGRA238_MAIN_GPIO_PORT_N 12 +#define TEGRA238_MAIN_GPIO_PORT_P 13 +#define TEGRA238_MAIN_GPIO_PORT_Q 14 +#define TEGRA238_MAIN_GPIO_PORT_R 15 +#define TEGRA238_MAIN_GPIO_PORT_S 16 +#define TEGRA238_MAIN_GPIO_PORT_T 17 +#define TEGRA238_MAIN_GPIO_PORT_U 18 +#define TEGRA238_MAIN_GPIO_PORT_V 19 +#define TEGRA238_MAIN_GPIO_PORT_W 20 +#define TEGRA238_MAIN_GPIO_PORT_X 21 + +#define TEGRA238_MAIN_GPIO(port, offset) \ + ((TEGRA238_MAIN_GPIO_PORT_##port * 8) + (offset)) + +/* GPIOs implemented by AON GPIO controller */ +#define TEGRA238_AON_GPIO_PORT_AA 0 +#define TEGRA238_AON_GPIO_PORT_BB 1 +#define TEGRA238_AON_GPIO_PORT_CC 2 +#define TEGRA238_AON_GPIO_PORT_DD 3 +#define TEGRA238_AON_GPIO_PORT_EE 4 +#define TEGRA238_AON_GPIO_PORT_FF 5 +#define TEGRA238_AON_GPIO_PORT_GG 6 +#define TEGRA238_AON_GPIO_PORT_HH 7 + +#define TEGRA238_AON_GPIO(port, offset) \ + ((TEGRA238_AON_GPIO_PORT_##port * 8) + (offset)) + +#endif -- cgit v1.2.3 From e321561b915378d2e9eacd1bc4d7fb2338d09961 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Mon, 4 May 2026 14:27:05 +0200 Subject: dio: Update DIO_SCMAX comment DIO-II support was added in 2004, update a comment to reflect this. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/5aa3901baaa5d145804e1a836dd8ee3fb07ea144.1777897387.git.geert@linux-m68k.org --- include/linux/dio.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/dio.h b/include/linux/dio.h index 464331c4c4a7..894e50b91792 100644 --- a/include/linux/dio.h +++ b/include/linux/dio.h @@ -112,9 +112,7 @@ struct dio_driver { #define DIOII_END 0x20000000 /* end of DIO-II space */ #define DIOII_DEVSIZE 0x00400000 /* size of a DIO-II device */ -/* Highest valid select code. If we add DIO-II support this should become - * 256 for everything except HP320, which only has DIO. - */ +/* highest valid select code */ #define DIO_SCMAX (hp300_model == HP_320 ? 32 : 256) #define DIOII_SCBASE 132 /* lowest DIO-II select code */ #define DIO_SCINHOLE(scode) (((scode) >= 32) && ((scode) < DIOII_SCBASE)) -- cgit v1.2.3 From da2bfe3377b598b297400e7c6c3bf5d493b408c8 Mon Sep 17 00:00:00 2001 From: Leo Yan Date: Fri, 15 May 2026 21:08:11 +0100 Subject: coresight: Populate CPU ID into coresight_device Add a new flag CORESIGHT_DESC_CPU_BOUND to indicate components that are CPU bound. Populate CPU ID into the coresight_device structure; otherwise, set CPU ID to -1 for non CPU bound devices. Use the {0} initializer to clear coresight_desc structures to avoid uninitialized values. Tested-by: Jie Gan Reviewed-by: Yeoreum Yun Reviewed-by: James Clark Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260515-arm_coresight_path_power_management_improvement-v14-4-f88c4a3ecfe9@arm.com --- include/linux/coresight.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/coresight.h b/include/linux/coresight.h index 2131febebee9..687190ca11dd 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -141,6 +141,8 @@ struct csdev_access { .base = (_addr), \ }) +#define CORESIGHT_DESC_CPU_BOUND BIT(0) + /** * struct coresight_desc - description of a component required from drivers * @type: as defined by @coresight_dev_type. @@ -153,6 +155,8 @@ struct csdev_access { * in the component's sysfs sub-directory. * @name: name for the coresight device, also shown under sysfs. * @access: Describe access to the device + * @flags: The descritpion flags. + * @cpu: The CPU this component is affined to. */ struct coresight_desc { enum coresight_dev_type type; @@ -163,6 +167,8 @@ struct coresight_desc { const struct attribute_group **groups; const char *name; struct csdev_access access; + u32 flags; + int cpu; }; /** @@ -260,6 +266,7 @@ struct coresight_trace_id_map { * device's spinlock when the coresight_mutex held and mode == * CS_MODE_SYSFS. Otherwise it must be accessed from inside the * spinlock. + * @cpu: The CPU this component is affined to (-1 for not CPU bound). * @orphan: true if the component has connections that haven't been linked. * @sysfs_sink_activated: 'true' when a sink has been selected for use via sysfs * by writing a 1 to the 'enable_sink' file. A sink can be @@ -286,6 +293,7 @@ struct coresight_device { struct device dev; atomic_t mode; int refcnt; + int cpu; bool orphan; /* sink specific fields */ bool sysfs_sink_activated; -- cgit v1.2.3 From 9d5eb760e304d5c1e5deb80a185c6a04deaab7fe Mon Sep 17 00:00:00 2001 From: Leo Yan Date: Fri, 15 May 2026 21:08:12 +0100 Subject: coresight: Remove .cpu_id() callback from source ops The CPU ID can be fetched directly from the coresight_device structure, so the .cpu_id() callback is no longer needed. Remove the .cpu_id() callback from source ops and update callers accordingly. Tested-by: Jie Gan Reviewed-by: Yeoreum Yun Reviewed-by: James Clark Tested-by: James Clark Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260515-arm_coresight_path_power_management_improvement-v14-5-f88c4a3ecfe9@arm.com --- include/linux/coresight.h | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/linux/coresight.h b/include/linux/coresight.h index 687190ca11dd..e9c20ceb9016 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -395,15 +395,12 @@ struct coresight_ops_link { /** * struct coresight_ops_source - basic operations for a source * Operations available for sources. - * @cpu_id: returns the value of the CPU number this component - * is associated to. * @enable: enables tracing for a source. * @disable: disables tracing for a source. * @resume_perf: resumes tracing for a source in perf session. * @pause_perf: pauses tracing for a source in perf session. */ struct coresight_ops_source { - int (*cpu_id)(struct coresight_device *csdev); int (*enable)(struct coresight_device *csdev, struct perf_event *event, enum cs_mode mode, struct coresight_path *path); void (*disable)(struct coresight_device *csdev, -- cgit v1.2.3 From 4d8dd98ee5bf9f77862cce039adfcdccd02daa08 Mon Sep 17 00:00:00 2001 From: Leo Yan Date: Fri, 15 May 2026 21:08:18 +0100 Subject: coresight: Register CPU PM notifier in core layer The current implementation only saves and restores the context for ETM sources while ignoring the context of links. However, if funnels or replicators on a linked path resides in a CPU or cluster power domain, the hardware context for the link will be lost after resuming from low power states. To support context management for links during CPU low power modes, a better way is to implement CPU PM callbacks in the Arm CoreSight core layer. As the core layer has sufficient information for linked paths, from tracers to links, which can be used for power management. As a first step, this patch registers CPU PM notifier in the core layer. If a source device provides callbacks for saving and restoring context, these callbacks will be invoked in CPU suspend and resume. Reviewed-by: James Clark Tested-by: James Clark Reviewed-by: Yeoreum Yun Tested-by: Jie Gan Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260515-arm_coresight_path_power_management_improvement-v14-11-f88c4a3ecfe9@arm.com --- include/linux/coresight.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/coresight.h b/include/linux/coresight.h index e9c20ceb9016..5f9d7ea9f594 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -438,6 +438,8 @@ struct coresight_ops_panic { struct coresight_ops { int (*trace_id)(struct coresight_device *csdev, enum cs_mode mode, struct coresight_device *sink); + int (*pm_save_disable)(struct coresight_device *csdev); + void (*pm_restore_enable)(struct coresight_device *csdev); const struct coresight_ops_sink *sink_ops; const struct coresight_ops_link *link_ops; const struct coresight_ops_source *source_ops; -- cgit v1.2.3 From ac8eac9062eefc33f5e97e526eef69bc98ecbdbc Mon Sep 17 00:00:00 2001 From: Leo Yan Date: Fri, 15 May 2026 21:08:26 +0100 Subject: coresight: Save active path for system tracers This commit only set the path pointer for system tracers (e.g. STM) in coresight_{enable|disable}_source(). Later changes will set the path pointer locally for per-CPU sources. This is because the mode and path pointer must be set together, so that they are observed atomically by the CPU PM notifier. Reviewed-by: Yeoreum Yun Reviewed-by: James Clark Tested-by: James Clark Tested-by: Jie Gan Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260515-arm_coresight_path_power_management_improvement-v14-19-f88c4a3ecfe9@arm.com --- include/linux/coresight.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/coresight.h b/include/linux/coresight.h index 5f9d7ea9f594..58d474b26980 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -257,6 +257,7 @@ struct coresight_trace_id_map { * by @coresight_ops. * @access: Device i/o access abstraction for this device. * @dev: The device entity associated to this component. + * @path: Activated path pointer (only used for source device). * @mode: The device mode, i.e sysFS, Perf or disabled. This is actually * an 'enum cs_mode' but stored in an atomic type. Access is always * through atomic APIs, ensuring SMP-safe synchronisation between @@ -291,6 +292,7 @@ struct coresight_device { const struct coresight_ops *ops; struct csdev_access access; struct device dev; + struct coresight_path *path; atomic_t mode; int refcnt; int cpu; -- cgit v1.2.3 From f233124fb36cd57ef09f96d517a38ab4b902e15e Mon Sep 17 00:00:00 2001 From: Niklas Cassel Date: Thu, 14 May 2026 09:39:01 +0200 Subject: ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS When using Port Multipliers (PMPs) with Command-Based Switching (CBS), you can only issue commands to one link at a time. For PMPs with CBS, there is already code to handle commands being sent to different links in sata_pmp_qc_defer_cmd_switch() using ap->excl_link. sata_sil24 also makes use of ap->excl_link. A user on the list reported that commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") broke PMPs with CBS. The commit introduced code that stores a deferred qc in ap->deferred_qc, to later be issued via a workqueue. It turns out that this change is incompatible with the existing ap->excl_link handling used by PMPs with CBS. Thus, modify sata_pmp_qc_defer_cmd_switch() and sil24_qc_defer() to return ATA_DEFER_LINK_EXCL, and make sure that the deferred QC handling via workqueue is not used for this return value. This way, PMPs with CBS will work once again. Note that the starvation referenced in commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") can only happen on libsas ports, and libsas does not support Port Multipliers, thus there is no harm of reverting back to the previous way of deferring commands for PMPs with CBS. Non-libsas ports connected to anything but a PMP with CBS (e.g. a normal drive or a PMP with FBS) will continue using the deferred workqueue, since it does result in lower completion latencies for non-NCQ commands, even though the workqueue is not strictly needed to avoid starvation for non-libsas ports. If we want to modify the scope of the workqueue issuing to also handle PMPs with CBS, then we should ensure that we can save both NCQ and non-NCQ commands in ap->deferred_qc, while also removing the existing PMP CBS handling using ap->excl_link, such that we don't duplicate features. While at it, also add a comment explaining how the ap->excl_link mechanism works. Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Tested-by: Tommy Kelly Reported-by: Tommy Kelly Closes: https://lore.kernel.org/linux-ide/ce09cc21-a8e9-4845-b205-35411e22fba9@tkel.ly/ Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel --- include/linux/libata.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/libata.h b/include/linux/libata.h index 5c085ef4eda7..360776016b50 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h @@ -371,6 +371,7 @@ enum { /* return values for ->qc_defer */ ATA_DEFER_LINK = 1, ATA_DEFER_PORT = 2, + ATA_DEFER_LINK_EXCL = 3, /* desc_len for ata_eh_info and context */ ATA_EH_DESC_LEN = 80, -- cgit v1.2.3 From 759e8756da00aa115d504a18155b1d1ee1cc12e8 Mon Sep 17 00:00:00 2001 From: Niklas Cassel Date: Thu, 14 May 2026 09:39:02 +0200 Subject: ata: libata-scsi: do not needlessly defer commands when using PMP with FBS The ACS specification does not allow a non-NCQ command to be issued while an NCQ command is outstanding. Commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") introduced a feature where a deferred non-NCQ command gets issued from a workqueue. The design stores a single non-NCQ command per port. However, when using Port Multipliers (PMPs), specifically PMPs that support FIS-Based Switching (FBS), non-NCQ and NCQ commands can be mixed on the same port, just not for the same link, see e.g. ata_std_qc_defer() which is, and always has operated on a per-link basis. Therefore, move the deferred_qc from struct ata_port to struct ata_link. This way, when using a PMP with FBS, we will not needlessly defer commands to all other links, just because one link issued a non-NCQ command while having an NCQ command outstanding. Only commands for that specific link will be deferred. This is in line with how PMPs with FBS worked before commit 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation"). Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation") Tested-by: Tommy Kelly Reviewed-by: Damien Le Moal Signed-off-by: Niklas Cassel --- include/linux/libata.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/libata.h b/include/linux/libata.h index 360776016b50..127229fbd1a6 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h @@ -855,6 +855,9 @@ struct ata_link { unsigned int sata_spd; /* current SATA PHY speed */ enum ata_lpm_policy lpm_policy; + struct work_struct deferred_qc_work; + struct ata_queued_cmd *deferred_qc; + /* record runtime error info, protected by host_set lock */ struct ata_eh_info eh_info; /* EH context */ @@ -900,9 +903,6 @@ struct ata_port { u64 qc_active; int nr_active_links; /* #links with active qcs */ - struct work_struct deferred_qc_work; - struct ata_queued_cmd *deferred_qc; - struct ata_link link; /* host default link */ struct ata_link *slave_link; /* see ata_slave_link_init() */ -- cgit v1.2.3 From bf64b06ede93a8b56bf4dce0809e4edd111ccf36 Mon Sep 17 00:00:00 2001 From: Leo Yan Date: Fri, 15 May 2026 21:08:33 +0100 Subject: coresight: sysfs: Increment refcount only for software source Except for software sources (e.g. STM), other sources treat multiple enables as equivalent to a single enable. The device mode already tracks the binary state, so it is redundant to operate refcount. Introduce a helper coresight_is_software_source() for check software source. Refactor to maintain the refcount only for software sources. This simplifies future CPU PM handling without refcount logic. Tested-by: James Clark Reviewed-by: Yeoreum Yun Reviewed-by: James Clark Tested-by: Jie Gan Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260515-arm_coresight_path_power_management_improvement-v14-26-f88c4a3ecfe9@arm.com --- include/linux/coresight.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/coresight.h b/include/linux/coresight.h index 58d474b26980..76ef4c096512 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -611,6 +611,12 @@ static inline bool coresight_is_percpu_source(struct coresight_device *csdev) (csdev->subtype.source_subtype == CORESIGHT_DEV_SUBTYPE_SOURCE_PROC); } +static inline bool coresight_is_software_source(struct coresight_device *csdev) +{ + return csdev && coresight_is_device_source(csdev) && + (csdev->subtype.source_subtype == CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE); +} + static inline bool coresight_is_percpu_sink(struct coresight_device *csdev) { return csdev && (csdev->type == CORESIGHT_DEV_TYPE_SINK) && -- cgit v1.2.3 From 7105d2aa76d81d5133b2819a32c62c6dfbfbe12f Mon Sep 17 00:00:00 2001 From: Leo Yan Date: Fri, 15 May 2026 21:08:34 +0100 Subject: coresight: Move CPU hotplug callbacks to core layer This commit moves CPU hotplug callbacks from ETMv4 driver to core layer. The motivation is the core layer can control all components on an activated path rather but not only managing tracer in ETMv4 driver. The perf event layer will disable CoreSight PMU event 'cs_etm' when hotplug off a CPU. That means a perf mode will be always converted to disabled mode in CPU hotplug. Arm CoreSight CPU hotplug callbacks only need to handle the Sysfs mode and ignore the perf mode. Add a 'mode' argument to coresight_pm_get_active_path() so it only returns active paths for the relevant mode. Define the enum with bit flags so it is safe for bitwise operations. Change CPUHP_AP_ARM_CORESIGHT_STARTING to CPUHP_AP_ARM_CORESIGHT_ONLINE so that the CPU hotplug callback runs in the online state and thread context, allowing coresight_disable_sysfs() to be called directly to disable the path. Tested-by: James Clark Reviewed-by: Yeoreum Yun Reviewed-by: James Clark Tested-by: Jie Gan Signed-off-by: Leo Yan Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20260515-arm_coresight_path_power_management_improvement-v14-27-f88c4a3ecfe9@arm.com --- include/linux/coresight.h | 6 +++--- include/linux/cpuhotplug.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/coresight.h b/include/linux/coresight.h index 76ef4c096512..add0579cad88 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -344,9 +344,9 @@ struct coresight_path { }; enum cs_mode { - CS_MODE_DISABLED, - CS_MODE_SYSFS, - CS_MODE_PERF, + CS_MODE_DISABLED = 0, + CS_MODE_SYSFS = BIT(0), + CS_MODE_PERF = BIT(1), }; #define coresight_ops(csdev) csdev->ops diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h index 22ba327ec227..0fb3a2a62eb0 100644 --- a/include/linux/cpuhotplug.h +++ b/include/linux/cpuhotplug.h @@ -180,7 +180,6 @@ enum cpuhp_state { CPUHP_AP_DUMMY_TIMER_STARTING, CPUHP_AP_ARM_XEN_STARTING, CPUHP_AP_ARM_XEN_RUNSTATE_STARTING, - CPUHP_AP_ARM_CORESIGHT_STARTING, CPUHP_AP_ARM_CORESIGHT_CTI_STARTING, CPUHP_AP_ARM64_ISNDEP_STARTING, CPUHP_AP_SMPCFD_DYING, @@ -200,6 +199,7 @@ enum cpuhp_state { CPUHP_AP_IRQ_AFFINITY_ONLINE, CPUHP_AP_BLK_MQ_ONLINE, CPUHP_AP_ARM_MVEBU_SYNC_CLOCKS, + CPUHP_AP_ARM_CORESIGHT_ONLINE, CPUHP_AP_X86_INTEL_EPB_ONLINE, CPUHP_AP_PERF_ONLINE, CPUHP_AP_PERF_X86_ONLINE, -- cgit v1.2.3 From 47f28b493daf9049307494689e515205f1c377af Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 08:29:13 +0200 Subject: iomap: don't make REQ_POLLED imply REQ_NOWAIT As described in commit 2bc057692599 ("block: don't make REQ_POLLED imply REQ_NOWAIT"), which fixed the same issue for the block device node, there are valid cases to poll for I/O completion without REQ_NOWAIT. Additionally, sing REQ_NOWAIT for file system writes is currently not supported as file systems writes are not idempotent and would need a retry of just the bio and not the entire operation to be fully supported. Switch iomap to set REQ_POLLED and remove the now unused bio_set_polled helper. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260518062917.506483-1-hch@lst.de Signed-off-by: Christian Brauner --- include/linux/bio.h | 14 -------------- 1 file changed, 14 deletions(-) (limited to 'include') diff --git a/include/linux/bio.h b/include/linux/bio.h index 97d747320b35..fbccb2f264b0 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -702,20 +702,6 @@ static inline bool bioset_initialized(struct bio_set *bs) return bs->bio_slab != NULL; } -/* - * Mark a bio as polled. Note that for async polled IO, the caller must - * expect -EWOULDBLOCK if we cannot allocate a request (or other resources). - * We cannot block waiting for requests on polled IO, as those completions - * must be found by the caller. This is different than IRQ driven IO, where - * it's safe to wait for IO to complete. - */ -static inline void bio_set_polled(struct bio *bio, struct kiocb *kiocb) -{ - bio->bi_opf |= REQ_POLLED; - if (kiocb->ki_flags & IOCB_NOWAIT) - bio->bi_opf |= REQ_NOWAIT; -} - static inline void bio_clear_polled(struct bio *bio) { bio->bi_opf &= ~REQ_POLLED; -- cgit v1.2.3 From 379e8f1ca5e919b130b40d8115d92a536e5f8d7a Mon Sep 17 00:00:00 2001 From: Boris Brezillon Date: Mon, 18 May 2026 13:41:45 +0200 Subject: drm/gem: Make the GEM LRU lock part of drm_device Recently, a few races have been discovered in the GEM LRU logic, all of them caused by the fact the LRU lock is accessed through gem->lru->lock, and that very same lock also protects changes to gem->lru, leading to situations where gem->lru needs to first be accessed without the lock held, to then get the lru to access the lock through and finally take the lock and do the expected operation. Currently, the only driver making use of this API (MSM) declares a device-wide lock, and the user we're about to add (panthor) will do the same. There's no evidence that we will ever have a driver that wants different pools of LRUs protected by different locks under the same drm_device. So we're better off moving this lock to drm_device and always locking it through obj->dev->gem_lru_mutex, or directly through dev->gem_lru_mutex. If anyone ever needs more fine-grained locking, this can be revisited to pass some drm_gem_lru_pool object representing the pool of LRUs under a specific lock, but for now, the per-device lock seems to be enough. Fixes: e7c2af13f811 ("drm/gem: Add LRU/shrinker helper") Reported-by: Chia-I Wu Closes: https://gitlab.freedesktop.org/panfrost/linux/-/work_items/86 Reviewed-by: Rob Clark Reviewed-by: Liviu Dudau Reviewed-by: Steven Price Reviewed-by: Chia-I Wu Link: https://patch.msgid.link/20260518-panthor-shrinker-fixes-v4-1-1920234470d5@collabora.com Signed-off-by: Boris Brezillon --- include/drm/drm_device.h | 7 +++++++ include/drm/drm_gem.h | 20 +++++++++----------- 2 files changed, 16 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/drm/drm_device.h b/include/drm/drm_device.h index bc78fb77cc27..768a8dae83c5 100644 --- a/include/drm/drm_device.h +++ b/include/drm/drm_device.h @@ -375,6 +375,13 @@ struct drm_device { * Root directory for debugfs files. */ struct dentry *debugfs_root; + + /** + * @gem_lru_mutex: + * + * Lock protecting movement of GEM objects between LRUs. + */ + struct mutex gem_lru_mutex; }; void drm_dev_set_dma_dev(struct drm_device *dev, struct device *dma_dev); diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 86f5846154f7..8a704f6a65c1 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -245,17 +245,11 @@ struct drm_gem_object_funcs { * for lockless &shrinker.count_objects, and provides * &drm_gem_lru_scan for driver's &shrinker.scan_objects * implementation. + * + * Any access to this kind of object must be done with + * drm_device::gem_lru_mutex held. */ struct drm_gem_lru { - /** - * @lock: - * - * Lock protecting movement of GEM objects between LRUs. All - * LRUs that the object can move between should be protected - * by the same lock. - */ - struct mutex *lock; - /** * @count: * @@ -453,6 +447,9 @@ struct drm_gem_object { * @lru: * * The current LRU list that the GEM object is on. + * + * Access to this field must be done with drm_device::gem_lru_mutex + * held. */ struct drm_gem_lru *lru; }; @@ -610,12 +607,13 @@ void drm_gem_unlock_reservations(struct drm_gem_object **objs, int count, int drm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev, u32 handle, u64 *offset); -void drm_gem_lru_init(struct drm_gem_lru *lru, struct mutex *lock); +void drm_gem_lru_init(struct drm_gem_lru *lru); void drm_gem_lru_remove(struct drm_gem_object *obj); void drm_gem_lru_move_tail_locked(struct drm_gem_lru *lru, struct drm_gem_object *obj); void drm_gem_lru_move_tail(struct drm_gem_lru *lru, struct drm_gem_object *obj); unsigned long -drm_gem_lru_scan(struct drm_gem_lru *lru, +drm_gem_lru_scan(struct drm_device *dev, + struct drm_gem_lru *lru, unsigned int nr_to_scan, unsigned long *remaining, bool (*shrink)(struct drm_gem_object *obj, struct ww_acquire_ctx *ticket), -- cgit v1.2.3 From 37dba38ac8d0910f31788368bce4d93aa4059040 Mon Sep 17 00:00:00 2001 From: Herve Codina Date: Wed, 13 May 2026 10:16:45 +0200 Subject: of: Introduce of_property_read_s32_index() Signed integers can be read from single value properties using of_property_read_s32() but nothing exist to read signed integers from multi-value properties. Fix this lack adding of_property_read_s32_index(). Signed-off-by: Herve Codina Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260513081702.317117-2-herve.codina@bootlin.com Signed-off-by: Mark Brown --- include/linux/of.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/of.h b/include/linux/of.h index 959786f8f196..28153616e616 100644 --- a/include/linux/of.h +++ b/include/linux/of.h @@ -1476,6 +1476,13 @@ static inline int of_property_read_s32(const struct device_node *np, return of_property_read_u32(np, propname, (u32*) out_value); } +static inline int of_property_read_s32_index(const struct device_node *np, + const char *propname, u32 index, + s32 *out_value) +{ + return of_property_read_u32_index(np, propname, index, (u32 *)out_value); +} + #define of_for_each_phandle(it, err, np, ln, cn, cc) \ for (of_phandle_iterator_init((it), (np), (ln), (cn), (cc)), \ err = of_phandle_iterator_next(it); \ -- cgit v1.2.3 From 96a3d2f3167f5644b30e60171898e67123c3c2c6 Mon Sep 17 00:00:00 2001 From: Joonwon Kang Date: Sun, 10 May 2026 05:41:11 +0000 Subject: mailbox: Make mbox_send_message() return error code when tx fails When the mailbox controller failed transmitting message, the error code was only passed to the client's tx done handler and not to mbox_send_message() in blocking mode. For this reason, the function could return a false success. This commit resolves the issue by introducing the tx status and checking it before mbox_send_message() returns. This commit works with the premise that the multi-threads' access to a channel in blocking mode is serialized by clients, not by the mailbox APIs, since the current mbox_send_message() in blocking mode does not support multi-threads. Signed-off-by: Joonwon Kang Reviewed-by: Sudeep Holla Signed-off-by: Jassi Brar --- include/linux/mailbox_controller.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/mailbox_controller.h b/include/linux/mailbox_controller.h index dc93287a2a01..26a238a6f941 100644 --- a/include/linux/mailbox_controller.h +++ b/include/linux/mailbox_controller.h @@ -120,6 +120,7 @@ struct mbox_controller { * @txdone_method: Way to detect TXDone chosen by the API * @cl: Pointer to the current owner of this channel * @tx_complete: Transmission completion + * @tx_status: Transmission status * @active_req: Currently active request hook * @msg_count: No. of mssg currently queued * @msg_free: Index of next available mssg slot @@ -132,6 +133,7 @@ struct mbox_chan { unsigned txdone_method; struct mbox_client *cl; struct completion tx_complete; + int tx_status; void *active_req; unsigned msg_count, msg_free; void *msg_data[MBOX_TX_QUEUE_LEN]; -- cgit v1.2.3 From 8817005efbdfdf5d4e4814cb5dc52b53d12917d7 Mon Sep 17 00:00:00 2001 From: Qing Ming Date: Sat, 16 May 2026 15:08:49 +0800 Subject: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers: UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9 index 2147483647 is out of range for type 'long unsigned int [64]' Call Trace: css_rstat_updated bpf_iter_run_prog cgroup_iter_seq_show bpf_seq_read Add cpu validation to the BPF-facing css_rstat_updated() kfunc and move the common implementation to __css_rstat_updated() for in-kernel callers. Fixes: a319185be9f5 ("cgroup: bpf: enable bpf programs to integrate with rstat") Signed-off-by: Qing Ming Signed-off-by: Tejun Heo --- include/linux/cgroup.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index e52160e85af4..e011dc43fcf1 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -776,6 +776,7 @@ static inline void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen) /* * cgroup scalable recursive statistics. */ +void __css_rstat_updated(struct cgroup_subsys_state *css, int cpu); void css_rstat_updated(struct cgroup_subsys_state *css, int cpu); void css_rstat_flush(struct cgroup_subsys_state *css); -- cgit v1.2.3 From a2b4cf39d9d333bfeb9262dbaafe3d24d405a5c0 Mon Sep 17 00:00:00 2001 From: Jianyong Wu Date: Wed, 13 May 2026 13:39:12 -0700 Subject: sched/cache: Allow only 1 thread of the process to calculate the LLC occupancy Scanning online CPUs to calculate the occupancy might be time-consuming. Only allow 1 thread of the process to scan the CPUs at the same time, which is similar to what NUMA balance does in task_numa_work(). Signed-off-by: Jianyong Wu Signed-off-by: Chen Yu Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/5672b52e588b855b01e5a1a17822f7c6c7237a3d.1778703694.git.tim.c.chen@linux.intel.com --- include/linux/sched.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index d2010483cd77..6d883f109ba3 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2423,6 +2423,7 @@ struct sched_cache_stat { struct sched_cache_time __percpu *pcpu_sched; raw_spinlock_t lock; unsigned long epoch; + unsigned long next_scan; int cpu; } ____cacheline_aligned_in_smp; -- cgit v1.2.3 From deee5e27d5b608323c04dc99979e55f944016a13 Mon Sep 17 00:00:00 2001 From: Chen Yu Date: Wed, 13 May 2026 13:39:13 -0700 Subject: sched/cache: Disable cache aware scheduling for processes with high thread counts A performance regression was observed by Prateek when running hackbench with many threads per process (high fd count). To avoid this, processes with a large number of active threads are excluded from cache-aware scheduling. With sched_cache enabled, record the number of active threads in each process during the periodic task_cache_work(). While iterating over CPUs, if the currently running task belongs to the same process as the task that launched task_cache_work(), increment the active thread count. If the number of active threads within the process exceeds the number of Cores (divided by the SMT number) in the LLC, do not enable cache-aware scheduling. However, on systems with a smaller number of CPUs within 1 LLC, like Power10/Power11 with SMT4 and an LLC size of 4, this check effectively disables cache-aware scheduling for any process. One possible solution suggested by Peter is to use an LLC-mask instead of a single LLC value for preference. Once there are a 'few' LLCs as preference, this constraint becomes a little easier. It could be an enhancement in the future. For users who wish to perform task aggregation regardless, a debugfs knob is provided for tuning in a subsequent change. Suggested-by: K Prateek Nayak Suggested-by: Aaron Lu Signed-off-by: Chen Yu Co-developed-by: Tim Chen Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Tested-by: Tingyin Duan Link: https://patch.msgid.link/d076cd21a8e6c6341d1e2d927e118db770ebb650.1778703694.git.tim.c.chen@linux.intel.com --- include/linux/sched.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index 6d883f109ba3..6701911eaaf7 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2423,6 +2423,7 @@ struct sched_cache_stat { struct sched_cache_time __percpu *pcpu_sched; raw_spinlock_t lock; unsigned long epoch; + u64 nr_running_avg; unsigned long next_scan; int cpu; } ____cacheline_aligned_in_smp; -- cgit v1.2.3 From 7030513a08776b2ca70fccd5dfddf7bb5c5c88ba Mon Sep 17 00:00:00 2001 From: Chen Yu Date: Wed, 13 May 2026 13:39:15 -0700 Subject: sched/cache: Calculate the LLC size and store it in sched_domain Cache aware scheduling needs to know the LLC size that a process can use, so as to avoid memory-intensive tasks from being over-aggregated on a single LLC. Introduce a preparation patch to add get_effective_llc_bytes() to get the LLC size that a CPU can use. The function can be further enhanced by subtracting the LLC cache ways reserved by resctrl (CAT in Intel RDT, etc). Suggested-by: Peter Zijlstra (Intel) Signed-off-by: Chen Yu Co-developed-by: Tim Chen Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Tested-by: Tingyin Duan Link: https://patch.msgid.link/37afee09ff608034da0ce149e72d33b6f4698edf.1778703694.git.tim.c.chen@linux.intel.com --- include/linux/cacheinfo.h | 1 + include/linux/sched/topology.h | 7 +++++++ 2 files changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/cacheinfo.h b/include/linux/cacheinfo.h index c8f4f0a0b874..fc879ac4cc4f 100644 --- a/include/linux/cacheinfo.h +++ b/include/linux/cacheinfo.h @@ -89,6 +89,7 @@ int populate_cache_leaves(unsigned int cpu); int cache_setup_acpi(unsigned int cpu); bool last_level_cache_is_valid(unsigned int cpu); bool last_level_cache_is_shared(unsigned int cpu_x, unsigned int cpu_y); +struct cacheinfo *get_cpu_cacheinfo_llc(unsigned int cpu); int fetch_cache_info(unsigned int cpu); int detect_cache_attributes(unsigned int cpu); #ifndef CONFIG_ACPI_PPTT diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index 0036d6b4bd67..fe09d3268bc9 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -106,6 +106,7 @@ struct sched_domain { #ifdef CONFIG_SCHED_CACHE unsigned int llc_max; unsigned int *llc_counts __counted_by_ptr(llc_max); + unsigned long llc_bytes; #endif #ifdef CONFIG_SCHEDSTATS @@ -265,4 +266,10 @@ static inline int task_node(const struct task_struct *p) return cpu_to_node(task_cpu(p)); } +#ifdef CONFIG_SCHED_CACHE +extern void sched_update_llc_bytes(unsigned int cpu); +#else +static inline void sched_update_llc_bytes(unsigned int cpu) { } +#endif + #endif /* _LINUX_SCHED_TOPOLOGY_H */ -- cgit v1.2.3 From 808915f982c2a52f5d148510ecfab52284de67cf Mon Sep 17 00:00:00 2001 From: Chen Yu Date: Wed, 13 May 2026 13:39:16 -0700 Subject: sched/cache: Avoid cache-aware scheduling for memory-heavy processes Prateek and Tingyin reported that memory-intensive workloads (such as stream) can saturate memory bandwidth and caches on the preferred LLC when sched_cache aggregates too many threads. To mitigate this, estimate a process's memory footprint by comparing its NUMA balancing fault statistics to the size of the LLC. If the footprint exceeds the LLC size, skip cache-aware scheduling. Note that footprint is only an approximation of the memory footprint, since the kernel lacks suitable metrics to estimate the real working set. If a user-provided hint is available in the future, it would be more accurate. A later patch will allow users to provide a hint to adjust this threshold. Suggested-by: K Prateek Nayak Suggested-by: Vern Hao Signed-off-by: Chen Yu Co-developed-by: Tim Chen Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Tested-by: Tingyin Duan Link: https://patch.msgid.link/95cf64a385bcc12f18dcebe9d59e8d3ba8bb318f.1778703694.git.tim.c.chen@linux.intel.com --- include/linux/sched.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index 6701911eaaf7..95729670929c 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2425,6 +2425,7 @@ struct sched_cache_stat { unsigned long epoch; u64 nr_running_avg; unsigned long next_scan; + unsigned long footprint; int cpu; } ____cacheline_aligned_in_smp; -- cgit v1.2.3 From 03755348b8e74421f92ffed9da159175a698290b Mon Sep 17 00:00:00 2001 From: Chen Yu Date: Wed, 13 May 2026 13:39:21 -0700 Subject: sched/cache: Fix unpaired account_llc_enqueue/dequeue There is a race condition that, after a task is enqueued on a runqueue, task_llc(p) may change due to CPU hotplug, because the llc_id is dynamically allocated and adjusted at runtime. Therefore, checking task_llc(p) to determine whether the task is being dequeued from its preferred LLC is unreliable and can cause inconsistent values. To fix this problem, record whether p is enqueued on its preferred LLC, in order to pair with account_llc_dequeue() to maintain a consistent nr_pref_llc_running per runqueue. This bug was reported by sashiko, and the solution was once suggested by Prateek. Fixes: 46afe3af7ead ("sched/cache: Track LLC-preferred tasks per runqueue") Suggested-by: K Prateek Nayak Signed-off-by: Chen Yu Co-developed-by: Tim Chen Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/0c8c6a1571d66792a4d2ff0103ba3cc13e059046.1778703694.git.tim.c.chen@linux.intel.com --- include/linux/sched.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index 95729670929c..2c9e8e2edde1 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1410,6 +1410,8 @@ struct task_struct { #ifdef CONFIG_SCHED_CACHE struct callback_head cache_work; int preferred_llc; + /* 1: task was enqueued to its preferred LLC, 0 otherwise */ + int pref_llc_queued; #endif struct rseq_data rseq; -- cgit v1.2.3 From b269bb5e4cc3cf04a592d516a3dc260d9d893f24 Mon Sep 17 00:00:00 2001 From: Sherry Sun Date: Wed, 22 Apr 2026 17:35:39 +0800 Subject: PCI: host-generic: Add common helpers for parsing Root Port properties Introduce generic helper functions to parse Root Port device tree nodes and extract common properties like reset GPIOs. This allows multiple PCI host controller drivers to share the same parsing logic. Define struct pci_host_port to hold common Root Port properties (currently only list of PERST# GPIO descriptors) and add pci_host_common_parse_ports() to parse Root Port nodes from device tree. Also add the 'ports' list to struct pci_host_bridge to better maintain parsed Root Port information. Signed-off-by: Sherry Sun Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260422093549.407022-3-sherry.sun@nxp.com --- include/linux/pci.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index 2c4454583c11..cb5f3e7e8e48 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -636,6 +636,7 @@ struct pci_host_bridge { int domain_nr; struct list_head windows; /* resource_entry */ struct list_head dma_ranges; /* dma ranges resource list */ + struct list_head ports; /* Root Port list (pci_host_port) */ #ifdef CONFIG_PCI_IDE u16 nr_ide_streams; /* Max streams possibly active in @ide_stream_ida */ struct ida ide_stream_ida; -- cgit v1.2.3 From 9fe78db3ad1737f393b18b04220a158b45e6dd91 Mon Sep 17 00:00:00 2001 From: Nimrod Oren Date: Thu, 14 May 2026 13:49:25 +0300 Subject: net/mlx5: add debugfs stats for frag buf dma pools Add a debugfs file exposing per-node DMA pool usage for mlx5_frag_buf allocations. # cat /sys/kernel/debug/mlx5//frag_buf_dma_pools node block_size used_blocks allocated_blocks 0 4096 0 0 0 8192 0 0 0 16384 0 0 0 32768 0 0 0 65536 0 0 1 4096 0 0 1 8192 0 0 1 16384 0 0 1 32768 0 0 1 65536 0 0 Signed-off-by: Nimrod Oren Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260514104925.337570-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski --- include/linux/mlx5/driver.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index 8b4d384125d1..9a4bb25d8e0a 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -547,6 +547,7 @@ struct mlx5_debugfs_entries { struct dentry *eq_debugfs; struct dentry *cq_debugfs; struct dentry *cmdif_debugfs; + struct dentry *frag_buf_dma_pools_debugfs; struct dentry *pages_debugfs; struct dentry *lag_debugfs; }; -- cgit v1.2.3 From 086abf9da661e3da9a9ef40b36963b230ec58112 Mon Sep 17 00:00:00 2001 From: Costa Shulyupin Date: Fri, 15 May 2026 21:45:25 +0300 Subject: include: Remove unused ks8851_mll.h The last user was removed in commit 72628da6d634 ("net: ks8851: Remove ks8851_mll.c") which consolidated the driver into a common implementation. No file includes this header. Signed-off-by: Costa Shulyupin Link: https://patch.msgid.link/20260515184531.1515418-1-costa.shul@redhat.com Signed-off-by: Jakub Kicinski --- include/linux/ks8851_mll.h | 21 --------------------- 1 file changed, 21 deletions(-) delete mode 100644 include/linux/ks8851_mll.h (limited to 'include') diff --git a/include/linux/ks8851_mll.h b/include/linux/ks8851_mll.h deleted file mode 100644 index 57c0a39ed796..000000000000 --- a/include/linux/ks8851_mll.h +++ /dev/null @@ -1,21 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * ks8861_mll platform data struct definition - * Copyright (c) 2012 BTicino S.p.A. - */ - -#ifndef _LINUX_KS8851_MLL_H -#define _LINUX_KS8851_MLL_H - -#include - -/** - * struct ks8851_mll_platform_data - Platform data of the KS8851_MLL network driver - * @macaddr: The MAC address of the device, set to all 0:s to use the on in - * the chip. - */ -struct ks8851_mll_platform_data { - u8 mac_addr[ETH_ALEN]; -}; - -#endif -- cgit v1.2.3 From 7d3ab852dcd853692197a830d20052127754a087 Mon Sep 17 00:00:00 2001 From: Bobby Eshleman Date: Thu, 14 May 2026 10:22:28 -0700 Subject: net: convert netmem_tx flag to enum Devices that support netmem TX previously set dev->netmem_tx = true. This was checked in validate_xmit_unreadable_skb() to drop unreadable skbs (skbs with dmabuf-backed frags) before they reach drivers that would mishandle them or devices that would not have the iommu mappings for them. A subsequent patch will introduce a third state for virtual devices that forward unreadable skbs without ever performing DMA on them. To prepare for that, convert the boolean dev->netmem_tx into an enum: NETMEM_TX_NONE - no netmem TX support (drop unreadable skbs) NETMEM_TX_DMA - full support, device does DMA Update the existing NIC drivers (bnxt, gve, mlx5, fbnic) and the validators in net/core to use the new enum. No functional change. Acked-by: Harshitha Ramamurthy Acked-by: Stanislav Fomichev Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260514-tcp-dm-netkit-v5-1-408c59b91e66@meta.com Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index e7af71491a47..b7a4503f7cdb 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1794,6 +1794,11 @@ enum netdev_stat_type { NETDEV_PCPU_STAT_DSTATS, /* struct pcpu_dstats */ }; +enum netmem_tx_mode { + NETMEM_TX_NONE, /* no netmem TX support */ + NETMEM_TX_DMA, /* DMA-capable netmem TX (real HW) */ +}; + enum netdev_reg_state { NETREG_UNINITIALIZED = 0, NETREG_REGISTERED, /* completed register_netdevice */ @@ -1815,7 +1820,7 @@ enum netdev_reg_state { * @lltx: device supports lockless Tx. Deprecated for real HW * drivers. Mainly used by logical interfaces, such as * bonding and tunnels - * @netmem_tx: device support netmem_tx. + * @netmem_tx: device netmem TX mode * * @name: This is the first field of the "visible" part of this structure * (i.e. as seen by users in the "Space.c" file). It is the name -- cgit v1.2.3 From 6ce2bb048055ee599c0f35f1a90ff5db29ba5d65 Mon Sep 17 00:00:00 2001 From: Bobby Eshleman Date: Thu, 14 May 2026 10:22:29 -0700 Subject: net: netkit: declare NETMEM_TX_NO_DMA mode Some virtual devices like netkit (or ifb) never DMA and never touch frag contents, they just forward the skb to another device. They are unable to forward unreadable skbs, however, because they fail to pass TX validation checks on dev->netmem_tx. The existing two-state NETMEM_TX_NONE / NETMEM_TX_DMA doesn't give the TX validator enough information to differentiate devices that will attempt DMA on the unreadable skb from those that will simply route it untouched. Add a third mode to the enum so drivers can indicate 1) if they have netmem TX support, and 2) if they do, whether they are DMA-capable: NETMEM_TX_NO_DMA - pass-through, device never DMAs Widen dev->netmem_tx from a 1-bit field to 2 bits to fit the new value, and declare netkit as NETMEM_TX_NO_DMA. Devmem TX support over these devices comes in a follow-up patch. Acked-by: Stanislav Fomichev Signed-off-by: Bobby Eshleman Link: https://patch.msgid.link/20260514-tcp-dm-netkit-v5-2-408c59b91e66@meta.com Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index b7a4503f7cdb..bf3dd9b2c1a7 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1797,6 +1797,7 @@ enum netdev_stat_type { enum netmem_tx_mode { NETMEM_TX_NONE, /* no netmem TX support */ NETMEM_TX_DMA, /* DMA-capable netmem TX (real HW) */ + NETMEM_TX_NO_DMA, /* no DMA, e.g. passthrough for virtual devs */ }; enum netdev_reg_state { @@ -2143,7 +2144,7 @@ struct net_device { struct_group(priv_flags_fast, unsigned long priv_flags:32; unsigned long lltx:1; - unsigned long netmem_tx:1; + unsigned long netmem_tx:2; ); const struct net_device_ops *netdev_ops; const struct header_ops *header_ops; -- cgit v1.2.3 From 5073d284650a585dc2450d682ae0c0052b253ae4 Mon Sep 17 00:00:00 2001 From: Alexander Koskovich Date: Sun, 12 Apr 2026 15:42:40 +0000 Subject: dt-bindings: arm: qcom,ids: Add SoC ID for SM7750 Document the ID for SM7750, an Eliza SoC variant that can be found on the Nothing Phone (4a) Pro. Signed-off-by: Alexander Koskovich Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260412-sm7550-id-v1-1-958a673ff791@pm.me Signed-off-by: Bjorn Andersson --- include/dt-bindings/arm/qcom,ids.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/dt-bindings/arm/qcom,ids.h b/include/dt-bindings/arm/qcom,ids.h index bc65e233eb93..7f73f315f0ec 100644 --- a/include/dt-bindings/arm/qcom,ids.h +++ b/include/dt-bindings/arm/qcom,ids.h @@ -290,6 +290,7 @@ #define QCOM_ID_IPQ5424 651 #define QCOM_ID_QCM6690 657 #define QCOM_ID_QCS6690 658 +#define QCOM_ID_SM7750 659 #define QCOM_ID_SM8850 660 #define QCOM_ID_IPQ5404 671 #define QCOM_ID_QCS9100 667 -- cgit v1.2.3 From 0670a10b7c22bef36d9e1ca5a75b832db4508a1b Mon Sep 17 00:00:00 2001 From: Deepti Jaggi Date: Mon, 27 Apr 2026 08:35:30 +0800 Subject: dt-bindings: arm: qcom,ids: Add SoC ID for Nord SA8797P Nord is a SoC family from Qualcomm designed as the next generation of Lemans series. SA8797P is the automotive variant of Nord, where platform resources such as clocks, regulators, interconnects, etc. are managed by firmware through SCMI. Add SoC ID for Nord SA8797P. Signed-off-by: Deepti Jaggi Reviewed-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo Link: https://lore.kernel.org/r/20260427003531.229671-2-shengchao.guo@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/arm/qcom,ids.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/dt-bindings/arm/qcom,ids.h b/include/dt-bindings/arm/qcom,ids.h index 7f73f315f0ec..1af73c0ad41c 100644 --- a/include/dt-bindings/arm/qcom,ids.h +++ b/include/dt-bindings/arm/qcom,ids.h @@ -298,6 +298,7 @@ #define QCOM_ID_QCS8275 675 #define QCOM_ID_QCS9075 676 #define QCOM_ID_QCS615 680 +#define QCOM_ID_SA8797P 690 #define QCOM_ID_CQ7790M 731 #define QCOM_ID_CQ7790S 732 #define QCOM_ID_CQ2390M 756 -- cgit v1.2.3 From 74c9d82c7e3fe9e5845103fe83d711d89b169ab1 Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Fri, 8 May 2026 11:53:00 -0300 Subject: iommu: Split the kdoc comment for struct iommu_iotlb_gather Use in-line member documentation and add some small clarifications to the members. This is preparation to add more members. - Note that pgsize is only used by arm-smmuv3 - Note that freelist is only used by iommupt - Reword queued to emphasize the flush-all behavior Signed-off-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Tested-by: Andrew Jones Signed-off-by: Joerg Roedel --- include/linux/iommu.h | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/iommu.h b/include/linux/iommu.h index e587d4ac4d33..a9e89911c90f 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -345,12 +345,6 @@ struct iommu_pages_list { /** * struct iommu_iotlb_gather - Range information for a pending IOTLB flush * - * @start: IOVA representing the start of the range to be flushed - * @end: IOVA representing the end of the range to be flushed (inclusive) - * @pgsize: The interval at which to perform the flush - * @freelist: Removed pages to free after sync - * @queued: Indicates that the flush will be queued - * * This structure is intended to be updated by multiple calls to the * ->unmap() function in struct iommu_ops before eventually being passed * into ->iotlb_sync(). Drivers can add pages to @freelist to be freed after @@ -359,10 +353,24 @@ struct iommu_pages_list { * later instead of ->iotlb_sync(), so drivers may optimise accordingly. */ struct iommu_iotlb_gather { + /** @start: IOVA representing the start of the range to be flushed */ unsigned long start; + /** + * @end: IOVA representing the end of the range to be + * flushed (inclusive) + */ unsigned long end; + /** + * @pgsize: The interval at which to perform the flush, only used + * by arm-smmu-v3 + */ size_t pgsize; + /** + * @freelist: Removed pages to free after sync, only used by + * iommupt + */ struct iommu_pages_list freelist; + /** @queued: True if the gather will be completed with a flush all */ bool queued; }; -- cgit v1.2.3 From 89792629d4b260104555f9719ac84c1afc9a2012 Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Fri, 8 May 2026 11:53:02 -0300 Subject: iommupt: Add PT_FEAT_DETAILED_GATHER Generating the ARM SMMUv3 and RISC-V invalidation commands optimally requires some additional details from iommupt: - leaf_levels_bitmap is used to compute the ARM Range Invalidation Table Top Level hint - leaf_levels_bitmap is also used to compute the stride when generating single invalidations to invalidate once per leaf - table_levels_bitmap also computes the ARM TTL for future cases when there are no leaves Put these under a feature since only two drivers need to calculate them. This is also useful for the coming kunit iotlb invalidation test to know more about what invalidation is happening. Signed-off-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Tested-by: Andrew Jones Signed-off-by: Joerg Roedel --- include/linux/generic_pt/common.h | 5 +++++ include/linux/iommu.h | 30 +++++++++++++++++++++++++----- 2 files changed, 30 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/generic_pt/common.h b/include/linux/generic_pt/common.h index 2683e5b38998..07ef1c8341a4 100644 --- a/include/linux/generic_pt/common.h +++ b/include/linux/generic_pt/common.h @@ -134,6 +134,11 @@ enum pt_features { * significant amount of page table. */ PT_FEAT_FLUSH_RANGE_NO_GAPS, + /** + * @PT_FEAT_DETAILED_GATHER: Fill in the struct iommu_iotlb_gather pt + * sub structure with information about which levels were changed. + */ + PT_FEAT_DETAILED_GATHER, /* private: */ PT_FEAT_FMT_START, }; diff --git a/include/linux/iommu.h b/include/linux/iommu.h index a9e89911c90f..bf8a77a164e4 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -360,11 +360,31 @@ struct iommu_iotlb_gather { * flushed (inclusive) */ unsigned long end; - /** - * @pgsize: The interval at which to perform the flush, only used - * by arm-smmu-v3 - */ - size_t pgsize; + + union { + /** + * @pgsize: The interval at which to perform the flush, only + * used by arm-smmu-v3 + */ + size_t pgsize; + struct { + /** + * @pt.leaf_levels_bitmap: Bitmap of generic_pt + * levels where leaf entries were unmapped. Bit 0 + * means the leaf only level. If 0 no leafs + * were unmapped. + */ + u8 leaf_levels_bitmap; + /** + * @pt.table_levels_bitmap: Bitmap of generic_pt levels + * of table entries that were removed. Bit 0 is never + * set, bit 1 means a table of all leafs was removed. + * When freelist is empty this must be 0. + */ + u8 table_levels_bitmap; + } pt; + }; + /** * @freelist: Removed pages to free after sync, only used by * iommupt -- cgit v1.2.3 From 03d1078112fddd706b2c1e4a7d98cf18700eb5df Mon Sep 17 00:00:00 2001 From: Luca Ceresoli Date: Mon, 11 May 2026 18:40:06 +0200 Subject: drm/bridge: add of_drm_get_bridge_by_endpoint() drm_of_find_panel_or_bridge() is widely used, but many callers pass NULL into the @panel or the @bridge arguments, thus making a very partial usage of this rather complex function. Besides, the bridge returned in @bridge is not refcounted, thus making this API unsafe when DRM bridge hotplug will be introduced. Solve both issues for the cases of calls to drm_of_find_panel_or_bridge() with a NULL @panel pointer by adding a new function that only looks for bridges (and is thus much simpler) and increments the refcount of the returned bridge. The new function is identical to drm_of_find_panel_or_bridge() except it: - handles bridge refcounting: uses of_drm_find_and_get_bridge() instead of of_drm_find_bridge() internally to return a refcounted bridge - is simpler to use: just takes no @panel parameter, returns the pointer in the return value instead of a double pointer argument - has a simpler implementation: it is equal to drm_of_find_panel_or_bridge() after removing the code that becomes dead when @panel == NULL Also add this function to drm_bridge.c and not drm_of.c because it returns bridges only. Reviewed-by: Dmitry Baryshkov Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260511-drm-bridge-alloc-getput-panel_or_bridge-v6-2-f61c9e498b3f@bootlin.com Signed-off-by: Luca Ceresoli --- include/drm/drm_bridge.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h index fdac9a526f38..4ba3a5deef9a 100644 --- a/include/drm/drm_bridge.h +++ b/include/drm/drm_bridge.h @@ -1327,6 +1327,8 @@ int drm_bridge_attach(struct drm_encoder *encoder, struct drm_bridge *bridge, #ifdef CONFIG_OF struct drm_bridge *of_drm_find_and_get_bridge(struct device_node *np); struct drm_bridge *of_drm_find_bridge(struct device_node *np); +struct drm_bridge *of_drm_get_bridge_by_endpoint(const struct device_node *np, + int port, int endpoint); #else static inline struct drm_bridge *of_drm_find_and_get_bridge(struct device_node *np) { @@ -1336,6 +1338,11 @@ static inline struct drm_bridge *of_drm_find_bridge(struct device_node *np) { return NULL; } +static inline struct drm_bridge *of_drm_get_bridge_by_endpoint(const struct device_node *np, + int port, int endpoint) +{ + return ERR_PTR(-ENODEV); +} #endif static inline bool drm_bridge_is_last(struct drm_bridge *bridge) -- cgit v1.2.3 From ea19506013ad13685573e4674fbeddb790e27906 Mon Sep 17 00:00:00 2001 From: Yiyang Chen Date: Fri, 15 May 2026 00:05:05 +0800 Subject: sched/clock: Provide !HAVE_UNSTABLE_SCHED_CLOCK stub for sched_clock_stable() When CONFIG_HAVE_UNSTABLE_SCHED_CLOCK is disabled, sched_clock() is already assumed to provide stable semantics, but the public header doesn't provide a sched_clock_stable() stub for that case. Add a header stub that always returns true and clean up the duplicate local stub in ring_buffer.c, so callers can use sched_clock_stable() unconditionally. Signed-off-by: Yiyang Chen Signed-off-by: Peter Zijlstra (Intel) Acked-by: Steven Rostedt Link: https://patch.msgid.link/56e45338858946cd9581b75c8bd45dd37dba52c5.1778773587.git.cyyzero16@gmail.com --- include/linux/sched/clock.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/sched/clock.h b/include/linux/sched/clock.h index 196f0ca351a2..39f0a7f94bfc 100644 --- a/include/linux/sched/clock.h +++ b/include/linux/sched/clock.h @@ -33,6 +33,11 @@ extern u64 sched_clock_cpu(int cpu); extern void sched_clock_init(void); #ifndef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK +static inline int sched_clock_stable(void) +{ + return 1; +} + static inline void sched_clock_tick(void) { } -- cgit v1.2.3 From 815c5cb76a3e5dad4fc3911b9073591dc3a29282 Mon Sep 17 00:00:00 2001 From: Shrikanth Hegde Date: Fri, 15 May 2026 22:54:53 +0530 Subject: topology: Introduce cpu_smt_mask for CONFIG_SCHED_SMT=n Define cpu_smt_mask in case of CONFIG_SCHED_SMT=n as cpumask_of that CPU. With that config, it is expected that kernel treats each CPU as individual core. Using cpumask_of(cpu) reflects that. This would help to get rid of the ifdeffery that is spread across the codebase since cpu_smt_mask is defined only in case of CONFIG_SCHED_SMT=y. Note: There is no arch today which defines cpu_smt_mask unconditionally. So likely defining the cpu_smt_mask shouldn't lead redefinition errors. Signed-off-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Phil Auld Reviewed-by: Valentin Schneider Tested-by: K Prateek Nayak Link: https://patch.msgid.link/20260515172456.542799-2-sshegde@linux.ibm.com --- include/linux/topology.h | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/topology.h b/include/linux/topology.h index 6575af39fd10..709a2dcf4c73 100644 --- a/include/linux/topology.h +++ b/include/linux/topology.h @@ -230,11 +230,24 @@ static inline int cpu_to_mem(int cpu) #define topology_drawer_cpumask(cpu) cpumask_of(cpu) #endif -#if defined(CONFIG_SCHED_SMT) && !defined(cpu_smt_mask) +/* + * Defining cpu_smt_mask as cpumask_of that CPU helps to get + * rid of lot of ifdeffery all around the codebase in case of + * CONFIG_SCHED_SMT=n. It just means there are no other siblings, which + * is what is expected. + */ +#if defined(CONFIG_SCHED_SMT) +# if !defined(cpu_smt_mask) static inline const struct cpumask *cpu_smt_mask(int cpu) { return topology_sibling_cpumask(cpu); } +# endif +#else /* !CONFIG_SCHED_SMT */ +static inline const struct cpumask *cpu_smt_mask(int cpu) +{ + return cpumask_of(cpu); +} #endif #ifndef topology_is_primary_thread -- cgit v1.2.3 From 5bc6ab2d42e545f816def21cfcdb4ba35cc74bf6 Mon Sep 17 00:00:00 2001 From: Shrikanth Hegde Date: Fri, 15 May 2026 22:54:54 +0530 Subject: sched: Simplify ifdeffery around cpu_smt_mask Now, that cpu_smt_mask is defined as cpumask_of(cpu) for CONFIG_SCHED_SMT=n, it is possible to get rid of the ifdeffery. Effectively, - This makes sched_smt_present is defined always - cpumask_weight(cpumask_of(cpu)) == 1. So sched_smt_present_inc/dec will never enable the sched_smt_present. Which is expected. - Paths that were compile-time eliminated become runtime guarded using static keys. - Defines set_idle_cores, test_idle_cores, etc which could likely benefit the CONFIG_SCHED_SMT=n systems to use the same optimizations within the LLC at wakeups. - This will expose sched_smt_present symbol for CONFIG_SCHED_SMT=n. Likely not a concern. - There is a bloat of code CONFIG_SCHED_SMT=n. (NR_CPUS=2048) add/remove: 24/18 grow/shrink: 26/28 up/down: 6396/-3188 (3208) Total: Before=30629880, After=30633088, chg +0.01% - No code bloat for CONFIG_SCHED_SMT=y, which is expected. - Add comments around stop_core_cpuslocked on why ifdefs are not removed. - This leaves the remaining uses of CONFIG_SCHED_SMT mainly for topology building bits which has a policy based decision. Signed-off-by: Shrikanth Hegde Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Phil Auld Reviewed-by: Valentin Schneider Acked-by: Tejun Heo Tested-by: K Prateek Nayak Link: https://patch.msgid.link/20260515172456.542799-3-sshegde@linux.ibm.com --- include/linux/sched/smt.h | 4 ---- 1 file changed, 4 deletions(-) (limited to 'include') diff --git a/include/linux/sched/smt.h b/include/linux/sched/smt.h index 166b19af956f..cde6679c0278 100644 --- a/include/linux/sched/smt.h +++ b/include/linux/sched/smt.h @@ -4,16 +4,12 @@ #include -#ifdef CONFIG_SCHED_SMT extern struct static_key_false sched_smt_present; static __always_inline bool sched_smt_active(void) { return static_branch_likely(&sched_smt_present); } -#else -static __always_inline bool sched_smt_active(void) { return false; } -#endif void arch_smt_update(void); -- cgit v1.2.3 From 9e005ed21152d4a4bb0ceea71045ff8a642a6feb Mon Sep 17 00:00:00 2001 From: K Prateek Nayak Date: Tue, 19 May 2026 05:14:23 +0000 Subject: sched/topology: Allow multiple domains to claim sched_domain_shared Recent optimizations of sd->shared assignment moved to allocating a single instance of per-CPU sched_domain_shared objects per s_data. Recent optimizations to select_idle_capacity() moved the sd->shared assignments to "sd_asym" domain when ASYM_CPUCAPACITY is detected but cache-aware scheduling mandates the presence of "sd_llc_shared" to compute and cache per-LLC statistics. Use an "alloc_flags" union in sched_domain_shared to claim a sched_domain_shared object per sched_domain. Allocation starts searching for an available / matching sched_domain_shared instance from the first CPU of sched_domain_span(sd) (sd can be sd_llc, or sd_asym). If the shared object is claimed by another domain, the instance corresponding to next CPU in the domain span is explored until a matching / available instance is found. In case of a single CPU in sched_domain_span(), the domain will be degenerated and a temporary overlap of ->shared objects across different domains is acceptable. "alloc_flags" forms a union with "nr_idle_scan" and the stale flags are left as is when the sd->shared is published. The expectation is for the first load balancing instance to correct the value just like the current behavior, except the initial value is no longer 0. Originally-by: Peter Zijlstra Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Tested-by: Andrea Righi --- include/linux/sched/topology.h | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h index fe09d3268bc9..b5d9d7c2b8ad 100644 --- a/include/linux/sched/topology.h +++ b/include/linux/sched/topology.h @@ -67,7 +67,21 @@ struct sched_domain_shared { atomic_t ref; atomic_t nr_busy_cpus; int has_idle_cores; - int nr_idle_scan; + union { + int nr_idle_scan; + /* + * Used during allocation to claim the sched_domain_shared + * object at multiple levels. + * + * Note: between build and the first periodic LB tick, which + * rewrites the union via update_idle_cpu_scan(), readers of + * nr_idle_scan may observe the transient SD_* flag value as + * the scan bound. The flag bits are small positive integers, + * so the effect is just a slightly relaxed scan bound for one + * window and self-heals on the first tick. + */ + int alloc_flags; + }; #ifdef CONFIG_SCHED_CACHE unsigned long util_avg; unsigned long capacity; -- cgit v1.2.3 From a9e4e50519e99e5be2d69fa4eebec6a4848ae201 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Fri, 8 May 2026 10:45:16 -0700 Subject: locking/rtmutex: Annotate API and implementation Enable context analysis for struct rt_mutex and annotate all functions that accept a struct rt_mutex pointer. In the __rt_mutex_lock_common() callers, instead of adding the __no_context_analysis annotation, emit a runtime warning if the __rt_mutex_lock_common() return value is not zero and add an __acquire() statement. Signed-off-by: Bart Van Assche Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260508174520.1416285-1-bvanassche@acm.org --- include/linux/rtmutex.h | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/linux/rtmutex.h b/include/linux/rtmutex.h index 78e7e588817c..9e1f012f89db 100644 --- a/include/linux/rtmutex.h +++ b/include/linux/rtmutex.h @@ -56,6 +56,8 @@ static inline struct task_struct *rt_mutex_owner(struct rt_mutex_base *lock) #endif extern void rt_mutex_base_init(struct rt_mutex_base *rtb); +context_lock_struct(rt_mutex); + /** * The rt_mutex structure * @@ -108,8 +110,10 @@ do { \ extern void __rt_mutex_init(struct rt_mutex *lock, const char *name, struct lock_class_key *key); #ifdef CONFIG_DEBUG_LOCK_ALLOC -extern void rt_mutex_lock_nested(struct rt_mutex *lock, unsigned int subclass); -extern void _rt_mutex_lock_nest_lock(struct rt_mutex *lock, struct lockdep_map *nest_lock); +extern void rt_mutex_lock_nested(struct rt_mutex *lock, unsigned int subclass) + __acquires(lock); +extern void _rt_mutex_lock_nest_lock(struct rt_mutex *lock, struct lockdep_map *nest_lock) + __acquires(lock); #define rt_mutex_lock(lock) rt_mutex_lock_nested(lock, 0) #define rt_mutex_lock_nest_lock(lock, nest_lock) \ do { \ @@ -118,15 +122,19 @@ extern void _rt_mutex_lock_nest_lock(struct rt_mutex *lock, struct lockdep_map * } while (0) #else -extern void rt_mutex_lock(struct rt_mutex *lock); +extern void rt_mutex_lock(struct rt_mutex *lock) __acquires(lock); #define rt_mutex_lock_nested(lock, subclass) rt_mutex_lock(lock) #define rt_mutex_lock_nest_lock(lock, nest_lock) rt_mutex_lock(lock) #endif -extern int rt_mutex_lock_interruptible(struct rt_mutex *lock); -extern int rt_mutex_lock_killable(struct rt_mutex *lock); -extern int rt_mutex_trylock(struct rt_mutex *lock); +extern int rt_mutex_lock_interruptible(struct rt_mutex *lock) + __cond_acquires(0, lock); +extern int rt_mutex_lock_killable(struct rt_mutex *lock) + __cond_acquires(0, lock); +extern int rt_mutex_trylock(struct rt_mutex *lock) + __cond_acquires(true, lock); -extern void rt_mutex_unlock(struct rt_mutex *lock); +extern void rt_mutex_unlock(struct rt_mutex *lock) + __releases(lock); #endif -- cgit v1.2.3 From 65efd1314dbcb37e4ab47974095ae97f90751f30 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Mon, 18 May 2026 16:40:32 +0200 Subject: media: include/uapi/linux/cec*.h: add CEC LIP support Add support for the new Latency Indication Protocol feature. This adds the opcodes and the wrapper functions. Signed-off-by: Hans Verkuil Link: https://patch.msgid.link/8dac7c99b7eab4fcc11d76d50dd08fb4448672f4.1779115235.git.hverkuil+cisco@kernel.org Signed-off-by: Mauro Carvalho Chehab Message-ID: <8dac7c99b7eab4fcc11d76d50dd08fb4448672f4.1779115235.git.hverkuil+cisco@kernel.org> --- include/uapi/linux/cec-funcs.h | 182 +++++++++++++++++++++++++++++++++++++++++ include/uapi/linux/cec.h | 24 ++++++ 2 files changed, 206 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h index 189ecf0e13cd..ba4b47de9bf0 100644 --- a/include/uapi/linux/cec-funcs.h +++ b/include/uapi/linux/cec-funcs.h @@ -1701,6 +1701,188 @@ static inline void cec_ops_request_current_latency(const struct cec_msg *msg, } +/* Latency Indication Protocol Feature */ +/* Only for CEC 2.0 and up */ +static inline void cec_msg_request_lip_support(struct cec_msg *msg, + int reply, __u16 phys_addr) +{ + msg->len = 4; + msg->msg[1] = CEC_MSG_REQUEST_LIP_SUPPORT; + msg->msg[2] = phys_addr >> 8; + msg->msg[3] = phys_addr & 0xff; + msg->reply = reply ? CEC_MSG_REPORT_LIP_SUPPORT : 0; +} + +static inline void cec_ops_request_lip_support(const struct cec_msg *msg, + __u16 *phys_addr) +{ + *phys_addr = (msg->msg[2] << 8) | msg->msg[3]; +} + +static inline void cec_msg_report_lip_support(struct cec_msg *msg, __u32 sqid) +{ + msg->len = 6; + msg->msg[1] = CEC_MSG_REPORT_LIP_SUPPORT; + msg->msg[2] = sqid >> 24; + msg->msg[3] = (sqid >> 16) & 0xff; + msg->msg[4] = (sqid >> 8) & 0xff; + msg->msg[5] = sqid & 0xff; +} + +static inline void cec_ops_report_lip_support(const struct cec_msg *msg, + __u32 *sqid) +{ + *sqid = (msg->msg[2] << 24) | (msg->msg[3] << 16) | + (msg->msg[4] << 8) | msg->msg[5]; +} + +static inline void cec_msg_request_audio_and_video_latency(struct cec_msg *msg, + int reply, __u8 video_format, + __u8 hdr_format, __u8 vrr_format, + __u8 audio_format, + __u8 audio_format_extension) +{ + msg->len = 6; + msg->msg[1] = CEC_MSG_REQUEST_AUDIO_AND_VIDEO_LATENCY; + msg->msg[2] = video_format; + msg->msg[3] = hdr_format; + msg->msg[4] = vrr_format; + msg->msg[5] = audio_format; + if (audio_format >= 1 && audio_format <= 31) { + msg->msg[6] = audio_format_extension; + msg->len++; + } + msg->reply = reply ? CEC_MSG_REPORT_AUDIO_AND_VIDEO_LATENCY : 0; +} + +static inline void cec_ops_request_audio_and_video_latency(const struct cec_msg *msg, + __u8 *video_format, + __u8 *hdr_format, + __u8 *vrr_format, + __u8 *audio_format, + __u8 *audio_format_extension) +{ + *video_format = msg->msg[2]; + *hdr_format = msg->msg[3]; + *vrr_format = msg->msg[4]; + *audio_format = msg->msg[5]; + *audio_format_extension = msg->len > 6 ? msg->msg[6] : 0; +} + +static inline void cec_msg_report_audio_and_video_latency(struct cec_msg *msg, + __u16 video_latency, + __u16 audio_latency) +{ + msg->len = 6; + msg->msg[1] = CEC_MSG_REPORT_AUDIO_AND_VIDEO_LATENCY; + msg->msg[2] = video_latency >> 8; + msg->msg[3] = video_latency & 0xff; + msg->msg[4] = audio_latency >> 8; + msg->msg[5] = audio_latency & 0xff; +} + +static inline void cec_ops_report_audio_and_video_latency(const struct cec_msg *msg, + __u16 *video_latency, + __u16 *audio_latency) +{ + *video_latency = (msg->msg[2] << 8) | msg->msg[3]; + *audio_latency = (msg->msg[4] << 8) | msg->msg[5]; +} + +static inline void cec_msg_request_audio_latency(struct cec_msg *msg, + int reply, + __u8 audio_format, + __u8 audio_format_extension) +{ + msg->len = 3; + msg->msg[1] = CEC_MSG_REQUEST_AUDIO_LATENCY; + msg->msg[2] = audio_format; + if (audio_format >= 1 && audio_format <= 31) { + msg->msg[3] = audio_format_extension; + msg->len++; + } + msg->reply = reply ? CEC_MSG_REPORT_AUDIO_LATENCY : 0; +} + +static inline void cec_ops_request_audio_latency(const struct cec_msg *msg, + __u8 *audio_format, + __u8 *audio_format_extension) +{ + *audio_format = msg->msg[2]; + *audio_format_extension = msg->len > 3 ? msg->msg[3] : 0; +} + +static inline void cec_msg_report_audio_latency(struct cec_msg *msg, + __u16 audio_latency) +{ + msg->len = 4; + msg->msg[1] = CEC_MSG_REPORT_AUDIO_LATENCY; + msg->msg[2] = audio_latency >> 8; + msg->msg[3] = audio_latency & 0xff; +} + +static inline void cec_ops_report_audio_latency(const struct cec_msg *msg, + __u16 *audio_latency) +{ + *audio_latency = (msg->msg[2] << 8) | msg->msg[3]; +} + +static inline void cec_msg_request_video_latency(struct cec_msg *msg, + int reply, __u8 video_format, + __u8 hdr_format, + __u8 vrr_format) +{ + msg->len = 5; + msg->msg[1] = CEC_MSG_REQUEST_VIDEO_LATENCY; + msg->msg[2] = video_format; + msg->msg[3] = hdr_format; + msg->msg[4] = vrr_format; + msg->reply = reply ? CEC_MSG_REPORT_VIDEO_LATENCY : 0; +} + +static inline void cec_ops_request_video_latency(const struct cec_msg *msg, + __u8 *video_format, + __u8 *hdr_format, + __u8 *vrr_format) +{ + *video_format = msg->msg[2]; + *hdr_format = msg->msg[3]; + *vrr_format = msg->msg[4]; +} + +static inline void cec_msg_report_video_latency(struct cec_msg *msg, + __u16 video_latency) +{ + msg->len = 4; + msg->msg[1] = CEC_MSG_REPORT_VIDEO_LATENCY; + msg->msg[2] = video_latency >> 8; + msg->msg[3] = video_latency & 0xff; +} + +static inline void cec_ops_report_video_latency(const struct cec_msg *msg, + __u16 *video_latency) +{ + *video_latency = (msg->msg[2] << 8) | msg->msg[3]; +} + +static inline void cec_msg_update_sqid(struct cec_msg *msg, __u32 sqid) +{ + msg->len = 6; + msg->msg[1] = CEC_MSG_UPDATE_SQID; + msg->msg[2] = sqid >> 24; + msg->msg[3] = (sqid >> 16) & 0xff; + msg->msg[4] = (sqid >> 8) & 0xff; + msg->msg[5] = sqid & 0xff; +} + +static inline void cec_ops_update_sqid(const struct cec_msg *msg, + __u32 *sqid) +{ + *sqid = (msg->msg[2] << 24) | (msg->msg[3] << 16) | + (msg->msg[4] << 8) | msg->msg[5]; +} + + /* Capability Discovery and Control Feature */ static inline void cec_msg_cdc_hec_inquire_state(struct cec_msg *msg, __u16 phys_addr1, diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h index b2af1dddd4d7..75bc9e4e0350 100644 --- a/include/uapi/linux/cec.h +++ b/include/uapi/linux/cec.h @@ -1104,6 +1104,30 @@ struct cec_event { #define CEC_OP_AUD_OUT_COMPENSATED_PARTIAL_DELAY 3 +/* Latency Indication Protocol Feature */ +#define CEC_MSG_REQUEST_LIP_SUPPORT 0x50 +#define CEC_MSG_REPORT_LIP_SUPPORT 0x51 +#define CEC_MSG_REQUEST_AUDIO_AND_VIDEO_LATENCY 0x52 +/* HDR Format Operand (hdr_format) */ +#define CEC_OP_HDR_FORMAT_GAMMA_SDR 0 +#define CEC_OP_HDR_FORMAT_GAMMA_HDR 1 +#define CEC_OP_HDR_FORMAT_PQ 2 +#define CEC_OP_HDR_FORMAT_HLG 3 +#define CEC_OP_HDR_FORMAT_DYNAMIC_HDR_TYPE_1 8 +#define CEC_OP_HDR_FORMAT_DYNAMIC_HDR_TYPE_2 9 +#define CEC_OP_HDR_FORMAT_DYNAMIC_HDR_TYPE_4 11 +#define CEC_OP_HDR_FORMAT_DV_SINK_LED 16 +#define CEC_OP_HDR_FORMAT_DV_SOURCE_LED 17 +#define CEC_OP_HDR_FORMAT_HDR10PLUS 24 +#define CEC_OP_HDR_FORMAT_ETSI_TS_103_433 32 +#define CEC_MSG_REPORT_AUDIO_AND_VIDEO_LATENCY 0x53 +#define CEC_MSG_REQUEST_AUDIO_LATENCY 0x54 +#define CEC_MSG_REPORT_AUDIO_LATENCY 0x55 +#define CEC_MSG_REQUEST_VIDEO_LATENCY 0x56 +#define CEC_MSG_REPORT_VIDEO_LATENCY 0x57 +#define CEC_MSG_UPDATE_SQID 0x58 + + /* Capability Discovery and Control Feature */ #define CEC_MSG_CDC_MESSAGE 0xf8 /* Ethernet-over-HDMI: nobody ever does this... */ -- cgit v1.2.3 From 79500c929de313550554e604d22f3202955cea20 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Mon, 18 May 2026 16:40:35 +0200 Subject: media: include/uapi/linux/cec*: clarify which msgs are CEC 2.0 Drop comments about CEC 2.0 from cec-funcs.h. In cec.h clearly comment messages that are CEC 2.0 specific as such. Also rename references to HDMI 2.0 to CEC 2.0. The messages were marked as CEC 2.0 only. That is wrong, these messages are explicitly allowed for any CEC version. Signed-off-by: Hans Verkuil Link: https://patch.msgid.link/098789ee233f777d5ad87a72f09a997373c98d25.1779115235.git.hverkuil+cisco@kernel.org Signed-off-by: Mauro Carvalho Chehab Message-ID: <098789ee233f777d5ad87a72f09a997373c98d25.1779115235.git.hverkuil+cisco@kernel.org> --- include/uapi/linux/cec.h | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h index 75bc9e4e0350..81a05c9c0706 100644 --- a/include/uapi/linux/cec.h +++ b/include/uapi/linux/cec.h @@ -742,7 +742,7 @@ struct cec_event { #define CEC_OP_PRIM_DEVTYPE_PROCESSOR 7 #define CEC_MSG_SET_MENU_LANGUAGE 0x32 -#define CEC_MSG_REPORT_FEATURES 0xa6 /* HDMI 2.0 */ +#define CEC_MSG_REPORT_FEATURES 0xa6 /* CEC 2.0 */ /* All Device Types Operand (all_device_types) */ #define CEC_OP_ALL_DEVTYPE_TV 0x80 #define CEC_OP_ALL_DEVTYPE_RECORD 0x40 @@ -777,7 +777,7 @@ struct cec_event { #define CEC_OP_FEAT_DEV_SOURCE_HAS_ARC_RX 0x02 #define CEC_OP_FEAT_DEV_HAS_SET_AUDIO_VOLUME_LEVEL 0x01 -#define CEC_MSG_GIVE_FEATURES 0xa5 /* HDMI 2.0 */ +#define CEC_MSG_GIVE_FEATURES 0xa5 /* CEC 2.0 */ /* Deck Control Feature */ @@ -1067,7 +1067,7 @@ struct cec_event { #define CEC_OP_AUD_FMT_ID_CEA861 0 #define CEC_OP_AUD_FMT_ID_CEA861_CXT 1 -#define CEC_MSG_SET_AUDIO_VOLUME_LEVEL 0x73 +#define CEC_MSG_SET_AUDIO_VOLUME_LEVEL 0x73 /* CEC 2.0 */ /* Audio Rate Control Feature */ #define CEC_MSG_SET_AUDIO_RATE 0x9a @@ -1091,7 +1091,6 @@ struct cec_event { /* Dynamic Audio Lipsync Feature */ -/* Only for CEC 2.0 and up */ #define CEC_MSG_REQUEST_CURRENT_LATENCY 0xa7 #define CEC_MSG_REPORT_CURRENT_LATENCY 0xa8 /* Low Latency Mode Operand (low_latency_mode) */ @@ -1105,9 +1104,9 @@ struct cec_event { /* Latency Indication Protocol Feature */ -#define CEC_MSG_REQUEST_LIP_SUPPORT 0x50 -#define CEC_MSG_REPORT_LIP_SUPPORT 0x51 -#define CEC_MSG_REQUEST_AUDIO_AND_VIDEO_LATENCY 0x52 +#define CEC_MSG_REQUEST_LIP_SUPPORT 0x50 /* CEC 2.0 */ +#define CEC_MSG_REPORT_LIP_SUPPORT 0x51 /* CEC 2.0 */ +#define CEC_MSG_REQUEST_AUDIO_AND_VIDEO_LATENCY 0x52 /* CEC 2.0 */ /* HDR Format Operand (hdr_format) */ #define CEC_OP_HDR_FORMAT_GAMMA_SDR 0 #define CEC_OP_HDR_FORMAT_GAMMA_HDR 1 @@ -1120,12 +1119,12 @@ struct cec_event { #define CEC_OP_HDR_FORMAT_DV_SOURCE_LED 17 #define CEC_OP_HDR_FORMAT_HDR10PLUS 24 #define CEC_OP_HDR_FORMAT_ETSI_TS_103_433 32 -#define CEC_MSG_REPORT_AUDIO_AND_VIDEO_LATENCY 0x53 -#define CEC_MSG_REQUEST_AUDIO_LATENCY 0x54 -#define CEC_MSG_REPORT_AUDIO_LATENCY 0x55 -#define CEC_MSG_REQUEST_VIDEO_LATENCY 0x56 -#define CEC_MSG_REPORT_VIDEO_LATENCY 0x57 -#define CEC_MSG_UPDATE_SQID 0x58 +#define CEC_MSG_REPORT_AUDIO_AND_VIDEO_LATENCY 0x53 /* CEC 2.0 */ +#define CEC_MSG_REQUEST_AUDIO_LATENCY 0x54 /* CEC 2.0 */ +#define CEC_MSG_REPORT_AUDIO_LATENCY 0x55 /* CEC 2.0 */ +#define CEC_MSG_REQUEST_VIDEO_LATENCY 0x56 /* CEC 2.0 */ +#define CEC_MSG_REPORT_VIDEO_LATENCY 0x57 /* CEC 2.0 */ +#define CEC_MSG_UPDATE_SQID 0x58 /* CEC 2.0 */ /* Capability Discovery and Control Feature */ -- cgit v1.2.3 From 7e6445d9d6f7dfc5635fc216488d6f62a5594fe9 Mon Sep 17 00:00:00 2001 From: Mika Westerberg Date: Tue, 23 Sep 2025 12:43:51 +0300 Subject: thunderbolt: Add tb_property_merge_dir() This allows merging one XDomain property directory into another. We are going to use this in the subsequent patch. Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index bbdbbc84c999..e98d569779f9 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -153,6 +153,9 @@ struct tb_property_dir *tb_property_parse_dir(const u32 *block, ssize_t tb_property_format_dir(const struct tb_property_dir *dir, u32 *block, size_t block_len); struct tb_property_dir *tb_property_copy_dir(const struct tb_property_dir *dir); +int tb_property_merge_dir(struct tb_property_dir *parent, + const struct tb_property_dir *dir, + bool replace); struct tb_property_dir *tb_property_create_dir(const uuid_t *uuid); void tb_property_free_dir(struct tb_property_dir *dir); int tb_property_add_immediate(struct tb_property_dir *parent, const char *key, -- cgit v1.2.3 From abc27e5bfed2fa281ccb23419ef4d1c9ded86398 Mon Sep 17 00:00:00 2001 From: Mika Westerberg Date: Tue, 23 Sep 2025 12:51:27 +0300 Subject: thunderbolt: Allow service drivers to specify their own properties The XDomain properties can be useful for service drivers, for example to implement a registry for the services they expose. So far there has been no need for service drivers to specify these but with the USB4STREAM driver that we are going to use them. This adds remote and local side properties that the service drivers have access to. Remote side is read-only but the local side can be changed by a service driver. Also provide a mechanism to notify the remote side that there are changes. Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index e98d569779f9..f60e3a1aecae 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -397,6 +397,10 @@ void tb_unregister_protocol_handler(struct tb_protocol_handler *handler); * @prtcvers: Protocol version from the properties directory * @prtcrevs: Protocol software revision from the properties directory * @prtcstns: Protocol settings mask from the properties directory + * @lock: Protects this structure + * @local_properties: Properties owned by the service driver + * @remote_properties: Properties read from the remote service. These + * are read-only. * @debugfs_dir: Pointer to the service debugfs directory. Always created * when debugfs is enabled. Can be used by service drivers to * add their own entries under the service. @@ -404,6 +408,9 @@ void tb_unregister_protocol_handler(struct tb_protocol_handler *handler); * Each domain exposes set of services it supports as collection of * properties. For each service there will be one corresponding * &struct tb_service. Service drivers are bound to these. + * + * Service drivers can add their own dynamic properties to + * @local_properties but whenever they do so @lock must be held. */ struct tb_service { struct device dev; @@ -413,6 +420,9 @@ struct tb_service { u32 prtcvers; u32 prtcrevs; u32 prtcstns; + struct mutex lock; + struct tb_property_dir *local_properties; + struct tb_property_dir *remote_properties; struct dentry *debugfs_dir; }; @@ -481,6 +491,8 @@ static inline struct tb_xdomain *tb_service_parent(struct tb_service *svc) return tb_to_xdomain(svc->dev.parent); } +void tb_service_properties_changed(struct tb_service *svc); + /** * struct tb_nhi - thunderbolt native host interface * @lock: Must be held during ring creation/destruction. Is acquired by -- cgit v1.2.3 From 5140737c592d23b4de0f98c47dd347684a0c8de3 Mon Sep 17 00:00:00 2001 From: Mika Westerberg Date: Mon, 10 Nov 2025 13:16:53 +0200 Subject: thunderbolt / net: Move ring_frame_size() to thunderbolt.h This function can be used outside of thunderbolt networking driver so move it to the common header. No functional changes. Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index f60e3a1aecae..1d1bd458b5af 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -628,7 +628,15 @@ struct ring_frame { }; /* Minimum size for ring_rx */ -#define TB_FRAME_SIZE 0x100 +#define TB_FRAME_SIZE 256 +#define TB_MAX_FRAME_SIZE 4096 + +static inline size_t tb_ring_frame_size(const struct ring_frame *frame) +{ + if (frame->size) + return frame->size; + return TB_MAX_FRAME_SIZE; +} struct tb_ring *tb_ring_alloc_tx(struct tb_nhi *nhi, int hop, int size, unsigned int flags); -- cgit v1.2.3 From c51777370ac2ef435401340e205ef1d0c778df28 Mon Sep 17 00:00:00 2001 From: Mika Westerberg Date: Fri, 27 Feb 2026 19:51:45 +0200 Subject: thunderbolt / net: Let the service drivers configure interrupt throttling Instead of the core driver programming fixed value for throttling let the service drivers to specify the interval if they need this. Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index 1d1bd458b5af..1160e0bf5c5b 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -554,6 +554,8 @@ struct tb_nhi { * @start_poll: Called when ring interrupt is triggered to start * polling. Passing %NULL keeps the ring in interrupt mode. * @poll_data: Data passed to @start_poll + * @interval_nsec: Interval counter if interrupt throttling is to be + * used with this ring (in ns) */ struct tb_ring { spinlock_t lock; @@ -577,6 +579,7 @@ struct tb_ring { u16 eof_mask; void (*start_poll)(void *data); void *poll_data; + unsigned int interval_nsec; }; /* Leave ring interrupt enabled on suspend */ @@ -697,6 +700,8 @@ static inline int tb_ring_tx(struct tb_ring *ring, struct ring_frame *frame) struct ring_frame *tb_ring_poll(struct tb_ring *ring); void tb_ring_poll_complete(struct tb_ring *ring); +int tb_ring_throttling(struct tb_ring *ring, unsigned int interval_nsec); + /** * tb_ring_dma_device() - Return device used for DMA mapping * @ring: Ring whose DMA device is retrieved -- cgit v1.2.3 From d614113c10ae6e35e74cdfc4fea280ce1a93ca0b Mon Sep 17 00:00:00 2001 From: Mika Westerberg Date: Mon, 10 Nov 2025 13:18:06 +0200 Subject: thunderbolt: Add helper to figure size of the ring Add to common header a function that returns size of the ring. This can be used in the drivers instead of rolling own version. Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index 1160e0bf5c5b..9df8a356396f 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -641,6 +641,11 @@ static inline size_t tb_ring_frame_size(const struct ring_frame *frame) return TB_MAX_FRAME_SIZE; } +static inline size_t tb_ring_size(const struct tb_ring *ring) +{ + return ring->size; +} + struct tb_ring *tb_ring_alloc_tx(struct tb_nhi *nhi, int hop, int size, unsigned int flags); struct tb_ring *tb_ring_alloc_rx(struct tb_nhi *nhi, int hop, int size, -- cgit v1.2.3 From 94a11cd5ddb1d7c206f81df17a5fcb5d3ec2d13f Mon Sep 17 00:00:00 2001 From: Mika Westerberg Date: Fri, 27 Jun 2025 20:25:42 +0300 Subject: thunderbolt: Add tb_ring_flush() This allows the caller to wait for the ring to be empty. We are going to need this in the upcoming userspace tunneling support. Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index 9df8a356396f..9c5cb5e4f23d 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -556,6 +556,7 @@ struct tb_nhi { * @poll_data: Data passed to @start_poll * @interval_nsec: Interval counter if interrupt throttling is to be * used with this ring (in ns) + * @wait: Used to signal that the ring may be empty now */ struct tb_ring { spinlock_t lock; @@ -580,6 +581,7 @@ struct tb_ring { void (*start_poll)(void *data); void *poll_data; unsigned int interval_nsec; + wait_queue_head_t wait; }; /* Leave ring interrupt enabled on suspend */ @@ -653,6 +655,7 @@ struct tb_ring *tb_ring_alloc_rx(struct tb_nhi *nhi, int hop, int size, u16 sof_mask, u16 eof_mask, void (*start_poll)(void *), void *poll_data); void tb_ring_start(struct tb_ring *ring); +bool tb_ring_flush(struct tb_ring *ring, unsigned int timeout_msec); void tb_ring_stop(struct tb_ring *ring); void tb_ring_free(struct tb_ring *ring); -- cgit v1.2.3 From cba57ed6f1e7529498cebbbe135c5132667fa923 Mon Sep 17 00:00:00 2001 From: Mika Westerberg Date: Tue, 12 Aug 2025 13:53:49 +0300 Subject: thunderbolt: Add support for ConfigFS This adds ConfigFS support to USB4/Thunderbolt bus. By itself this just creates the subsystem but it exposes functions that can be used to register groups under it. Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index 9c5cb5e4f23d..0be9b298e692 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -13,6 +13,7 @@ #include +struct config_group; struct fwnode_handle; struct device; @@ -727,6 +728,11 @@ static inline struct device *tb_ring_dma_device(struct tb_ring *ring) bool usb4_usb3_port_match(struct device *usb4_port_dev, const struct fwnode_handle *usb3_port_fwnode); +#if IS_REACHABLE(CONFIG_CONFIGFS_FS) +int tb_configfs_register_group(struct config_group *group); +void tb_configfs_unregister_group(struct config_group *group); +#endif + #else /* CONFIG_USB4 */ static inline bool usb4_usb3_port_match(struct device *usb4_port_dev, const struct fwnode_handle *usb3_port_fwnode) -- cgit v1.2.3 From bf62d130b1f2e34d91ba606a8c1bd3037d6c1450 Mon Sep 17 00:00:00 2001 From: Praveen Talari Date: Mon, 18 May 2026 22:30:51 +0530 Subject: spi: qcom-geni: trace: Add trace events for Qualcomm GENI SPI Add tracepoint support to the Qualcomm GENI SPI driver to provide runtime visibility into driver behavior without requiring invasive debug patches. The trace events cover clock and setup parameter configuration, transfer metadata, interrupt status to be making it easier to diagnose communication issues in the field.. Reviewed-by: Konrad Dybcio Signed-off-by: Praveen Talari Link: https://patch.msgid.link/20260518-add-tracepoints-for-qcom-geni-spi-v3-1-7928f6810a79@oss.qualcomm.com Signed-off-by: Mark Brown --- include/trace/events/qcom_geni_spi.h | 103 +++++++++++++++++++++++++++++++++++ 1 file changed, 103 insertions(+) create mode 100644 include/trace/events/qcom_geni_spi.h (limited to 'include') diff --git a/include/trace/events/qcom_geni_spi.h b/include/trace/events/qcom_geni_spi.h new file mode 100644 index 000000000000..6d027adf2e1d --- /dev/null +++ b/include/trace/events/qcom_geni_spi.h @@ -0,0 +1,103 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#undef TRACE_SYSTEM +#define TRACE_SYSTEM qcom_geni_spi + +#if !defined(_TRACE_QCOM_GENI_SPI_H) || defined(TRACE_HEADER_MULTI_READ) +#define _TRACE_QCOM_GENI_SPI_H + +#include + +TRACE_EVENT(geni_spi_setup_params, + TP_PROTO(struct device *dev, u8 cs, u32 mode, + u32 mode_changed, bool cs_changed), + TP_ARGS(dev, cs, mode, mode_changed, cs_changed), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(u8, cs) + __field(u32, mode) + __field(u32, mode_changed) + __field(bool, cs_changed) + ), + + TP_fast_assign(__assign_str(name); + __entry->cs = cs; + __entry->mode = mode; + __entry->mode_changed = mode_changed; + __entry->cs_changed = cs_changed; + ), + + TP_printk("%s: cs=%u mode=0x%08x mode_changed=0x%08x cs_changed=%d", + __get_str(name), __entry->cs, __entry->mode, + __entry->mode_changed, __entry->cs_changed) +); + +TRACE_EVENT(geni_spi_clk_cfg, + TP_PROTO(struct device *dev, unsigned long req_hz, + unsigned long sclk_hz, unsigned int clk_idx, + unsigned int clk_div, unsigned int bpw), + TP_ARGS(dev, req_hz, sclk_hz, clk_idx, clk_div, bpw), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(unsigned long, req_hz) + __field(unsigned long, sclk_hz) + __field(unsigned int, clk_idx) + __field(unsigned int, clk_div) + __field(unsigned int, bpw) + ), + + TP_fast_assign(__assign_str(name); + __entry->req_hz = req_hz; + __entry->sclk_hz = sclk_hz; + __entry->clk_idx = clk_idx; + __entry->clk_div = clk_div; + __entry->bpw = bpw; + ), + + TP_printk("%s: req_hz=%lu sclk_hz=%lu clk_idx=%u clk_div=%u bpw=%u", + __get_str(name), __entry->req_hz, __entry->sclk_hz, + __entry->clk_idx, __entry->clk_div, __entry->bpw) +); + +TRACE_EVENT(geni_spi_transfer, + TP_PROTO(struct device *dev, unsigned int len, u32 m_cmd), + TP_ARGS(dev, len, m_cmd), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(unsigned int, len) + __field(u32, m_cmd) + ), + + TP_fast_assign(__assign_str(name); + __entry->len = len; + __entry->m_cmd = m_cmd; + ), + + TP_printk("%s: len=%u m_cmd=0x%08x", + __get_str(name), __entry->len, __entry->m_cmd) +); + +TRACE_EVENT(geni_spi_irq, + TP_PROTO(struct device *dev, u32 m_irq, u32 dma_tx, u32 dma_rx), + TP_ARGS(dev, m_irq, dma_tx, dma_rx), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(u32, m_irq) + __field(u32, dma_tx) + __field(u32, dma_rx) + ), + + TP_fast_assign(__assign_str(name); + __entry->m_irq = m_irq; + __entry->dma_tx = dma_tx; + __entry->dma_rx = dma_rx; + ), + + TP_printk("%s: m_irq=0x%08x dma_tx=0x%08x dma_rx=0x%08x", + __get_str(name), __entry->m_irq, __entry->dma_tx, + __entry->dma_rx) +); + +#endif /* _TRACE_QCOM_GENI_SPI_H */ + +/* This part must be outside protection */ +#include -- cgit v1.2.3 From 8939562b16052c75b908d3c5f968bffb526fc6e9 Mon Sep 17 00:00:00 2001 From: Rong Tao Date: Mon, 18 May 2026 15:02:08 +0800 Subject: efi: efi.h: Remove extra semicolon Remove extra semicolons from comments. Signed-off-by: Rong Tao Signed-off-by: Ard Biesheuvel --- include/linux/efi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/efi.h b/include/linux/efi.h index 72e76ec54641..ccbc35479684 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -61,7 +61,7 @@ typedef void *efi_handle_t; /* * The UEFI spec and EDK2 reference implementation both define EFI_GUID as - * struct { u32 a; u16; b; u16 c; u8 d[8]; }; and so the implied alignment + * struct { u32 a; u16 b; u16 c; u8 d[8]; }; and so the implied alignment * is 32 bits not 8 bits like our guid_t. In some cases (i.e., on 32-bit ARM), * this means that firmware services invoked by the kernel may assume that * efi_guid_t* arguments are 32-bit aligned, and use memory accessors that -- cgit v1.2.3 From 9bf93cb2e180a58d5984ba13daee95903ff4fc14 Mon Sep 17 00:00:00 2001 From: Vadim Fedorenko Date: Fri, 15 May 2026 13:50:28 +0000 Subject: pps: bump PPS device count Modern systems may have more than 16 PPS sources and current hard-coded limit breaks registration of some devices. Let's bump the limit to 256 in hope it will be enough in foreseen future. Signed-off-by: Vadim Fedorenko Acked-by: Rodolfo Giometti Link: https://patch.msgid.link/20260515135028.2021318-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski --- include/uapi/linux/pps.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/pps.h b/include/uapi/linux/pps.h index 009ebcd8ced5..1088dea65e12 100644 --- a/include/uapi/linux/pps.h +++ b/include/uapi/linux/pps.h @@ -26,7 +26,7 @@ #include #define PPS_VERSION "5.3.6" -#define PPS_MAX_SOURCES 16 /* should be enough... */ +#define PPS_MAX_SOURCES 256 /* should be enough... */ /* Implementation note: the logical states ``assert'' and ``clear'' * are implemented in terms of the chip register, i.e. ``assert'' -- cgit v1.2.3 From 7122ff96068a03595bde2fbafaca82ca2ed8084e Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Wed, 13 May 2026 12:00:16 -0300 Subject: RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn() Sashiko points out the legacy write path in ib_uverbs_write() does allocate a struct uverbs_attr_bundle, but it doesn't wrap it in a bundle_priv so downcasting here isn't safe. Instead lift the method_elm out of the bundle_priv and use it for the debug function. The legacy write path will leave it set as NULL since the write method_elm uses a different type. Cc: stable@vger.kernel.org Fixes: 1de9287ece44 ("RDMA: Add ib_copy_validate_udata_in()") Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky --- include/rdma/uverbs_ioctl.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h index e2af17da3e32..c89428030d61 100644 --- a/include/rdma/uverbs_ioctl.h +++ b/include/rdma/uverbs_ioctl.h @@ -635,6 +635,7 @@ struct uverbs_attr_bundle { struct ib_uverbs_file *ufile; struct ib_ucontext *context; struct ib_uobject *uobject; + const struct uverbs_api_ioctl_method *method_elm; DECLARE_BITMAP(attr_present, UVERBS_API_ATTR_BKEY_LEN); ); struct uverbs_attr attrs[]; -- cgit v1.2.3 From 0cb5a74faa3bdcfa3b18735d554e12c0f615e35d Mon Sep 17 00:00:00 2001 From: Christian Marangi Date: Mon, 18 May 2026 15:44:57 +0200 Subject: net: airoha: Fix NPU RX DMA descriptor bits In an internal review from Airoha, it was notice that the RX DMA descriptor bits and mask are wrong. These values probably refer to an old NPU firmware never published. The previous value works correctly but it was reported that in some specific condition in mixed scenario with both Ethernet and WiFi offload it's possible that RX DMA descriptor signal wrong value with the problem to the RX ring or packets getting dropped. To handle these specific scenario, apply the new suggested bits mask from Airoha. Correct functionality of both AN7581 NPU and MT7996 variant were verified and confirmed working. Fixes: a7fc8c641cab ("net: airoha: Fix npu rx DMA definitions") Signed-off-by: Christian Marangi Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260518134530.3683-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski --- include/linux/soc/airoha/airoha_offload.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/soc/airoha/airoha_offload.h b/include/linux/soc/airoha/airoha_offload.h index d01ef4a6b3d7..7589fccfeef6 100644 --- a/include/linux/soc/airoha/airoha_offload.h +++ b/include/linux/soc/airoha/airoha_offload.h @@ -71,9 +71,9 @@ static inline void airoha_ppe_dev_check_skb(struct airoha_ppe_dev *dev, #define NPU_RX1_DESC_NUM 512 /* CTRL */ -#define NPU_RX_DMA_DESC_LAST_MASK BIT(27) -#define NPU_RX_DMA_DESC_LEN_MASK GENMASK(26, 14) -#define NPU_RX_DMA_DESC_CUR_LEN_MASK GENMASK(13, 1) +#define NPU_RX_DMA_DESC_LAST_MASK BIT(29) +#define NPU_RX_DMA_DESC_LEN_MASK GENMASK(28, 15) +#define NPU_RX_DMA_DESC_CUR_LEN_MASK GENMASK(14, 1) #define NPU_RX_DMA_DESC_DONE_MASK BIT(0) /* INFO */ #define NPU_RX_DMA_PKT_COUNT_MASK GENMASK(31, 29) -- cgit v1.2.3 From ab7e4d7cf6f8efd37a675a85eb0aef3d6a4954ba Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov Date: Thu, 7 May 2026 16:02:58 +0300 Subject: soc: qcom: ubwc: define UBWC 3.1 Follow the comment for the macrotile_mode and introduce separate revision for UBWC 3.0 + 8-channel macrotiling mode. It is not used by the database (since the drivers are not yet changed to handle it yet). Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260507-ubwc-rework-v4-2-c19593d20c1d@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/ubwc.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/soc/qcom/ubwc.h b/include/linux/soc/qcom/ubwc.h index f5d0e2341261..319caed88775 100644 --- a/include/linux/soc/qcom/ubwc.h +++ b/include/linux/soc/qcom/ubwc.h @@ -50,6 +50,7 @@ struct qcom_ubwc_cfg_data { #define UBWC_1_0 0x10000000 #define UBWC_2_0 0x20000000 #define UBWC_3_0 0x30000000 +#define UBWC_3_1 0x30010000 /* UBWC 3.0 + Macrotile mode */ #define UBWC_4_0 0x40000000 #define UBWC_4_3 0x40030000 #define UBWC_5_0 0x50000000 -- cgit v1.2.3 From b5f7365c44d8fd58ef0224bf4111805c4fea0a1e Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov Date: Thu, 7 May 2026 16:02:59 +0300 Subject: soc: qcom: ubwc: define helper for MDSS and Adreno drivers Define special helper returning version setting for MDSS and A8xx drivers. Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20260507-ubwc-rework-v4-3-c19593d20c1d@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/ubwc.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include') diff --git a/include/linux/soc/qcom/ubwc.h b/include/linux/soc/qcom/ubwc.h index 319caed88775..8355ffe40f88 100644 --- a/include/linux/soc/qcom/ubwc.h +++ b/include/linux/soc/qcom/ubwc.h @@ -100,4 +100,20 @@ static inline u32 qcom_ubwc_swizzle(const struct qcom_ubwc_cfg_data *cfg) return cfg->ubwc_swizzle; } +static inline u32 qcom_ubwc_version_tag(const struct qcom_ubwc_cfg_data *cfg) +{ + if (cfg->ubwc_enc_version >= UBWC_6_0) + return 5; + if (cfg->ubwc_enc_version >= UBWC_5_0) + return 4; + if (cfg->ubwc_enc_version >= UBWC_4_3) + return 3; + if (cfg->ubwc_enc_version >= UBWC_4_0) + return 2; + if (cfg->ubwc_enc_version >= UBWC_3_0) + return 1; + + return 0; +} + #endif /* __QCOM_UBWC_H__ */ -- cgit v1.2.3 From c5e3f2a3abcb925f0364df09abfd759ff0590454 Mon Sep 17 00:00:00 2001 From: Dmitry Baryshkov Date: Thu, 7 May 2026 16:03:00 +0300 Subject: soc: qcom: ubwc: add helper controlling AMSBC enablement Adreno and MDSS drivers need to know whether to enable AMSBC. Add separate helper, describing that feature. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20260507-ubwc-rework-v4-4-c19593d20c1d@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/ubwc.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/soc/qcom/ubwc.h b/include/linux/soc/qcom/ubwc.h index 8355ffe40f88..83d2c2a7116c 100644 --- a/include/linux/soc/qcom/ubwc.h +++ b/include/linux/soc/qcom/ubwc.h @@ -116,4 +116,9 @@ static inline u32 qcom_ubwc_version_tag(const struct qcom_ubwc_cfg_data *cfg) return 0; } +static inline bool qcom_ubwc_enable_amsbc(const struct qcom_ubwc_cfg_data *cfg) +{ + return cfg->ubwc_enc_version >= UBWC_3_0; +} + #endif /* __QCOM_UBWC_H__ */ -- cgit v1.2.3 From c15d7a2a11ea055bcecc0b538ae8ba79475637f9 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Thu, 4 Dec 2025 11:17:23 +0100 Subject: tee: fix tee_ioctl_object_invoke_arg padding The tee_ioctl_object_invoke_arg structure has padding on some architectures but not on x86-32 and a few others: include/linux/tee.h:474:32: error: padding struct to align 'params' [-Werror=padded] I expect that all current users of this are on architectures that do have implicit padding here (arm64, arm, x86, riscv), so make the padding explicit in order to avoid surprises if this later gets used elsewhere. Fixes: d5b8b0fa1775 ("tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF") Signed-off-by: Arnd Bergmann Reviewed-by: Jens Wiklander Tested-by: Harshal Dev Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander --- include/uapi/linux/tee.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/tee.h b/include/uapi/linux/tee.h index cab5cadca8ef..5203977ed35d 100644 --- a/include/uapi/linux/tee.h +++ b/include/uapi/linux/tee.h @@ -470,6 +470,7 @@ struct tee_ioctl_object_invoke_arg { __u32 op; __u32 ret; __u32 num_params; + __u32 :32; /* num_params tells the actual number of element in params */ struct tee_ioctl_param params[]; }; -- cgit v1.2.3 From 70492cfce2a4d41e87bf46989028a90f4bc6b38f Mon Sep 17 00:00:00 2001 From: Andre Przywara Date: Tue, 2 Sep 2025 18:20:53 +0100 Subject: firmware: smccc: Fix Arm SMCCC SOC_ID name call Commit 5f9c23abc477 ("firmware: smccc: Support optional Arm SMCCC SOC_ID name") introduced the SOC_ID name string call, which reports a human readable string describing the SoC, as returned by firmware. The SMCCC spec v1.6 describes this feature as AArch64 only, since we rely on 8 characters to be transmitted per register. Consequently the SMCCC call must use the AArch64 calling convention, which requires bit 30 of the FID to be set. The spec is a bit confusing here, since it mentions that in the parameter description ("2: SoC name (optionally implemented for SMC64 calls, ..."), but still prints the FID explicitly as 0x80000002. But as this FID is using the SMC32 calling convention (correct for the other two calls), it will not match what any SMCCC conformant firmware is expecting, so any call would return NOT_SUPPORTED. Add a 64-bit version of the ARCH_SOC_ID FID macro, and use that for the SoC name version of the call to fix the issue. Fixes: 5f9c23abc477 ("firmware: smccc: Support optional Arm SMCCC SOC_ID name") Signed-off-by: Andre Przywara Link: https://patch.msgid.link/20250902172053.304911-1-andre.przywara@arm.com Signed-off-by: Sudeep Holla --- include/linux/arm-smccc.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h index 50b47eba7d01..976c5f8001ff 100644 --- a/include/linux/arm-smccc.h +++ b/include/linux/arm-smccc.h @@ -90,6 +90,11 @@ ARM_SMCCC_SMC_32, \ 0, 2) +#define ARM_SMCCC_ARCH_SOC_ID64 \ + ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ + ARM_SMCCC_SMC_64, \ + 0, 2) + #define ARM_SMCCC_ARCH_WORKAROUND_1 \ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ ARM_SMCCC_SMC_32, \ -- cgit v1.2.3 From c62675c217f10a7fec945b4671e21274fe92f097 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 15 May 2026 14:12:12 +0300 Subject: wifi: cfg80211: add a function to parse UHR DBE Add a function that takes the DBE information and parses it into an existing chandef that should hold the BSS channel. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260515141209.4eb1490f5cc6.I3ca9421f1fe4c31073846b1b62017f12c75889de@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index ddcf559430dd..69dc9a978861 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -1190,6 +1190,16 @@ int cfg80211_chandef_add_npca(struct wiphy *wiphy, struct cfg80211_chan_def *chandef, const struct ieee80211_uhr_npca_info *npca); +/** + * cfg80211_chandef_add_dbe - parse and add DBE information to chandef + * @chandef: the chandef to expand + * @dbe: the DBE information, must be size-checked if not %NULL + * + * Returns: 0 for success, a negative error code otherwise + */ +int cfg80211_chandef_add_dbe(struct cfg80211_chan_def *chandef, + const struct ieee80211_uhr_dbe_info *dbe); + /** * nl80211_send_chandef - sends the channel definition. * @msg: the msg to send channel definition -- cgit v1.2.3 From 9639a6875ea9926ab021484ee46c432a1df7c209 Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Tue, 12 May 2026 00:47:50 +0000 Subject: ASoC: soc-dapm: move card->pop_time to soc-dapm.c Card has pop_time which have used only from TI, and it is now stop using it. This pop_time is used for debug, and can be access from debugfs. Let's move it from Card to soc-dapm.c local. This patch renames it as asoc/${card}/pop_time to asoc/dapm_pop_time. This patch moves it from Card to soc-dapm.c, tidyup soc-dapm.c accordingly, and remove card->pop_time from cx20442.c which is no longer needed. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87tssdwj0p.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/soc-dapm.h | 1 + include/sound/soc.h | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h index 4f8fb7622a13..f24eafefbdff 100644 --- a/include/sound/soc-dapm.h +++ b/include/sound/soc-dapm.h @@ -673,6 +673,7 @@ int snd_soc_dapm_mux_update_power(struct snd_soc_dapm_context *dapm, /* dapm sys fs - used by the core */ extern struct attribute *snd_soc_dapm_dev_attrs[]; void snd_soc_dapm_debugfs_init(struct snd_soc_dapm_context *dapm, struct dentry *parent); +void snd_soc_dapm_debugfs_pop_time(struct dentry *parent); /* dapm audio pin control and status */ int snd_soc_dapm_enable_pin(struct snd_soc_dapm_context *dapm, const char *pin); diff --git a/include/sound/soc.h b/include/sound/soc.h index 5e3eb617d832..453548988d38 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -1081,8 +1081,6 @@ struct snd_soc_card { #ifdef CONFIG_PM_SLEEP struct work_struct deferred_resume_work; #endif - u32 pop_time; - /* bit field */ unsigned int instantiated:1; unsigned int topology_shortname_created:1; -- cgit v1.2.3 From 7b5121c3374e24c8f6490b54f347eb06ee16028c Mon Sep 17 00:00:00 2001 From: Sergio Lopez Date: Tue, 28 Apr 2026 21:44:48 +0200 Subject: drm/virtio: support VIRTIO_GPU_F_BLOB_ALIGNMENT Support VIRTIO_GPU_F_BLOB_ALIGNMENT, a feature that indicates the device provides a valid blob_alignment field in its configuration, and that both RESOURCE_CREATE_BLOB and RESOURCE_MAP_BLOB requests must be aligned to that value. Signed-off-by: Sergio Lopez Signed-off-by: Dmitry Osipenko Link: https://patch.msgid.link/20260428194450.518296-2-slp@redhat.com --- include/uapi/linux/virtio_gpu.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/virtio_gpu.h b/include/uapi/linux/virtio_gpu.h index be109777d10d..4f530d90058c 100644 --- a/include/uapi/linux/virtio_gpu.h +++ b/include/uapi/linux/virtio_gpu.h @@ -64,6 +64,14 @@ * context_init and multiple timelines */ #define VIRTIO_GPU_F_CONTEXT_INIT 4 +/* + * The device provides a valid blob_alignment + * field in its configuration and both + * VIRTIO_GPU_CMD_RESOURCE_CREATE_BLOB and + * VIRTIO_GPU_CMD_RESOURCE_MAP_BLOB requests + * must be aligned to that value. + */ +#define VIRTIO_GPU_F_BLOB_ALIGNMENT 5 enum virtio_gpu_ctrl_type { VIRTIO_GPU_UNDEFINED = 0, @@ -365,6 +373,7 @@ struct virtio_gpu_config { __le32 events_clear; __le32 num_scanouts; __le32 num_capsets; + __le32 blob_alignment; }; /* simple formats for fbcon/X use */ -- cgit v1.2.3 From 6bd7e82e26531541a6023f060ba749547b9868ac Mon Sep 17 00:00:00 2001 From: Sergio Lopez Date: Tue, 28 Apr 2026 21:44:50 +0200 Subject: drm/virtio: add VIRTGPU_PARAM_BLOB_ALIGNMENT to params Add VIRTGPU_PARAM_BLOB_ALIGNMENT as a param that can be read with VIRTGPU_GETPARAM by userspace applications running in the guest to obtain the host's page size and find out the right alignment to be used in shared memory allocations. Signed-off-by: Sergio Lopez Signed-off-by: Dmitry Osipenko Link: https://patch.msgid.link/20260428194450.518296-4-slp@redhat.com --- include/uapi/drm/virtgpu_drm.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/drm/virtgpu_drm.h b/include/uapi/drm/virtgpu_drm.h index ba09a4ee3e77..95587e12aed5 100644 --- a/include/uapi/drm/virtgpu_drm.h +++ b/include/uapi/drm/virtgpu_drm.h @@ -98,6 +98,7 @@ struct drm_virtgpu_execbuffer { #define VIRTGPU_PARAM_CONTEXT_INIT 6 /* DRM_VIRTGPU_CONTEXT_INIT */ #define VIRTGPU_PARAM_SUPPORTED_CAPSET_IDs 7 /* Bitmask of supported capability set ids */ #define VIRTGPU_PARAM_EXPLICIT_DEBUG_NAME 8 /* Ability to set debug name from userspace */ +#define VIRTGPU_PARAM_BLOB_ALIGNMENT 9 /* Device alignment requirements for blobs */ struct drm_virtgpu_getparam { __u64 param; -- cgit v1.2.3 From 2c3f0541b99c60ac079228627ea325317e7d8b2a Mon Sep 17 00:00:00 2001 From: Yury Norov Date: Mon, 27 Apr 2026 17:41:18 -0400 Subject: bitfield: add FIELD_GET_SIGNED() The bitfields are designed in assumption that fields contain unsigned integer values, thus extracting the values from the field implies zero-extending. Some drivers need to sign-extend their fields, and currently do it like: dc_re += sign_extend32(FIELD_GET(0xfff000, tmp), 11); dc_im += sign_extend32(FIELD_GET(0xfff, tmp), 11); It's error-prone because it relies on user to provide the correct index of the most significant bit and proper 32 vs 64 function flavor. Thus, introduce a FIELD_GET_SIGNED(). With the new API, the above snippet turns into the more convenient: dc_re += FIELD_GET_SIGNED(0xfff000, tmp); dc_im += FIELD_GET_SIGNED(0xfff, tmp); It compiles (on x86_64) into just a couple instructions: shl and sar. When the mask includes MSB, the '<< __builtin_clzll(mask)' part becomes a NOP, and the compiler only emits a single sar: long long foo(long long reg) { 10: f3 0f 1e fa endbr64 return FIELD_GET_SIGNED(GENMASK_ULL(63, 60), reg); 14: 48 89 f8 mov %rdi,%rax 17: 48 c1 f8 3c sar $0x3c,%rax } 32-bit code generation is equally well. On arm32: long long foo(long long reg) { return FIELD_GET_SIGNED(0x00f00000ULL, reg); } generates: foo(long long): lsls r1, r0, #8 asrs r0, r1, #28 asrs r1, r1, #31 bx lr Signed-off-by: Yury Norov --- include/linux/bitfield.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include') diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h index 54aeeef1f0ec..989c214ec8a5 100644 --- a/include/linux/bitfield.h +++ b/include/linux/bitfield.h @@ -178,6 +178,22 @@ __FIELD_GET(_mask, _reg, "FIELD_GET: "); \ }) +/** + * FIELD_GET_SIGNED() - extract a signed bitfield element + * @mask: shifted mask defining the field's length and position + * @reg: value of entire bitfield + * + * Returns the sign-extended field specified by @_mask from the + * bitfield passed in as @reg by masking and shifting it down. + */ +#define FIELD_GET_SIGNED(mask, reg) \ + ({ \ + __BF_FIELD_CHECK(mask, reg, 0U, "FIELD_GET_SIGNED: "); \ + ((__signed_scalar_typeof(mask)) \ + (((long long)(reg) << __builtin_clzll(mask)) >> \ + (__builtin_clzll(mask) + __builtin_ctzll(mask)))); \ + }) + /** * FIELD_MODIFY() - modify a bitfield element * @_mask: shifted mask defining the field's length and position -- cgit v1.2.3 From 8a51b2e874f47a6094353b59ecae421f0968fe3a Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Sat, 2 May 2026 22:25:08 -0700 Subject: bitops: use common function parameter names Fix the function prototypes to use the common parameter name 'addr' instead of 'p' (common to arch-specific implementations of these functions). This avoids the kernel-doc warnings: Warning: include/asm-generic/bitops/lock.h:19 function parameter 'p' not described in 'arch_test_and_set_bit_lock' Warning: include/asm-generic/bitops/lock.h:41 function parameter 'p' not described in 'arch_clear_bit_unlock' Warning: include/asm-generic/bitops/lock.h:59 function parameter 'p' not described in 'arch___clear_bit_unlock' Fixes: 84c6591103db ("locking/atomics, asm-generic/bitops/lock.h: Rewrite using atomic_fetch_*()") Signed-off-by: Randy Dunlap Signed-off-by: Yury Norov --- include/asm-generic/bitops/lock.h | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h index 14d4ec8c5152..ffb73b6129e7 100644 --- a/include/asm-generic/bitops/lock.h +++ b/include/asm-generic/bitops/lock.h @@ -16,16 +16,16 @@ * It can be used to implement bit locks. */ static __always_inline int -arch_test_and_set_bit_lock(unsigned int nr, volatile unsigned long *p) +arch_test_and_set_bit_lock(unsigned int nr, volatile unsigned long *addr) { long old; unsigned long mask = BIT_MASK(nr); - p += BIT_WORD(nr); - if (READ_ONCE(*p) & mask) + addr += BIT_WORD(nr); + if (READ_ONCE(*addr) & mask) return 1; - old = raw_atomic_long_fetch_or_acquire(mask, (atomic_long_t *)p); + old = raw_atomic_long_fetch_or_acquire(mask, (atomic_long_t *)addr); return !!(old & mask); } @@ -38,10 +38,10 @@ arch_test_and_set_bit_lock(unsigned int nr, volatile unsigned long *p) * This operation is atomic and provides release barrier semantics. */ static __always_inline void -arch_clear_bit_unlock(unsigned int nr, volatile unsigned long *p) +arch_clear_bit_unlock(unsigned int nr, volatile unsigned long *addr) { - p += BIT_WORD(nr); - raw_atomic_long_fetch_andnot_release(BIT_MASK(nr), (atomic_long_t *)p); + addr += BIT_WORD(nr); + raw_atomic_long_fetch_andnot_release(BIT_MASK(nr), (atomic_long_t *)addr); } /** @@ -56,14 +56,14 @@ arch_clear_bit_unlock(unsigned int nr, volatile unsigned long *p) * See for example x86's implementation. */ static inline void -arch___clear_bit_unlock(unsigned int nr, volatile unsigned long *p) +arch___clear_bit_unlock(unsigned int nr, volatile unsigned long *addr) { unsigned long old; - p += BIT_WORD(nr); - old = READ_ONCE(*p); + addr += BIT_WORD(nr); + old = READ_ONCE(*addr); old &= ~BIT_MASK(nr); - raw_atomic_long_set_release((atomic_long_t *)p, old); + raw_atomic_long_set_release((atomic_long_t *)addr, old); } #ifndef arch_xor_unlock_is_negative_byte -- cgit v1.2.3 From 09472f591aa0b72c2dd6c693f48b2d6fea66c7ba Mon Sep 17 00:00:00 2001 From: Yury Norov Date: Mon, 27 Apr 2026 18:57:05 -0400 Subject: bitfield: wire __bf_shf to __builtin_ctzll __bf_shf() is currently based on built-in ffsll. It's more straightforward to wire it to __builtin_ctzll, which makes it a pure rename. Worth to notice that __builtin_ffsll() is buggy on GCC before 14.1: int main() { sizeof(struct { int t : !(__builtin_ffsll(~0ULL) + 1 < 0); }); } test.c: In function 'main': test.c:3:21: error: bit-field 't' width not an integer constant 3 | int t : !(__builtin_ffsll(~0ULL) + 1 < 0); | ^ Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124699 Reported-by: Matt Coster Closes: https://lore.kernel.org/oe-kbuild-all/202603222211.A2XiR1YU-lkp@intel.com/ Signed-off-by: Yury Norov --- include/linux/bitfield.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h index 989c214ec8a5..14f86e455a67 100644 --- a/include/linux/bitfield.h +++ b/include/linux/bitfield.h @@ -44,7 +44,7 @@ * FIELD_MODIFY(REG_FIELD_C, ®, c); */ -#define __bf_shf(x) (__builtin_ffsll(x) - 1) +#define __bf_shf __builtin_ctzll #define __scalar_type_to_unsigned_cases(type) \ unsigned type: (unsigned type)0, \ -- cgit v1.2.3 From fb6a6297acfad9810dea91a67185a90ba7a7bfbd Mon Sep 17 00:00:00 2001 From: Chen-Yu Tsai Date: Thu, 14 May 2026 17:15:19 +0800 Subject: regulator: mt6359: Add proper ldo_vcn33_[12] regulators The ldo_vcn33_[12]_wifi and ldo_vcn33_[12]_bt are just two regulator outputs instead of four. The wifi and bt parts refer to separate enable bits that are OR-ed together to affect the actual regulator output. The separate bits allow the wifi and bt stacks to enable their power without coordination between them. These have been deprecated in favor of proper nodes matching the output. Add proper ldo_vcn33_[12] regulators to replace the existing ones. The enable status is synced to just one of the two enable bits, and the other is forced off. This makes the handling in other bits simpler. The existing *_(bt|wifi) regulators are converted to no-op regulators that are fed from their new respective ldo_vcn33_[12] regulator. This allows existing device trees to continue to work. Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20260514091520.2718987-7-wenst@chromium.org Signed-off-by: Mark Brown --- include/linux/regulator/mt6359-regulator.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/regulator/mt6359-regulator.h b/include/linux/regulator/mt6359-regulator.h index 6d6e5a58f482..ce2cd0fc9d95 100644 --- a/include/linux/regulator/mt6359-regulator.h +++ b/include/linux/regulator/mt6359-regulator.h @@ -29,8 +29,7 @@ enum { MT6359_ID_VCN18, MT6359_ID_VFE28, MT6359_ID_VCN13, - MT6359_ID_VCN33_1_BT, - MT6359_ID_VCN33_1_WIFI, + MT6359_ID_VCN33_1, MT6359_ID_VAUX18, MT6359_ID_VSRAM_OTHERS, MT6359_ID_VEFUSE, @@ -39,8 +38,7 @@ enum { MT6359_ID_VBIF28, MT6359_ID_VIO28, MT6359_ID_VEMC, - MT6359_ID_VCN33_2_BT, - MT6359_ID_VCN33_2_WIFI, + MT6359_ID_VCN33_2, MT6359_ID_VA12, MT6359_ID_VA09, MT6359_ID_VRF18, @@ -51,6 +49,10 @@ enum { MT6359_ID_VSRAM_PROC1, MT6359_ID_VSIM2, MT6359_ID_VSRAM_OTHERS_SSHUB, + MT6359_ID_VCN33_1_BT, + MT6359_ID_VCN33_1_WIFI, + MT6359_ID_VCN33_2_BT, + MT6359_ID_VCN33_2_WIFI, MT6359_ID_RG_MAX, }; -- cgit v1.2.3 From 859dc0f6253b0d65fd4d79e29aa29b3d939c51a9 Mon Sep 17 00:00:00 2001 From: Matt Evans Date: Mon, 11 May 2026 07:58:25 -0700 Subject: vfio/pci: Replace vfio_pci_core_setup_barmap() with vfio_pci_core_get_iomap() Since "vfio/pci: Set up barmap in vfio_pci_core_enable()", the resource request and iomap for the BARs was performed early, and vfio_pci_core_setup_barmap() just checks those actions succeeded. Move this logic to a new helper that checks success and returns the iomap address, replacing the various bare vdev->barmap[] lookups. This maintains the error behaviour of the previous on-demand vfio_pci_core_setup_barmap() scheme. Signed-off-by: Matt Evans Link: https://lore.kernel.org/r/20260511145829.2993601-4-mattev@meta.com Signed-off-by: Alex Williamson --- include/linux/vfio_pci_core.h | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 89165b769e5c..7accd0eac457 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -188,7 +188,6 @@ int vfio_pci_core_match_token_uuid(struct vfio_device *core_vdev, int vfio_pci_core_enable(struct vfio_pci_core_device *vdev); void vfio_pci_core_disable(struct vfio_pci_core_device *vdev); void vfio_pci_core_finish_enable(struct vfio_pci_core_device *vdev); -int vfio_pci_core_setup_barmap(struct vfio_pci_core_device *vdev, int bar); pci_ers_result_t vfio_pci_core_aer_err_detected(struct pci_dev *pdev, pci_channel_state_t state); ssize_t vfio_pci_core_do_io_rw(struct vfio_pci_core_device *vdev, bool test_mem, @@ -234,6 +233,25 @@ static inline bool is_aligned_for_order(struct vm_area_struct *vma, !IS_ALIGNED(pfn, 1 << order))); } +/* + * Returns a BAR's iomap base or an ERR_PTR() if, for example, the + * BAR isn't valid, its resource wasn't acquired, or its iomap + * failed. This shall only be used after vfio_pci_core_enable() + * has set up the BAR maps and before vfio_pci_core_disable() + * tears them down. + */ +static inline void __iomem __must_check * +vfio_pci_core_get_iomap(struct vfio_pci_core_device *vdev, unsigned int bar) +{ + if (WARN_ON_ONCE(bar >= PCI_STD_NUM_BARS)) + return ERR_PTR(-EINVAL); + + if (WARN_ON_ONCE(!vdev->barmap[bar])) + return ERR_PTR(-ENODEV); + + return vdev->barmap[bar]; +} + int vfio_pci_dma_buf_iommufd_map(struct dma_buf_attachment *attachment, struct phys_vec *phys); -- cgit v1.2.3 From e38b27199e0f5b530fd2b033e3b63241a0b16596 Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Tue, 19 May 2026 20:31:36 -0700 Subject: console: mdacon: remove this obsolete driver The mdacon driver supports using ISA MDA or Hercules-compatible display adapters as a secondary text console. This was commonly used in the 1990s and earlier for debugging software which took over the primary display. It is highly unlikely anyone is doing so nowadays because serial consoles and much better methods of debugging exist. The driver is not enabled by any defconfig, nor any of the dozens of distro configs collected at [1]. It has been relegated to VTs 13-16 since commit 0b9cf3aa6b1e ("mdacon messing up default vc's - set default to vc13-16 again") in Linux 2.6.27 (and before Linux 2.5.53 - see the link in the message of the above commit). The change in 2.6.27 was done because it was incorrectly detecting non-MDA adapters as MDA and taking over all VTs, rendering them unusable. Furthermore, vgacon supports using MDA/Hercules-compatible adapters as the primary text console, so any systems with only one of these adapters were already using vgacon and will not experience any loss in functionality from the removal of this driver. Given all of these factors, the mdacon driver is likely entirely unused. Remove it. [1] https://github.com/nyrahul/linux-kernel-configs/tree/f0bee86a135a0406ea427855f52702dd00d770f9 Signed-off-by: Ethan Nelson-Moore Signed-off-by: Helge Deller --- include/linux/console.h | 2 -- include/linux/vt_buffer.h | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/console.h b/include/linux/console.h index 5520e4477ad7..d624200cfc17 100644 --- a/include/linux/console.h +++ b/include/linux/console.h @@ -718,8 +718,6 @@ extern bool console_suspend_enabled; extern void console_suspend_all(void); extern void console_resume_all(void); -int mda_console_init(void); - void vcs_make_sysfs(int index); void vcs_remove_sysfs(int index); diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h index b6eeb8cb6070..6c15c6a15f74 100644 --- a/include/linux/vt_buffer.h +++ b/include/linux/vt_buffer.h @@ -16,7 +16,7 @@ #include -#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE) +#if IS_ENABLED(CONFIG_VGA_CONSOLE) #include #endif -- cgit v1.2.3 From b8d7519352ba8c6df83259295d4a3bad093cae90 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Fri, 15 May 2026 15:13:25 -0700 Subject: net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing a VALID mark for a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching the entry which is now a different pointer than the pointer for which VALID was meant. The biggest consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without VALID can be freed without observing RCU. Looks like the XArray marks are buying us nothing at this point. Let's convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers are marginally cleaner. Reported-by: Sashiko Fixes: 93954b40f6a4 ("net-shapers: implement NL set and delete operations") Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260515221325.1685455-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/net/net_shaper.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/net_shaper.h b/include/net/net_shaper.h index 5c3f49b52fe9..3939b816b001 100644 --- a/include/net/net_shaper.h +++ b/include/net/net_shaper.h @@ -53,6 +53,7 @@ struct net_shaper { /* private: */ u32 leaves; /* accounted only for NODE scope */ + bool valid; struct rcu_head rcu; }; -- cgit v1.2.3 From 2b50aceafe6606ea52ed42aadd1b4d44a188aade Mon Sep 17 00:00:00 2001 From: David Howells Date: Sat, 16 May 2026 00:05:13 +0100 Subject: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AF_RXRPC to make use of this to validate DATA packets secured with RxGK. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Closes: https://sashiko.dev/#/patchset/20260511160753.607296-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Herbert Xu cc: Simon Horman cc: Chuck Lever cc: linux-afs@lists.infradead.org Reviewed-by: Jeffrey Altman Tested-by: Marc Dionne Link: https://patch.msgid.link/20260515230516.2718212-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski --- include/crypto/krb5.h | 9 ++++++--- include/trace/events/rxrpc.h | 1 + 2 files changed, 7 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/crypto/krb5.h b/include/crypto/krb5.h index 71dd38f59be1..aac3ecf88467 100644 --- a/include/crypto/krb5.h +++ b/include/crypto/krb5.h @@ -121,9 +121,12 @@ size_t crypto_krb5_how_much_buffer(const struct krb5_enctype *krb5, size_t crypto_krb5_how_much_data(const struct krb5_enctype *krb5, enum krb5_crypto_mode mode, size_t *_buffer_size, size_t *_offset); -void crypto_krb5_where_is_the_data(const struct krb5_enctype *krb5, - enum krb5_crypto_mode mode, - size_t *_offset, size_t *_len); +int crypto_krb5_where_is_the_data(const struct krb5_enctype *krb5, + enum krb5_crypto_mode mode, + size_t *_offset, size_t *_len); +int crypto_krb5_check_data_len(const struct krb5_enctype *krb5, + enum krb5_crypto_mode mode, + size_t len, size_t min_content); struct crypto_aead *crypto_krb5_prepare_encryption(const struct krb5_enctype *krb5, const struct krb5_buffer *TK, u32 usage, gfp_t gfp); diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h index 573f2df3a2c9..704a10de6670 100644 --- a/include/trace/events/rxrpc.h +++ b/include/trace/events/rxrpc.h @@ -71,6 +71,7 @@ EM(rxkad_abort_resp_unknown_tkt, "rxkad-resp-unknown-tkt") \ EM(rxkad_abort_resp_version, "rxkad-resp-version") \ /* RxGK security errors */ \ + EM(rxgk_abort_1_short_header, "rxgk1-short-hdr") \ EM(rxgk_abort_1_verify_mic_eproto, "rxgk1-vfy-mic-eproto") \ EM(rxgk_abort_2_decrypt_eproto, "rxgk2-dec-eproto") \ EM(rxgk_abort_2_short_data, "rxgk2-short-data") \ -- cgit v1.2.3 From 5026c42d7f147fb6bc4e063abfa5b52bfd52ca35 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 18 May 2026 17:52:06 -0700 Subject: smc: Use flexible array for SMCD connections Store the per-DMB connection pointers in the SMCD device allocation instead of allocating a separate connection array. This keeps the connection table tied to the SMCD device lifetime and simplifies the allocation and cleanup paths. Signed-off-by: Rosen Penev Reviewed-by: Sidraya Jayagond Link: https://patch.msgid.link/20260519005206.628071-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski --- include/net/smc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/smc.h b/include/net/smc.h index bfdc4c41f019..a2bc3ab88075 100644 --- a/include/net/smc.h +++ b/include/net/smc.h @@ -40,7 +40,6 @@ struct smcd_dev { struct dibs_dev *dibs; struct list_head list; spinlock_t lock; - struct smc_connection **conn; struct list_head vlan; struct workqueue_struct *event_wq; u8 pnetid[SMC_MAX_PNETID_LEN]; @@ -50,6 +49,7 @@ struct smcd_dev { atomic_t lgr_cnt; wait_queue_head_t lgrs_deleted; u8 going_away : 1; + struct smc_connection *conn[]; }; #define SMC_HS_CTRL_NAME_MAX 16 -- cgit v1.2.3 From 1bbf0ced1d9db73ac7893c2187f3459288603e0d Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 19 May 2026 08:46:11 +0000 Subject: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00% Fixes: 41eecbd712b7 ("tcp: replace TCP_SKB_CB(skb)->tcp_tw_isn with a per-cpu field") Reported-by: Chris Mason Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260519084611.2485277-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/tcp.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/tcp.h b/include/net/tcp.h index ecbadcb3a744..98848db62894 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -65,8 +65,6 @@ static inline void tcp_orphan_count_dec(void) this_cpu_dec(tcp_orphan_count); } -DECLARE_PER_CPU(u32, tcp_tw_isn); - void tcp_time_wait(struct sock *sk, int state, int timeo); #define MAX_TCP_HEADER L1_CACHE_ALIGN(128 + MAX_HEADER) @@ -1102,10 +1100,13 @@ struct tcp_skb_cb { __u32 seq; /* Starting sequence number */ __u32 end_seq; /* SEQ + FIN + SYN + datalen */ union { - /* Note : + /* Notes : + * tcp_tw_isn is used in input path only + * (isn chosen by tcp_timewait_state_process()) * tcp_gso_segs/size are used in write queue only, * cf tcp_skb_pcount()/tcp_skb_mss() */ + u32 tcp_tw_isn; struct { u16 tcp_gso_segs; u16 tcp_gso_size; -- cgit v1.2.3 From b3a035a02213c0409ce5f14bcbb0a435a6eca085 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 6 May 2026 19:54:37 +0300 Subject: media: mc-entity: Fix documentation typo in function name The media_entity_pads_init() function name is misspelled. Fix it. Reviewed-by: Frank Li Reviewed-by: Jacopo Mondi Link: https://patch.msgid.link/20260506165438.1767378-1-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil --- include/media/media-entity.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/media/media-entity.h b/include/media/media-entity.h index b91ff6f8c3bb..904f61c14dc1 100644 --- a/include/media/media-entity.h +++ b/include/media/media-entity.h @@ -726,7 +726,7 @@ int media_entity_pads_init(struct media_entity *entity, u16 num_pads, * the entity (currently, it does nothing). * * Calling media_entity_cleanup() on a media_entity whose memory has been - * zeroed but that has not been initialized with media_entity_pad_init() is + * zeroed but that has not been initialized with media_entity_pads_init() is * valid and is a no-op. */ #if IS_ENABLED(CONFIG_MEDIA_CONTROLLER) -- cgit v1.2.3 From aef73a9dad5c761e4a70fa171fed8e85ca1c1abd Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 6 May 2026 19:54:38 +0300 Subject: media: mc-entity: Drop ifdef for media_entity_cleanup definition The media_entity_cleanup() function is defined in media-entity.h as a static inline no-op when CONFIG_MEDIA_CONTROLLER is enabled, and as a no-op macro otherwise. This complexity is unneeded. Use a static inline function in all cases. Reviewed-by: Jacopo Mondi Link: https://patch.msgid.link/20260506165438.1767378-2-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil --- include/media/media-entity.h | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/media/media-entity.h b/include/media/media-entity.h index 904f61c14dc1..d9b72cd87d52 100644 --- a/include/media/media-entity.h +++ b/include/media/media-entity.h @@ -729,11 +729,9 @@ int media_entity_pads_init(struct media_entity *entity, u16 num_pads, * zeroed but that has not been initialized with media_entity_pads_init() is * valid and is a no-op. */ -#if IS_ENABLED(CONFIG_MEDIA_CONTROLLER) -static inline void media_entity_cleanup(struct media_entity *entity) {} -#else -#define media_entity_cleanup(entity) do { } while (false) -#endif +static inline void media_entity_cleanup(struct media_entity *entity) +{ +} /** * media_get_pad_index() - retrieves a pad index from an entity -- cgit v1.2.3 From c4c01c4fd4a3916ffdfb35ad9f511c48e289f51c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niklas=20S=C3=B6derlund?= Date: Fri, 1 May 2026 21:03:39 +0200 Subject: media: uapi: rkisp: Correct name version enum MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The name of the enum to hold the mapping of parameter buffer versions have a typo in the name, correct it. While this is a uAPI header the impact should be minimal as the enum is only used as a collection for the one version number supported. Fixes: e9d05e9d5db1 ("media: uapi: rkisp1-config: Add extensible params format") Cc: stable@vger.kernel.org Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260501190339.3449193-1-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil --- include/uapi/linux/rkisp1-config.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/rkisp1-config.h b/include/uapi/linux/rkisp1-config.h index b2d2a71f7baf..7638b2220600 100644 --- a/include/uapi/linux/rkisp1-config.h +++ b/include/uapi/linux/rkisp1-config.h @@ -1535,11 +1535,11 @@ struct rkisp1_ext_params_wdr_config { sizeof(struct rkisp1_ext_params_wdr_config)) /** - * enum rksip1_ext_param_buffer_version - RkISP1 extensible parameters version + * enum rkisp1_ext_param_buffer_version - RkISP1 extensible parameters version * * @RKISP1_EXT_PARAM_BUFFER_V1: First version of RkISP1 extensible parameters */ -enum rksip1_ext_param_buffer_version { +enum rkisp1_ext_param_buffer_version { RKISP1_EXT_PARAM_BUFFER_V1 = V4L2_ISP_PARAMS_VERSION_V1, }; @@ -1601,7 +1601,7 @@ enum rksip1_ext_param_buffer_version { * +---------------------------------------------------------------------+ * * @version: The RkISP1 extensible parameters buffer version, see - * :c:type:`rksip1_ext_param_buffer_version` + * :c:type:`rkisp1_ext_param_buffer_version` * @data_size: The RkISP1 configuration data effective size, excluding this * header * @data: The RkISP1 extensible configuration data blocks -- cgit v1.2.3 From 27caa94f4d13d16f7f63eec879ea7d4d79699415 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= Date: Mon, 11 May 2026 17:09:57 +0200 Subject: media: rkisp1: Add support for CAC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CAC block implements chromatic aberration correction. Expose it to userspace using the extensible parameters format. This was tested on the i.MX8MP platform, but based on available documentation it is also present in the RK3399 variant (V10). Thus presumably also in later versions, so no feature flag is introduced. Signed-off-by: Barnabás Pőcze Reviewed-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20260511150957.581049-1-barnabas.pocze@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil --- include/uapi/linux/rkisp1-config.h | 107 ++++++++++++++++++++++++++++++++++++- 1 file changed, 106 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/rkisp1-config.h b/include/uapi/linux/rkisp1-config.h index 7638b2220600..d97384abc157 100644 --- a/include/uapi/linux/rkisp1-config.h +++ b/include/uapi/linux/rkisp1-config.h @@ -967,6 +967,92 @@ struct rkisp1_cif_isp_wdr_config { __u8 use_iref; }; +/* + * enum rkisp1_cif_isp_cac_h_clip_mode - horizontal clipping mode + * + * @RKISP1_CIF_ISP_CAC_H_CLIP_MODE_4PX: +/- 4 pixels + * @RKISP1_CIF_ISP_CAC_H_CLIP_MODE_4_5PX: +/- 4/5 pixels depending on bayer position + */ +enum rkisp1_cif_isp_cac_h_clip_mode { + RKISP1_CIF_ISP_CAC_H_CLIP_MODE_4PX = 0, + RKISP1_CIF_ISP_CAC_H_CLIP_MODE_4_5PX = 1, +}; + +/** + * enum rkisp1_cif_isp_cac_v_clip_mode - vertical clipping mode + * + * @RKISP1_CIF_ISP_CAC_V_CLIP_MODE_2PX: +/- 2 pixels + * @RKISP1_CIF_ISP_CAC_V_CLIP_MODE_3PX: +/- 3 pixels + * @RKISP1_CIF_ISP_CAC_V_CLIP_MODE_3_4PX: +/- 3/4 pixels depending on bayer position + */ +enum rkisp1_cif_isp_cac_v_clip_mode { + RKISP1_CIF_ISP_CAC_V_CLIP_MODE_2PX = 0, + RKISP1_CIF_ISP_CAC_V_CLIP_MODE_3PX = 1, + RKISP1_CIF_ISP_CAC_V_CLIP_MODE_3_4PX = 2, +}; + +/** + * struct rkisp1_cif_isp_cac_config - chromatic aberration correction configuration + * + * The correction is carried out by shifting the red and blue pixels relative + * to the green ones, depending on the distance from the optical center: + * + * @h_count_start: horizontal coordinate of the optical center (13-bit unsigned integer; [1,8191]) + * @v_count_start: vertical coordinate of the optical center (13-bit unsigned integer; [1,8191]) + * + * For each pixel, the x/y distances from the optical center are calculated and + * then transformed into the [0,255] range based on the following formula: + * + * (((d << 4) >> ns) * nf) >> 5 + * + * where `d` is the distance, `ns` and `nf` are the normalization parameters: + * + * @x_nf: horizontal normalization scale parameter (5-bit unsigned integer; [0,31]) + * @x_ns: horizontal normalization shift parameter (4-bit unsigned integer; [0,15]) + * + * @y_nf: vertical normalization scale parameter (5-bit unsigned integer; [0,31]) + * @y_ns: vertical normalization shift parameter (4-bit unsigned integer; [0,15]) + * + * These parameters should be chosen based on the image resolution, the position + * of the optical center, and the shape of pixels, so that no normalized distance + * is larger than 255. If the pixels have square shape, the two sets of parameters + * should be equal. + * + * The actual amount of correction is calculated with a third degree polynomial: + * + * c[0] * r + c[1] * r^2 + c[2] * r^3 + * + * where `c` is the set of coefficients for the given color, and `r` is distance: + * + * @red: red coefficients (5.4 two's complement; [-16,15.9375]) + * @blue: blue coefficients (5.4 two's complement; [-16,15.9375]) + * + * Finally, the amount is clipped as requested: + * + * @h_clip_mode: maximum horizontal shift (from enum rkisp1_cif_isp_cac_h_clip_mode) + * @v_clip_mode: maximum vertical shift (from enum rkisp1_cif_isp_cac_v_clip_mode) + * + * A positive result will shift away from the optical center, while a negative + * one will shift towards the optical center. In the latter case, the pixel + * values at the edges are duplicated. + */ +struct rkisp1_cif_isp_cac_config { + __u8 h_clip_mode; + __u8 v_clip_mode; + + __u16 h_count_start; + __u16 v_count_start; + + __u16 red[3]; + __u16 blue[3]; + + __u8 x_nf; + __u8 x_ns; + + __u8 y_nf; + __u8 y_ns; +}; + /*---------- PART2: Measurement Statistics ------------*/ /** @@ -1138,6 +1224,7 @@ struct rkisp1_stat_buffer { * @RKISP1_EXT_PARAMS_BLOCK_TYPE_COMPAND_EXPAND: Companding expand curve * @RKISP1_EXT_PARAMS_BLOCK_TYPE_COMPAND_COMPRESS: Companding compress curve * @RKISP1_EXT_PARAMS_BLOCK_TYPE_WDR: Wide dynamic range + * @RKISP1_EXT_PARAMS_BLOCK_TYPE_CAC: Chromatic aberration correction */ enum rkisp1_ext_params_block_type { RKISP1_EXT_PARAMS_BLOCK_TYPE_BLS, @@ -1161,6 +1248,7 @@ enum rkisp1_ext_params_block_type { RKISP1_EXT_PARAMS_BLOCK_TYPE_COMPAND_EXPAND, RKISP1_EXT_PARAMS_BLOCK_TYPE_COMPAND_COMPRESS, RKISP1_EXT_PARAMS_BLOCK_TYPE_WDR, + RKISP1_EXT_PARAMS_BLOCK_TYPE_CAC, }; /* For backward compatibility */ @@ -1507,6 +1595,22 @@ struct rkisp1_ext_params_wdr_config { struct rkisp1_cif_isp_wdr_config config; } __attribute__((aligned(8))); +/** + * struct rkisp1_ext_params_cac_config - RkISP1 extensible params CAC config + * + * RkISP1 extensible parameters CAC block. + * Identified by :c:type:`RKISP1_EXT_PARAMS_BLOCK_TYPE_CAC`. + * + * @header: The RkISP1 extensible parameters header, see + * :c:type:`rkisp1_ext_params_block_header` + * @config: CAC configuration, see + * :c:type:`rkisp1_cif_isp_cac_config` + */ +struct rkisp1_ext_params_cac_config { + struct rkisp1_ext_params_block_header header; + struct rkisp1_cif_isp_cac_config config; +} __attribute__((aligned(8))); + /* * The rkisp1_ext_params_compand_curve_config structure is counted twice as it * is used for both the COMPAND_EXPAND and COMPAND_COMPRESS block types. @@ -1532,7 +1636,8 @@ struct rkisp1_ext_params_wdr_config { sizeof(struct rkisp1_ext_params_compand_bls_config) +\ sizeof(struct rkisp1_ext_params_compand_curve_config) +\ sizeof(struct rkisp1_ext_params_compand_curve_config) +\ - sizeof(struct rkisp1_ext_params_wdr_config)) + sizeof(struct rkisp1_ext_params_wdr_config) +\ + sizeof(struct rkisp1_ext_params_cac_config)) /** * enum rkisp1_ext_param_buffer_version - RkISP1 extensible parameters version -- cgit v1.2.3 From 0d27b4b351493cb2fe1f87cd152856704d4e141d Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Wed, 20 May 2026 11:01:56 +0100 Subject: KVM: arm64: Simplify userspace notification of interrupt state The userspace notification of interrupts is has a few problems: - it is utterly pointless - it is annoyingly split between detecting the need for notification and the population of the interrupts in the run structure We can't do anything about the former (yet), but the latter can be addressed. If we detect that we must notify userspace, we know that we are going to exit, as we populate the exit status. Which means we can also populate the interrupt state at this stage and be done with it. This simplifies the structure of the code. Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20260520100200.543845-3-maz@kernel.org Signed-off-by: Marc Zyngier --- include/kvm/arm_arch_timer.h | 2 +- include/kvm/arm_pmu.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h index bf8cc9589bd0..9e4076eebd29 100644 --- a/include/kvm/arm_arch_timer.h +++ b/include/kvm/arm_arch_timer.h @@ -104,7 +104,7 @@ void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu); void kvm_timer_sync_nested(struct kvm_vcpu *vcpu); void kvm_timer_sync_user(struct kvm_vcpu *vcpu); bool kvm_timer_should_notify_user(struct kvm_vcpu *vcpu); -void kvm_timer_update_run(struct kvm_vcpu *vcpu); +bool kvm_timer_update_run(struct kvm_vcpu *vcpu); void kvm_timer_vcpu_terminate(struct kvm_vcpu *vcpu); void kvm_timer_init_vm(struct kvm *kvm); diff --git a/include/kvm/arm_pmu.h b/include/kvm/arm_pmu.h index 0a36a3d5c894..3e844c5ee917 100644 --- a/include/kvm/arm_pmu.h +++ b/include/kvm/arm_pmu.h @@ -54,7 +54,7 @@ void kvm_pmu_reprogram_counter_mask(struct kvm_vcpu *vcpu, u64 val); void kvm_pmu_flush_hwstate(struct kvm_vcpu *vcpu); void kvm_pmu_sync_hwstate(struct kvm_vcpu *vcpu); bool kvm_pmu_should_notify_user(struct kvm_vcpu *vcpu); -void kvm_pmu_update_run(struct kvm_vcpu *vcpu); +bool kvm_pmu_update_run(struct kvm_vcpu *vcpu); void kvm_pmu_software_increment(struct kvm_vcpu *vcpu, u64 val); void kvm_pmu_handle_pmcr(struct kvm_vcpu *vcpu, u64 val); void kvm_pmu_set_counter_event_type(struct kvm_vcpu *vcpu, u64 data, @@ -131,7 +131,7 @@ static inline bool kvm_pmu_should_notify_user(struct kvm_vcpu *vcpu) { return false; } -static inline void kvm_pmu_update_run(struct kvm_vcpu *vcpu) {} +static inline bool kvm_pmu_update_run(struct kvm_vcpu *vcpu) { return false; } static inline void kvm_pmu_software_increment(struct kvm_vcpu *vcpu, u64 val) {} static inline void kvm_pmu_handle_pmcr(struct kvm_vcpu *vcpu, u64 val) {} static inline void kvm_pmu_set_counter_event_type(struct kvm_vcpu *vcpu, -- cgit v1.2.3 From ac7002031852ab8f75b3debb1a4c4b2d1ff5a26c Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Wed, 20 May 2026 11:01:57 +0100 Subject: KVM: arm64: timer: Kill the per-timer irq level cache The timer code makes use of a per-timer irq level cache, which looks like a very minor optimisation to avoid taking a lock upon updating the GIC view of the interrupt when it is unchanged from the previous state. This is coming in the way of more important correctness issues, so get rid of the cache, which simplifies a couple of minor things. Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20260520100200.543845-4-maz@kernel.org Signed-off-by: Marc Zyngier --- include/kvm/arm_arch_timer.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include') diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h index 9e4076eebd29..15a4f97f8105 100644 --- a/include/kvm/arm_arch_timer.h +++ b/include/kvm/arm_arch_timer.h @@ -66,11 +66,6 @@ struct arch_timer_context { */ bool loaded; - /* Output level of the timer IRQ */ - struct { - bool level; - } irq; - /* Who am I? */ enum kvm_arch_timers timer_id; -- cgit v1.2.3 From 2772383afc5c65d6242f62947b5c184ffb049359 Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Wed, 20 May 2026 11:01:58 +0100 Subject: KVM: arm64: pmu: Kill the PMU interrupt level cache Just like the timer, the PMU has an interrupt cache that serves little purpose. Drop it. Reviewed-by: Oliver Upton Link: https://patch.msgid.link/20260520100200.543845-5-maz@kernel.org Signed-off-by: Marc Zyngier --- include/kvm/arm_pmu.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/kvm/arm_pmu.h b/include/kvm/arm_pmu.h index 3e844c5ee917..b5e5942204fc 100644 --- a/include/kvm/arm_pmu.h +++ b/include/kvm/arm_pmu.h @@ -32,7 +32,6 @@ struct kvm_pmu { struct kvm_pmc pmc[KVM_ARMV8_PMU_MAX_COUNTERS]; int irq_num; bool created; - bool irq_level; }; struct arm_pmu_entry { -- cgit v1.2.3 From 79448d5386f62a3caaba7fe04204a587a8bfa5c4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Tue, 12 May 2026 02:56:26 +0300 Subject: media: renesas: vsp1: Split vsp1_du_setup_lif() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The vsp1_du_setup_lif() function is used to configure and enable a pipeline, as well as disable it, depending on the cfg argument being a valid pointer or NULL. This creates a confusing API. Improve it by splitting the function in two, a vsp1_du_enable() function to configure a pipeline, and a vsp1_du_disable() function to disaple it. Keep vsp1_du_setup_lif() as an inline wrapper for existing callers in the DRM subsystem, to simplify merging. The callers will be updated separately and the old API will then be removed. Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20260511235637.3468558-3-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil --- include/media/vsp1.h | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/media/vsp1.h b/include/media/vsp1.h index d9b91ff02761..d2085cdb7fcb 100644 --- a/include/media/vsp1.h +++ b/include/media/vsp1.h @@ -44,8 +44,18 @@ struct vsp1_du_lif_config { void *callback_data; }; -int vsp1_du_setup_lif(struct device *dev, unsigned int pipe_index, - const struct vsp1_du_lif_config *cfg); +int vsp1_du_enable(struct device *dev, unsigned int pipe_index, + const struct vsp1_du_lif_config *cfg); +int vsp1_du_disable(struct device *dev, unsigned int pipe_index); + +static inline int vsp1_du_setup_lif(struct device *dev, unsigned int pipe_index, + const struct vsp1_du_lif_config *cfg) +{ + if (cfg) + return vsp1_du_enable(dev, pipe_index, cfg); + else + return vsp1_du_disable(dev, pipe_index); +} /** * struct vsp1_du_atomic_config - VSP atomic configuration parameters -- cgit v1.2.3 From bb16e2895a4161aa90a884bc2e9ef3f229f40e46 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Tue, 12 May 2026 02:56:35 +0300 Subject: media: renesas: vsp1: Drop deprecated vsp1_du_setup_lif() function MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The vsp1_du_setup_lif() is deprecated and its last users are gone. Drop it. Reviewed-by: Niklas Söderlund Link: https://patch.msgid.link/20260511235637.3468558-12-laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil --- include/media/vsp1.h | 9 --------- 1 file changed, 9 deletions(-) (limited to 'include') diff --git a/include/media/vsp1.h b/include/media/vsp1.h index d2085cdb7fcb..98089e0a4385 100644 --- a/include/media/vsp1.h +++ b/include/media/vsp1.h @@ -48,15 +48,6 @@ int vsp1_du_enable(struct device *dev, unsigned int pipe_index, const struct vsp1_du_lif_config *cfg); int vsp1_du_disable(struct device *dev, unsigned int pipe_index); -static inline int vsp1_du_setup_lif(struct device *dev, unsigned int pipe_index, - const struct vsp1_du_lif_config *cfg) -{ - if (cfg) - return vsp1_du_enable(dev, pipe_index, cfg); - else - return vsp1_du_disable(dev, pipe_index); -} - /** * struct vsp1_du_atomic_config - VSP atomic configuration parameters * @pixelformat: plane pixel format (V4L2 4CC) -- cgit v1.2.3 From 54d30551e460b74b171a6d4a1b49157999d68247 Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Tue, 31 Mar 2026 17:57:35 +1100 Subject: vsprintf: Revert "add simple_strntoul" No users anymore and none should be in the first place. This reverts commit fcc155008a20fa31b01569e105250490750f0687. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260331070519.5974-6-ddiss@suse.de Acked-by: Petr Mladek Reviewed-by: David Disseldorp Signed-off-by: Christian Brauner --- include/linux/kstrtox.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/kstrtox.h b/include/linux/kstrtox.h index 6ea897222af1..7fcf29a4e0de 100644 --- a/include/linux/kstrtox.h +++ b/include/linux/kstrtox.h @@ -143,7 +143,6 @@ static inline int __must_check kstrtos32_from_user(const char __user *s, size_t */ extern unsigned long simple_strtoul(const char *,char **,unsigned int); -extern unsigned long simple_strntoul(const char *,char **,unsigned int,size_t); extern long simple_strtol(const char *,char **,unsigned int); extern unsigned long long simple_strtoull(const char *,char **,unsigned int); extern long long simple_strtoll(const char *,char **,unsigned int); -- cgit v1.2.3 From a2faa0e062db577a0b2e76bea632e924c63c132f Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Tue, 31 Mar 2026 17:57:36 +1100 Subject: kstrtox: Drop extern keyword in the simple_strtox() declarations There is legacy 'extern' keyword for the exported simple_strtox() function which are the artefact that can be removed. So drop it. While at it, tweak the declaration to provide parameter names. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20260331070519.5974-7-ddiss@suse.de Reviewed-by: David Disseldorp Reviewed-by: Petr Mladek Signed-off-by: Christian Brauner --- include/linux/kstrtox.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/kstrtox.h b/include/linux/kstrtox.h index 7fcf29a4e0de..6c9282866770 100644 --- a/include/linux/kstrtox.h +++ b/include/linux/kstrtox.h @@ -142,9 +142,9 @@ static inline int __must_check kstrtos32_from_user(const char __user *s, size_t * Keep in mind above caveat. */ -extern unsigned long simple_strtoul(const char *,char **,unsigned int); -extern long simple_strtol(const char *,char **,unsigned int); -extern unsigned long long simple_strtoull(const char *,char **,unsigned int); -extern long long simple_strtoll(const char *,char **,unsigned int); +unsigned long simple_strtoul(const char *cp, char **endp, unsigned int base); +long simple_strtol(const char *cp, char **endp, unsigned int base); +unsigned long long simple_strtoull(const char *cp, char **endp, unsigned int base); +long long simple_strtoll(const char *cp, char **endp, unsigned int base); #endif /* _LINUX_KSTRTOX_H */ -- cgit v1.2.3 From 31cf44efa6df72a524b40adefb80539f3a4e13ba Mon Sep 17 00:00:00 2001 From: Jori Koolstra Date: Fri, 24 Apr 2026 13:46:02 +0200 Subject: vfs: add O_EMPTYPATH to openat(2)/openat2(2) To get an operable version of an O_PATH file descriptor, it is possible to use openat(fd, ".", O_DIRECTORY) for directories, but other files currently require going through open("/proc//fd/"), which depends on a functioning procfs. This patch adds the O_EMPTYPATH flag to openat(2)/openat2(2). If passed, LOOKUP_EMPTY is set at path resolution time. Note: This implies that you cannot rely anymore on disabling procfs from being mounted (e.g. inside a container without procfs mounted and with CAP_SYS_ADMIN dropped) to prevent O_PATH fds from being re-opened read-write. Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260424114611.1678641-2-jkoolstra@xs4all.nl Signed-off-by: Christian Brauner (Amutable) --- include/linux/fcntl.h | 2 +- include/uapi/asm-generic/fcntl.h | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/fcntl.h b/include/linux/fcntl.h index a332e79b3207..c65c5c73d362 100644 --- a/include/linux/fcntl.h +++ b/include/linux/fcntl.h @@ -10,7 +10,7 @@ (O_RDONLY | O_WRONLY | O_RDWR | O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | \ O_APPEND | O_NDELAY | O_NONBLOCK | __O_SYNC | O_DSYNC | \ FASYNC | O_DIRECT | O_LARGEFILE | O_DIRECTORY | O_NOFOLLOW | \ - O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE) + O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE | O_EMPTYPATH) /* List of all valid flags for the how->resolve argument: */ #define VALID_RESOLVE_FLAGS \ diff --git a/include/uapi/asm-generic/fcntl.h b/include/uapi/asm-generic/fcntl.h index 613475285643..bfc68156b45a 100644 --- a/include/uapi/asm-generic/fcntl.h +++ b/include/uapi/asm-generic/fcntl.h @@ -88,6 +88,10 @@ #define __O_TMPFILE 020000000 #endif +#ifndef O_EMPTYPATH +#define O_EMPTYPATH (1 << 26) /* allow empty path */ +#endif + /* a horrid kludge trying to make sure that this will fail on old kernels */ #define O_TMPFILE (__O_TMPFILE | O_DIRECTORY) -- cgit v1.2.3 From cf1b04aaef8b83f668fac10bfc4d4d76ba6e6fa1 Mon Sep 17 00:00:00 2001 From: Dorjoy Chowdhury Date: Sat, 28 Mar 2026 23:22:22 +0600 Subject: openat2: introduce EFTYPE error code Introduce a new error code EFTYPE for wrong file type operations. EFTYPE is already used in BSD systems like FreeBSD and macOS. This will be used by the upcoming OPENAT2_REGULAR flag support to return a specific error when a path doesn't refer to a regular file. Signed-off-by: Dorjoy Chowdhury Link: https://patch.msgid.link/20260328172314.45807-2-dorjoychy111@gmail.com Reviewed-by: Jeff Layton Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner (Amutable) --- include/uapi/asm-generic/errno.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/uapi/asm-generic/errno.h b/include/uapi/asm-generic/errno.h index 92e7ae493ee3..bd78e69e0a43 100644 --- a/include/uapi/asm-generic/errno.h +++ b/include/uapi/asm-generic/errno.h @@ -122,4 +122,6 @@ #define EHWPOISON 133 /* Memory page has hardware error */ +#define EFTYPE 134 /* Wrong file type for the intended operation */ + #endif -- cgit v1.2.3 From 988369959e9cc6dad1c3260ebaeb7a3bb5653ab2 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 20 May 2026 16:43:37 +0200 Subject: video/hdmi: Add common TMDS character rate constants Several DRM drivers already define their own constants for minimum and maximum TMDS character rates. By defining common rate constants in a shared header, drivers can just use them instead of having driver local define macros or use magic numbers. The values defined in the header correspond to maximum TMDS character rates defined by each HDMI specification version: - HDMI_TMDS_CHAR_RATE_MIN_HZ: 25 MHz (minimum for all versions) - HDMI_1_0_TMDS_CHAR_RATE_MAX_HZ: 165 MHz (HDMI 1.0 maximum) - HDMI_1_3_TMDS_CHAR_RATE_MAX_HZ: 340 MHz (HDMI 1.3 maximum) - HDMI_2_0_TMDS_CHAR_RATE_MAX_HZ: 600 MHz (HDMI 2.0 maximum) Suggested-by: Maxime Ripard Reviewed-by: Heiko Stuebner Reviewed-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Link: https://patch.msgid.link/20260520144424.1633354-2-javierm@redhat.com Signed-off-by: Javier Martinez Canillas --- include/linux/hdmi.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/hdmi.h b/include/linux/hdmi.h index 96bda41d9148..8dab78e1f61b 100644 --- a/include/linux/hdmi.h +++ b/include/linux/hdmi.h @@ -50,6 +50,12 @@ enum hdmi_infoframe_type { HDMI_INFOFRAME_TYPE_DRM = 0x87, }; +/* HDMI spec maximum TMDS character rates, in Hz */ +#define HDMI_TMDS_CHAR_RATE_MIN_HZ 25000000 +#define HDMI_1_0_TMDS_CHAR_RATE_MAX_HZ 165000000 +#define HDMI_1_3_TMDS_CHAR_RATE_MAX_HZ 340000000 +#define HDMI_2_0_TMDS_CHAR_RATE_MAX_HZ 600000000 + #define HDMI_IEEE_OUI 0x000c03 #define HDMI_FORUM_IEEE_OUI 0xc45dd8 #define HDMI_INFOFRAME_HEADER_SIZE 4 -- cgit v1.2.3 From 44730eac1778c72d3667ff5372f254056f542da8 Mon Sep 17 00:00:00 2001 From: Xukai Wang Date: Sat, 25 Apr 2026 17:29:31 +0800 Subject: dt-bindings: clock: Add Canaan K230 clock controller This patch adds the Device Tree binding for the clock controller on Canaan k230. The binding defines the clocks and the required properties to configure them correctly. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Xukai Wang Signed-off-by: Conor Dooley --- include/dt-bindings/clock/canaan,k230-clk.h | 220 ++++++++++++++++++++++++++++ 1 file changed, 220 insertions(+) create mode 100644 include/dt-bindings/clock/canaan,k230-clk.h (limited to 'include') diff --git a/include/dt-bindings/clock/canaan,k230-clk.h b/include/dt-bindings/clock/canaan,k230-clk.h new file mode 100644 index 000000000000..3b916678cc5b --- /dev/null +++ b/include/dt-bindings/clock/canaan,k230-clk.h @@ -0,0 +1,220 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Kendryte Canaan K230 Clock Drivers + * + * Author: Xukai Wang + */ + +#ifndef __DT_BINDINGS_CANAAN_K230_CLOCK_H__ +#define __DT_BINDINGS_CANAAN_K230_CLOCK_H__ + +#define K230_CPU0_SRC_GATE 0 +#define K230_CPU0_PLIC_GATE 1 +#define K230_CPU0_NOC_DDRCP4_GATE 2 +#define K230_CPU0_APB_GATE 3 +#define K230_CPU0_SRC_RATE 4 +#define K230_CPU0_AXI_RATE 5 +#define K230_CPU0_PLIC_RATE 6 +#define K230_CPU0_APB_RATE 7 +#define K230_HS_SSI0_MUX 8 +#define K230_HS_USB_REF_MUX 9 +#define K230_HS_HCLK_HIGH_GATE 10 +#define K230_HS_HCLK_GATE 11 +#define K230_HS_SD0_AHB_GATE 12 +#define K230_HS_SD1_AHB_GATE 13 +#define K230_HS_SSI1_AHB_GATE 14 +#define K230_HS_SSI2_AHB_GATE 15 +#define K230_HS_USB0_AHB_GATE 16 +#define K230_HS_USB1_AHB_GATE 17 +#define K230_HS_SSI0_AXI_GATE 18 +#define K230_HS_SSI1_GATE 19 +#define K230_HS_SSI2_GATE 20 +#define K230_HS_QSPI_AXI_SRC_GATE 21 +#define K230_HS_SSI1_AXI_GATE 22 +#define K230_HS_SSI2_AXI_GATE 23 +#define K230_HS_SD_CARD_SRC_GATE 24 +#define K230_HS_SD0_CARD_GATE 25 +#define K230_HS_SD1_CARD_GATE 26 +#define K230_HS_SD_AXI_SRC_GATE 27 +#define K230_HS_SD0_AXI_GATE 28 +#define K230_HS_SD1_AXI_GATE 29 +#define K230_HS_SD0_BASE_GATE 30 +#define K230_HS_SD1_BASE_GATE 31 +#define K230_HS_SSI0_GATE 32 +#define K230_HS_SD_TIMER_SRC_GATE 33 +#define K230_HS_SD0_TIMER_GATE 34 +#define K230_HS_SD1_TIMER_GATE 35 +#define K230_HS_USB0_REF_GATE 36 +#define K230_HS_USB1_REF_GATE 37 +#define K230_HS_HCLK_HIGH_RATE 38 +#define K230_HS_HCLK_RATE 39 +#define K230_HS_SSI0_AXI_RATE 40 +#define K230_HS_SSI1_RATE 41 +#define K230_HS_SSI2_RATE 42 +#define K230_HS_QSPI_AXI_SRC_RATE 43 +#define K230_HS_SD_CARD_SRC_RATE 44 +#define K230_HS_SD_AXI_SRC_RATE 45 +#define K230_HS_USB_REF_50M_RATE 46 +#define K230_HS_SD_TIMER_SRC_RATE 47 +#define K230_TIMER0_MUX 48 +#define K230_TIMER1_MUX 49 +#define K230_TIMER2_MUX 50 +#define K230_TIMER3_MUX 51 +#define K230_TIMER4_MUX 52 +#define K230_TIMER5_MUX 53 +#define K230_SHRM_SRAM_MUX 54 +#define K230_DDRC_SRC_MUX 55 +#define K230_AI_SRC_MUX 56 +#define K230_CAMERA0_MUX 57 +#define K230_CAMERA1_MUX 58 +#define K230_CAMERA2_MUX 59 +#define K230_CPU1_SRC_MUX 60 +#define K230_CPU1_SRC_GATE 61 +#define K230_CPU1_PLIC_GATE 62 +#define K230_CPU1_APB_GATE 63 +#define K230_CPU1_SRC_RATE 64 +#define K230_CPU1_AXI_RATE 65 +#define K230_CPU1_PLIC_RATE 66 +#define K230_PMU_APB_GATE 67 +#define K230_LS_APB_SRC_GATE 68 +#define K230_LS_UART0_APB_GATE 69 +#define K230_LS_UART1_APB_GATE 70 +#define K230_LS_UART2_APB_GATE 71 +#define K230_LS_UART3_APB_GATE 72 +#define K230_LS_UART4_APB_GATE 73 +#define K230_LS_I2C0_APB_GATE 74 +#define K230_LS_I2C1_APB_GATE 75 +#define K230_LS_I2C2_APB_GATE 76 +#define K230_LS_I2C3_APB_GATE 77 +#define K230_LS_I2C4_APB_GATE 78 +#define K230_LS_GPIO_APB_GATE 79 +#define K230_LS_PWM_APB_GATE 80 +#define K230_LS_JAMLINK0_APB_GATE 81 +#define K230_LS_JAMLINK1_APB_GATE 82 +#define K230_LS_JAMLINK2_APB_GATE 83 +#define K230_LS_JAMLINK3_APB_GATE 84 +#define K230_LS_AUDIO_APB_GATE 85 +#define K230_LS_ADC_APB_GATE 86 +#define K230_LS_CODEC_APB_GATE 87 +#define K230_LS_I2C0_GATE 88 +#define K230_LS_I2C1_GATE 89 +#define K230_LS_I2C2_GATE 90 +#define K230_LS_I2C3_GATE 91 +#define K230_LS_I2C4_GATE 92 +#define K230_LS_CODEC_ADC_GATE 93 +#define K230_LS_CODEC_DAC_GATE 94 +#define K230_LS_AUDIO_DEV_GATE 95 +#define K230_LS_PDM_GATE 96 +#define K230_LS_ADC_GATE 97 +#define K230_LS_UART0_GATE 98 +#define K230_LS_UART1_GATE 99 +#define K230_LS_UART2_GATE 100 +#define K230_LS_UART3_GATE 101 +#define K230_LS_UART4_GATE 102 +#define K230_LS_JAMLINK0CO_GATE 103 +#define K230_LS_JAMLINK1CO_GATE 104 +#define K230_LS_JAMLINK2CO_GATE 105 +#define K230_LS_JAMLINK3CO_GATE 106 +#define K230_LS_GPIO_DEBOUNCE_GATE 107 +#define K230_SYSCTL_WDT0_APB_GATE 108 +#define K230_SYSCTL_WDT1_APB_GATE 109 +#define K230_SYSCTL_TIMER_APB_GATE 110 +#define K230_SYSCTL_IOMUX_APB_GATE 111 +#define K230_SYSCTL_MAILBOX_APB_GATE 112 +#define K230_SYSCTL_HDI_GATE 113 +#define K230_SYSCTL_TIME_STAMP_GATE 114 +#define K230_SYSCTL_WDT0_GATE 115 +#define K230_SYSCTL_WDT1_GATE 116 +#define K230_TIMER0_GATE 117 +#define K230_TIMER1_GATE 118 +#define K230_TIMER2_GATE 119 +#define K230_TIMER3_GATE 120 +#define K230_TIMER4_GATE 121 +#define K230_TIMER5_GATE 122 +#define K230_SHRM_APB_GATE 123 +#define K230_SHRM_AXI_GATE 124 +#define K230_SHRM_AXI_SLAVE_GATE 125 +#define K230_SHRM_NONAI2D_AXI_GATE 126 +#define K230_SHRM_SRAM_GATE 127 +#define K230_SHRM_DECOMPRESS_AXI_GATE 128 +#define K230_SHRM_SDMA_AXI_GATE 129 +#define K230_SHRM_PDMA_AXI_GATE 130 +#define K230_DDRC_SRC_GATE 131 +#define K230_DDRC_BYPASS_GATE 132 +#define K230_DDRC_APB_GATE 133 +#define K230_DISPLAY_AHB_GATE 134 +#define K230_DISPLAY_AXI_GATE 135 +#define K230_DISPLAY_GPU_GATE 136 +#define K230_DISPLAY_DPIP_GATE 137 +#define K230_DISPLAY_CFG_GATE 138 +#define K230_DISPLAY_REF_GATE 139 +#define K230_USB_480M_GATE 140 +#define K230_USB_100M_GATE 141 +#define K230_DPHY_DFT_GATE 142 +#define K230_SPI2AXI_GATE 143 +#define K230_AI_SRC_GATE 144 +#define K230_AI_AXI_GATE 145 +#define K230_AI_SRC_RATE 146 +#define K230_CAMERA0_GATE 147 +#define K230_CAMERA1_GATE 148 +#define K230_CAMERA2_GATE 149 +#define K230_LS_APB_SRC_RATE 150 +#define K230_LS_I2C0_RATE 151 +#define K230_LS_I2C1_RATE 152 +#define K230_LS_I2C2_RATE 153 +#define K230_LS_I2C3_RATE 154 +#define K230_LS_I2C4_RATE 155 +#define K230_LS_CODEC_ADC_RATE 156 +#define K230_LS_CODEC_DAC_RATE 157 +#define K230_LS_AUDIO_DEV_RATE 158 +#define K230_LS_PDM_RATE 159 +#define K230_LS_ADC_RATE 160 +#define K230_LS_UART0_RATE 161 +#define K230_LS_UART1_RATE 162 +#define K230_LS_UART2_RATE 163 +#define K230_LS_UART3_RATE 164 +#define K230_LS_UART4_RATE 165 +#define K230_LS_JAMLINKCO_SRC_RATE 166 +#define K230_LS_GPIO_DEBOUNCE_RATE 167 +#define K230_SYSCTL_HDI_RATE 168 +#define K230_SYSCTL_TIME_STAMP_RATE 169 +#define K230_SYSCTL_TEMP_SENSOR_RATE 170 +#define K230_SYSCTL_WDT0_RATE 171 +#define K230_SYSCTL_WDT1_RATE 172 +#define K230_TIMER0_SRC_RATE 173 +#define K230_TIMER1_SRC_RATE 174 +#define K230_TIMER2_SRC_RATE 175 +#define K230_TIMER3_SRC_RATE 176 +#define K230_TIMER4_SRC_RATE 177 +#define K230_TIMER5_SRC_RATE 178 +#define K230_SHRM_APB_RATE 179 +#define K230_DDRC_SRC_RATE 180 +#define K230_DDRC_APB_RATE 181 +#define K230_DISPLAY_AHB_RATE 182 +#define K230_DISPLAY_CLKEXT_RATE 183 +#define K230_DISPLAY_GPU_RATE 184 +#define K230_DISPLAY_DPIP_RATE 185 +#define K230_DISPLAY_CFG_RATE 186 +#define K230_VPU_SRC_GATE 187 +#define K230_VPU_AXI_GATE 188 +#define K230_VPU_DDRCP2_GATE 189 +#define K230_VPU_CFG_GATE 190 +#define K230_VPU_SRC_RATE 191 +#define K230_VPU_AXI_SRC_RATE 192 +#define K230_VPU_CFG_RATE 193 +#define K230_SEC_APB_GATE 194 +#define K230_SEC_FIX_GATE 195 +#define K230_SEC_AXI_GATE 196 +#define K230_SEC_APB_RATE 197 +#define K230_SEC_FIX_RATE 198 +#define K230_SEC_AXI_RATE 199 +#define K230_USB_480M_RATE 200 +#define K230_USB_100M_RATE 201 +#define K230_DPHY_DFT_RATE 202 +#define K230_SPI2AXI_RATE 203 +#define K230_CAMERA0_RATE 204 +#define K230_CAMERA1_RATE 205 +#define K230_CAMERA2_RATE 206 +#define K230_SHRM_SRAM_DIV2 207 + +#endif /* __DT_BINDINGS_CANAAN_K230_CLOCK_H__ */ -- cgit v1.2.3 From 84fbe791a6203e35a602f7fef94d967466cd8d29 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sven=20P=C3=BCschel?= Date: Thu, 21 May 2026 00:44:09 +0200 Subject: media: v4l2-common: add has_alpha to v4l2_format_info MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a has_alpha value to the v4l2_format_info struct to indicate if the format contains an alpha component. This information can currently not be queried in a generic way, but might be useful for potential drivers to properly setup alpha blending to copy or set the alpha value. The implementation is based on the drm_format_info implementation. Reviewed-by: Nicolas Dufresne Signed-off-by: Sven Püschel Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil --- include/media/v4l2-common.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/media/v4l2-common.h b/include/media/v4l2-common.h index f8b1faced79c..401d8506c24b 100644 --- a/include/media/v4l2-common.h +++ b/include/media/v4l2-common.h @@ -520,6 +520,7 @@ enum v4l2_pixel_encoding { * @vdiv: Vertical chroma subsampling factor * @block_w: Per-plane macroblock pixel width (optional) * @block_h: Per-plane macroblock pixel height (optional) + * @has_alpha: Does the format embeds an alpha component? */ struct v4l2_format_info { u32 format; @@ -532,6 +533,7 @@ struct v4l2_format_info { u8 vdiv; u8 block_w[4]; u8 block_h[4]; + bool has_alpha; }; static inline bool v4l2_is_format_rgb(const struct v4l2_format_info *f) -- cgit v1.2.3 From 2c225846271fc6b4f7e2a34271ebe828ed461772 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sven=20P=C3=BCschel?= Date: Thu, 21 May 2026 00:44:10 +0200 Subject: media: v4l2-common: add v4l2_fill_pixfmt_mp_aligned helper MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a v4l2_fill_pixfmt_mp_aligned helper which allows the user to specify a custom stride alignment in bytes. This is necessary for hardware like the Rockchip RGA3, which requires the stride value to be aligned to a 16 bytes boundary. The code makes some assumptions about the v4l2 format to simplify the calculation. They currently hold for all known v4l2 formats. v4l2_format_plane_stride uses an unsigned int as argument type to avoid the later multiplication from overflowing the u8 value. All other places use u8, as no practical use cases for a larger alignment are known at the moment. Reviewed-by: Nicolas Dufresne Signed-off-by: Sven Püschel Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil --- include/media/v4l2-common.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/media/v4l2-common.h b/include/media/v4l2-common.h index 401d8506c24b..edd416178c33 100644 --- a/include/media/v4l2-common.h +++ b/include/media/v4l2-common.h @@ -558,6 +558,10 @@ int v4l2_fill_pixfmt(struct v4l2_pix_format *pixfmt, u32 pixelformat, u32 width, u32 height); int v4l2_fill_pixfmt_mp(struct v4l2_pix_format_mplane *pixfmt, u32 pixelformat, u32 width, u32 height); +/* @stride_alignment is a power of 2 value in bytes */ +int v4l2_fill_pixfmt_mp_aligned(struct v4l2_pix_format_mplane *pixfmt, + u32 pixelformat, u32 width, u32 height, + u8 stride_alignment); /** * v4l2_get_link_freq - Get link rate from transmitter -- cgit v1.2.3 From 4566269803ff284010550263299647f1bf9b01d5 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Mon, 18 May 2026 16:24:55 +0800 Subject: net: enetc: add basic operations to the FDB table The FDB table is used for MAC learning lookups and MAC forwarding lookups. Each table entry includes information such as a FID and MAC address that may be unicast or multicast and a forwarding destination field containing a port bitmap identifying the associated port(s) with the MAC address. FDB table entries can be static or dynamic. Static entries are added from software whereby dynamic entries are added either by software or by the hardware as MAC addresses are learned in the datapath. The FDB table can only be managed by the command BD ring using table management protocol version 2.0. Table management command operations Add, Delete, Update and Query are supported. And the FDB table supports three access methods: Entry ID, Exact Match Key Element and Search. This patch adds the following basic supports to the FDB table. ntmp_fdbt_update_entry() - update the configuration element data of a specified FDB entry ntmp_fdbt_delete_entry() - delete a specified FDB entry ntmp_fdbt_add_entry() - add an entry into the FDB table ntmp_fdbt_search_port_entry() - Search the FDB entry on the specified port based on RESUME_ENTRY_ID. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260518082506.1318236-5-wei.fang@nxp.com Signed-off-by: Paolo Abeni --- include/linux/fsl/ntmp.h | 44 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 83a449b4d6ec..4cfff835954e 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -1,11 +1,13 @@ /* SPDX-License-Identifier: (GPL-2.0+ OR BSD-3-Clause) */ -/* Copyright 2025 NXP */ +/* Copyright 2025-2026 NXP */ #ifndef __NETC_NTMP_H #define __NETC_NTMP_H #include #include +#define NTMP_NULL_ENTRY_ID 0xffffffffU + struct maft_keye_data { u8 mac_addr[ETH_ALEN]; __le16 resv; @@ -29,6 +31,7 @@ struct netc_cbdr_regs { struct netc_tbl_vers { u8 maft_ver; u8 rsst_ver; + u8 fdbt_ver; }; struct netc_swcbd { @@ -68,6 +71,36 @@ struct maft_entry_data { struct maft_cfge_data cfge; }; +struct fdbt_keye_data { + u8 mac_addr[ETH_ALEN]; /* big-endian */ + __le16 resv0; + __le16 fid; +#define FDBT_FID GENMASK(11, 0) + __le16 resv1; +}; + +struct fdbt_cfge_data { + __le32 port_bitmap; +#define FDBT_PORT_BITMAP GENMASK(23, 0) + __le32 cfg; +#define FDBT_OETEID GENMASK(1, 0) +#define FDBT_EPORT GENMASK(6, 2) +#define FDBT_IMIRE BIT(7) +#define FDBT_CTD GENMASK(10, 9) +#define FDBT_DYNAMIC BIT(11) +#define FDBT_TIMECAPE BIT(12) + __le32 et_eid; +}; + +struct fdbt_entry_data { + u32 entry_id; + struct fdbt_keye_data keye; + struct fdbt_cfge_data cfge; + u8 acte; +#define FDBT_ACT_CNT GENMASK(6, 0) +#define FDBT_ACT_FLAG BIT(7) +}; + #if IS_ENABLED(CONFIG_NXP_NETC_LIB) int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, const struct netc_cbdr_regs *regs); @@ -83,6 +116,15 @@ int ntmp_rsst_update_entry(struct ntmp_user *user, const u32 *table, int count); int ntmp_rsst_query_entry(struct ntmp_user *user, u32 *table, int count); +int ntmp_fdbt_add_entry(struct ntmp_user *user, u32 *entry_id, + const struct fdbt_keye_data *keye, + const struct fdbt_cfge_data *cfge); +int ntmp_fdbt_update_entry(struct ntmp_user *user, u32 entry_id, + const struct fdbt_cfge_data *cfge); +int ntmp_fdbt_delete_entry(struct ntmp_user *user, u32 entry_id); +int ntmp_fdbt_search_port_entry(struct ntmp_user *user, int port, + u32 *resume_entry_id, + struct fdbt_entry_data *entry); #else static inline int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, const struct netc_cbdr_regs *regs) -- cgit v1.2.3 From d0ac4d4bd299f5948be6a0a65e5f1b360fdfb686 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Mon, 18 May 2026 16:24:56 +0800 Subject: net: enetc: add support for the "Add" operation to VLAN filter table The VLAN filter table contains configuration and control information for each VLAN configured on the switch. Each VLAN entry includes the VLAN port membership, which FID to use in the FDB lookup, which spanning tree group to use, the egress frame modification actions to apply to a frame exiting form this VLAN, and various configuration and control parameters for this VLAN. The VLAN filter table can only be managed by the command BD ring using table management protocol version 2.0. The table supports Add, Delete, Update and Query operations. And the table supports 3 access methods: Entry ID, Exact Match Key Element and Search. But currently we only add the ntmp_vft_add_entry() helper to support the upcoming switch driver to add an entry to the VLAN filter table. Other interfaces will be added in the future. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260518082506.1318236-6-wei.fang@nxp.com Signed-off-by: Paolo Abeni --- include/linux/fsl/ntmp.h | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 4cfff835954e..3672e0dc7726 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -32,6 +32,7 @@ struct netc_tbl_vers { u8 maft_ver; u8 rsst_ver; u8 fdbt_ver; + u8 vft_ver; }; struct netc_swcbd { @@ -101,6 +102,27 @@ struct fdbt_entry_data { #define FDBT_ACT_FLAG BIT(7) }; +struct vft_cfge_data { + __le32 bitmap_stg; +#define VFT_PORT_MEMBERSHIP GENMASK(23, 0) +#define VFT_STG_ID_MASK GENMASK(27, 24) +#define VFT_STG_ID(g) FIELD_PREP(VFT_STG_ID_MASK, (g)) + __le16 fid; +#define VFT_FID GENMASK(11, 0) + __le16 cfg; +#define VFT_MLO GENMASK(2, 0) +#define VFT_MFO GENMASK(4, 3) +#define VFT_IPMFE BIT(6) +#define VFT_IPMFLE BIT(7) +#define VFT_PGA BIT(8) +#define VFT_SFDA BIT(10) +#define VFT_OSFDA BIT(11) +#define VFT_FDBAFSS BIT(12) + __le32 eta_port_bitmap; +#define VFT_ETA_PORT_BITMAP GENMASK(23, 0) + __le32 et_eid; +}; + #if IS_ENABLED(CONFIG_NXP_NETC_LIB) int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, const struct netc_cbdr_regs *regs); @@ -125,6 +147,8 @@ int ntmp_fdbt_delete_entry(struct ntmp_user *user, u32 entry_id); int ntmp_fdbt_search_port_entry(struct ntmp_user *user, int port, u32 *resume_entry_id, struct fdbt_entry_data *entry); +int ntmp_vft_add_entry(struct ntmp_user *user, u16 vid, + const struct vft_cfge_data *cfge); #else static inline int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, const struct netc_cbdr_regs *regs) -- cgit v1.2.3 From cb4d95d79d85e9614a701041100b5012bf595b44 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Mon, 18 May 2026 16:24:57 +0800 Subject: net: enetc: add support for the "Update" operation to buffer pool table The buffer pool table contains buffer pool configuration and operational information. Each entry corresponds to a buffer pool. The Entry ID value represents the buffer pool ID to access. The buffer pool table is a static bounded index table, buffer pools are always present and enabled. It only supports Update and Query operations, This patch only adds ntmp_bpt_update_entry() helper to support updating the specified entry of the buffer pool table. Query action to the table will be added in the future. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260518082506.1318236-7-wei.fang@nxp.com Signed-off-by: Paolo Abeni --- include/linux/fsl/ntmp.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 3672e0dc7726..5fded868725f 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -33,6 +33,7 @@ struct netc_tbl_vers { u8 rsst_ver; u8 fdbt_ver; u8 vft_ver; + u8 bpt_ver; }; struct netc_swcbd { @@ -123,6 +124,28 @@ struct vft_cfge_data { __le32 et_eid; }; +struct bpt_bpse_data { + __le32 amount_used; + __le32 amount_used_hwm; + u8 bpd_fc_state; +#define BPT_FC_STATE BIT(0) +#define BPT_BPD BIT(1) +} __packed; + +struct bpt_cfge_data { + u8 fccfg_sbpen; +#define BPT_FC_CFG GENMASK(2, 1) +#define BPT_FC_CFG_EN_BPFC 1 + u8 pfc_vector; + __le16 max_thresh; + __le16 fc_on_thresh; + __le16 fc_off_thresh; + __le16 sbp_thresh; + __le16 resv; + __le32 sbp_eid; + __le32 fc_ports; +}; + #if IS_ENABLED(CONFIG_NXP_NETC_LIB) int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, const struct netc_cbdr_regs *regs); @@ -149,6 +172,8 @@ int ntmp_fdbt_search_port_entry(struct ntmp_user *user, int port, struct fdbt_entry_data *entry); int ntmp_vft_add_entry(struct ntmp_user *user, u16 vid, const struct vft_cfge_data *cfge); +int ntmp_bpt_update_entry(struct ntmp_user *user, u32 entry_id, + const struct bpt_cfge_data *cfge); #else static inline int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, const struct netc_cbdr_regs *regs) -- cgit v1.2.3 From 123db6a2751144f3e86cb029ebac4ef4777a5507 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Mon, 18 May 2026 16:24:58 +0800 Subject: net: enetc: add support for "Add" and "Delete" operations to IPFT The ingress port filter table (IPFT )contains a set of filters each capable of classifying incoming traffic using a mix of L2, L3, and L4 parsed and arbitrary field data. As a result of a filter match, several actions can be specified such as on whether to deny or allow a frame, overriding internal QoS attributes associated with the frame and setting parameters for the subsequent frame processing functions, such as stream identification, policing, ingress mirroring. Each entry corresponds to a filter. The ingress port filter entries are added using a precedence value. If a frame matches multiple entries, the entry with the higher precedence is used. Currently, this patch only adds "Add" and "Delete" operations to the ingress port filter table. These two interfaces will be used by both ENETC driver and NETC switch driver. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260518082506.1318236-8-wei.fang@nxp.com Signed-off-by: Paolo Abeni --- include/linux/fsl/ntmp.h | 93 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 93 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 5fded868725f..88166f9ad3a2 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -7,6 +7,7 @@ #include #define NTMP_NULL_ENTRY_ID 0xffffffffU +#define IPFT_MAX_PLD_LEN 24 struct maft_keye_data { u8 mac_addr[ETH_ALEN]; @@ -34,6 +35,7 @@ struct netc_tbl_vers { u8 fdbt_ver; u8 vft_ver; u8 bpt_ver; + u8 ipft_ver; }; struct netc_swcbd { @@ -73,6 +75,94 @@ struct maft_entry_data { struct maft_cfge_data cfge; }; +struct ipft_pld_byte { + u8 data; + u8 mask; +}; + +struct ipft_keye_data { + __le16 precedence; + __le16 resv0[3]; + __le16 frm_attr_flags; +#define IPFT_FAF_OVLAN BIT(2) +#define IPFT_FAF_IVLAN BIT(3) +#define IPFT_FAF_IP_HDR BIT(7) +#define IPFT_FAF_IP_VER6 BIT(8) +#define IPFT_FAF_L4_CODE GENMASK(11, 10) +#define IPFT_FAF_TCP_HDR 1 +#define IPFT_FAF_UDP_HDR 2 +#define IPFT_FAF_SCTP_HDR 3 +#define IPFT_FAF_WOL_MAGIC BIT(12) + __le16 frm_attr_flags_mask; + __le16 dscp; +#define IPFT_DSCP GENMASK(5, 0) +#define IPFT_DSCP_MASK GENMASK(11, 6) +#define IPFT_DSCP_MASK_ALL 0x3f + __le16 src_port; /* This field is reserved for ENETC */ +#define IPFT_SRC_PORT GENMASK(4, 0) +#define IPFT_SRC_PORT_MASK GENMASK(9, 5) +#define IPFT_SRC_PORT_MASK_ALL 0x1f + __be16 outer_vlan_tci; + __be16 outer_vlan_tci_mask; + u8 dmac[ETH_ALEN]; + u8 dmac_mask[ETH_ALEN]; + u8 smac[ETH_ALEN]; + u8 smac_mask[ETH_ALEN]; + __be16 inner_vlan_tci; + __be16 inner_vlan_tci_mask; + __be16 ethertype; + __be16 ethertype_mask; + u8 ip_protocol; + u8 ip_protocol_mask; + __le16 resv1[7]; + __be32 ip_src[4]; + __le32 resv2[2]; + __be32 ip_src_mask[4]; + __be16 l4_src_port; + __be16 l4_src_port_mask; + __le32 resv3; + __be32 ip_dst[4]; + __le32 resv4[2]; + __be32 ip_dst_mask[4]; + __be16 l4_dst_port; + __be16 l4_dst_port_mask; + __le32 resv5; + struct ipft_pld_byte byte[IPFT_MAX_PLD_LEN]; +}; + +struct ipft_cfge_data { + __le32 cfg; +#define IPFT_IPV GENMASK(3, 0) +#define IPFT_OIPV BIT(4) +#define IPFT_DR GENMASK(6, 5) +#define IPFT_ODR BIT(7) +#define IPFT_FLTFA GENMASK(10, 8) +#define IPFT_FLTFA_DISCARD 0 +#define IPFT_FLTFA_PERMIT 1 +/* Redirect is only for switch */ +#define IPFT_FLTFA_REDIRECT 2 +#define IPFT_IMIRE BIT(11) +#define IPFT_WOLTE BIT(12) +#define IPFT_FLTA GENMASK(14, 13) +#define IPFT_FLTA_RP 1 +#define IPFT_FLTA_IS 2 +#define IPFT_FLTA_SI_BITMAP 3 +#define IPFT_RPR GENMASK(16, 15) +#define IPFT_CTD BIT(17) +#define IPFT_HR GENMASK(21, 18) +#define IPFT_TIMECAPE BIT(22) +#define IPFT_RRT BIT(23) +#define IPFT_BL2F BIT(24) +#define IPFT_EVMEID GENMASK(31, 28) + __le32 flta_tgt; +}; + +struct ipft_entry_data { + u32 entry_id; /* hardware assigns entry ID */ + struct ipft_keye_data keye; + struct ipft_cfge_data cfge; +}; + struct fdbt_keye_data { u8 mac_addr[ETH_ALEN]; /* big-endian */ __le16 resv0; @@ -161,6 +251,9 @@ int ntmp_rsst_update_entry(struct ntmp_user *user, const u32 *table, int count); int ntmp_rsst_query_entry(struct ntmp_user *user, u32 *table, int count); +int ntmp_ipft_add_entry(struct ntmp_user *user, + struct ipft_entry_data *entry); +int ntmp_ipft_delete_entry(struct ntmp_user *user, u32 entry_id); int ntmp_fdbt_add_entry(struct ntmp_user *user, u32 *entry_id, const struct fdbt_keye_data *keye, const struct fdbt_cfge_data *cfge); -- cgit v1.2.3 From 0850005c26d2623f3d77489cf27d342191a97b5c Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Mon, 18 May 2026 16:25:00 +0800 Subject: net: dsa: add NETC switch tag support The NXP NETC switch tag is a proprietary header added to frames after the source MAC address. The switch tag has 3 types, and each type has 1 ~ 4 subtypes, the details are as follows. Forward NXP switch tag (Type=0): Represents forwarded frames. - SubType = 0 - Normal frame processing. To_Port NXP switch tag (Type=1): Represents frames that are to be sent to a specific switch port. - SubType = 0. No request to perform timestamping. - SubType = 1. Request to perform one-step timestamping. - SubType = 2. Request to perform two-step timestamping. - SubType = 3. Request to perform both one-step timestamping and two-step timestamping. To_Host NXP switch tag (Type=2): Represents frames redirected or copied to the switch management port. - SubType = 0. Received frames redirected or copied to the switch management port. - SubType = 1. Received frames redirected or copied to the switch management port with captured timestamp at the switch port where the frame was received. - SubType = 2. Transmit timestamp response (two-step timestamping). In addition, the length of different type switch tag is different, the minimum length is 6 bytes, the maximum length is 14 bytes. Currently, Forward tag, SubType 0 of To_Port tag and Subtype 0 of To_Host tag are supported. More tags will be supported in the future. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260518082506.1318236-10-wei.fang@nxp.com Signed-off-by: Paolo Abeni --- include/linux/dsa/tag_netc.h | 14 ++++++++++++++ include/net/dsa.h | 2 ++ include/uapi/linux/if_ether.h | 1 + 3 files changed, 17 insertions(+) create mode 100644 include/linux/dsa/tag_netc.h (limited to 'include') diff --git a/include/linux/dsa/tag_netc.h b/include/linux/dsa/tag_netc.h new file mode 100644 index 000000000000..fe964722e5b0 --- /dev/null +++ b/include/linux/dsa/tag_netc.h @@ -0,0 +1,14 @@ +/* SPDX-License-Identifier: GPL-2.0 + * + * Copyright 2025-2026 NXP + */ + +#ifndef __NET_DSA_TAG_NETC_H +#define __NET_DSA_TAG_NETC_H + +#include +#include + +#define NETC_TAG_MAX_LEN 14 + +#endif diff --git a/include/net/dsa.h b/include/net/dsa.h index 4cc67469cf2e..8c16ef23cc10 100644 --- a/include/net/dsa.h +++ b/include/net/dsa.h @@ -58,6 +58,7 @@ struct tc_action; #define DSA_TAG_PROTO_YT921X_VALUE 30 #define DSA_TAG_PROTO_MXL_GSW1XX_VALUE 31 #define DSA_TAG_PROTO_MXL862_VALUE 32 +#define DSA_TAG_PROTO_NETC_VALUE 33 enum dsa_tag_protocol { DSA_TAG_PROTO_NONE = DSA_TAG_PROTO_NONE_VALUE, @@ -93,6 +94,7 @@ enum dsa_tag_protocol { DSA_TAG_PROTO_YT921X = DSA_TAG_PROTO_YT921X_VALUE, DSA_TAG_PROTO_MXL_GSW1XX = DSA_TAG_PROTO_MXL_GSW1XX_VALUE, DSA_TAG_PROTO_MXL862 = DSA_TAG_PROTO_MXL862_VALUE, + DSA_TAG_PROTO_NETC = DSA_TAG_PROTO_NETC_VALUE, }; struct dsa_switch; diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h index df9d44a11540..fb5efc8e06cc 100644 --- a/include/uapi/linux/if_ether.h +++ b/include/uapi/linux/if_ether.h @@ -123,6 +123,7 @@ #define ETH_P_DSA_A5PSW 0xE001 /* A5PSW Tag Value [ NOT AN OFFICIALLY REGISTERED ID ] */ #define ETH_P_IFE 0xED3E /* ForCES inter-FE LFB type */ #define ETH_P_AF_IUCV 0xFBFB /* IBM af_iucv [ NOT AN OFFICIALLY REGISTERED ID ] */ +#define ETH_P_NXP_NETC 0xFD3A /* NXP NETC DSA [ NOT AN OFFICIALLY REGISTERED ID ] */ #define ETH_P_802_3_MIN 0x0600 /* If the value in the ethernet type is more than this value * then the frame is Ethernet II. Else it is 802.3 */ -- cgit v1.2.3 From 25049d8b6e6b87f7ffcf53ce5ea1b51528b8677f Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Mon, 18 May 2026 16:25:05 +0800 Subject: net: dsa: netc: add support for the standardized counters Each user port of the NETC switch supports 802.3 basic and mandatory managed objects statistic counters and IETF Management Information Database (MIB) package (RFC2665) and Remote Network Monitoring (RMON) counters. And all of these counters are 64-bit registers. In addition, some user ports support preemption, so these ports have two MACs, MAC 0 is the express MAC (eMAC), MAC 1 is the preemptible MAC (pMAC). So for ports that support preemption, the statistics are the sum of the pMAC and eMAC statistics. Note that the current switch driver does not support preemption, all frames are sent and received via the eMAC by default. The statistics read from the pMAC should be zero. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260518082506.1318236-15-wei.fang@nxp.com Signed-off-by: Paolo Abeni --- include/linux/fsl/netc_global.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/netc_global.h b/include/linux/fsl/netc_global.h index fdecca8c90f0..5b8ff528d369 100644 --- a/include/linux/fsl/netc_global.h +++ b/include/linux/fsl/netc_global.h @@ -5,6 +5,7 @@ #define __NETC_GLOBAL_H #include +#include static inline u32 netc_read(void __iomem *reg) { @@ -16,4 +17,9 @@ static inline void netc_write(void __iomem *reg, u32 val) iowrite32(val, reg); } +static inline u64 netc_read64(void __iomem *reg) +{ + return ioread64(reg); +} + #endif -- cgit v1.2.3 From 16ba3b0c66ef1d16bce2e99d787d7d12281bb2de Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Thu, 21 May 2026 09:38:16 +0200 Subject: spi: fix controller registration API inconsistency The SPI controller API is asymmetric in that a controller is allocated and registered in two step, while it is freed as part of deregistration. [1] This is especially unfortunate as any driver data is freed along with the controller, something which has lead to use-after-free bugs during deregistration when drivers tear down resources after deregistering the controller (or tear down resources that may still be in use before deregistering the controller in an attempt to work around the API). To reduce the risk of such bugs being introduced a device managed allocation interface was added, but this arguably made things even less consistent as now whether the controller gets freed as part of deregistration depends on how it was allocated. [2][3] With most drivers converted to use managed allocation in preparation for fixing the API, the remaining 16 drivers can be converted in one tree-wide change. Ten of those drivers use the bitbang interface and can be converted by simply removing the extra reference already taken by spi_bitbang_start() (and updating the two bitbang drivers that use managed allocation). [4] Fix the API inconsistency by no longer dropping a reference when deregistering non-devres allocated controllers. [1] 68b892f1fdc4 ("spi: document odd controller reference handling") [2] 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation") [3] 3f174274d224 ("spi: fix misleading controller deregistration kernel-doc") [4] 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master") Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260521073816.766596-1-johan@kernel.org Signed-off-by: Mark Brown --- include/linux/spi/spi.h | 4 ---- 1 file changed, 4 deletions(-) (limited to 'include') diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h index 79513f5941cc..f6ed93eff00b 100644 --- a/include/linux/spi/spi.h +++ b/include/linux/spi/spi.h @@ -424,7 +424,6 @@ extern struct spi_device *devm_spi_new_ancillary_device(struct spi_device *spi, * @flags: other constraints relevant to this driver * @slave: indicates that this is an SPI slave controller * @target: indicates that this is an SPI target controller - * @devm_allocated: whether the allocation of this struct is devres-managed * @max_transfer_size: function that returns the max transfer size for * a &spi_device; may be %NULL, so the default %SIZE_MAX will be used. * @max_message_size: function that returns the max message size for @@ -629,9 +628,6 @@ struct spi_controller { */ #define SPI_CONTROLLER_MULTI_CS BIT(7) - /* Flag indicating if the allocation of this struct is devres-managed */ - bool devm_allocated; - union { /* Flag indicating this is an SPI slave controller */ bool slave; -- cgit v1.2.3 From e6666aef11053d492ff6e715c89b139fc1655b1c Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 11 May 2026 09:22:29 +0200 Subject: fs: remove start_removing_user_path_at This function is entirely unused, remove it. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260511072239.2456725-3-hch@lst.de Signed-off-by: Christian Brauner (Amutable) --- include/linux/namei.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/namei.h b/include/linux/namei.h index 2ad6dd9987b9..80488b3de0c9 100644 --- a/include/linux/namei.h +++ b/include/linux/namei.h @@ -61,7 +61,6 @@ extern struct dentry *start_creating_path(int, const char *, struct path *, unsi extern struct dentry *start_creating_user_path(int, const char __user *, struct path *, unsigned int); extern void end_creating_path(const struct path *, struct dentry *); extern struct dentry *start_removing_path(const char *, struct path *); -extern struct dentry *start_removing_user_path_at(int , const char __user *, struct path *); static inline void end_removing_path(const struct path *path , struct dentry *dentry) { end_creating_path(path, dentry); -- cgit v1.2.3 From a494d3c8d5392bcdff83c2a593df0c160ff9f322 Mon Sep 17 00:00:00 2001 From: "Masami Hiramatsu (Google)" Date: Thu, 30 Apr 2026 12:28:16 +0900 Subject: ring-buffer: Flush and stop persistent ring buffer on panic On real hardware, panic and machine reboot may not flush hardware cache to memory. This means the persistent ring buffer, which relies on a coherent state of memory, may not have its events written to the buffer and they may be lost. Moreover, there may be inconsistency with the counters which are used for validation of the integrity of the persistent ring buffer which may cause all data to be discarded. To avoid this issue, stop recording of the ring buffer on panic and flush the cache of the ring buffer's memory. Fixes: e645535a954a ("tracing: Add option to use memmapped memory for trace boot instance") Cc: stable@vger.kernel.org Cc: Will Deacon Cc: Mathieu Desnoyers Cc: Ian Rogers Link: https://patch.msgid.link/177751969602.2136606.12031934362587643488.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Acked-by: Catalin Marinas Acked-by: Geert Uytterhoeven Signed-off-by: Steven Rostedt --- include/asm-generic/ring_buffer.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 include/asm-generic/ring_buffer.h (limited to 'include') diff --git a/include/asm-generic/ring_buffer.h b/include/asm-generic/ring_buffer.h new file mode 100644 index 000000000000..201d2aee1005 --- /dev/null +++ b/include/asm-generic/ring_buffer.h @@ -0,0 +1,13 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Generic arch dependent ring_buffer macros. + */ +#ifndef __ASM_GENERIC_RING_BUFFER_H__ +#define __ASM_GENERIC_RING_BUFFER_H__ + +#include + +/* Flush cache on ring buffer range if needed. Do nothing by default. */ +#define arch_ring_buffer_flush_range(start, end) do { } while (0) + +#endif /* __ASM_GENERIC_RING_BUFFER_H__ */ -- cgit v1.2.3 From 8c3ff7c5ae15cc71000f10f4d0f26669b9471faa Mon Sep 17 00:00:00 2001 From: Konrad Dybcio Date: Thu, 21 May 2026 12:40:00 +0200 Subject: thunderbolt: Move pci_device out of tb_nhi Not all USB4/TB implementations are based on a PCIe-attached controller. In order to make way for these, start off with moving the pci_device reference out of the main tb_nhi structure. Encapsulate the existing struct in a new tb_nhi_pci, that shall also house all properties that relate to the parent bus. Similarly, any other type of controller will be expected to contain tb_nhi as a member. Signed-off-by: Konrad Dybcio Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index 0be9b298e692..b5659f883517 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -498,12 +498,11 @@ void tb_service_properties_changed(struct tb_service *svc); * struct tb_nhi - thunderbolt native host interface * @lock: Must be held during ring creation/destruction. Is acquired by * interrupt_work when dispatching interrupts to individual rings. - * @pdev: Pointer to the PCI device + * @dev: Device associated with this NHI instance * @ops: NHI specific optional ops * @iobase: MMIO space of the NHI * @tx_rings: All Tx rings available on this host controller * @rx_rings: All Rx rings available on this host controller - * @msix_ida: Used to allocate MSI-X vectors for rings * @going_away: The host controller device is about to disappear so when * this flag is set, avoid touching the hardware anymore. * @iommu_dma_protection: An IOMMU will isolate external-facing ports. @@ -515,12 +514,11 @@ void tb_service_properties_changed(struct tb_service *svc); */ struct tb_nhi { spinlock_t lock; - struct pci_dev *pdev; + struct device *dev; const struct tb_nhi_ops *ops; void __iomem *iobase; struct tb_ring **tx_rings; struct tb_ring **rx_rings; - struct ida msix_ida; bool going_away; bool iommu_dma_protection; struct work_struct interrupt_work; @@ -722,7 +720,7 @@ int tb_ring_throttling(struct tb_ring *ring, unsigned int interval_nsec); */ static inline struct device *tb_ring_dma_device(struct tb_ring *ring) { - return &ring->nhi->pdev->dev; + return ring->nhi->dev; } bool usb4_usb3_port_match(struct device *usb4_port_dev, -- cgit v1.2.3 From 8b82cacad92ebae9619872a5a69c570eba30140b Mon Sep 17 00:00:00 2001 From: Dorjoy Chowdhury Date: Sat, 16 May 2026 16:42:39 +0200 Subject: openat2: new OPENAT2_REGULAR flag support This flag indicates the path should be opened if it's a regular file. This is useful to write secure programs that want to avoid being tricked into opening device nodes with special semantics while thinking they operate on regular files. This is a requested feature from the uapi-group[1]. The previously introduced EFTYPE error code is returned when the path doesn't refer to a regular file. For example, if openat2 is called on path /dev/null with OPENAT2_REGULAR in the flag param, it will return -EFTYPE. When used in combination with O_CREAT, either the regular file is created, or if the path already exists, it is opened if it's a regular file. Otherwise, -EFTYPE is returned. When OPENAT2_REGULAR is combined with O_DIRECTORY, -EINVAL is returned as it doesn't make sense to open a path that is both a directory and a regular file. The UAPI bit lives in the upper 32 bits of open_how::flags (((__u64)1 << 32)) so that open(2) and openat(2) -- whose @flags argument is a C int -- cannot physically express it. This is a structural guarantee, not a runtime mask: the bit is unrepresentable in 32 bits. Because the rest of the VFS open path narrows to 32 bits in several places (op->open_flag, f->f_flags, the unsigned open_flag argument of i_op->atomic_open()), build_open_flags() translates OPENAT2_REGULAR into a kernel-internal lower-32-bit carrier __O_REGULAR (bit 4, unused as an O_* on every architecture) before the assignment to op->open_flag. __O_REGULAR then rides through the existing channels exactly like __FMODE_EXEC. do_dentry_open() strips it so it cannot leak back to userspace via fcntl(F_GETFL). Four BUILD_BUG_ON_MSG() invariants in build_open_flags() prevent any future bit collision or accidental low-32 redefinition: - VALID_OPEN_FLAGS fits in 32 bits. - OPENAT2_REGULAR lives in the upper 32 bits. - OPENAT2_REGULAR does not alias any open()/openat() flag. - __O_REGULAR does not alias any user-visible flag. [1]: https://uapi-group.org/kernel-features/#ability-to-only-open-regular-files Christian Brauner says: Move OPENAT2_REGULAR to the upper 32 bits of open_how::flags with a kernel-internal __O_REGULAR carrier so that open(2)/openat(2) cannot encode the flag; add BUILD_BUG_ON_MSG() invariants and register __O_REGULAR in the fcntl_init() allocation-uniqueness BUILD_BUG_ON() (bit count 21 -> 22). Signed-off-by: Dorjoy Chowdhury Link: https://patch.msgid.link/20260328172314.45807-2-dorjoychy111@gmail.com Reviewed-by: Jeff Layton Reviewed-by: Aleksa Sarai Signed-off-by: Christian Brauner (Amutable) --- include/linux/fcntl.h | 18 ++++++++++++++++++ include/uapi/linux/openat2.h | 7 +++++++ 2 files changed, 25 insertions(+) (limited to 'include') diff --git a/include/linux/fcntl.h b/include/linux/fcntl.h index c65c5c73d362..6ad6b9e7a226 100644 --- a/include/linux/fcntl.h +++ b/include/linux/fcntl.h @@ -4,6 +4,7 @@ #include #include +#include /* List of all valid flags for the open/openat flags argument: */ #define VALID_OPEN_FLAGS \ @@ -12,6 +13,23 @@ FASYNC | O_DIRECT | O_LARGEFILE | O_DIRECTORY | O_NOFOLLOW | \ O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE | O_EMPTYPATH) +/* List of all valid flags for openat2(2)'s how->flags argument. */ +#define VALID_OPENAT2_FLAGS (VALID_OPEN_FLAGS | OPENAT2_REGULAR) + +/* + * Kernel-internal carrier for OPENAT2_REGULAR. The UAPI bit lives in the + * upper 32 bits of open_how::flags so open()/openat() cannot encode it. + * build_open_flags() translates it to this internal flag, which then + * propagates through op->open_flag and f->f_flags exactly like __FMODE_EXEC. + * do_dentry_open() strips it so userspace cannot observe it via + * fcntl(F_GETFL). + * + * Bit 30 is not claimed by any O_* flag on any architecture and stays clear + * of the sign bit of the int op->open_flag. fcntl_init() enforces that it + * never aliases an open-flag bit. + */ +#define __O_REGULAR (1 << 30) + /* List of all valid flags for the how->resolve argument: */ #define VALID_RESOLVE_FLAGS \ (RESOLVE_NO_XDEV | RESOLVE_NO_MAGICLINKS | RESOLVE_NO_SYMLINKS | \ diff --git a/include/uapi/linux/openat2.h b/include/uapi/linux/openat2.h index a5feb7604948..575c2c59d14a 100644 --- a/include/uapi/linux/openat2.h +++ b/include/uapi/linux/openat2.h @@ -22,6 +22,13 @@ struct open_how { __u64 resolve; }; +/* + * how->flags bits exclusive to openat2(2). These live in the upper 32 bits + * of @flags so that they cannot be expressed by open(2) / openat(2), whose + * @flags argument is a C int. + */ +#define OPENAT2_REGULAR ((__u64)1 << 32) /* Only open regular files. */ + /* how->resolve flags for openat2(2). */ #define RESOLVE_NO_XDEV 0x01 /* Block mount-point crossings (includes bind-mounts). */ -- cgit v1.2.3 From dd2147375a8fe7c5bc3f1f1b1d3a9567c26faefa Mon Sep 17 00:00:00 2001 From: Liu Kai Date: Thu, 7 May 2026 16:32:04 +0800 Subject: HID: remove duplicate hid_warn_ratelimited definition The hid_warn_ratelimited macro is defined twice in include/linux/hid.h: - first one added by commit 4051ead99888 ("HID: rate-limit hid_warn to prevent log flooding") - second one added by commit 1d64624243af ("HID: core: Add printk_ratelimited variants to hid_warn() etc")). The second definition is correctly grouped with other ratelimited macros. Remove the duplicate definition. Fixes: 1d64624243af ("HID: core: Add printk_ratelimited variants to hid_warn() etc") Signed-off-by: Liu Kai [bentiss: edited commit message] Signed-off-by: Benjamin Tissoires --- include/linux/hid.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/hid.h b/include/linux/hid.h index bfb9859f391e..47dc0bc89fa4 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -1316,8 +1316,6 @@ void hid_quirks_exit(__u16 bus); dev_notice(&(hid)->dev, fmt, ##__VA_ARGS__) #define hid_warn(hid, fmt, ...) \ dev_warn(&(hid)->dev, fmt, ##__VA_ARGS__) -#define hid_warn_ratelimited(hid, fmt, ...) \ - dev_warn_ratelimited(&(hid)->dev, fmt, ##__VA_ARGS__) #define hid_info(hid, fmt, ...) \ dev_info(&(hid)->dev, fmt, ##__VA_ARGS__) #define hid_dbg(hid, fmt, ...) \ -- cgit v1.2.3 From 9e896b4a48c4e815956d28961448041c80ad5a19 Mon Sep 17 00:00:00 2001 From: Jihong Min Date: Tue, 19 May 2026 09:07:31 +0900 Subject: usb: xhci-pci: add AMD Promontory 21 PCI glue AMD Promontory 21 (PROM21) xHCI PCI functions use the common xhci-pci core for USB operation, but also expose controller-specific sensor data. Add a small PROM21 PCI glue driver for AMD 1022:43fc and 1022:43fd controllers. The glue delegates USB host operation to the common xhci-pci core and publishes a "hwmon" auxiliary device with parent-provided MMIO data. Auxiliary device creation failure is logged but does not fail the xHCI probe. Make the PROM21 glue a hidden Kconfig tristate driven by the user-visible SENSORS_PROM21_XHCI option. If sensor support is disabled, generic xhci-pci binds PROM21 controllers normally. If sensor support is enabled, the glue follows USB_XHCI_PCI. This keeps the auxiliary device available for a modular sensor driver while avoiding a built-in xhci-pci core handing PROM21 controllers to a glue driver that is only available as a module during initramfs. Assisted-by: Codex:gpt-5.5 Signed-off-by: Jihong Min Reviewed-by: Mario Limonciello (AMD) Tested-by: Yaroslav Isakov Acked-by: Guenter Roeck Link: https://patch.msgid.link/20260519000732.2334711-2-hurryman2212@gmail.com Signed-off-by: Greg Kroah-Hartman --- include/linux/platform_data/usb-xhci-prom21.h | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 include/linux/platform_data/usb-xhci-prom21.h (limited to 'include') diff --git a/include/linux/platform_data/usb-xhci-prom21.h b/include/linux/platform_data/usb-xhci-prom21.h new file mode 100644 index 000000000000..ee672ad452a8 --- /dev/null +++ b/include/linux/platform_data/usb-xhci-prom21.h @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * AMD Promontory 21 xHCI auxiliary device platform data. + * + * Copyright (C) 2026 Jihong Min + */ + +#ifndef _LINUX_PLATFORM_DATA_USB_XHCI_PROM21_H +#define _LINUX_PLATFORM_DATA_USB_XHCI_PROM21_H + +#include +#include + +struct pci_dev; + +struct prom21_xhci_pdata { + struct pci_dev *pdev; + void __iomem *regs; + resource_size_t rsrc_len; +}; + +#endif -- cgit v1.2.3 From fb6988b83b4cafe8db63999c1ddff1b7c66d2ff5 Mon Sep 17 00:00:00 2001 From: Florian Schmaus Date: Thu, 7 May 2026 10:48:54 +0200 Subject: kunit: fix use-after-free in debugfs when using kunit.filter When the kernel is booted with a kunit filter (e.g., kunit.filter="speed!=slow"), the kunit executor dynamically allocates copies of the filtered test suites using kmalloc/kmemdup. During the initial boot execution, kunit_debugfs_create_suite() creates debugfs files (such as /sys/kernel/debug/kunit//run) and permanently stores a pointer to the dynamically allocated suite in the inode's i_private field. Previously, the executor freed this dynamically allocated suite_set immediately after executing the boot-time tests. Because the debugfs nodes were not destroyed, any subsequent interaction with the debugfs `run` file from userspace triggered a use-after-free (UAF). On systems with architectural capabilities, like CHERI RISC-V, this resulted in an immediate fatal hardware exception due to the invalidation of the capability tags on the reclaimed memory. On other architectures, it resulted in silent memory corruption. Fix this UAF by properly coupling the lifetime of the filtered suite memory allocation to the lifetime of the kunit subsystem and its associated VFS nodes. Ownership of the boot-time suite_set is now transferred to a global tracker ('kunit_boot_suites'), and the memory is cleanly released in kunit_exit() during module teardown. Link: https://lore.kernel.org/r/20260507084854.233984-1-florian.schmaus@codasip.com Fixes: e2219db280e3 ("kunit: add debugfs /sys/kernel/debug/kunit//results display") Signed-off-by: Florian Schmaus Reviewed-by: Martin Kaiser Reviewed-by: David Gow Signed-off-by: Shuah Khan --- include/kunit/test.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/kunit/test.h b/include/kunit/test.h index 9cd1594ab697..ce0573e196ce 100644 --- a/include/kunit/test.h +++ b/include/kunit/test.h @@ -613,6 +613,7 @@ unsigned long kunit_vm_mmap(struct kunit *test, struct file *file, unsigned long offset); void kunit_cleanup(struct kunit *test); +void kunit_free_boot_suites(void); void __printf(2, 3) kunit_log_append(struct string_stream *log, const char *fmt, ...); -- cgit v1.2.3 From 07548b04dc36678898f1d1274c2e1731ce264701 Mon Sep 17 00:00:00 2001 From: Vivek Aknurwar Date: Wed, 6 May 2026 11:38:46 -0700 Subject: dt-bindings: interconnect: qcom: document the RPMh NoC for Hawi SoC Document the RPMh Network-On-Chip interconnect for the Qualcomm Hawi SoC. Reviewed-by: Mike Tipton Reviewed-by: Krzysztof Kozlowski Signed-off-by: Vivek Aknurwar Link: https://patch.msgid.link/20260506-icc-hawi-v4-1-35447fdc482b@oss.qualcomm.com Signed-off-by: Georgi Djakov --- include/dt-bindings/interconnect/qcom,hawi-rpmh.h | 165 ++++++++++++++++++++++ 1 file changed, 165 insertions(+) create mode 100644 include/dt-bindings/interconnect/qcom,hawi-rpmh.h (limited to 'include') diff --git a/include/dt-bindings/interconnect/qcom,hawi-rpmh.h b/include/dt-bindings/interconnect/qcom,hawi-rpmh.h new file mode 100644 index 000000000000..a8b649679846 --- /dev/null +++ b/include/dt-bindings/interconnect/qcom,hawi-rpmh.h @@ -0,0 +1,165 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef __DT_BINDINGS_INTERCONNECT_QCOM_HAWI_H +#define __DT_BINDINGS_INTERCONNECT_QCOM_HAWI_H + +#define MASTER_QSPI_0 0 +#define MASTER_QUP_2 1 +#define MASTER_QUP_3 2 +#define MASTER_QUP_4 3 +#define MASTER_CRYPTO 4 +#define MASTER_IPA 5 +#define MASTER_QUP_1 6 +#define MASTER_SOCCP_PROC 7 +#define MASTER_QDSS_ETR 8 +#define MASTER_QDSS_ETR_1 9 +#define MASTER_SDCC_2 10 +#define MASTER_SDCC_4 11 +#define MASTER_UFS_MEM 12 +#define MASTER_USB3 13 +#define SLAVE_A1NOC_SNOC 14 + +#define MASTER_DDR_EFF_VETO 0 +#define MASTER_QUP_CORE_0 1 +#define MASTER_QUP_CORE_1 2 +#define MASTER_QUP_CORE_2 3 +#define MASTER_QUP_CORE_3 4 +#define MASTER_QUP_CORE_4 5 +#define SLAVE_DDR_EFF_VETO 6 +#define SLAVE_QUP_CORE_0 7 +#define SLAVE_QUP_CORE_1 8 +#define SLAVE_QUP_CORE_2 9 +#define SLAVE_QUP_CORE_3 10 +#define SLAVE_QUP_CORE_4 11 + +#define MASTER_GEM_NOC_CNOC 0 +#define MASTER_GEM_NOC_PCIE_SNOC 1 +#define SLAVE_AOSS 2 +#define SLAVE_IPA_CFG 3 +#define SLAVE_IPC_ROUTER_FENCE 4 +#define SLAVE_SOCCP 5 +#define SLAVE_TME_CFG 6 +#define SLAVE_CNOC_CFG 7 +#define SLAVE_DDRSS_CFG 8 +#define SLAVE_IMEM 9 +#define SLAVE_PCIE_0 10 +#define SLAVE_PCIE_1 11 + +#define MASTER_GIC 0 +#define MASTER_GPU_TCU 1 +#define MASTER_SYS_TCU 2 +#define MASTER_APPSS_PROC 3 +#define MASTER_GFX3D 4 +#define MASTER_LPASS_GEM_NOC 5 +#define MASTER_MSS_PROC 6 +#define MASTER_MNOC_HF_MEM_NOC 7 +#define MASTER_MNOC_SF_MEM_NOC 8 +#define MASTER_COMPUTE_NOC 9 +#define MASTER_ANOC_PCIE_GEM_NOC 10 +#define MASTER_QPACE 11 +#define MASTER_SNOC_SF_MEM_NOC 12 +#define MASTER_WLAN_Q6 13 +#define SLAVE_GEM_NOC_CNOC 14 +#define SLAVE_LLCC 15 +#define SLAVE_MEM_NOC_PCIE_SNOC 16 + +#define MASTER_LPIAON_NOC_LLCLPI_NOC 0 +#define SLAVE_LPASS_LPI_CC 1 +#define SLAVE_LLCC_ISLAND 2 +#define SLAVE_SERVICE_LLCLPI_NOC 3 +#define SLAVE_SERVICE_LLCLPI_NOC_CHIPCX 4 + +#define MASTER_LPIAON_NOC 0 +#define SLAVE_LPASS_GEM_NOC 1 + +#define MASTER_LPASS_LPINOC 0 +#define SLAVE_LPIAON_NOC_LLCLPI_NOC 1 +#define SLAVE_LPIAON_NOC_LPASS_AG_NOC 2 + +#define MASTER_LPASS_PROC 0 +#define SLAVE_LPICX_NOC_LPIAON_NOC 1 + +#define MASTER_LLCC 0 +#define MASTER_DDR_RT 1 +#define SLAVE_EBI1 2 +#define SLAVE_DDR_RT 3 + +#define MASTER_CAMNOC_HF 0 +#define MASTER_CAMNOC_NRT_ICP_SF 1 +#define MASTER_CAMNOC_RT_CDM_SF 2 +#define MASTER_CAMNOC_SF 3 +#define MASTER_MDP 4 +#define MASTER_MDSS_DCP 5 +#define MASTER_CDSP_HCP 6 +#define MASTER_VIDEO_CV_PROC 7 +#define MASTER_VIDEO_EVA 8 +#define MASTER_VIDEO_MVP 9 +#define MASTER_VIDEO_V_PROC 10 +#define SLAVE_MNOC_HF_MEM_NOC 11 +#define SLAVE_MNOC_SF_MEM_NOC 12 + +#define MASTER_CDSP_PROC 0 +#define SLAVE_CDSP_MEM_NOC 1 + +#define MASTER_PCIE_ANOC_CFG 0 +#define MASTER_PCIE_0 1 +#define MASTER_PCIE_1 2 +#define SLAVE_ANOC_PCIE_GEM_NOC 3 +#define SLAVE_SERVICE_PCIE_ANOC 4 + +#define MASTER_CFG_CENTER 0 +#define MASTER_CFG_EAST 1 +#define MASTER_CFG_MM 2 +#define MASTER_CFG_NORTH 3 +#define MASTER_CFG_SOUTH 4 +#define MASTER_CFG_SOUTHWEST 5 +#define SLAVE_AHB2PHY_SOUTH 6 +#define SLAVE_BOOT_ROM 7 +#define SLAVE_CAMERA_CFG 8 +#define SLAVE_CLK_CTL 9 +#define SLAVE_CRYPTO_CFG 10 +#define SLAVE_DISPLAY_CFG 11 +#define SLAVE_EVA_CFG 12 +#define SLAVE_GFX3D_CFG 13 +#define SLAVE_I2C 14 +#define SLAVE_IMEM_CFG 15 +#define SLAVE_IPC_ROUTER_CFG 16 +#define SLAVE_IRIS_CFG 17 +#define SLAVE_CNOC_MSS 18 +#define SLAVE_PCIE_0_CFG 19 +#define SLAVE_PCIE_1_CFG 20 +#define SLAVE_PRNG 21 +#define SLAVE_QSPI_0 22 +#define SLAVE_QUP_1 23 +#define SLAVE_QUP_2 24 +#define SLAVE_QUP_3 25 +#define SLAVE_QUP_4 26 +#define SLAVE_SDCC_2 27 +#define SLAVE_SDCC_4 28 +#define SLAVE_TLMM 29 +#define SLAVE_UFS_MEM_CFG 30 +#define SLAVE_USB3 31 +#define SLAVE_VSENSE_CTRL_CFG 32 +#define SLAVE_PCIE_ANOC_CFG 33 +#define SLAVE_QDSS_CFG 34 +#define SLAVE_QDSS_STM 35 +#define SLAVE_TCSR 36 +#define SLAVE_TCU 37 + +#define MASTER_CNOC_STARDUST 0 +#define SLAVE_STARDUST_CENTER_CFG 1 +#define SLAVE_STARDUST_EAST_CFG 2 +#define SLAVE_STARDUST_MM_CFG 3 +#define SLAVE_STARDUST_NORTH_CFG 4 +#define SLAVE_STARDUST_SOUTH_CFG 5 +#define SLAVE_STARDUST_SOUTHWEST_CFG 6 + +#define MASTER_A1NOC_SNOC 0 +#define MASTER_APSS_NOC 1 +#define MASTER_CNOC_SNOC 2 +#define SLAVE_SNOC_GEM_NOC_SF 3 + +#endif -- cgit v1.2.3 From 9764e731ef6abacdfc00d914061d4d900e302670 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Thu, 30 Apr 2026 15:41:59 +0100 Subject: tracepoint: Add lockdep rcu_is_watching() check to trace_##name##_enabled() The trace_##name##_enabled() static call branch is used when work needs to be done for a tracepoint. It allows that work to be skipped when the tracepoint is not active and still uses the static_branch() of the tracepoint to keep performance. Tracepoints themselves require being called in "RCU watching" locations otherwise races can occur that corrupts things. In order to make sure lockdep triggers at tracepoint locations, the lockdep checks are added to the tracepoint calling location and trigger even if the tracepoint is not enabled. This is done because a poorly placed tracepoint may never be detected if it is never enabled when lockdep is enabled. As trace_##name##_enabled() also prevents the lockdep checks when the tracepoint is disabled add lockdep checks to that as well so that if one is placed in a location that RCU is not watching, it will trigger a lockdep splat even when the tracepoint is not enabled. Cc: Vineeth Pillai (Google) Cc: Mathieu Desnoyers Cc: Masami Hiramatsu Cc: Peter Zijlstra Link: https://patch.msgid.link/20260430144159.10985-1-devnexen@gmail.com Signed-off-by: David Carlier [ Updated the change log ] Signed-off-by: Steven Rostedt --- include/linux/tracepoint.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h index 763eea4d80d8..c29fc57392bb 100644 --- a/include/linux/tracepoint.h +++ b/include/linux/tracepoint.h @@ -293,6 +293,10 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p) static inline bool \ trace_##name##_enabled(void) \ { \ + if (IS_ENABLED(CONFIG_LOCKDEP)) { \ + WARN_ONCE(!rcu_is_watching(), \ + "RCU not watching for tracepoint"); \ + } \ return static_branch_unlikely(&__tracepoint_##name.key);\ } -- cgit v1.2.3 From 04fcbcf2dfe6a3fadc50b0f925c0b757386b82f8 Mon Sep 17 00:00:00 2001 From: Qian-Yu Lin Date: Sat, 2 May 2026 15:55:34 +0800 Subject: tracing: Remove local variable for argument detection from trace_printk() The trace_printk() macro uses a local variable _______STR to detect whether variadic arguments are present. This name can shadow outer variables. Replace the local variable with sizeof applied directly to the stringified arguments: if (sizeof __stringify((__VA_ARGS__)) > 3) This eliminates the shadowing risk entirely without introducing any additional includes or local variables. Verified with objdump on samples/trace_printk that all four cases branch correctly: __trace_bputs, __trace_puts, __trace_bprintk, and __trace_printk. Link: https://patch.msgid.link/20260502075535.34997-1-tiffany019230@gmail.com Suggested-by: David Laight Signed-off-by: Qian-Yu Lin Signed-off-by: Steven Rostedt --- include/linux/trace_printk.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/trace_printk.h b/include/linux/trace_printk.h index 2670ec7f4262..3d54f440dccf 100644 --- a/include/linux/trace_printk.h +++ b/include/linux/trace_printk.h @@ -86,8 +86,7 @@ do { \ #define trace_printk(fmt, ...) \ do { \ - char _______STR[] = __stringify((__VA_ARGS__)); \ - if (sizeof(_______STR) > 3) \ + if (sizeof __stringify((__VA_ARGS__)) > 3) \ do_trace_printk(fmt, ##__VA_ARGS__); \ else \ trace_puts(fmt); \ -- cgit v1.2.3 From b3efa3b2bb72ec3e3a13f2cca8bd3e855eec539d Mon Sep 17 00:00:00 2001 From: Martin Kaiser Date: Thu, 7 May 2026 10:09:06 +0200 Subject: tracefs: Fix typo in a comment of eventfs_callback() kerneldoc Fix a typo "evetnfs files" to "eventfs files" in a comment. Cc: Masami Hiramatsu Link: https://patch.msgid.link/20260507081041.885781-2-martin@kaiser.cx Signed-off-by: Martin Kaiser Signed-off-by: Steven Rostedt --- include/linux/tracefs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/tracefs.h b/include/linux/tracefs.h index d03f74658716..bc354d340046 100644 --- a/include/linux/tracefs.h +++ b/include/linux/tracefs.h @@ -30,7 +30,7 @@ struct eventfs_file; * @data: data to pass to the created file ops * @fops: the file operations of the created file * - * The evetnfs files are dynamically created. The struct eventfs_entry array + * The eventfs files are dynamically created. The struct eventfs_entry array * is passed to eventfs_create_dir() or eventfs_create_events_dir() that will * be used to create the files within those directories. When a lookup * or access to a file within the directory is made, the struct eventfs_entry -- cgit v1.2.3 From 44d16948af557175e37209349cf3aa87167b823f Mon Sep 17 00:00:00 2001 From: Vijendar Mukunda Date: Thu, 7 May 2026 23:41:29 +0530 Subject: include: sound: add register header file for acp7.x series Add acp register header file for ACP7.x(7.D/7.E/7.F) variants. Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20260507181251.20594-2-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown --- include/sound/acp7x_chip_offset_byte.h | 2519 ++++++++++++++++++++++++++++++++ 1 file changed, 2519 insertions(+) create mode 100644 include/sound/acp7x_chip_offset_byte.h (limited to 'include') diff --git a/include/sound/acp7x_chip_offset_byte.h b/include/sound/acp7x_chip_offset_byte.h new file mode 100644 index 000000000000..772c3d38cb8d --- /dev/null +++ b/include/sound/acp7x_chip_offset_byte.h @@ -0,0 +1,2519 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * AMD ACP 7.x Register Documentation + * + * Copyright 2026 Advanced Micro Devices, Inc. + */ + +#ifndef _acp_ip_7x_chip_OFFSET_BYTE_H +#define _acp_ip_7x_chip_OFFSET_BYTE_H + +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_1 0x000C00 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_1 0x000C04 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_2 0x000C08 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_2 0x000C0C +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_3 0x000C10 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_3 0x000C14 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_4 0x000C18 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_4 0x000C1C +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_5 0x000C20 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_5 0x000C24 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_6 0x000C28 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_6 0x000C2C +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_7 0x000C30 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_7 0x000C34 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_8 0x000C38 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_8 0x000C3C +#define ACPAXI2AXI_ATU_CTRL 0x000C40 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_9 0x000C44 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_9 0x000C48 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_10 0x000C4C +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_10 0x000C50 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_11 0x000C54 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_11 0x000C58 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_12 0x000C5C +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_12 0x000C60 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_13 0x000C64 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_13 0x000C68 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_14 0x000C6C +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_14 0x000C70 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_15 0x000C74 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_15 0x000C78 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_16 0x000C7C +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_16 0x000C80 + +#define ACP_SOFT_RESET 0x001000 +#define ACP_CONTROL 0x001004 +#define ACP_STATUS 0x001008 +#define ACP_DYNAMIC_CG_MASTER_CONTROL 0x001010 +#define ACP_ZSC_DSP_CTRL 0x001014 +#define ACP_ZSC_STS 0x001018 +#define ACP_PGFSM_CONTROL 0x001024 +#define ACP_PGFSM_STATUS 0x001028 +#define ACP_CLKMUX_SEL 0x00102C +#define ACP_SW_48MHz_CLK_SEL 0x001030 +#define ACP_AUDIO_CLK_SEL 0x001038 +#define ACP_PDM_CORE_CLK_SEL 0x00103C + +#define ACP_PME_EN 0x001400 +#define ACP_DEVICE_STATE 0x001404 +#define SW_DEVICE_STATE 0x001430 +#define ACP_PIN_CONFIG 0x001440 +#define ACP_PAD_PULLUP_CTRL 0x001444 +#define ACP_PAD_PULLDOWN_CTRL 0x001448 +#define ACP_PAD_DRIVE_STRENGTH_CTRL 0x00144C +#define ACP_PAD_SCHMEN_CTRL 0x001450 +#define ACP_SW_PAD_KEEPER_EN 0x001454 +#define ACP_SW_WAKE_EN 0x001458 +#define ACP_I2S_WAKE_EN 0x00145C +#define ACP_ACLK_AUDIOCLK_CTRL 0x001464 +#define ACP_PAD_DISABLE_OE_CTRL 0x001468 +#define ACP_SW0_PME_STS 0x001474 +#define ACP_SW1_PME_STS 0x001478 +#define ACP_SW2_PME_STS 0x00147C +#define ACP_SW3_PME_STS 0x001480 +#define ACP_I2S_PME_STS 0x001484 +#define ACP_TDM_LOOPBACK_EN 0x001488 + +#define ACP_FUTURE_REG_ACLK_0 0x0018E0 +#define ACP_FUTURE_REG_ACLK_1 0x0018E4 +#define ACP_FUTURE_REG_ACLK_2 0x0018E8 +#define ACP_FUTURE_REG_ACLK_3 0x0018EC +#define ACP_FUTURE_REG_ACLK_4 0x0018F0 +#define ACP_AXI2DAGB_SEM_0 0x0018F4 + +#define ACP_EXTERNAL_INTR_ENB 0x001A00 +#define ACP_EXTERNAL_INTR_CNTL 0x001A04 +#define ACP_EXTERNAL_INTR_CNTL1 0x001A08 +#define ACP_EXTERNAL_SW0_INTR_CNTL 0x001A0C +#define ACP_EXTERNAL_SW1_INTR_CNTL 0x001A10 +#define ACP_EXTERNAL_SW2_INTR_CNTL 0x001A14 +#define ACP_EXTERNAL_SW3_INTR_CNTL 0x001A18 +#define ACP_EXTERNAL_INTR_STAT 0x001A1C +#define ACP_EXTERNAL_INTR_STAT1 0x001A20 +#define ACP_EXTERNAL_SW0_INTR_STAT 0x001A24 +#define ACP_EXTERNAL_SW1_INTR_STAT 0x001A28 +#define ACP_EXTERNAL_SW2_INTR_STAT 0x001A2C +#define ACP_EXTERNAL_SW3_INTR_STAT 0x001A30 +#define ACP_ERROR_STATUS 0x001A88 +#define ACP_ERROR_INTR_CTRL1 0x001AA4 +#define ACP_P1_FUTURE_REG_ACLK_0 0x001AB4 +#define ACP_P1_FUTURE_REG_ACLK_1 0x001AB8 + +#define ACP_I2S_TDM0_RX_RINGBUFADDR 0x002000 +#define ACP_I2S_TDM0_RX_RINGBUFSIZE 0x002004 +#define ACP_I2S_TDM0_RX_LINKPOSITIONCNTR 0x002008 +#define ACP_I2S_TDM0_RX_FIFOADDR 0x00200C +#define ACP_I2S_TDM0_RX_FIFOSIZE 0x002010 +#define ACP_I2S_TDM0_RX_DMA_SIZE 0x002014 +#define ACP_I2S_TDM0_RX_LINEARPOSITIONCNTR_HIGH 0x002018 +#define ACP_I2S_TDM0_RX_LINEARPOSITIONCNTR_LOW 0x00201C +#define ACP_I2S_TDM0_RX_INTR_WATERMARK_SIZE 0x002020 +#define ACP_I2S_TDM0_TX_RINGBUFADDR 0x002024 +#define ACP_I2S_TDM0_TX_RINGBUFSIZE 0x002028 +#define ACP_I2S_TDM0_TX_LINKPOSITIONCNTR 0x00202C +#define ACP_I2S_TDM0_TX_FIFOADDR 0x002030 +#define ACP_I2S_TDM0_TX_FIFOSIZE 0x002034 +#define ACP_I2S_TDM0_TX_DMA_SIZE 0x002038 +#define ACP_I2S_TDM0_TX_LINEARPOSITIONCNTR_HIGH 0x00203C +#define ACP_I2S_TDM0_TX_LINEARPOSITIONCNTR_LOW 0x002040 +#define ACP_I2S_TDM0_TX_INTR_WATERMARK_SIZE 0x002044 +#define ACP_I2S_TDM0_POS_TRACK_TX_CTRL 0x002048 +#define ACP_I2S_TDM0_TX_DMA_POS 0x00204C +#define ACP_I2S_TDM0_POS_TRACK_I2S_RX_CTRL 0x002050 +#define ACP_I2S_TDM0_RX_DMA_POS 0x002054 +#define ACP_I2S_TDM0_ERROR_STATUS 0x002058 +#define ACP_I2S_TDM0_ERROR_MASK 0x00205C +#define ACP_I2S_TDM0_IER 0x002100 +#define ACP_I2S_TDM0_IRER 0x002104 +#define ACP_I2S_TDM0_RXFRMT 0x002108 +#define ACP_I2S_TDM0_ITER 0x00210C +#define ACP_I2S_TDM0_TXFRMT 0x002110 +#define ACP_I2S_TDM0_MSTRCLKGEN 0x002114 +#define ACP_I2S_TDM0_OUTPUT_SPLIT_EN 0x002118 +#define ACP_I2S_TDM0_WALLCLK_MISC 0x00211C +#define ACP_I2S_TDM0_WALL_CLK_COUNTER 0x002120 +#define ACP_I2S_TDM_REFCLKGEN 0x002124 +#define ACP_TDM_SYNCEN 0x002128 +#define ACP_TDM_LRCLK_START 0x00212C +#define ACP_I2S_TDM0_WALLCLK_INTR_CNTL 0x002130 + +#define ACP_I2S_TDM1_RX_RINGBUFADDR 0x002200 +#define ACP_I2S_TDM1_RX_RINGBUFSIZE 0x002204 +#define ACP_I2S_TDM1_RX_LINKPOSITIONCNTR 0x002208 +#define ACP_I2S_TDM1_RX_FIFOADDR 0x00220C +#define ACP_I2S_TDM1_RX_FIFOSIZE 0x002210 +#define ACP_I2S_TDM1_RX_DMA_SIZE 0x002214 +#define ACP_I2S_TDM1_RX_LINEARPOSITIONCNTR_HIGH 0x002218 +#define ACP_I2S_TDM1_RX_LINEARPOSITIONCNTR_LOW 0x00221C +#define ACP_I2S_TDM1_RX_INTR_WATERMARK_SIZE 0x002220 +#define ACP_I2S_TDM1_TX_RINGBUFADDR 0x002224 +#define ACP_I2S_TDM1_TX_RINGBUFSIZE 0x002228 +#define ACP_I2S_TDM1_TX_LINKPOSITIONCNTR 0x00222C +#define ACP_I2S_TDM1_TX_FIFOADDR 0x002230 +#define ACP_I2S_TDM1_TX_FIFOSIZE 0x002234 +#define ACP_I2S_TDM1_TX_DMA_SIZE 0x002238 +#define ACP_I2S_TDM1_TX_LINEARPOSITIONCNTR_HIGH 0x00223C +#define ACP_I2S_TDM1_TX_LINEARPOSITIONCNTR_LOW 0x002240 +#define ACP_I2S_TDM1_TX_INTR_WATERMARK_SIZE 0x002244 +#define ACP_I2S_TDM1_POS_TRACK_TX_CTRL 0x002248 +#define ACP_I2S_TDM1_TX_DMA_POS 0x00224C +#define ACP_I2S_TDM1_POS_TRACK_I2S_RX_CTRL 0x002250 +#define ACP_I2S_TDM1_RX_DMA_POS 0x002254 +#define ACP_I2S_TDM1_ERROR_STATUS 0x002258 +#define ACP_I2S_TDM1_ERROR_MASK 0x00225C +#define ACP_I2S_TDM1_IER 0x002300 +#define ACP_I2S_TDM1_IRER 0x002304 +#define ACP_I2S_TDM1_RXFRMT 0x002308 +#define ACP_I2S_TDM1_ITER 0x00230C +#define ACP_I2S_TDM1_TXFRMT 0x002310 +#define ACP_I2S_TDM1_MSTRCLKGEN 0x002314 +#define ACP_I2S_TDM1_OUTPUT_SPLIT_EN 0x002318 +#define ACP_I2S_TDM1_WALLCLK_MISC 0x00231C +#define ACP_I2S_TDM1_WALL_CLK_COUNTER 0x002320 +#define ACP_I2S_TDM1_WALLCLK_INTR_CNTL 0x002330 + +#define ACP_I2S_TDM2_RX_RINGBUFADDR 0x002400 +#define ACP_I2S_TDM2_RX_RINGBUFSIZE 0x002404 +#define ACP_I2S_TDM2_RX_LINKPOSITIONCNTR 0x002408 +#define ACP_I2S_TDM2_RX_FIFOADDR 0x00240C +#define ACP_I2S_TDM2_RX_FIFOSIZE 0x002410 +#define ACP_I2S_TDM2_RX_DMA_SIZE 0x002414 +#define ACP_I2S_TDM2_RX_LINEARPOSITIONCNTR_HIGH 0x002418 +#define ACP_I2S_TDM2_RX_LINEARPOSITIONCNTR_LOW 0x00241C +#define ACP_I2S_TDM2_RX_INTR_WATERMARK_SIZE 0x002420 +#define ACP_I2S_TDM2_TX_RINGBUFADDR 0x002424 +#define ACP_I2S_TDM2_TX_RINGBUFSIZE 0x002428 +#define ACP_I2S_TDM2_TX_LINKPOSITIONCNTR 0x00242C +#define ACP_I2S_TDM2_TX_FIFOADDR 0x002430 +#define ACP_I2S_TDM2_TX_FIFOSIZE 0x002434 +#define ACP_I2S_TDM2_TX_DMA_SIZE 0x002438 +#define ACP_I2S_TDM2_TX_LINEARPOSITIONCNTR_HIGH 0x00243C +#define ACP_I2S_TDM2_TX_LINEARPOSITIONCNTR_LOW 0x002440 +#define ACP_I2S_TDM2_TX_INTR_WATERMARK_SIZE 0x002444 +#define ACP_I2S_TDM2_POS_TRACK_TX_CTRL 0x002448 +#define ACP_I2S_TDM2_TX_DMA_POS 0x00244C +#define ACP_I2S_TDM2_POS_TRACK_I2S_RX_CTRL 0x002450 +#define ACP_I2S_TDM2_RX_DMA_POS 0x002454 +#define ACP_I2S_TDM2_ERROR_STATUS 0x002458 +#define ACP_I2S_TDM2_ERROR_MASK 0x00245C +#define ACP_I2S_TDM2_IER 0x002500 +#define ACP_I2S_TDM2_IRER 0x002504 +#define ACP_I2S_TDM2_RXFRMT 0x002508 +#define ACP_I2S_TDM2_ITER 0x00250C +#define ACP_I2S_TDM2_TXFRMT 0x002510 +#define ACP_I2S_TDM2_MSTRCLKGEN 0x002514 +#define ACP_I2S_TDM2_OUTPUT_SPLIT_EN 0x002518 +#define ACP_I2S_TDM2_WALLCLK_MISC 0x00251C +#define ACP_I2S_TDM2_WALL_CLK_COUNTER 0x002520 +#define ACP_I2S_TDM2_WALLCLK_INTR_CNTL 0x002530 + +#define ACP_SW_CTRL_COUNT 0x004D00 +#define ACP_SW_GSYNC_EN 0x004D04 +#define ACP_SW_GSYNC_EN_PRE_SELECT 0x004D08 +#define ACP_SW_GSYNC_DP_EN 0x004D0C + +#define ACP_SW0_GLOBAL_CAPABILITIES 0x004E00 +#define ACP_SW0_RX_DMA0_RINGBUFADDR 0x004E04 +#define ACP_SW0_RX_DMA0_RINGBUFSIZE 0x004E08 +#define ACP_SW0_RX_DMA0_FIFOADDR 0x004E0C +#define ACP_SW0_RX_DMA0_FIFOSIZE 0x004E10 +#define ACP_SW0_RX_DMA0_BURST_SIZE 0x004E14 +#define ACP_SW0_RX_DMA0_LINKPOSITIONCNTR 0x004E18 +#define ACP_SW0_RX_DMA0_LINEARPOSITIONCNTR_HIGH 0x004E1C +#define ACP_SW0_RX_DMA0_LINEARPOSITIONCNTR_LOW 0x004E20 +#define ACP_SW0_RX_DMA0_INTR_WATERMARK_SIZE 0x004E24 +#define ACP_SW0_RX_DMA1_RINGBUFADDR 0x004E28 +#define ACP_SW0_RX_DMA1_RINGBUFSIZE 0x004E2C +#define ACP_SW0_RX_DMA1_FIFOADDR 0x004E30 +#define ACP_SW0_RX_DMA1_FIFOSIZE 0x004E34 +#define ACP_SW0_RX_DMA1_BURST_SIZE 0x004E38 +#define ACP_SW0_RX_DMA1_LINKPOSITIONCNTR 0x004E3C +#define ACP_SW0_RX_DMA1_LINEARPOSITIONCNTR_HIGH 0x004E40 +#define ACP_SW0_RX_DMA1_LINEARPOSITIONCNTR_LOW 0x004E44 +#define ACP_SW0_RX_DMA1_INTR_WATERMARK_SIZE 0x004E48 +#define ACP_SW0_RX_DMA2_RINGBUFADDR 0x004E4C +#define ACP_SW0_RX_DMA2_RINGBUFSIZE 0x004E50 +#define ACP_SW0_RX_DMA2_FIFOADDR 0x004E54 +#define ACP_SW0_RX_DMA2_FIFOSIZE 0x004E58 +#define ACP_SW0_RX_DMA2_BURST_SIZE 0x004E5C +#define ACP_SW0_RX_DMA2_LINKPOSITIONCNTR 0x004E60 +#define ACP_SW0_RX_DMA2_LINEARPOSITIONCNTR_HIGH 0x004E64 +#define ACP_SW0_RX_DMA2_LINEARPOSITIONCNTR_LOW 0x004E68 +#define ACP_SW0_RX_DMA2_INTR_WATERMARK_SIZE 0x004E6C +#define ACP_SW0_RX_DMA3_RINGBUFADDR 0x004E70 +#define ACP_SW0_RX_DMA3_RINGBUFSIZE 0x004E74 +#define ACP_SW0_RX_DMA3_FIFOADDR 0x004E78 +#define ACP_SW0_RX_DMA3_FIFOSIZE 0x004E7C +#define ACP_SW0_RX_DMA3_BURST_SIZE 0x004E80 +#define ACP_SW0_RX_DMA3_LINKPOSITIONCNTR 0x004E84 +#define ACP_SW0_RX_DMA3_LINEARPOSITIONCNTR_HIGH 0x004E88 +#define ACP_SW0_RX_DMA3_LINEARPOSITIONCNTR_LOW 0x004E8C +#define ACP_SW0_RX_DMA3_INTR_WATERMARK_SIZE 0x004E90 +#define ACP_SW0_RX_DMA4_RINGBUFADDR 0x004E94 +#define ACP_SW0_RX_DMA4_RINGBUFSIZE 0x004E98 +#define ACP_SW0_RX_DMA4_FIFOADDR 0x004E9C +#define ACP_SW0_RX_DMA4_FIFOSIZE 0x004EA0 +#define ACP_SW0_RX_DMA4_BURST_SIZE 0x004EA4 +#define ACP_SW0_RX_DMA4_LINKPOSITIONCNTR 0x004EA8 +#define ACP_SW0_RX_DMA4_LINEARPOSITIONCNTR_HIGH 0x004EAC +#define ACP_SW0_RX_DMA4_LINEARPOSITIONCNTR_LOW 0x004EB0 +#define ACP_SW0_RX_DMA4_INTR_WATERMARK_SIZE 0x004EB4 +#define ACP_SW0_RX_DMA5_RINGBUFADDR 0x004EB8 +#define ACP_SW0_RX_DMA5_RINGBUFSIZE 0x004EBC +#define ACP_SW0_RX_DMA5_FIFOADDR 0x004EC0 +#define ACP_SW0_RX_DMA5_FIFOSIZE 0x004EC4 +#define ACP_SW0_RX_DMA5_BURST_SIZE 0x004EC8 +#define ACP_SW0_RX_DMA5_LINKPOSITIONCNTR 0x004ECC +#define ACP_SW0_RX_DMA5_LINEARPOSITIONCNTR_HIGH 0x004ED0 +#define ACP_SW0_RX_DMA5_LINEARPOSITIONCNTR_LOW 0x004ED4 +#define ACP_SW0_RX_DMA5_INTR_WATERMARK_SIZE 0x004ED8 +#define ACP_SW0_RX_DMA6_RINGBUFADDR 0x004EDC +#define ACP_SW0_RX_DMA6_RINGBUFSIZE 0x004EE0 +#define ACP_SW0_RX_DMA6_FIFOADDR 0x004EE4 +#define ACP_SW0_RX_DMA6_FIFOSIZE 0x004EE8 +#define ACP_SW0_RX_DMA6_BURST_SIZE 0x004EEC +#define ACP_SW0_RX_DMA6_LINKPOSITIONCNTR 0x004EF0 +#define ACP_SW0_RX_DMA6_LINEARPOSITIONCNTR_HIGH 0x004EF4 +#define ACP_SW0_RX_DMA6_LINEARPOSITIONCNTR_LOW 0x004EF8 +#define ACP_SW0_RX_DMA6_INTR_WATERMARK_SIZE 0x004EFC +#define ACP_SW0_RX_DMA7_RINGBUFADDR 0x004F00 +#define ACP_SW0_RX_DMA7_RINGBUFSIZE 0x004F04 +#define ACP_SW0_RX_DMA7_FIFOADDR 0x004F08 +#define ACP_SW0_RX_DMA7_FIFOSIZE 0x004F0C +#define ACP_SW0_RX_DMA7_BURST_SIZE 0x004F10 +#define ACP_SW0_RX_DMA7_LINKPOSITIONCNTR 0x004F14 +#define ACP_SW0_RX_DMA7_LINEARPOSITIONCNTR_HIGH 0x004F18 +#define ACP_SW0_RX_DMA7_LINEARPOSITIONCNTR_LOW 0x004F1C +#define ACP_SW0_RX_DMA7_INTR_WATERMARK_SIZE 0x004F20 +#define ACP_SW0_TX_DMA0_RINGBUFADDR 0x004F24 +#define ACP_SW0_TX_DMA0_RINGBUFSIZE 0x004F28 +#define ACP_SW0_TX_DMA0_FIFOADDR 0x004F2C +#define ACP_SW0_TX_DMA0_FIFOSIZE 0x004F30 +#define ACP_SW0_TX_DMA0_BURST_SIZE 0x004F34 +#define ACP_SW0_TX_DMA0_LINKPOSITIONCNTR 0x004F38 +#define ACP_SW0_TX_DMA0_LINEARPOSITIONCNTR_HIGH 0x004F3C +#define ACP_SW0_TX_DMA0_LINEARPOSITIONCNTR_LOW 0x004F40 +#define ACP_SW0_TX_DMA0_INTR_WATERMARK_SIZE 0x004F44 +#define ACP_SW0_TX_DMA1_RINGBUFADDR 0x004F48 +#define ACP_SW0_TX_DMA1_RINGBUFSIZE 0x004F4C +#define ACP_SW0_TX_DMA1_FIFOADDR 0x004F50 +#define ACP_SW0_TX_DMA1_FIFOSIZE 0x004F54 +#define ACP_SW0_TX_DMA1_BURST_SIZE 0x004F58 +#define ACP_SW0_TX_DMA1_LINKPOSITIONCNTR 0x004F5C +#define ACP_SW0_TX_DMA1_LINEARPOSITIONCNTR_HIGH 0x004F60 +#define ACP_SW0_TX_DMA1_LINEARPOSITIONCNTR_LOW 0x004F64 +#define ACP_SW0_TX_DMA1_INTR_WATERMARK_SIZE 0x004F68 +#define ACP_SW0_TX_DMA2_RINGBUFADDR 0x004F6C +#define ACP_SW0_TX_DMA2_RINGBUFSIZE 0x004F70 +#define ACP_SW0_TX_DMA2_FIFOADDR 0x004F74 +#define ACP_SW0_TX_DMA2_FIFOSIZE 0x004F78 +#define ACP_SW0_TX_DMA2_BURST_SIZE 0x004F7C +#define ACP_SW0_TX_DMA2_LINKPOSITIONCNTR 0x004F80 +#define ACP_SW0_TX_DMA2_LINEARPOSITIONCNTR_HIGH 0x004F84 +#define ACP_SW0_TX_DMA2_LINEARPOSITIONCNTR_LOW 0x004F88 +#define ACP_SW0_TX_DMA2_INTR_WATERMARK_SIZE 0x004F8C +#define ACP_SW0_TX_DMA3_RINGBUFADDR 0x004F90 +#define ACP_SW0_TX_DMA3_RINGBUFSIZE 0x004F94 +#define ACP_SW0_TX_DMA3_FIFOADDR 0x004F98 +#define ACP_SW0_TX_DMA3_FIFOSIZE 0x004F9C +#define ACP_SW0_TX_DMA3_BURST_SIZE 0x004FA0 +#define ACP_SW0_TX_DMA3_LINKPOSITIONCNTR 0x004FA4 +#define ACP_SW0_TX_DMA3_LINEARPOSITIONCNTR_HIGH 0x004FA8 +#define ACP_SW0_TX_DMA3_LINEARPOSITIONCNTR_LOW 0x004FAC +#define ACP_SW0_TX_DMA3_INTR_WATERMARK_SIZE 0x004FB0 +#define ACP_SW0_TX_DMA4_RINGBUFADDR 0x004FB4 +#define ACP_SW0_TX_DMA4_RINGBUFSIZE 0x004FB8 +#define ACP_SW0_TX_DMA4_FIFOADDR 0x004FBC +#define ACP_SW0_TX_DMA4_FIFOSIZE 0x004FC0 +#define ACP_SW0_TX_DMA4_BURST_SIZE 0x004FC4 +#define ACP_SW0_TX_DMA4_LINKPOSITIONCNTR 0x004FC8 +#define ACP_SW0_TX_DMA4_LINEARPOSITIONCNTR_HIGH 0x004FCC +#define ACP_SW0_TX_DMA4_LINEARPOSITIONCNTR_LOW 0x004FD0 +#define ACP_SW0_TX_DMA4_INTR_WATERMARK_SIZE 0x004FD4 +#define ACP_SW0_TX_DMA5_RINGBUFADDR 0x004FD8 +#define ACP_SW0_TX_DMA5_RINGBUFSIZE 0x004FDC +#define ACP_SW0_TX_DMA5_FIFOADDR 0x004FE0 +#define ACP_SW0_TX_DMA5_FIFOSIZE 0x004FE4 +#define ACP_SW0_TX_DMA5_BURST_SIZE 0x004FE8 +#define ACP_SW0_TX_DMA5_LINKPOSITIONCNTR 0x004FEC +#define ACP_SW0_TX_DMA5_LINEARPOSITIONCNTR_HIGH 0x004FF0 +#define ACP_SW0_TX_DMA5_LINEARPOSITIONCNTR_LOW 0x004FF4 +#define ACP_SW0_TX_DMA5_INTR_WATERMARK_SIZE 0x004FF8 +#define ACP_SW0_TX_DMA6_RINGBUFADDR 0x004FFC +#define ACP_SW0_TX_DMA6_RINGBUFSIZE 0x005000 +#define ACP_SW0_TX_DMA6_FIFOADDR 0x005004 +#define ACP_SW0_TX_DMA6_FIFOSIZE 0x005008 +#define ACP_SW0_TX_DMA6_BURST_SIZE 0x00500C +#define ACP_SW0_TX_DMA6_LINKPOSITIONCNTR 0x005010 +#define ACP_SW0_TX_DMA6_LINEARPOSITIONCNTR_HIGH 0x005014 +#define ACP_SW0_TX_DMA6_LINEARPOSITIONCNTR_LOW 0x005018 +#define ACP_SW0_TX_DMA6_INTR_WATERMARK_SIZE 0x00501C +#define ACP_SW0_TX_DMA7_RINGBUFADDR 0x005020 +#define ACP_SW0_TX_DMA7_RINGBUFSIZE 0x005024 +#define ACP_SW0_TX_DMA7_FIFOADDR 0x005028 +#define ACP_SW0_TX_DMA7_FIFOSIZE 0x00502C +#define ACP_SW0_TX_DMA7_BURST_SIZE 0x005030 +#define ACP_SW0_TX_DMA7_LINKPOSITIONCNTR 0x005034 +#define ACP_SW0_TX_DMA7_LINEARPOSITIONCNTR_HIGH 0x005038 +#define ACP_SW0_TX_DMA7_LINEARPOSITIONCNTR_LOW 0x00503C +#define ACP_SW0_TX_DMA7_INTR_WATERMARK_SIZE 0x005040 +#define ACP_SW0_RX_DMA0_POS_TRACK 0x005044 +#define ACP_SW0_RX_DMA0_POS 0x005048 +#define ACP_SW0_RX_DMA1_POS_TRACK 0x00504C +#define ACP_SW0_RX_DMA1_POS 0x005050 +#define ACP_SW0_RX_DMA2_POS_TRACK 0x005054 +#define ACP_SW0_RX_DMA2_POS 0x005058 +#define ACP_SW0_RX_DMA3_POS_TRACK 0x00505C +#define ACP_SW0_RX_DMA3_POS 0x005060 +#define ACP_SW0_RX_DMA4_POS_TRACK 0x005064 +#define ACP_SW0_RX_DMA4_POS 0x005068 +#define ACP_SW0_RX_DMA5_POS_TRACK 0x00506C +#define ACP_SW0_RX_DMA5_POS 0x005070 +#define ACP_SW0_RX_DMA6_POS_TRACK 0x005074 +#define ACP_SW0_RX_DMA6_POS 0x005078 +#define ACP_SW0_RX_DMA7_POS_TRACK 0x00507C +#define ACP_SW0_RX_DMA7_POS 0x005080 +#define ACP_SW0_TX_DMA0_POS_TRACK 0x005084 +#define ACP_SW0_TX_DMA0_POS 0x005088 +#define ACP_SW0_TX_DMA1_POS_TRACK 0x00508C +#define ACP_SW0_TX_DMA1_POS 0x005090 +#define ACP_SW0_TX_DMA2_POS_TRACK 0x005094 +#define ACP_SW0_TX_DMA2_POS 0x005098 +#define ACP_SW0_TX_DMA3_POS_TRACK 0x00509C +#define ACP_SW0_TX_DMA3_POS 0x0050A0 +#define ACP_SW0_TX_DMA4_POS_TRACK 0x0050A4 +#define ACP_SW0_TX_DMA4_POS 0x0050A8 +#define ACP_SW0_TX_DMA5_POS_TRACK 0x0050AC +#define ACP_SW0_TX_DMA5_POS 0x0050B0 +#define ACP_SW0_TX_DMA6_POS_TRACK 0x0050B4 +#define ACP_SW0_TX_DMA6_POS 0x0050B8 +#define ACP_SW0_TX_DMA7_POS_TRACK 0x0050BC +#define ACP_SW0_TX_DMA7_POS 0x0050C0 +#define ACP_SW0_FIFO_ERROR_REASON 0x0050C4 +#define ACP_SW0_FIFO_ERROR_INTR_MASK 0x0050C8 +#define ACP_SW0_ERROR_REASON1 0x0050CC +#define ACP_SW0_ERROR_INTR_MASK1 0x0050D0 +#define ACP_SW0_ERROR_REASON2 0x0050D4 +#define ACP_SW0_ERROR_INTR_MASK2 0x0050D8 + +#define ACP_SW0_CORB_BASE_ADDRESS 0x005100 +#define ACP_SW0_CORB_WRITE_POINTER 0x005104 +#define ACP_SW0_CORB_READ_POINTER 0x005108 +#define ACP_SW0_CORB_CONTROL 0x00510C +#define ACP_SW0_CORB_SIZE 0x005114 +#define ACP_SW0_RIRB_BASE_ADDRESS 0x005118 +#define ACP_SW0_RIRB_WRITE_POINTER 0x00511C +#define ACP_SW0_RIRB_RESPONSE_INTERRUPT_COUNT 0x005120 +#define ACP_SW0_RIRB_CONTROL 0x005124 +#define ACP_SW0_RIRB_SIZE 0x005128 +#define ACP_SW0_RIRB_FIFO_MIN_THDL 0x00512C +#define ACP_SW0_IMM_CMD_UPPER_WORD 0x005130 +#define ACP_SW0_IMM_CMD_LOWER_QWORD 0x005134 +#define ACP_SW0_IMM_RESP_UPPER_WORD 0x005138 +#define ACP_SW0_IMM_RESP_LOWER_QWORD 0x00513C +#define ACP_SW0_IMM_CMD_STS 0x005140 +#define ACP_SW0_BRA_BASE_ADDRESS 0x005144 +#define ACP_SW0_BRA_TRANSFER_SIZE 0x005148 +#define ACP_SW0_BRA_DMA_BUSY 0x00514C +#define ACP_SW0_BRA_RESP 0x005150 +#define ACP_SW0_BRA_RESP_FRAME_ADDR 0x005154 +#define ACP_SW0_BRA_CURRENT_TRANSFER_SIZE 0x005158 +#define ACP_SW0_STATE_CHANGE_STATUS_0TO7 0x00515C +#define ACP_SW0_STATE_CHANGE_STATUS_8TO11 0x005160 +#define ACP_SW0_STATE_CHANGE_STATUS_MASK_0TO7 0x005164 +#define ACP_SW0_STATE_CHANGE_STATUS_MASK_8TO11 0x005168 +#define ACP_SW0_CLK_FREQUENCY_CTRL_BANK0 0x00516C +#define ACP_SW0_CLK_FREQUENCY_CTRL_BANK1 0x005170 +#define ACP_SW0_ERROR_INTR_MASK 0x005174 +#define ACP_SW0_PHY_TEST_MODE_DATA_OFF 0x005178 +#define ACP_SW0_DATA_TO_PDM_EN 0x00517C + +#define ACP_SW0_EN 0x005200 +#define ACP_SW0_EN_STATUS 0x005204 +#define ACP_SW0_FRAMESIZE_BANK0 0x005208 +#define ACP_SW0_FRAMESIZE_BANK1 0x00520C +#define ACP_SW0_SSP_COUNTER 0x005210 +#define ACP_SW0_TX_STREAM0_EN 0x005214 +#define ACP_SW0_TX_STREAM1_EN 0x005218 +#define ACP_SW0_TX_STREAM2_EN 0x00521C +#define ACP_SW0_TX_STREAM3_EN 0x005220 +#define ACP_SW0_TX_STREAM4_EN 0x005224 +#define ACP_SW0_TX_STREAM5_EN 0x005228 +#define ACP_SW0_TX_STREAM6_EN 0x00522C +#define ACP_SW0_TX_STREAM7_EN 0x005230 +#define ACP_SW0_TX_STREAM0_EN_STATUS 0x005234 +#define ACP_SW0_TX_STREAM1_EN_STATUS 0x005238 +#define ACP_SW0_TX_STREAM2_EN_STATUS 0x00523C +#define ACP_SW0_TX_STREAM3_EN_STATUS 0x005240 +#define ACP_SW0_TX_STREAM4_EN_STATUS 0x005244 +#define ACP_SW0_TX_STREAM5_EN_STATUS 0x005248 +#define ACP_SW0_TX_STREAM6_EN_STATUS 0x00524C +#define ACP_SW0_TX_STREAM7_EN_STATUS 0x005250 +#define ACP_SW0_TX_DP0_FRAME_FORMAT 0x005254 +#define ACP_SW0_TX_DP1_FRAME_FORMAT 0x005258 +#define ACP_SW0_TX_DP2_FRAME_FORMAT 0x00525C +#define ACP_SW0_TX_DP3_FRAME_FORMAT 0x005260 +#define ACP_SW0_TX_DP4_FRAME_FORMAT 0x005264 +#define ACP_SW0_TX_DP5_FRAME_FORMAT 0x005268 +#define ACP_SW0_TX_DP6_FRAME_FORMAT 0x00526C +#define ACP_SW0_TX_DP7_FRAME_FORMAT 0x005270 +#define ACP_SW0_TX_DP0_0_SAMPLEINTERVAL_BANK0 0x005280 +#define ACP_SW0_TX_DP0_0_HCTRL_BANK0 0x005284 +#define ACP_SW0_TX_DP0_0_HCTRL_OFFSET_BANK0 0x005288 +#define ACP_SW0_TX_DP0_0_LANE_CTRL_BANK0 0x00528C +#define ACP_SW0_TX_DP0_0_CHANNEL_ENABLE_BANK0 0x005290 +#define ACP_SW0_TX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005294 +#define ACP_SW0_TX_DP0_0_SAMPLEINTERVAL_BANK1 0x005298 +#define ACP_SW0_TX_DP0_0_HCTRL_BANK1 0x00529C +#define ACP_SW0_TX_DP0_0_HCTRL_OFFSET_BANK1 0x0052A0 +#define ACP_SW0_TX_DP0_0_LANE_CTRL_BANK1 0x0052A4 +#define ACP_SW0_TX_DP0_0_CHANNEL_ENABLE_BANK1 0x0052A8 +#define ACP_SW0_TX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0052AC +#define ACP_SW0_TX_DP0_1_SAMPLEINTERVAL_BANK0 0x0052B0 +#define ACP_SW0_TX_DP0_1_HCTRL_BANK0 0x0052B4 +#define ACP_SW0_TX_DP0_1_HCTRL_OFFSET_BANK0 0x0052B8 +#define ACP_SW0_TX_DP0_1_LANE_CTRL_BANK0 0x0052BC +#define ACP_SW0_TX_DP0_1_CHANNEL_ENABLE_BANK0 0x0052C0 +#define ACP_SW0_TX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0052C4 +#define ACP_SW0_TX_DP0_1_SAMPLEINTERVAL_BANK1 0x0052C8 +#define ACP_SW0_TX_DP0_1_HCTRL_BANK1 0x0052CC +#define ACP_SW0_TX_DP0_1_HCTRL_OFFSET_BANK1 0x0052D0 +#define ACP_SW0_TX_DP0_1_LANE_CTRL_BANK1 0x0052D4 +#define ACP_SW0_TX_DP0_1_CHANNEL_ENABLE_BANK1 0x0052D8 +#define ACP_SW0_TX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0052DC +#define ACP_SW0_TX_DP0_2_SAMPLEINTERVAL_BANK0 0x0052E0 +#define ACP_SW0_TX_DP0_2_HCTRL_BANK0 0x0052E4 +#define ACP_SW0_TX_DP0_2_HCTRL_OFFSET_BANK0 0x0052E8 +#define ACP_SW0_TX_DP0_2_LANE_CTRL_BANK0 0x0052EC +#define ACP_SW0_TX_DP0_2_CHANNEL_ENABLE_BANK0 0x0052F0 +#define ACP_SW0_TX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0052F4 +#define ACP_SW0_TX_DP0_2_SAMPLEINTERVAL_BANK1 0x0052F8 +#define ACP_SW0_TX_DP0_2_HCTRL_BANK1 0x0052FC +#define ACP_SW0_TX_DP0_2_HCTRL_OFFSET_BANK1 0x005300 +#define ACP_SW0_TX_DP0_2_LANE_CTRL_BANK1 0x005304 +#define ACP_SW0_TX_DP0_2_CHANNEL_ENABLE_BANK1 0x005308 +#define ACP_SW0_TX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00530C +#define ACP_SW0_TX_DP0_3_SAMPLEINTERVAL_BANK0 0x005310 +#define ACP_SW0_TX_DP0_3_HCTRL_BANK0 0x005314 +#define ACP_SW0_TX_DP0_3_HCTRL_OFFSET_BANK0 0x005318 +#define ACP_SW0_TX_DP0_3_LANE_CTRL_BANK0 0x00531C +#define ACP_SW0_TX_DP0_3_CHANNEL_ENABLE_BANK0 0x005320 +#define ACP_SW0_TX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005324 +#define ACP_SW0_TX_DP0_3_SAMPLEINTERVAL_BANK1 0x005328 +#define ACP_SW0_TX_DP0_3_HCTRL_BANK1 0x00532C +#define ACP_SW0_TX_DP0_3_HCTRL_OFFSET_BANK1 0x005330 +#define ACP_SW0_TX_DP0_3_LANE_CTRL_BANK1 0x005334 +#define ACP_SW0_TX_DP0_3_CHANNEL_ENABLE_BANK1 0x005338 +#define ACP_SW0_TX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00533C +#define ACP_SW0_TX_DP1_SAMPLEINTERVAL_BANK0 0x005370 +#define ACP_SW0_TX_DP1_HCTRL_BANK0 0x005374 +#define ACP_SW0_TX_DP1_HCTRL_OFFSET_BANK0 0x005378 +#define ACP_SW0_TX_DP1_LANE_CTRL_BANK0 0x00537C +#define ACP_SW0_TX_DP1_CHANNEL_ENABLE_BANK0 0x005380 +#define ACP_SW0_TX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005384 +#define ACP_SW0_TX_DP1_SAMPLEINTERVAL_BANK1 0x005388 +#define ACP_SW0_TX_DP1_HCTRL_BANK1 0x00538C +#define ACP_SW0_TX_DP1_HCTRL_OFFSET_BANK1 0x005390 +#define ACP_SW0_TX_DP1_LANE_CTRL_BANK1 0x005394 +#define ACP_SW0_TX_DP1_CHANNEL_ENABLE_BANK1 0x005398 +#define ACP_SW0_TX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00539C +#define ACP_SW0_TX_DP2_SAMPLEINTERVAL_BANK0 0x0053A0 +#define ACP_SW0_TX_DP2_HCTRL_BANK0 0x0053A4 +#define ACP_SW0_TX_DP2_HCTRL_OFFSET_BANK0 0x0053A8 +#define ACP_SW0_TX_DP2_LANE_CTRL_BANK0 0x0053AC +#define ACP_SW0_TX_DP2_CHANNEL_ENABLE_BANK0 0x0053B0 +#define ACP_SW0_TX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0053B4 +#define ACP_SW0_TX_DP2_SAMPLEINTERVAL_BANK1 0x0053B8 +#define ACP_SW0_TX_DP2_HCTRL_BANK1 0x0053BC +#define ACP_SW0_TX_DP2_HCTRL_OFFSET_BANK1 0x0053C0 +#define ACP_SW0_TX_DP2_LANE_CTRL_BANK1 0x0053C4 +#define ACP_SW0_TX_DP2_CHANNEL_ENABLE_BANK1 0x0053C8 +#define ACP_SW0_TX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0053CC +#define ACP_SW0_TX_DP3_SAMPLEINTERVAL_BANK0 0x0053D0 +#define ACP_SW0_TX_DP3_HCTRL_BANK0 0x0053D4 +#define ACP_SW0_TX_DP3_HCTRL_OFFSET_BANK0 0x0053D8 +#define ACP_SW0_TX_DP3_LANE_CTRL_BANK0 0x0053DC +#define ACP_SW0_TX_DP3_CHANNEL_ENABLE_BANK0 0x0053E0 +#define ACP_SW0_TX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0053E4 +#define ACP_SW0_TX_DP3_SAMPLEINTERVAL_BANK1 0x0053E8 +#define ACP_SW0_TX_DP3_HCTRL_BANK1 0x0053EC +#define ACP_SW0_TX_DP3_HCTRL_OFFSET_BANK1 0x0053F0 +#define ACP_SW0_TX_DP3_LANE_CTRL_BANK1 0x0053F4 +#define ACP_SW0_TX_DP3_CHANNEL_ENABLE_BANK1 0x0053F8 +#define ACP_SW0_TX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0053FC +#define ACP_SW0_TX_DP4_SAMPLEINTERVAL_BANK0 0x005400 +#define ACP_SW0_TX_DP4_HCTRL_BANK0 0x005404 +#define ACP_SW0_TX_DP4_HCTRL_OFFSET_BANK0 0x005408 +#define ACP_SW0_TX_DP4_LANE_CTRL_BANK0 0x00540C +#define ACP_SW0_TX_DP4_CHANNEL_ENABLE_BANK0 0x005410 +#define ACP_SW0_TX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005414 +#define ACP_SW0_TX_DP4_SAMPLEINTERVAL_BANK1 0x005418 +#define ACP_SW0_TX_DP4_HCTRL_BANK1 0x00541C +#define ACP_SW0_TX_DP4_HCTRL_OFFSET_BANK1 0x005420 +#define ACP_SW0_TX_DP4_LANE_CTRL_BANK1 0x005424 +#define ACP_SW0_TX_DP4_CHANNEL_ENABLE_BANK1 0x005428 +#define ACP_SW0_TX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00542C +#define ACP_SW0_TX_DP5_SAMPLEINTERVAL_BANK0 0x005430 +#define ACP_SW0_TX_DP5_HCTRL_BANK0 0x005434 +#define ACP_SW0_TX_DP5_HCTRL_OFFSET_BANK0 0x005438 +#define ACP_SW0_TX_DP5_LANE_CTRL_BANK0 0x00543C +#define ACP_SW0_TX_DP5_CHANNEL_ENABLE_BANK0 0x005440 +#define ACP_SW0_TX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005444 +#define ACP_SW0_TX_DP5_SAMPLEINTERVAL_BANK1 0x005448 +#define ACP_SW0_TX_DP5_HCTRL_BANK1 0x00544C +#define ACP_SW0_TX_DP5_HCTRL_OFFSET_BANK1 0x005450 +#define ACP_SW0_TX_DP5_LANE_CTRL_BANK1 0x005454 +#define ACP_SW0_TX_DP5_CHANNEL_ENABLE_BANK1 0x005458 +#define ACP_SW0_TX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00545C +#define ACP_SW0_TX_DP6_SAMPLEINTERVAL_BANK0 0x005460 +#define ACP_SW0_TX_DP6_HCTRL_BANK0 0x005464 +#define ACP_SW0_TX_DP6_HCTRL_OFFSET_BANK0 0x005468 +#define ACP_SW0_TX_DP6_LANE_CTRL_BANK0 0x00546C +#define ACP_SW0_TX_DP6_CHANNEL_ENABLE_BANK0 0x005470 +#define ACP_SW0_TX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005474 +#define ACP_SW0_TX_DP6_SAMPLEINTERVAL_BANK1 0x005478 +#define ACP_SW0_TX_DP6_HCTRL_BANK1 0x00547C +#define ACP_SW0_TX_DP6_HCTRL_OFFSET_BANK1 0x005480 +#define ACP_SW0_TX_DP6_LANE_CTRL_BANK1 0x005484 +#define ACP_SW0_TX_DP6_CHANNEL_ENABLE_BANK1 0x005488 +#define ACP_SW0_TX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00548C +#define ACP_SW0_TX_DP7_SAMPLEINTERVAL_BANK0 0x005490 +#define ACP_SW0_TX_DP7_HCTRL_BANK0 0x005494 +#define ACP_SW0_TX_DP7_HCTRL_OFFSET_BANK0 0x005498 +#define ACP_SW0_TX_DP7_LANE_CTRL_BANK0 0x00549C +#define ACP_SW0_TX_DP7_CHANNEL_ENABLE_BANK0 0x0054A0 +#define ACP_SW0_TX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0054A4 +#define ACP_SW0_TX_DP7_SAMPLEINTERVAL_BANK1 0x0054A8 +#define ACP_SW0_TX_DP7_HCTRL_BANK1 0x0054AC +#define ACP_SW0_TX_DP7_HCTRL_OFFSET_BANK1 0x0054B0 +#define ACP_SW0_TX_DP7_LANE_CTRL_BANK1 0x0054B4 +#define ACP_SW0_TX_DP7_CHANNEL_ENABLE_BANK1 0x0054B8 +#define ACP_SW0_TX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0054BC +#define ACP_SW0_RX_STREAM0_EN 0x005514 +#define ACP_SW0_RX_STREAM1_EN 0x005518 +#define ACP_SW0_RX_STREAM2_EN 0x00551C +#define ACP_SW0_RX_STREAM3_EN 0x005520 +#define ACP_SW0_RX_STREAM4_EN 0x005524 +#define ACP_SW0_RX_STREAM5_EN 0x005528 +#define ACP_SW0_RX_STREAM6_EN 0x00552C +#define ACP_SW0_RX_STREAM7_EN 0x005530 +#define ACP_SW0_RX_STREAM0_EN_STATUS 0x005534 +#define ACP_SW0_RX_STREAM1_EN_STATUS 0x005538 +#define ACP_SW0_RX_STREAM2_EN_STATUS 0x00553C +#define ACP_SW0_RX_STREAM3_EN_STATUS 0x005540 +#define ACP_SW0_RX_STREAM4_EN_STATUS 0x005544 +#define ACP_SW0_RX_STREAM5_EN_STATUS 0x005548 +#define ACP_SW0_RX_STREAM6_EN_STATUS 0x00554C +#define ACP_SW0_RX_STREAM7_EN_STATUS 0x005550 +#define ACP_SW0_RX_DP0_FRAME_FORMAT 0x005554 +#define ACP_SW0_RX_DP1_FRAME_FORMAT 0x005558 +#define ACP_SW0_RX_DP2_FRAME_FORMAT 0x00555C +#define ACP_SW0_RX_DP3_FRAME_FORMAT 0x005560 +#define ACP_SW0_RX_DP4_FRAME_FORMAT 0x005564 +#define ACP_SW0_RX_DP5_FRAME_FORMAT 0x005568 +#define ACP_SW0_RX_DP6_FRAME_FORMAT 0x00556C +#define ACP_SW0_RX_DP7_FRAME_FORMAT 0x005570 +#define ACP_SW0_RX_DP0_0_SAMPLEINTERVAL_BANK0 0x005580 +#define ACP_SW0_RX_DP0_0_HCTRL_BANK0 0x005584 +#define ACP_SW0_RX_DP0_0_HCTRL_OFFSET_BANK0 0x005588 +#define ACP_SW0_RX_DP0_0_LANE_CTRL_BANK0 0x00558C +#define ACP_SW0_RX_DP0_0_CHANNEL_ENABLE_BANK0 0x005590 +#define ACP_SW0_RX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005594 +#define ACP_SW0_RX_DP0_0_SAMPLEINTERVAL_BANK1 0x005598 +#define ACP_SW0_RX_DP0_0_HCTRL_BANK1 0x00559C +#define ACP_SW0_RX_DP0_0_HCTRL_OFFSET_BANK1 0x0055A0 +#define ACP_SW0_RX_DP0_0_LANE_CTRL_BANK1 0x0055A4 +#define ACP_SW0_RX_DP0_0_CHANNEL_ENABLE_BANK1 0x0055A8 +#define ACP_SW0_RX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0055AC +#define ACP_SW0_RX_DP0_1_SAMPLEINTERVAL_BANK0 0x0055B0 +#define ACP_SW0_RX_DP0_1_HCTRL_BANK0 0x0055B4 +#define ACP_SW0_RX_DP0_1_HCTRL_OFFSET_BANK0 0x0055B8 +#define ACP_SW0_RX_DP0_1_LANE_CTRL_BANK0 0x0055BC +#define ACP_SW0_RX_DP0_1_CHANNEL_ENABLE_BANK0 0x0055C0 +#define ACP_SW0_RX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0055C4 +#define ACP_SW0_RX_DP0_1_SAMPLEINTERVAL_BANK1 0x0055C8 +#define ACP_SW0_RX_DP0_1_HCTRL_BANK1 0x0055CC +#define ACP_SW0_RX_DP0_1_HCTRL_OFFSET_BANK1 0x0055D0 +#define ACP_SW0_RX_DP0_1_LANE_CTRL_BANK1 0x0055D4 +#define ACP_SW0_RX_DP0_1_CHANNEL_ENABLE_BANK1 0x0055D8 +#define ACP_SW0_RX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0055DC +#define ACP_SW0_RX_DP0_2_SAMPLEINTERVAL_BANK0 0x0055E0 +#define ACP_SW0_RX_DP0_2_HCTRL_BANK0 0x0055E4 +#define ACP_SW0_RX_DP0_2_HCTRL_OFFSET_BANK0 0x0055E8 +#define ACP_SW0_RX_DP0_2_LANE_CTRL_BANK0 0x0055EC +#define ACP_SW0_RX_DP0_2_CHANNEL_ENABLE_BANK0 0x0055F0 +#define ACP_SW0_RX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0055F4 +#define ACP_SW0_RX_DP0_2_SAMPLEINTERVAL_BANK1 0x0055F8 +#define ACP_SW0_RX_DP0_2_HCTRL_BANK1 0x0055FC +#define ACP_SW0_RX_DP0_2_HCTRL_OFFSET_BANK1 0x005600 +#define ACP_SW0_RX_DP0_2_LANE_CTRL_BANK1 0x005604 +#define ACP_SW0_RX_DP0_2_CHANNEL_ENABLE_BANK1 0x005608 +#define ACP_SW0_RX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00560C +#define ACP_SW0_RX_DP0_3_SAMPLEINTERVAL_BANK0 0x005610 +#define ACP_SW0_RX_DP0_3_HCTRL_BANK0 0x005614 +#define ACP_SW0_RX_DP0_3_HCTRL_OFFSET_BANK0 0x005618 +#define ACP_SW0_RX_DP0_3_LANE_CTRL_BANK0 0x00561C +#define ACP_SW0_RX_DP0_3_CHANNEL_ENABLE_BANK0 0x005620 +#define ACP_SW0_RX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005624 +#define ACP_SW0_RX_DP0_3_SAMPLEINTERVAL_BANK1 0x005628 +#define ACP_SW0_RX_DP0_3_HCTRL_BANK1 0x00562C +#define ACP_SW0_RX_DP0_3_HCTRL_OFFSET_BANK1 0x005630 +#define ACP_SW0_RX_DP0_3_LANE_CTRL_BANK1 0x005634 +#define ACP_SW0_RX_DP0_3_CHANNEL_ENABLE_BANK1 0x005638 +#define ACP_SW0_RX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00563C +#define ACP_SW0_RX_DP1_SAMPLEINTERVAL_BANK0 0x005670 +#define ACP_SW0_RX_DP1_HCTRL_BANK0 0x005674 +#define ACP_SW0_RX_DP1_HCTRL_OFFSET_BANK0 0x005678 +#define ACP_SW0_RX_DP1_LANE_CTRL_BANK0 0x00567C +#define ACP_SW0_RX_DP1_CHANNEL_ENABLE_BANK0 0x005680 +#define ACP_SW0_RX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005684 +#define ACP_SW0_RX_DP1_SAMPLEINTERVAL_BANK1 0x005688 +#define ACP_SW0_RX_DP1_HCTRL_BANK1 0x00568C +#define ACP_SW0_RX_DP1_HCTRL_OFFSET_BANK1 0x005690 +#define ACP_SW0_RX_DP1_LANE_CTRL_BANK1 0x005694 +#define ACP_SW0_RX_DP1_CHANNEL_ENABLE_BANK1 0x005698 +#define ACP_SW0_RX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00569C +#define ACP_SW0_RX_DP2_SAMPLEINTERVAL_BANK0 0x0056A0 +#define ACP_SW0_RX_DP2_HCTRL_BANK0 0x0056A4 +#define ACP_SW0_RX_DP2_HCTRL_OFFSET_BANK0 0x0056A8 +#define ACP_SW0_RX_DP2_LANE_CTRL_BANK0 0x0056AC +#define ACP_SW0_RX_DP2_CHANNEL_ENABLE_BANK0 0x0056B0 +#define ACP_SW0_RX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0056B4 +#define ACP_SW0_RX_DP2_SAMPLEINTERVAL_BANK1 0x0056B8 +#define ACP_SW0_RX_DP2_HCTRL_BANK1 0x0056BC +#define ACP_SW0_RX_DP2_HCTRL_OFFSET_BANK1 0x0056C0 +#define ACP_SW0_RX_DP2_LANE_CTRL_BANK1 0x0056C4 +#define ACP_SW0_RX_DP2_CHANNEL_ENABLE_BANK1 0x0056C8 +#define ACP_SW0_RX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0056CC +#define ACP_SW0_RX_DP3_SAMPLEINTERVAL_BANK0 0x0056D0 +#define ACP_SW0_RX_DP3_HCTRL_BANK0 0x0056D4 +#define ACP_SW0_RX_DP3_HCTRL_OFFSET_BANK0 0x0056D8 +#define ACP_SW0_RX_DP3_LANE_CTRL_BANK0 0x0056DC +#define ACP_SW0_RX_DP3_CHANNEL_ENABLE_BANK0 0x0056E0 +#define ACP_SW0_RX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0056E4 +#define ACP_SW0_RX_DP3_SAMPLEINTERVAL_BANK1 0x0056E8 +#define ACP_SW0_RX_DP3_HCTRL_BANK1 0x0056EC +#define ACP_SW0_RX_DP3_HCTRL_OFFSET_BANK1 0x0056F0 +#define ACP_SW0_RX_DP3_LANE_CTRL_BANK1 0x0056F4 +#define ACP_SW0_RX_DP3_CHANNEL_ENABLE_BANK1 0x0056F8 +#define ACP_SW0_RX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0056FC +#define ACP_SW0_RX_DP4_SAMPLEINTERVAL_BANK0 0x005700 +#define ACP_SW0_RX_DP4_HCTRL_BANK0 0x005704 +#define ACP_SW0_RX_DP4_HCTRL_OFFSET_BANK0 0x005708 +#define ACP_SW0_RX_DP4_LANE_CTRL_BANK0 0x00570C +#define ACP_SW0_RX_DP4_CHANNEL_ENABLE_BANK0 0x005710 +#define ACP_SW0_RX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005714 +#define ACP_SW0_RX_DP4_SAMPLEINTERVAL_BANK1 0x005718 +#define ACP_SW0_RX_DP4_HCTRL_BANK1 0x00571C +#define ACP_SW0_RX_DP4_HCTRL_OFFSET_BANK1 0x005720 +#define ACP_SW0_RX_DP4_LANE_CTRL_BANK1 0x005724 +#define ACP_SW0_RX_DP4_CHANNEL_ENABLE_BANK1 0x005728 +#define ACP_SW0_RX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00572C +#define ACP_SW0_RX_DP5_SAMPLEINTERVAL_BANK0 0x005730 +#define ACP_SW0_RX_DP5_HCTRL_BANK0 0x005734 +#define ACP_SW0_RX_DP5_HCTRL_OFFSET_BANK0 0x005738 +#define ACP_SW0_RX_DP5_LANE_CTRL_BANK0 0x00573C +#define ACP_SW0_RX_DP5_CHANNEL_ENABLE_BANK0 0x005740 +#define ACP_SW0_RX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005744 +#define ACP_SW0_RX_DP5_SAMPLEINTERVAL_BANK1 0x005748 +#define ACP_SW0_RX_DP5_HCTRL_BANK1 0x00574C +#define ACP_SW0_RX_DP5_HCTRL_OFFSET_BANK1 0x005750 +#define ACP_SW0_RX_DP5_LANE_CTRL_BANK1 0x005754 +#define ACP_SW0_RX_DP5_CHANNEL_ENABLE_BANK1 0x005758 +#define ACP_SW0_RX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00575C +#define ACP_SW0_RX_DP6_SAMPLEINTERVAL_BANK0 0x005760 +#define ACP_SW0_RX_DP6_HCTRL_BANK0 0x005764 +#define ACP_SW0_RX_DP6_HCTRL_OFFSET_BANK0 0x005768 +#define ACP_SW0_RX_DP6_LANE_CTRL_BANK0 0x00576C +#define ACP_SW0_RX_DP6_CHANNEL_ENABLE_BANK0 0x005770 +#define ACP_SW0_RX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK0 0x005774 +#define ACP_SW0_RX_DP6_SAMPLEINTERVAL_BANK1 0x005778 +#define ACP_SW0_RX_DP6_HCTRL_BANK1 0x00577C +#define ACP_SW0_RX_DP6_HCTRL_OFFSET_BANK1 0x005780 +#define ACP_SW0_RX_DP6_LANE_CTRL_BANK1 0x005784 +#define ACP_SW0_RX_DP6_CHANNEL_ENABLE_BANK1 0x005788 +#define ACP_SW0_RX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00578C +#define ACP_SW0_RX_DP7_SAMPLEINTERVAL_BANK0 0x005790 +#define ACP_SW0_RX_DP7_HCTRL_BANK0 0x005794 +#define ACP_SW0_RX_DP7_HCTRL_OFFSET_BANK0 0x005798 +#define ACP_SW0_RX_DP7_LANE_CTRL_BANK0 0x00579C +#define ACP_SW0_RX_DP7_CHANNEL_ENABLE_BANK0 0x0057A0 +#define ACP_SW0_RX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0057A4 +#define ACP_SW0_RX_DP7_SAMPLEINTERVAL_BANK1 0x0057A8 +#define ACP_SW0_RX_DP7_HCTRL_BANK1 0x0057AC +#define ACP_SW0_RX_DP7_HCTRL_OFFSET_BANK1 0x0057B0 +#define ACP_SW0_RX_DP7_LANE_CTRL_BANK1 0x0057B4 +#define ACP_SW0_RX_DP7_CHANNEL_ENABLE_BANK1 0x0057B8 +#define ACP_SW0_RX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0057BC +#define ACP_SW0_BPT_PORT_EN 0x0057C0 +#define ACP_SW0_BPT_PORT_EN_STATUS 0x0057C4 +#define ACP_SW0_BPT_PORT_FRAME_FORMAT 0x0057C8 +#define ACP_SW0_BPT_PORT_SAMPLEINTERVAL_BANK0 0x0057CC +#define ACP_SW0_BPT_PORT_HCTRL_BANK0 0x0057D0 +#define ACP_SW0_BPT_PORT_OFFSET_BANK0 0x0057D4 +#define ACP_SW0_BPT_PORT_LANE_SELECT_BANK0 0x0057D8 +#define ACP_SW0_BPT_PORT_CHANNEL_ENABLE_BANK0 0x0057DC +#define ACP_SW0_BPT_PORT_SAMPLEINTERVAL_BANK1 0x0057E0 +#define ACP_SW0_BPT_PORT_HCTRL_BANK1 0x0057E4 +#define ACP_SW0_BPT_PORT_OFFSET_BANK1 0x0057E8 +#define ACP_SW0_BPT_PORT_LANE_SELECT_BANK1 0x0057EC +#define ACP_SW0_BPT_PORT_CHANNEL_ENABLE_BANK1 0x0057F0 +#define ACP_SW0_BPT_PORT_FIRST_BYTE_ADDR 0x0057F4 +#define ACP_SW0_CLK_RESUME_CTRL 0x0057F8 +#define ACP_SW0_CLK_RESUME_DELAY_CNTR 0x0057FC +#define ACP_SW0_BUS_RESET_CTRL 0x005800 +#define ACP_SW0_PRBS_ERR_STATUS 0x005804 +#define ACP_SW0_WALLCLK_MISC 0x005808 +#define ACP_SW0_WALL_CLK_COUNTER 0x00580C +#define ACP_SW0_PING_STATUS_REGISTER_LOW 0x005810 +#define ACP_SW0_PING_STATUS_REGISTER_HIGH 0x005814 +#define ACP_SW0_PING_STATUS_CURRENT_BANK_SEL 0x005818 +#define ACP_SW0_TZD_CHANGE 0x00581C +#define ACP_SW0_WALLCLK_INTR_CNTL 0x005820 + +#define ACP_SW1_GLOBAL_CAPABILITIES 0x006E00 +#define ACP_SW1_RX_DMA0_RINGBUFADDR 0x006E04 +#define ACP_SW1_RX_DMA0_RINGBUFSIZE 0x006E08 +#define ACP_SW1_RX_DMA0_FIFOADDR 0x006E0C +#define ACP_SW1_RX_DMA0_FIFOSIZE 0x006E10 +#define ACP_SW1_RX_DMA0_BURST_SIZE 0x006E14 +#define ACP_SW1_RX_DMA0_LINKPOSITIONCNTR 0x006E18 +#define ACP_SW1_RX_DMA0_LINEARPOSITIONCNTR_HIGH 0x006E1C +#define ACP_SW1_RX_DMA0_LINEARPOSITIONCNTR_LOW 0x006E20 +#define ACP_SW1_RX_DMA0_INTR_WATERMARK_SIZE 0x006E24 +#define ACP_SW1_RX_DMA1_RINGBUFADDR 0x006E28 +#define ACP_SW1_RX_DMA1_RINGBUFSIZE 0x006E2C +#define ACP_SW1_RX_DMA1_FIFOADDR 0x006E30 +#define ACP_SW1_RX_DMA1_FIFOSIZE 0x006E34 +#define ACP_SW1_RX_DMA1_BURST_SIZE 0x006E38 +#define ACP_SW1_RX_DMA1_LINKPOSITIONCNTR 0x006E3C +#define ACP_SW1_RX_DMA1_LINEARPOSITIONCNTR_HIGH 0x006E40 +#define ACP_SW1_RX_DMA1_LINEARPOSITIONCNTR_LOW 0x006E44 +#define ACP_SW1_RX_DMA1_INTR_WATERMARK_SIZE 0x006E48 +#define ACP_SW1_RX_DMA2_RINGBUFADDR 0x006E4C +#define ACP_SW1_RX_DMA2_RINGBUFSIZE 0x006E50 +#define ACP_SW1_RX_DMA2_FIFOADDR 0x006E54 +#define ACP_SW1_RX_DMA2_FIFOSIZE 0x006E58 +#define ACP_SW1_RX_DMA2_BURST_SIZE 0x006E5C +#define ACP_SW1_RX_DMA2_LINKPOSITIONCNTR 0x006E60 +#define ACP_SW1_RX_DMA2_LINEARPOSITIONCNTR_HIGH 0x006E64 +#define ACP_SW1_RX_DMA2_LINEARPOSITIONCNTR_LOW 0x006E68 +#define ACP_SW1_RX_DMA2_INTR_WATERMARK_SIZE 0x006E6C +#define ACP_SW1_RX_DMA3_RINGBUFADDR 0x006E70 +#define ACP_SW1_RX_DMA3_RINGBUFSIZE 0x006E74 +#define ACP_SW1_RX_DMA3_FIFOADDR 0x006E78 +#define ACP_SW1_RX_DMA3_FIFOSIZE 0x006E7C +#define ACP_SW1_RX_DMA3_BURST_SIZE 0x006E80 +#define ACP_SW1_RX_DMA3_LINKPOSITIONCNTR 0x006E84 +#define ACP_SW1_RX_DMA3_LINEARPOSITIONCNTR_HIGH 0x006E88 +#define ACP_SW1_RX_DMA3_LINEARPOSITIONCNTR_LOW 0x006E8C +#define ACP_SW1_RX_DMA3_INTR_WATERMARK_SIZE 0x006E90 +#define ACP_SW1_RX_DMA4_RINGBUFADDR 0x006E94 +#define ACP_SW1_RX_DMA4_RINGBUFSIZE 0x006E98 +#define ACP_SW1_RX_DMA4_FIFOADDR 0x006E9C +#define ACP_SW1_RX_DMA4_FIFOSIZE 0x006EA0 +#define ACP_SW1_RX_DMA4_BURST_SIZE 0x006EA4 +#define ACP_SW1_RX_DMA4_LINKPOSITIONCNTR 0x006EA8 +#define ACP_SW1_RX_DMA4_LINEARPOSITIONCNTR_HIGH 0x006EAC +#define ACP_SW1_RX_DMA4_LINEARPOSITIONCNTR_LOW 0x006EB0 +#define ACP_SW1_RX_DMA4_INTR_WATERMARK_SIZE 0x006EB4 +#define ACP_SW1_RX_DMA5_RINGBUFADDR 0x006EB8 +#define ACP_SW1_RX_DMA5_RINGBUFSIZE 0x006EBC +#define ACP_SW1_RX_DMA5_FIFOADDR 0x006EC0 +#define ACP_SW1_RX_DMA5_FIFOSIZE 0x006EC4 +#define ACP_SW1_RX_DMA5_BURST_SIZE 0x006EC8 +#define ACP_SW1_RX_DMA5_LINKPOSITIONCNTR 0x006ECC +#define ACP_SW1_RX_DMA5_LINEARPOSITIONCNTR_HIGH 0x006ED0 +#define ACP_SW1_RX_DMA5_LINEARPOSITIONCNTR_LOW 0x006ED4 +#define ACP_SW1_RX_DMA5_INTR_WATERMARK_SIZE 0x006ED8 +#define ACP_SW1_RX_DMA6_RINGBUFADDR 0x006EDC +#define ACP_SW1_RX_DMA6_RINGBUFSIZE 0x006EE0 +#define ACP_SW1_RX_DMA6_FIFOADDR 0x006EE4 +#define ACP_SW1_RX_DMA6_FIFOSIZE 0x006EE8 +#define ACP_SW1_RX_DMA6_BURST_SIZE 0x006EEC +#define ACP_SW1_RX_DMA6_LINKPOSITIONCNTR 0x006EF0 +#define ACP_SW1_RX_DMA6_LINEARPOSITIONCNTR_HIGH 0x006EF4 +#define ACP_SW1_RX_DMA6_LINEARPOSITIONCNTR_LOW 0x006EF8 +#define ACP_SW1_RX_DMA6_INTR_WATERMARK_SIZE 0x006EFC +#define ACP_SW1_RX_DMA7_RINGBUFADDR 0x006F00 +#define ACP_SW1_RX_DMA7_RINGBUFSIZE 0x006F04 +#define ACP_SW1_RX_DMA7_FIFOADDR 0x006F08 +#define ACP_SW1_RX_DMA7_FIFOSIZE 0x006F0C +#define ACP_SW1_RX_DMA7_BURST_SIZE 0x006F10 +#define ACP_SW1_RX_DMA7_LINKPOSITIONCNTR 0x006F14 +#define ACP_SW1_RX_DMA7_LINEARPOSITIONCNTR_HIGH 0x006F18 +#define ACP_SW1_RX_DMA7_LINEARPOSITIONCNTR_LOW 0x006F1C +#define ACP_SW1_RX_DMA7_INTR_WATERMARK_SIZE 0x006F20 +#define ACP_SW1_TX_DMA0_RINGBUFADDR 0x006F24 +#define ACP_SW1_TX_DMA0_RINGBUFSIZE 0x006F28 +#define ACP_SW1_TX_DMA0_FIFOADDR 0x006F2C +#define ACP_SW1_TX_DMA0_FIFOSIZE 0x006F30 +#define ACP_SW1_TX_DMA0_BURST_SIZE 0x006F34 +#define ACP_SW1_TX_DMA0_LINKPOSITIONCNTR 0x006F38 +#define ACP_SW1_TX_DMA0_LINEARPOSITIONCNTR_HIGH 0x006F3C +#define ACP_SW1_TX_DMA0_LINEARPOSITIONCNTR_LOW 0x006F40 +#define ACP_SW1_TX_DMA0_INTR_WATERMARK_SIZE 0x006F44 +#define ACP_SW1_TX_DMA1_RINGBUFADDR 0x006F48 +#define ACP_SW1_TX_DMA1_RINGBUFSIZE 0x006F4C +#define ACP_SW1_TX_DMA1_FIFOADDR 0x006F50 +#define ACP_SW1_TX_DMA1_FIFOSIZE 0x006F54 +#define ACP_SW1_TX_DMA1_BURST_SIZE 0x006F58 +#define ACP_SW1_TX_DMA1_LINKPOSITIONCNTR 0x006F5C +#define ACP_SW1_TX_DMA1_LINEARPOSITIONCNTR_HIGH 0x006F60 +#define ACP_SW1_TX_DMA1_LINEARPOSITIONCNTR_LOW 0x006F64 +#define ACP_SW1_TX_DMA1_INTR_WATERMARK_SIZE 0x006F68 +#define ACP_SW1_TX_DMA2_RINGBUFADDR 0x006F6C +#define ACP_SW1_TX_DMA2_RINGBUFSIZE 0x006F70 +#define ACP_SW1_TX_DMA2_FIFOADDR 0x006F74 +#define ACP_SW1_TX_DMA2_FIFOSIZE 0x006F78 +#define ACP_SW1_TX_DMA2_BURST_SIZE 0x006F7C +#define ACP_SW1_TX_DMA2_LINKPOSITIONCNTR 0x006F80 +#define ACP_SW1_TX_DMA2_LINEARPOSITIONCNTR_HIGH 0x006F84 +#define ACP_SW1_TX_DMA2_LINEARPOSITIONCNTR_LOW 0x006F88 +#define ACP_SW1_TX_DMA2_INTR_WATERMARK_SIZE 0x006F8C +#define ACP_SW1_TX_DMA3_RINGBUFADDR 0x006F90 +#define ACP_SW1_TX_DMA3_RINGBUFSIZE 0x006F94 +#define ACP_SW1_TX_DMA3_FIFOADDR 0x006F98 +#define ACP_SW1_TX_DMA3_FIFOSIZE 0x006F9C +#define ACP_SW1_TX_DMA3_BURST_SIZE 0x006FA0 +#define ACP_SW1_TX_DMA3_LINKPOSITIONCNTR 0x006FA4 +#define ACP_SW1_TX_DMA3_LINEARPOSITIONCNTR_HIGH 0x006FA8 +#define ACP_SW1_TX_DMA3_LINEARPOSITIONCNTR_LOW 0x006FAC +#define ACP_SW1_TX_DMA3_INTR_WATERMARK_SIZE 0x006FB0 +#define ACP_SW1_TX_DMA4_RINGBUFADDR 0x006FB4 +#define ACP_SW1_TX_DMA4_RINGBUFSIZE 0x006FB8 +#define ACP_SW1_TX_DMA4_FIFOADDR 0x006FBC +#define ACP_SW1_TX_DMA4_FIFOSIZE 0x006FC0 +#define ACP_SW1_TX_DMA4_BURST_SIZE 0x006FC4 +#define ACP_SW1_TX_DMA4_LINKPOSITIONCNTR 0x006FC8 +#define ACP_SW1_TX_DMA4_LINEARPOSITIONCNTR_HIGH 0x006FCC +#define ACP_SW1_TX_DMA4_LINEARPOSITIONCNTR_LOW 0x006FD0 +#define ACP_SW1_TX_DMA4_INTR_WATERMARK_SIZE 0x006FD4 +#define ACP_SW1_TX_DMA5_RINGBUFADDR 0x006FD8 +#define ACP_SW1_TX_DMA5_RINGBUFSIZE 0x006FDC +#define ACP_SW1_TX_DMA5_FIFOADDR 0x006FE0 +#define ACP_SW1_TX_DMA5_FIFOSIZE 0x006FE4 +#define ACP_SW1_TX_DMA5_BURST_SIZE 0x006FE8 +#define ACP_SW1_TX_DMA5_LINKPOSITIONCNTR 0x006FEC +#define ACP_SW1_TX_DMA5_LINEARPOSITIONCNTR_HIGH 0x006FF0 +#define ACP_SW1_TX_DMA5_LINEARPOSITIONCNTR_LOW 0x006FF4 +#define ACP_SW1_TX_DMA5_INTR_WATERMARK_SIZE 0x006FF8 +#define ACP_SW1_TX_DMA6_RINGBUFADDR 0x006FFC +#define ACP_SW1_TX_DMA6_RINGBUFSIZE 0x007000 +#define ACP_SW1_TX_DMA6_FIFOADDR 0x007004 +#define ACP_SW1_TX_DMA6_FIFOSIZE 0x007008 +#define ACP_SW1_TX_DMA6_BURST_SIZE 0x00700C +#define ACP_SW1_TX_DMA6_LINKPOSITIONCNTR 0x007010 +#define ACP_SW1_TX_DMA6_LINEARPOSITIONCNTR_HIGH 0x007014 +#define ACP_SW1_TX_DMA6_LINEARPOSITIONCNTR_LOW 0x007018 +#define ACP_SW1_TX_DMA6_INTR_WATERMARK_SIZE 0x00701C +#define ACP_SW1_TX_DMA7_RINGBUFADDR 0x007020 +#define ACP_SW1_TX_DMA7_RINGBUFSIZE 0x007024 +#define ACP_SW1_TX_DMA7_FIFOADDR 0x007028 +#define ACP_SW1_TX_DMA7_FIFOSIZE 0x00702C +#define ACP_SW1_TX_DMA7_BURST_SIZE 0x007030 +#define ACP_SW1_TX_DMA7_LINKPOSITIONCNTR 0x007034 +#define ACP_SW1_TX_DMA7_LINEARPOSITIONCNTR_HIGH 0x007038 +#define ACP_SW1_TX_DMA7_LINEARPOSITIONCNTR_LOW 0x00703C +#define ACP_SW1_TX_DMA7_INTR_WATERMARK_SIZE 0x007040 +#define ACP_SW1_RX_DMA0_POS_TRACK 0x007044 +#define ACP_SW1_RX_DMA0_POS 0x007048 +#define ACP_SW1_RX_DMA1_POS_TRACK 0x00704C +#define ACP_SW1_RX_DMA1_POS 0x007050 +#define ACP_SW1_RX_DMA2_POS_TRACK 0x007054 +#define ACP_SW1_RX_DMA2_POS 0x007058 +#define ACP_SW1_RX_DMA3_POS_TRACK 0x00705C +#define ACP_SW1_RX_DMA3_POS 0x007060 +#define ACP_SW1_RX_DMA4_POS_TRACK 0x007064 +#define ACP_SW1_RX_DMA4_POS 0x007068 +#define ACP_SW1_RX_DMA5_POS_TRACK 0x00706C +#define ACP_SW1_RX_DMA5_POS 0x007070 +#define ACP_SW1_RX_DMA6_POS_TRACK 0x007074 +#define ACP_SW1_RX_DMA6_POS 0x007078 +#define ACP_SW1_RX_DMA7_POS_TRACK 0x00707C +#define ACP_SW1_RX_DMA7_POS 0x007080 +#define ACP_SW1_TX_DMA0_POS_TRACK 0x007084 +#define ACP_SW1_TX_DMA0_POS 0x007088 +#define ACP_SW1_TX_DMA1_POS_TRACK 0x00708C +#define ACP_SW1_TX_DMA1_POS 0x007090 +#define ACP_SW1_TX_DMA2_POS_TRACK 0x007094 +#define ACP_SW1_TX_DMA2_POS 0x007098 +#define ACP_SW1_TX_DMA3_POS_TRACK 0x00709C +#define ACP_SW1_TX_DMA3_POS 0x0070A0 +#define ACP_SW1_TX_DMA4_POS_TRACK 0x0070A4 +#define ACP_SW1_TX_DMA4_POS 0x0070A8 +#define ACP_SW1_TX_DMA5_POS_TRACK 0x0070AC +#define ACP_SW1_TX_DMA5_POS 0x0070B0 +#define ACP_SW1_TX_DMA6_POS_TRACK 0x0070B4 +#define ACP_SW1_TX_DMA6_POS 0x0070B8 +#define ACP_SW1_TX_DMA7_POS_TRACK 0x0070BC +#define ACP_SW1_TX_DMA7_POS 0x0070C0 +#define ACP_SW1_FIFO_ERROR_REASON 0x0070C4 +#define ACP_SW1_FIFO_ERROR_INTR_MASK 0x0070C8 +#define ACP_SW1_ERROR_REASON1 0x0070CC +#define ACP_SW1_ERROR_INTR_MASK1 0x0070D0 +#define ACP_SW1_ERROR_REASON2 0x0070D4 +#define ACP_SW1_ERROR_INTR_MASK2 0x0070D8 + +#define ACP_SW1_CORB_BASE_ADDRESS 0x007100 +#define ACP_SW1_CORB_WRITE_POINTER 0x007104 +#define ACP_SW1_CORB_READ_POINTER 0x007108 +#define ACP_SW1_CORB_CONTROL 0x00710C +#define ACP_SW1_CORB_SIZE 0x007114 +#define ACP_SW1_RIRB_BASE_ADDRESS 0x007118 +#define ACP_SW1_RIRB_WRITE_POINTER 0x00711C +#define ACP_SW1_RIRB_RESPONSE_INTERRUPT_COUNT 0x007120 +#define ACP_SW1_RIRB_CONTROL 0x007124 +#define ACP_SW1_RIRB_SIZE 0x007128 +#define ACP_SW1_RIRB_FIFO_MIN_THDL 0x00712C +#define ACP_SW1_IMM_CMD_UPPER_WORD 0x007130 +#define ACP_SW1_IMM_CMD_LOWER_QWORD 0x007134 +#define ACP_SW1_IMM_RESP_UPPER_WORD 0x007138 +#define ACP_SW1_IMM_RESP_LOWER_QWORD 0x00713C +#define ACP_SW1_IMM_CMD_STS 0x007140 +#define ACP_SW1_BRA_BASE_ADDRESS 0x007144 +#define ACP_SW1_BRA_TRANSFER_SIZE 0x007148 +#define ACP_SW1_BRA_DMA_BUSY 0x00714C +#define ACP_SW1_BRA_RESP 0x007150 +#define ACP_SW1_BRA_RESP_FRAME_ADDR 0x007154 +#define ACP_SW1_BRA_CURRENT_TRANSFER_SIZE 0x007158 +#define ACP_SW1_STATE_CHANGE_STATUS_0TO7 0x00715C +#define ACP_SW1_STATE_CHANGE_STATUS_8TO11 0x007160 +#define ACP_SW1_STATE_CHANGE_STATUS_MASK_0TO7 0x007164 +#define ACP_SW1_STATE_CHANGE_STATUS_MASK_8TO11 0x007168 +#define ACP_SW1_CLK_FREQUENCY_CTRL_BANK0 0x00716C +#define ACP_SW1_CLK_FREQUENCY_CTRL_BANK1 0x007170 +#define ACP_SW1_ERROR_INTR_MASK 0x007174 +#define ACP_SW1_PHY_TEST_MODE_DATA_OFF 0x007178 +#define ACP_SW1_DATA_TO_PDM_EN 0x00717C + +#define ACP_SW1_EN 0x007200 +#define ACP_SW1_EN_STATUS 0x007204 +#define ACP_SW1_FRAMESIZE_BANK0 0x007208 +#define ACP_SW1_FRAMESIZE_BANK1 0x00720C +#define ACP_SW1_SSP_COUNTER 0x007210 +#define ACP_SW1_TX_STREAM0_EN 0x007214 +#define ACP_SW1_TX_STREAM1_EN 0x007218 +#define ACP_SW1_TX_STREAM2_EN 0x00721C +#define ACP_SW1_TX_STREAM3_EN 0x007220 +#define ACP_SW1_TX_STREAM4_EN 0x007224 +#define ACP_SW1_TX_STREAM5_EN 0x007228 +#define ACP_SW1_TX_STREAM6_EN 0x00722C +#define ACP_SW1_TX_STREAM7_EN 0x007230 +#define ACP_SW1_TX_STREAM0_EN_STATUS 0x007234 +#define ACP_SW1_TX_STREAM1_EN_STATUS 0x007238 +#define ACP_SW1_TX_STREAM2_EN_STATUS 0x00723C +#define ACP_SW1_TX_STREAM3_EN_STATUS 0x007240 +#define ACP_SW1_TX_STREAM4_EN_STATUS 0x007244 +#define ACP_SW1_TX_STREAM5_EN_STATUS 0x007248 +#define ACP_SW1_TX_STREAM6_EN_STATUS 0x00724C +#define ACP_SW1_TX_STREAM7_EN_STATUS 0x007250 +#define ACP_SW1_TX_DP0_FRAME_FORMAT 0x007254 +#define ACP_SW1_TX_DP1_FRAME_FORMAT 0x007258 +#define ACP_SW1_TX_DP2_FRAME_FORMAT 0x00725C +#define ACP_SW1_TX_DP3_FRAME_FORMAT 0x007260 +#define ACP_SW1_TX_DP4_FRAME_FORMAT 0x007264 +#define ACP_SW1_TX_DP5_FRAME_FORMAT 0x007268 +#define ACP_SW1_TX_DP6_FRAME_FORMAT 0x00726C +#define ACP_SW1_TX_DP7_FRAME_FORMAT 0x007270 +#define ACP_SW1_TX_DP0_0_SAMPLEINTERVAL_BANK0 0x007280 +#define ACP_SW1_TX_DP0_0_HCTRL_BANK0 0x007284 +#define ACP_SW1_TX_DP0_0_HCTRL_OFFSET_BANK0 0x007288 +#define ACP_SW1_TX_DP0_0_LANE_CTRL_BANK0 0x00728C +#define ACP_SW1_TX_DP0_0_CHANNEL_ENABLE_BANK0 0x007290 +#define ACP_SW1_TX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007294 +#define ACP_SW1_TX_DP0_0_SAMPLEINTERVAL_BANK1 0x007298 +#define ACP_SW1_TX_DP0_0_HCTRL_BANK1 0x00729C +#define ACP_SW1_TX_DP0_0_HCTRL_OFFSET_BANK1 0x0072A0 +#define ACP_SW1_TX_DP0_0_LANE_CTRL_BANK1 0x0072A4 +#define ACP_SW1_TX_DP0_0_CHANNEL_ENABLE_BANK1 0x0072A8 +#define ACP_SW1_TX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0072AC +#define ACP_SW1_TX_DP0_1_SAMPLEINTERVAL_BANK0 0x0072B0 +#define ACP_SW1_TX_DP0_1_HCTRL_BANK0 0x0072B4 +#define ACP_SW1_TX_DP0_1_HCTRL_OFFSET_BANK0 0x0072B8 +#define ACP_SW1_TX_DP0_1_LANE_CTRL_BANK0 0x0072BC +#define ACP_SW1_TX_DP0_1_CHANNEL_ENABLE_BANK0 0x0072C0 +#define ACP_SW1_TX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0072C4 +#define ACP_SW1_TX_DP0_1_SAMPLEINTERVAL_BANK1 0x0072C8 +#define ACP_SW1_TX_DP0_1_HCTRL_BANK1 0x0072CC +#define ACP_SW1_TX_DP0_1_HCTRL_OFFSET_BANK1 0x0072D0 +#define ACP_SW1_TX_DP0_1_LANE_CTRL_BANK1 0x0072D4 +#define ACP_SW1_TX_DP0_1_CHANNEL_ENABLE_BANK1 0x0072D8 +#define ACP_SW1_TX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0072DC +#define ACP_SW1_TX_DP0_2_SAMPLEINTERVAL_BANK0 0x0072E0 +#define ACP_SW1_TX_DP0_2_HCTRL_BANK0 0x0072E4 +#define ACP_SW1_TX_DP0_2_HCTRL_OFFSET_BANK0 0x0072E8 +#define ACP_SW1_TX_DP0_2_LANE_CTRL_BANK0 0x0072EC +#define ACP_SW1_TX_DP0_2_CHANNEL_ENABLE_BANK0 0x0072F0 +#define ACP_SW1_TX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0072F4 +#define ACP_SW1_TX_DP0_2_SAMPLEINTERVAL_BANK1 0x0072F8 +#define ACP_SW1_TX_DP0_2_HCTRL_BANK1 0x0072FC +#define ACP_SW1_TX_DP0_2_HCTRL_OFFSET_BANK1 0x007300 +#define ACP_SW1_TX_DP0_2_LANE_CTRL_BANK1 0x007304 +#define ACP_SW1_TX_DP0_2_CHANNEL_ENABLE_BANK1 0x007308 +#define ACP_SW1_TX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00730C +#define ACP_SW1_TX_DP0_3_SAMPLEINTERVAL_BANK0 0x007310 +#define ACP_SW1_TX_DP0_3_HCTRL_BANK0 0x007314 +#define ACP_SW1_TX_DP0_3_HCTRL_OFFSET_BANK0 0x007318 +#define ACP_SW1_TX_DP0_3_LANE_CTRL_BANK0 0x00731C +#define ACP_SW1_TX_DP0_3_CHANNEL_ENABLE_BANK0 0x007320 +#define ACP_SW1_TX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007324 +#define ACP_SW1_TX_DP0_3_SAMPLEINTERVAL_BANK1 0x007328 +#define ACP_SW1_TX_DP0_3_HCTRL_BANK1 0x00732C +#define ACP_SW1_TX_DP0_3_HCTRL_OFFSET_BANK1 0x007330 +#define ACP_SW1_TX_DP0_3_LANE_CTRL_BANK1 0x007334 +#define ACP_SW1_TX_DP0_3_CHANNEL_ENABLE_BANK1 0x007338 +#define ACP_SW1_TX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00733C +#define ACP_SW1_TX_DP1_SAMPLEINTERVAL_BANK0 0x007370 +#define ACP_SW1_TX_DP1_HCTRL_BANK0 0x007374 +#define ACP_SW1_TX_DP1_HCTRL_OFFSET_BANK0 0x007378 +#define ACP_SW1_TX_DP1_LANE_CTRL_BANK0 0x00737C +#define ACP_SW1_TX_DP1_CHANNEL_ENABLE_BANK0 0x007380 +#define ACP_SW1_TX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007384 +#define ACP_SW1_TX_DP1_SAMPLEINTERVAL_BANK1 0x007388 +#define ACP_SW1_TX_DP1_HCTRL_BANK1 0x00738C +#define ACP_SW1_TX_DP1_HCTRL_OFFSET_BANK1 0x007390 +#define ACP_SW1_TX_DP1_LANE_CTRL_BANK1 0x007394 +#define ACP_SW1_TX_DP1_CHANNEL_ENABLE_BANK1 0x007398 +#define ACP_SW1_TX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00739C +#define ACP_SW1_TX_DP2_SAMPLEINTERVAL_BANK0 0x0073A0 +#define ACP_SW1_TX_DP2_HCTRL_BANK0 0x0073A4 +#define ACP_SW1_TX_DP2_HCTRL_OFFSET_BANK0 0x0073A8 +#define ACP_SW1_TX_DP2_LANE_CTRL_BANK0 0x0073AC +#define ACP_SW1_TX_DP2_CHANNEL_ENABLE_BANK0 0x0073B0 +#define ACP_SW1_TX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0073B4 +#define ACP_SW1_TX_DP2_SAMPLEINTERVAL_BANK1 0x0073B8 +#define ACP_SW1_TX_DP2_HCTRL_BANK1 0x0073BC +#define ACP_SW1_TX_DP2_HCTRL_OFFSET_BANK1 0x0073C0 +#define ACP_SW1_TX_DP2_LANE_CTRL_BANK1 0x0073C4 +#define ACP_SW1_TX_DP2_CHANNEL_ENABLE_BANK1 0x0073C8 +#define ACP_SW1_TX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0073CC +#define ACP_SW1_TX_DP3_SAMPLEINTERVAL_BANK0 0x0073D0 +#define ACP_SW1_TX_DP3_HCTRL_BANK0 0x0073D4 +#define ACP_SW1_TX_DP3_HCTRL_OFFSET_BANK0 0x0073D8 +#define ACP_SW1_TX_DP3_LANE_CTRL_BANK0 0x0073DC +#define ACP_SW1_TX_DP3_CHANNEL_ENABLE_BANK0 0x0073E0 +#define ACP_SW1_TX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0073E4 +#define ACP_SW1_TX_DP3_SAMPLEINTERVAL_BANK1 0x0073E8 +#define ACP_SW1_TX_DP3_HCTRL_BANK1 0x0073EC +#define ACP_SW1_TX_DP3_HCTRL_OFFSET_BANK1 0x0073F0 +#define ACP_SW1_TX_DP3_LANE_CTRL_BANK1 0x0073F4 +#define ACP_SW1_TX_DP3_CHANNEL_ENABLE_BANK1 0x0073F8 +#define ACP_SW1_TX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0073FC +#define ACP_SW1_TX_DP4_SAMPLEINTERVAL_BANK0 0x007400 +#define ACP_SW1_TX_DP4_HCTRL_BANK0 0x007404 +#define ACP_SW1_TX_DP4_HCTRL_OFFSET_BANK0 0x007408 +#define ACP_SW1_TX_DP4_LANE_CTRL_BANK0 0x00740C +#define ACP_SW1_TX_DP4_CHANNEL_ENABLE_BANK0 0x007410 +#define ACP_SW1_TX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007414 +#define ACP_SW1_TX_DP4_SAMPLEINTERVAL_BANK1 0x007418 +#define ACP_SW1_TX_DP4_HCTRL_BANK1 0x00741C +#define ACP_SW1_TX_DP4_HCTRL_OFFSET_BANK1 0x007420 +#define ACP_SW1_TX_DP4_LANE_CTRL_BANK1 0x007424 +#define ACP_SW1_TX_DP4_CHANNEL_ENABLE_BANK1 0x007428 +#define ACP_SW1_TX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00742C +#define ACP_SW1_TX_DP5_SAMPLEINTERVAL_BANK0 0x007430 +#define ACP_SW1_TX_DP5_HCTRL_BANK0 0x007434 +#define ACP_SW1_TX_DP5_HCTRL_OFFSET_BANK0 0x007438 +#define ACP_SW1_TX_DP5_LANE_CTRL_BANK0 0x00743C +#define ACP_SW1_TX_DP5_CHANNEL_ENABLE_BANK0 0x007440 +#define ACP_SW1_TX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007444 +#define ACP_SW1_TX_DP5_SAMPLEINTERVAL_BANK1 0x007448 +#define ACP_SW1_TX_DP5_HCTRL_BANK1 0x00744C +#define ACP_SW1_TX_DP5_HCTRL_OFFSET_BANK1 0x007450 +#define ACP_SW1_TX_DP5_LANE_CTRL_BANK1 0x007454 +#define ACP_SW1_TX_DP5_CHANNEL_ENABLE_BANK1 0x007458 +#define ACP_SW1_TX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00745C +#define ACP_SW1_TX_DP6_SAMPLEINTERVAL_BANK0 0x007460 +#define ACP_SW1_TX_DP6_HCTRL_BANK0 0x007464 +#define ACP_SW1_TX_DP6_HCTRL_OFFSET_BANK0 0x007468 +#define ACP_SW1_TX_DP6_LANE_CTRL_BANK0 0x00746C +#define ACP_SW1_TX_DP6_CHANNEL_ENABLE_BANK0 0x007470 +#define ACP_SW1_TX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007474 +#define ACP_SW1_TX_DP6_SAMPLEINTERVAL_BANK1 0x007478 +#define ACP_SW1_TX_DP6_HCTRL_BANK1 0x00747C +#define ACP_SW1_TX_DP6_HCTRL_OFFSET_BANK1 0x007480 +#define ACP_SW1_TX_DP6_LANE_CTRL_BANK1 0x007484 +#define ACP_SW1_TX_DP6_CHANNEL_ENABLE_BANK1 0x007488 +#define ACP_SW1_TX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00748C +#define ACP_SW1_TX_DP7_SAMPLEINTERVAL_BANK0 0x007490 +#define ACP_SW1_TX_DP7_HCTRL_BANK0 0x007494 +#define ACP_SW1_TX_DP7_HCTRL_OFFSET_BANK0 0x007498 +#define ACP_SW1_TX_DP7_LANE_CTRL_BANK0 0x00749C +#define ACP_SW1_TX_DP7_CHANNEL_ENABLE_BANK0 0x0074A0 +#define ACP_SW1_TX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0074A4 +#define ACP_SW1_TX_DP7_SAMPLEINTERVAL_BANK1 0x0074A8 +#define ACP_SW1_TX_DP7_HCTRL_BANK1 0x0074AC +#define ACP_SW1_TX_DP7_HCTRL_OFFSET_BANK1 0x0074B0 +#define ACP_SW1_TX_DP7_LANE_CTRL_BANK1 0x0074B4 +#define ACP_SW1_TX_DP7_CHANNEL_ENABLE_BANK1 0x0074B8 +#define ACP_SW1_TX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0074BC +#define ACP_SW1_RX_STREAM0_EN 0x007514 +#define ACP_SW1_RX_STREAM1_EN 0x007518 +#define ACP_SW1_RX_STREAM2_EN 0x00751C +#define ACP_SW1_RX_STREAM3_EN 0x007520 +#define ACP_SW1_RX_STREAM4_EN 0x007524 +#define ACP_SW1_RX_STREAM5_EN 0x007528 +#define ACP_SW1_RX_STREAM6_EN 0x00752C +#define ACP_SW1_RX_STREAM7_EN 0x007530 +#define ACP_SW1_RX_STREAM0_EN_STATUS 0x007534 +#define ACP_SW1_RX_STREAM1_EN_STATUS 0x007538 +#define ACP_SW1_RX_STREAM2_EN_STATUS 0x00753C +#define ACP_SW1_RX_STREAM3_EN_STATUS 0x007540 +#define ACP_SW1_RX_STREAM4_EN_STATUS 0x007544 +#define ACP_SW1_RX_STREAM5_EN_STATUS 0x007548 +#define ACP_SW1_RX_STREAM6_EN_STATUS 0x00754C +#define ACP_SW1_RX_STREAM7_EN_STATUS 0x007550 +#define ACP_SW1_RX_DP0_FRAME_FORMAT 0x007554 +#define ACP_SW1_RX_DP1_FRAME_FORMAT 0x007558 +#define ACP_SW1_RX_DP2_FRAME_FORMAT 0x00755C +#define ACP_SW1_RX_DP3_FRAME_FORMAT 0x007560 +#define ACP_SW1_RX_DP4_FRAME_FORMAT 0x007564 +#define ACP_SW1_RX_DP5_FRAME_FORMAT 0x007568 +#define ACP_SW1_RX_DP6_FRAME_FORMAT 0x00756C +#define ACP_SW1_RX_DP7_FRAME_FORMAT 0x007570 +#define ACP_SW1_RX_DP0_0_SAMPLEINTERVAL_BANK0 0x007580 +#define ACP_SW1_RX_DP0_0_HCTRL_BANK0 0x007584 +#define ACP_SW1_RX_DP0_0_HCTRL_OFFSET_BANK0 0x007588 +#define ACP_SW1_RX_DP0_0_LANE_CTRL_BANK0 0x00758C +#define ACP_SW1_RX_DP0_0_CHANNEL_ENABLE_BANK0 0x007590 +#define ACP_SW1_RX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007594 +#define ACP_SW1_RX_DP0_0_SAMPLEINTERVAL_BANK1 0x007598 +#define ACP_SW1_RX_DP0_0_HCTRL_BANK1 0x00759C +#define ACP_SW1_RX_DP0_0_HCTRL_OFFSET_BANK1 0x0075A0 +#define ACP_SW1_RX_DP0_0_LANE_CTRL_BANK1 0x0075A4 +#define ACP_SW1_RX_DP0_0_CHANNEL_ENABLE_BANK1 0x0075A8 +#define ACP_SW1_RX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0075AC +#define ACP_SW1_RX_DP0_1_SAMPLEINTERVAL_BANK0 0x0075B0 +#define ACP_SW1_RX_DP0_1_HCTRL_BANK0 0x0075B4 +#define ACP_SW1_RX_DP0_1_HCTRL_OFFSET_BANK0 0x0075B8 +#define ACP_SW1_RX_DP0_1_LANE_CTRL_BANK0 0x0075BC +#define ACP_SW1_RX_DP0_1_CHANNEL_ENABLE_BANK0 0x0075C0 +#define ACP_SW1_RX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0075C4 +#define ACP_SW1_RX_DP0_1_SAMPLEINTERVAL_BANK1 0x0075C8 +#define ACP_SW1_RX_DP0_1_HCTRL_BANK1 0x0075CC +#define ACP_SW1_RX_DP0_1_HCTRL_OFFSET_BANK1 0x0075D0 +#define ACP_SW1_RX_DP0_1_LANE_CTRL_BANK1 0x0075D4 +#define ACP_SW1_RX_DP0_1_CHANNEL_ENABLE_BANK1 0x0075D8 +#define ACP_SW1_RX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0075DC +#define ACP_SW1_RX_DP0_2_SAMPLEINTERVAL_BANK0 0x0075E0 +#define ACP_SW1_RX_DP0_2_HCTRL_BANK0 0x0075E4 +#define ACP_SW1_RX_DP0_2_HCTRL_OFFSET_BANK0 0x0075E8 +#define ACP_SW1_RX_DP0_2_LANE_CTRL_BANK0 0x0075EC +#define ACP_SW1_RX_DP0_2_CHANNEL_ENABLE_BANK0 0x0075F0 +#define ACP_SW1_RX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0075F4 +#define ACP_SW1_RX_DP0_2_SAMPLEINTERVAL_BANK1 0x0075F8 +#define ACP_SW1_RX_DP0_2_HCTRL_BANK1 0x0075FC +#define ACP_SW1_RX_DP0_2_HCTRL_OFFSET_BANK1 0x007600 +#define ACP_SW1_RX_DP0_2_LANE_CTRL_BANK1 0x007604 +#define ACP_SW1_RX_DP0_2_CHANNEL_ENABLE_BANK1 0x007608 +#define ACP_SW1_RX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00760C +#define ACP_SW1_RX_DP0_3_SAMPLEINTERVAL_BANK0 0x007610 +#define ACP_SW1_RX_DP0_3_HCTRL_BANK0 0x007614 +#define ACP_SW1_RX_DP0_3_HCTRL_OFFSET_BANK0 0x007618 +#define ACP_SW1_RX_DP0_3_LANE_CTRL_BANK0 0x00761C +#define ACP_SW1_RX_DP0_3_CHANNEL_ENABLE_BANK0 0x007620 +#define ACP_SW1_RX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007624 +#define ACP_SW1_RX_DP0_3_SAMPLEINTERVAL_BANK1 0x007628 +#define ACP_SW1_RX_DP0_3_HCTRL_BANK1 0x00762C +#define ACP_SW1_RX_DP0_3_HCTRL_OFFSET_BANK1 0x007630 +#define ACP_SW1_RX_DP0_3_LANE_CTRL_BANK1 0x007634 +#define ACP_SW1_RX_DP0_3_CHANNEL_ENABLE_BANK1 0x007638 +#define ACP_SW1_RX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00763C +#define ACP_SW1_RX_DP1_SAMPLEINTERVAL_BANK0 0x007670 +#define ACP_SW1_RX_DP1_HCTRL_BANK0 0x007674 +#define ACP_SW1_RX_DP1_HCTRL_OFFSET_BANK0 0x007678 +#define ACP_SW1_RX_DP1_LANE_CTRL_BANK0 0x00767C +#define ACP_SW1_RX_DP1_CHANNEL_ENABLE_BANK0 0x007680 +#define ACP_SW1_RX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007684 +#define ACP_SW1_RX_DP1_SAMPLEINTERVAL_BANK1 0x007688 +#define ACP_SW1_RX_DP1_HCTRL_BANK1 0x00768C +#define ACP_SW1_RX_DP1_HCTRL_OFFSET_BANK1 0x007690 +#define ACP_SW1_RX_DP1_LANE_CTRL_BANK1 0x007694 +#define ACP_SW1_RX_DP1_CHANNEL_ENABLE_BANK1 0x007698 +#define ACP_SW1_RX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00769C +#define ACP_SW1_RX_DP2_SAMPLEINTERVAL_BANK0 0x0076A0 +#define ACP_SW1_RX_DP2_HCTRL_BANK0 0x0076A4 +#define ACP_SW1_RX_DP2_HCTRL_OFFSET_BANK0 0x0076A8 +#define ACP_SW1_RX_DP2_LANE_CTRL_BANK0 0x0076AC +#define ACP_SW1_RX_DP2_CHANNEL_ENABLE_BANK0 0x0076B0 +#define ACP_SW1_RX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0076B4 +#define ACP_SW1_RX_DP2_SAMPLEINTERVAL_BANK1 0x0076B8 +#define ACP_SW1_RX_DP2_HCTRL_BANK1 0x0076BC +#define ACP_SW1_RX_DP2_HCTRL_OFFSET_BANK1 0x0076C0 +#define ACP_SW1_RX_DP2_LANE_CTRL_BANK1 0x0076C4 +#define ACP_SW1_RX_DP2_CHANNEL_ENABLE_BANK1 0x0076C8 +#define ACP_SW1_RX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0076CC +#define ACP_SW1_RX_DP3_SAMPLEINTERVAL_BANK0 0x0076D0 +#define ACP_SW1_RX_DP3_HCTRL_BANK0 0x0076D4 +#define ACP_SW1_RX_DP3_HCTRL_OFFSET_BANK0 0x0076D8 +#define ACP_SW1_RX_DP3_LANE_CTRL_BANK0 0x0076DC +#define ACP_SW1_RX_DP3_CHANNEL_ENABLE_BANK0 0x0076E0 +#define ACP_SW1_RX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0076E4 +#define ACP_SW1_RX_DP3_SAMPLEINTERVAL_BANK1 0x0076E8 +#define ACP_SW1_RX_DP3_HCTRL_BANK1 0x0076EC +#define ACP_SW1_RX_DP3_HCTRL_OFFSET_BANK1 0x0076F0 +#define ACP_SW1_RX_DP3_LANE_CTRL_BANK1 0x0076F4 +#define ACP_SW1_RX_DP3_CHANNEL_ENABLE_BANK1 0x0076F8 +#define ACP_SW1_RX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0076FC +#define ACP_SW1_RX_DP4_SAMPLEINTERVAL_BANK0 0x007700 +#define ACP_SW1_RX_DP4_HCTRL_BANK0 0x007704 +#define ACP_SW1_RX_DP4_HCTRL_OFFSET_BANK0 0x007708 +#define ACP_SW1_RX_DP4_LANE_CTRL_BANK0 0x00770C +#define ACP_SW1_RX_DP4_CHANNEL_ENABLE_BANK0 0x007710 +#define ACP_SW1_RX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007714 +#define ACP_SW1_RX_DP4_SAMPLEINTERVAL_BANK1 0x007718 +#define ACP_SW1_RX_DP4_HCTRL_BANK1 0x00771C +#define ACP_SW1_RX_DP4_HCTRL_OFFSET_BANK1 0x007720 +#define ACP_SW1_RX_DP4_LANE_CTRL_BANK1 0x007724 +#define ACP_SW1_RX_DP4_CHANNEL_ENABLE_BANK1 0x007728 +#define ACP_SW1_RX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00772C +#define ACP_SW1_RX_DP5_SAMPLEINTERVAL_BANK0 0x007730 +#define ACP_SW1_RX_DP5_HCTRL_BANK0 0x007734 +#define ACP_SW1_RX_DP5_HCTRL_OFFSET_BANK0 0x007738 +#define ACP_SW1_RX_DP5_LANE_CTRL_BANK0 0x00773C +#define ACP_SW1_RX_DP5_CHANNEL_ENABLE_BANK0 0x007740 +#define ACP_SW1_RX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007744 +#define ACP_SW1_RX_DP5_SAMPLEINTERVAL_BANK1 0x007748 +#define ACP_SW1_RX_DP5_HCTRL_BANK1 0x00774C +#define ACP_SW1_RX_DP5_HCTRL_OFFSET_BANK1 0x007750 +#define ACP_SW1_RX_DP5_LANE_CTRL_BANK1 0x007754 +#define ACP_SW1_RX_DP5_CHANNEL_ENABLE_BANK1 0x007758 +#define ACP_SW1_RX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00775C +#define ACP_SW1_RX_DP6_SAMPLEINTERVAL_BANK0 0x007760 +#define ACP_SW1_RX_DP6_HCTRL_BANK0 0x007764 +#define ACP_SW1_RX_DP6_HCTRL_OFFSET_BANK0 0x007768 +#define ACP_SW1_RX_DP6_LANE_CTRL_BANK0 0x00776C +#define ACP_SW1_RX_DP6_CHANNEL_ENABLE_BANK0 0x007770 +#define ACP_SW1_RX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK0 0x007774 +#define ACP_SW1_RX_DP6_SAMPLEINTERVAL_BANK1 0x007778 +#define ACP_SW1_RX_DP6_HCTRL_BANK1 0x00777C +#define ACP_SW1_RX_DP6_HCTRL_OFFSET_BANK1 0x007780 +#define ACP_SW1_RX_DP6_LANE_CTRL_BANK1 0x007784 +#define ACP_SW1_RX_DP6_CHANNEL_ENABLE_BANK1 0x007788 +#define ACP_SW1_RX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00778C +#define ACP_SW1_RX_DP7_SAMPLEINTERVAL_BANK0 0x007790 +#define ACP_SW1_RX_DP7_HCTRL_BANK0 0x007794 +#define ACP_SW1_RX_DP7_HCTRL_OFFSET_BANK0 0x007798 +#define ACP_SW1_RX_DP7_LANE_CTRL_BANK0 0x00779C +#define ACP_SW1_RX_DP7_CHANNEL_ENABLE_BANK0 0x0077A0 +#define ACP_SW1_RX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0077A4 +#define ACP_SW1_RX_DP7_SAMPLEINTERVAL_BANK1 0x0077A8 +#define ACP_SW1_RX_DP7_HCTRL_BANK1 0x0077AC +#define ACP_SW1_RX_DP7_HCTRL_OFFSET_BANK1 0x0077B0 +#define ACP_SW1_RX_DP7_LANE_CTRL_BANK1 0x0077B4 +#define ACP_SW1_RX_DP7_CHANNEL_ENABLE_BANK1 0x0077B8 +#define ACP_SW1_RX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0077BC +#define ACP_SW1_BPT_PORT_EN 0x0077C0 +#define ACP_SW1_BPT_PORT_EN_STATUS 0x0077C4 +#define ACP_SW1_BPT_PORT_FRAME_FORMAT 0x0077C8 +#define ACP_SW1_BPT_PORT_SAMPLEINTERVAL_BANK0 0x0077CC +#define ACP_SW1_BPT_PORT_HCTRL_BANK0 0x0077D0 +#define ACP_SW1_BPT_PORT_OFFSET_BANK0 0x0077D4 +#define ACP_SW1_BPT_PORT_LANE_SELECT_BANK0 0x0077D8 +#define ACP_SW1_BPT_PORT_CHANNEL_ENABLE_BANK0 0x0077DC +#define ACP_SW1_BPT_PORT_SAMPLEINTERVAL_BANK1 0x0077E0 +#define ACP_SW1_BPT_PORT_HCTRL_BANK1 0x0077E4 +#define ACP_SW1_BPT_PORT_OFFSET_BANK1 0x0077E8 +#define ACP_SW1_BPT_PORT_LANE_SELECT_BANK1 0x0077EC +#define ACP_SW1_BPT_PORT_CHANNEL_ENABLE_BANK1 0x0077F0 +#define ACP_SW1_BPT_PORT_FIRST_BYTE_ADDR 0x0077F4 +#define ACP_SW1_CLK_RESUME_CTRL 0x0077F8 +#define ACP_SW1_CLK_RESUME_DELAY_CNTR 0x0077FC +#define ACP_SW1_BUS_RESET_CTRL 0x007800 +#define ACP_SW1_PRBS_ERR_STATUS 0x007804 +#define ACP_SW1_WALLCLK_MISC 0x007808 +#define ACP_SW1_WALL_CLK_COUNTER 0x00780C +#define ACP_SW1_PING_STATUS_REGISTER_LOW 0x007810 +#define ACP_SW1_PING_STATUS_REGISTER_HIGH 0x007814 +#define ACP_SW1_PING_STATUS_CURRENT_BANK_SEL 0x007818 +#define ACP_SW1_TZD_CHANGE 0x00781C +#define ACP_SW1_WALLCLK_INTR_CNTL 0x007820 + +#define ACP_SW2_GLOBAL_CAPABILITIES 0x008E00 +#define ACP_SW2_RX_DMA0_RINGBUFADDR 0x008E04 +#define ACP_SW2_RX_DMA0_RINGBUFSIZE 0x008E08 +#define ACP_SW2_RX_DMA0_FIFOADDR 0x008E0C +#define ACP_SW2_RX_DMA0_FIFOSIZE 0x008E10 +#define ACP_SW2_RX_DMA0_BURST_SIZE 0x008E14 +#define ACP_SW2_RX_DMA0_LINKPOSITIONCNTR 0x008E18 +#define ACP_SW2_RX_DMA0_LINEARPOSITIONCNTR_HIGH 0x008E1C +#define ACP_SW2_RX_DMA0_LINEARPOSITIONCNTR_LOW 0x008E20 +#define ACP_SW2_RX_DMA0_INTR_WATERMARK_SIZE 0x008E24 +#define ACP_SW2_RX_DMA1_RINGBUFADDR 0x008E28 +#define ACP_SW2_RX_DMA1_RINGBUFSIZE 0x008E2C +#define ACP_SW2_RX_DMA1_FIFOADDR 0x008E30 +#define ACP_SW2_RX_DMA1_FIFOSIZE 0x008E34 +#define ACP_SW2_RX_DMA1_BURST_SIZE 0x008E38 +#define ACP_SW2_RX_DMA1_LINKPOSITIONCNTR 0x008E3C +#define ACP_SW2_RX_DMA1_LINEARPOSITIONCNTR_HIGH 0x008E40 +#define ACP_SW2_RX_DMA1_LINEARPOSITIONCNTR_LOW 0x008E44 +#define ACP_SW2_RX_DMA1_INTR_WATERMARK_SIZE 0x008E48 +#define ACP_SW2_RX_DMA2_RINGBUFADDR 0x008E4C +#define ACP_SW2_RX_DMA2_RINGBUFSIZE 0x008E50 +#define ACP_SW2_RX_DMA2_FIFOADDR 0x008E54 +#define ACP_SW2_RX_DMA2_FIFOSIZE 0x008E58 +#define ACP_SW2_RX_DMA2_BURST_SIZE 0x008E5C +#define ACP_SW2_RX_DMA2_LINKPOSITIONCNTR 0x008E60 +#define ACP_SW2_RX_DMA2_LINEARPOSITIONCNTR_HIGH 0x008E64 +#define ACP_SW2_RX_DMA2_LINEARPOSITIONCNTR_LOW 0x008E68 +#define ACP_SW2_RX_DMA2_INTR_WATERMARK_SIZE 0x008E6C +#define ACP_SW2_RX_DMA3_RINGBUFADDR 0x008E70 +#define ACP_SW2_RX_DMA3_RINGBUFSIZE 0x008E74 +#define ACP_SW2_RX_DMA3_FIFOADDR 0x008E78 +#define ACP_SW2_RX_DMA3_FIFOSIZE 0x008E7C +#define ACP_SW2_RX_DMA3_BURST_SIZE 0x008E80 +#define ACP_SW2_RX_DMA3_LINKPOSITIONCNTR 0x008E84 +#define ACP_SW2_RX_DMA3_LINEARPOSITIONCNTR_HIGH 0x008E88 +#define ACP_SW2_RX_DMA3_LINEARPOSITIONCNTR_LOW 0x008E8C +#define ACP_SW2_RX_DMA3_INTR_WATERMARK_SIZE 0x008E90 +#define ACP_SW2_RX_DMA4_RINGBUFADDR 0x008E94 +#define ACP_SW2_RX_DMA4_RINGBUFSIZE 0x008E98 +#define ACP_SW2_RX_DMA4_FIFOADDR 0x008E9C +#define ACP_SW2_RX_DMA4_FIFOSIZE 0x008EA0 +#define ACP_SW2_RX_DMA4_BURST_SIZE 0x008EA4 +#define ACP_SW2_RX_DMA4_LINKPOSITIONCNTR 0x008EA8 +#define ACP_SW2_RX_DMA4_LINEARPOSITIONCNTR_HIGH 0x008EAC +#define ACP_SW2_RX_DMA4_LINEARPOSITIONCNTR_LOW 0x008EB0 +#define ACP_SW2_RX_DMA4_INTR_WATERMARK_SIZE 0x008EB4 +#define ACP_SW2_RX_DMA5_RINGBUFADDR 0x008EB8 +#define ACP_SW2_RX_DMA5_RINGBUFSIZE 0x008EBC +#define ACP_SW2_RX_DMA5_FIFOADDR 0x008EC0 +#define ACP_SW2_RX_DMA5_FIFOSIZE 0x008EC4 +#define ACP_SW2_RX_DMA5_BURST_SIZE 0x008EC8 +#define ACP_SW2_RX_DMA5_LINKPOSITIONCNTR 0x008ECC +#define ACP_SW2_RX_DMA5_LINEARPOSITIONCNTR_HIGH 0x008ED0 +#define ACP_SW2_RX_DMA5_LINEARPOSITIONCNTR_LOW 0x008ED4 +#define ACP_SW2_RX_DMA5_INTR_WATERMARK_SIZE 0x008ED8 +#define ACP_SW2_RX_DMA6_RINGBUFADDR 0x008EDC +#define ACP_SW2_RX_DMA6_RINGBUFSIZE 0x008EE0 +#define ACP_SW2_RX_DMA6_FIFOADDR 0x008EE4 +#define ACP_SW2_RX_DMA6_FIFOSIZE 0x008EE8 +#define ACP_SW2_RX_DMA6_BURST_SIZE 0x008EEC +#define ACP_SW2_RX_DMA6_LINKPOSITIONCNTR 0x008EF0 +#define ACP_SW2_RX_DMA6_LINEARPOSITIONCNTR_HIGH 0x008EF4 +#define ACP_SW2_RX_DMA6_LINEARPOSITIONCNTR_LOW 0x008EF8 +#define ACP_SW2_RX_DMA6_INTR_WATERMARK_SIZE 0x008EFC +#define ACP_SW2_RX_DMA7_RINGBUFADDR 0x008F00 +#define ACP_SW2_RX_DMA7_RINGBUFSIZE 0x008F04 +#define ACP_SW2_RX_DMA7_FIFOADDR 0x008F08 +#define ACP_SW2_RX_DMA7_FIFOSIZE 0x008F0C +#define ACP_SW2_RX_DMA7_BURST_SIZE 0x008F10 +#define ACP_SW2_RX_DMA7_LINKPOSITIONCNTR 0x008F14 +#define ACP_SW2_RX_DMA7_LINEARPOSITIONCNTR_HIGH 0x008F18 +#define ACP_SW2_RX_DMA7_LINEARPOSITIONCNTR_LOW 0x008F1C +#define ACP_SW2_RX_DMA7_INTR_WATERMARK_SIZE 0x008F20 +#define ACP_SW2_TX_DMA0_RINGBUFADDR 0x008F24 +#define ACP_SW2_TX_DMA0_RINGBUFSIZE 0x008F28 +#define ACP_SW2_TX_DMA0_FIFOADDR 0x008F2C +#define ACP_SW2_TX_DMA0_FIFOSIZE 0x008F30 +#define ACP_SW2_TX_DMA0_BURST_SIZE 0x008F34 +#define ACP_SW2_TX_DMA0_LINKPOSITIONCNTR 0x008F38 +#define ACP_SW2_TX_DMA0_LINEARPOSITIONCNTR_HIGH 0x008F3C +#define ACP_SW2_TX_DMA0_LINEARPOSITIONCNTR_LOW 0x008F40 +#define ACP_SW2_TX_DMA0_INTR_WATERMARK_SIZE 0x008F44 +#define ACP_SW2_TX_DMA1_RINGBUFADDR 0x008F48 +#define ACP_SW2_TX_DMA1_RINGBUFSIZE 0x008F4C +#define ACP_SW2_TX_DMA1_FIFOADDR 0x008F50 +#define ACP_SW2_TX_DMA1_FIFOSIZE 0x008F54 +#define ACP_SW2_TX_DMA1_BURST_SIZE 0x008F58 +#define ACP_SW2_TX_DMA1_LINKPOSITIONCNTR 0x008F5C +#define ACP_SW2_TX_DMA1_LINEARPOSITIONCNTR_HIGH 0x008F60 +#define ACP_SW2_TX_DMA1_LINEARPOSITIONCNTR_LOW 0x008F64 +#define ACP_SW2_TX_DMA1_INTR_WATERMARK_SIZE 0x008F68 +#define ACP_SW2_TX_DMA2_RINGBUFADDR 0x008F6C +#define ACP_SW2_TX_DMA2_RINGBUFSIZE 0x008F70 +#define ACP_SW2_TX_DMA2_FIFOADDR 0x008F74 +#define ACP_SW2_TX_DMA2_FIFOSIZE 0x008F78 +#define ACP_SW2_TX_DMA2_BURST_SIZE 0x008F7C +#define ACP_SW2_TX_DMA2_LINKPOSITIONCNTR 0x008F80 +#define ACP_SW2_TX_DMA2_LINEARPOSITIONCNTR_HIGH 0x008F84 +#define ACP_SW2_TX_DMA2_LINEARPOSITIONCNTR_LOW 0x008F88 +#define ACP_SW2_TX_DMA2_INTR_WATERMARK_SIZE 0x008F8C +#define ACP_SW2_TX_DMA3_RINGBUFADDR 0x008F90 +#define ACP_SW2_TX_DMA3_RINGBUFSIZE 0x008F94 +#define ACP_SW2_TX_DMA3_FIFOADDR 0x008F98 +#define ACP_SW2_TX_DMA3_FIFOSIZE 0x008F9C +#define ACP_SW2_TX_DMA3_BURST_SIZE 0x008FA0 +#define ACP_SW2_TX_DMA3_LINKPOSITIONCNTR 0x008FA4 +#define ACP_SW2_TX_DMA3_LINEARPOSITIONCNTR_HIGH 0x008FA8 +#define ACP_SW2_TX_DMA3_LINEARPOSITIONCNTR_LOW 0x008FAC +#define ACP_SW2_TX_DMA3_INTR_WATERMARK_SIZE 0x008FB0 +#define ACP_SW2_TX_DMA4_RINGBUFADDR 0x008FB4 +#define ACP_SW2_TX_DMA4_RINGBUFSIZE 0x008FB8 +#define ACP_SW2_TX_DMA4_FIFOADDR 0x008FBC +#define ACP_SW2_TX_DMA4_FIFOSIZE 0x008FC0 +#define ACP_SW2_TX_DMA4_BURST_SIZE 0x008FC4 +#define ACP_SW2_TX_DMA4_LINKPOSITIONCNTR 0x008FC8 +#define ACP_SW2_TX_DMA4_LINEARPOSITIONCNTR_HIGH 0x008FCC +#define ACP_SW2_TX_DMA4_LINEARPOSITIONCNTR_LOW 0x008FD0 +#define ACP_SW2_TX_DMA4_INTR_WATERMARK_SIZE 0x008FD4 +#define ACP_SW2_TX_DMA5_RINGBUFADDR 0x008FD8 +#define ACP_SW2_TX_DMA5_RINGBUFSIZE 0x008FDC +#define ACP_SW2_TX_DMA5_FIFOADDR 0x008FE0 +#define ACP_SW2_TX_DMA5_FIFOSIZE 0x008FE4 +#define ACP_SW2_TX_DMA5_BURST_SIZE 0x008FE8 +#define ACP_SW2_TX_DMA5_LINKPOSITIONCNTR 0x008FEC +#define ACP_SW2_TX_DMA5_LINEARPOSITIONCNTR_HIGH 0x008FF0 +#define ACP_SW2_TX_DMA5_LINEARPOSITIONCNTR_LOW 0x008FF4 +#define ACP_SW2_TX_DMA5_INTR_WATERMARK_SIZE 0x008FF8 +#define ACP_SW2_TX_DMA6_RINGBUFADDR 0x008FFC +#define ACP_SW2_TX_DMA6_RINGBUFSIZE 0x009000 +#define ACP_SW2_TX_DMA6_FIFOADDR 0x009004 +#define ACP_SW2_TX_DMA6_FIFOSIZE 0x009008 +#define ACP_SW2_TX_DMA6_BURST_SIZE 0x00900C +#define ACP_SW2_TX_DMA6_LINKPOSITIONCNTR 0x009010 +#define ACP_SW2_TX_DMA6_LINEARPOSITIONCNTR_HIGH 0x009014 +#define ACP_SW2_TX_DMA6_LINEARPOSITIONCNTR_LOW 0x009018 +#define ACP_SW2_TX_DMA6_INTR_WATERMARK_SIZE 0x00901C +#define ACP_SW2_TX_DMA7_RINGBUFADDR 0x009020 +#define ACP_SW2_TX_DMA7_RINGBUFSIZE 0x009024 +#define ACP_SW2_TX_DMA7_FIFOADDR 0x009028 +#define ACP_SW2_TX_DMA7_FIFOSIZE 0x00902C +#define ACP_SW2_TX_DMA7_BURST_SIZE 0x009030 +#define ACP_SW2_TX_DMA7_LINKPOSITIONCNTR 0x009034 +#define ACP_SW2_TX_DMA7_LINEARPOSITIONCNTR_HIGH 0x009038 +#define ACP_SW2_TX_DMA7_LINEARPOSITIONCNTR_LOW 0x00903C +#define ACP_SW2_TX_DMA7_INTR_WATERMARK_SIZE 0x009040 +#define ACP_SW2_RX_DMA0_POS_TRACK 0x009044 +#define ACP_SW2_RX_DMA0_POS 0x009048 +#define ACP_SW2_RX_DMA1_POS_TRACK 0x00904C +#define ACP_SW2_RX_DMA1_POS 0x009050 +#define ACP_SW2_RX_DMA2_POS_TRACK 0x009054 +#define ACP_SW2_RX_DMA2_POS 0x009058 +#define ACP_SW2_RX_DMA3_POS_TRACK 0x00905C +#define ACP_SW2_RX_DMA3_POS 0x009060 +#define ACP_SW2_RX_DMA4_POS_TRACK 0x009064 +#define ACP_SW2_RX_DMA4_POS 0x009068 +#define ACP_SW2_RX_DMA5_POS_TRACK 0x00906C +#define ACP_SW2_RX_DMA5_POS 0x009070 +#define ACP_SW2_RX_DMA6_POS_TRACK 0x009074 +#define ACP_SW2_RX_DMA6_POS 0x009078 +#define ACP_SW2_RX_DMA7_POS_TRACK 0x00907C +#define ACP_SW2_RX_DMA7_POS 0x009080 +#define ACP_SW2_TX_DMA0_POS_TRACK 0x009084 +#define ACP_SW2_TX_DMA0_POS 0x009088 +#define ACP_SW2_TX_DMA1_POS_TRACK 0x00908C +#define ACP_SW2_TX_DMA1_POS 0x009090 +#define ACP_SW2_TX_DMA2_POS_TRACK 0x009094 +#define ACP_SW2_TX_DMA2_POS 0x009098 +#define ACP_SW2_TX_DMA3_POS_TRACK 0x00909C +#define ACP_SW2_TX_DMA3_POS 0x0090A0 +#define ACP_SW2_TX_DMA4_POS_TRACK 0x0090A4 +#define ACP_SW2_TX_DMA4_POS 0x0090A8 +#define ACP_SW2_TX_DMA5_POS_TRACK 0x0090AC +#define ACP_SW2_TX_DMA5_POS 0x0090B0 +#define ACP_SW2_TX_DMA6_POS_TRACK 0x0090B4 +#define ACP_SW2_TX_DMA6_POS 0x0090B8 +#define ACP_SW2_TX_DMA7_POS_TRACK 0x0090BC +#define ACP_SW2_TX_DMA7_POS 0x0090C0 +#define ACP_SW2_FIFO_ERROR_REASON 0x0090C4 +#define ACP_SW2_FIFO_ERROR_INTR_MASK 0x0090C8 +#define ACP_SW2_ERROR_REASON1 0x0090CC +#define ACP_SW2_ERROR_INTR_MASK1 0x0090D0 +#define ACP_SW2_ERROR_REASON2 0x0090D4 +#define ACP_SW2_ERROR_INTR_MASK2 0x0090D8 + +#define ACP_SW2_CORB_BASE_ADDRESS 0x009100 +#define ACP_SW2_CORB_WRITE_POINTER 0x009104 +#define ACP_SW2_CORB_READ_POINTER 0x009108 +#define ACP_SW2_CORB_CONTROL 0x00910C +#define ACP_SW2_CORB_SIZE 0x009114 +#define ACP_SW2_RIRB_BASE_ADDRESS 0x009118 +#define ACP_SW2_RIRB_WRITE_POINTER 0x00911C +#define ACP_SW2_RIRB_RESPONSE_INTERRUPT_COUNT 0x009120 +#define ACP_SW2_RIRB_CONTROL 0x009124 +#define ACP_SW2_RIRB_SIZE 0x009128 +#define ACP_SW2_RIRB_FIFO_MIN_THDL 0x00912C +#define ACP_SW2_IMM_CMD_UPPER_WORD 0x009130 +#define ACP_SW2_IMM_CMD_LOWER_QWORD 0x009134 +#define ACP_SW2_IMM_RESP_UPPER_WORD 0x009138 +#define ACP_SW2_IMM_RESP_LOWER_QWORD 0x00913C +#define ACP_SW2_IMM_CMD_STS 0x009140 +#define ACP_SW2_BRA_BASE_ADDRESS 0x009144 +#define ACP_SW2_BRA_TRANSFER_SIZE 0x009148 +#define ACP_SW2_BRA_DMA_BUSY 0x00914C +#define ACP_SW2_BRA_RESP 0x009150 +#define ACP_SW2_BRA_RESP_FRAME_ADDR 0x009154 +#define ACP_SW2_BRA_CURRENT_TRANSFER_SIZE 0x009158 +#define ACP_SW2_STATE_CHANGE_STATUS_0TO7 0x00915C +#define ACP_SW2_STATE_CHANGE_STATUS_8TO11 0x009160 +#define ACP_SW2_STATE_CHANGE_STATUS_MASK_0TO7 0x009164 +#define ACP_SW2_STATE_CHANGE_STATUS_MASK_8TO11 0x009168 +#define ACP_SW2_CLK_FREQUENCY_CTRL_BANK0 0x00916C +#define ACP_SW2_CLK_FREQUENCY_CTRL_BANK1 0x009170 +#define ACP_SW2_ERROR_INTR_MASK 0x009174 +#define ACP_SW2_PHY_TEST_MODE_DATA_OFF 0x009178 +#define ACP_SW2_DATA_TO_PDM_EN 0x00917C + +#define ACP_SW2_EN 0x009200 +#define ACP_SW2_EN_STATUS 0x009204 +#define ACP_SW2_FRAMESIZE_BANK0 0x009208 +#define ACP_SW2_FRAMESIZE_BANK1 0x00920C +#define ACP_SW2_SSP_COUNTER 0x009210 +#define ACP_SW2_TX_STREAM0_EN 0x009214 +#define ACP_SW2_TX_STREAM1_EN 0x009218 +#define ACP_SW2_TX_STREAM2_EN 0x00921C +#define ACP_SW2_TX_STREAM3_EN 0x009220 +#define ACP_SW2_TX_STREAM4_EN 0x009224 +#define ACP_SW2_TX_STREAM5_EN 0x009228 +#define ACP_SW2_TX_STREAM6_EN 0x00922C +#define ACP_SW2_TX_STREAM7_EN 0x009230 +#define ACP_SW2_TX_STREAM0_EN_STATUS 0x009234 +#define ACP_SW2_TX_STREAM1_EN_STATUS 0x009238 +#define ACP_SW2_TX_STREAM2_EN_STATUS 0x00923C +#define ACP_SW2_TX_STREAM3_EN_STATUS 0x009240 +#define ACP_SW2_TX_STREAM4_EN_STATUS 0x009244 +#define ACP_SW2_TX_STREAM5_EN_STATUS 0x009248 +#define ACP_SW2_TX_STREAM6_EN_STATUS 0x00924C +#define ACP_SW2_TX_STREAM7_EN_STATUS 0x009250 +#define ACP_SW2_TX_DP0_FRAME_FORMAT 0x009254 +#define ACP_SW2_TX_DP1_FRAME_FORMAT 0x009258 +#define ACP_SW2_TX_DP2_FRAME_FORMAT 0x00925C +#define ACP_SW2_TX_DP3_FRAME_FORMAT 0x009260 +#define ACP_SW2_TX_DP4_FRAME_FORMAT 0x009264 +#define ACP_SW2_TX_DP5_FRAME_FORMAT 0x009268 +#define ACP_SW2_TX_DP6_FRAME_FORMAT 0x00926C +#define ACP_SW2_TX_DP7_FRAME_FORMAT 0x009270 +#define ACP_SW2_TX_DP0_0_SAMPLEINTERVAL_BANK0 0x009280 +#define ACP_SW2_TX_DP0_0_HCTRL_BANK0 0x009284 +#define ACP_SW2_TX_DP0_0_HCTRL_OFFSET_BANK0 0x009288 +#define ACP_SW2_TX_DP0_0_LANE_CTRL_BANK0 0x00928C +#define ACP_SW2_TX_DP0_0_CHANNEL_ENABLE_BANK0 0x009290 +#define ACP_SW2_TX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009294 +#define ACP_SW2_TX_DP0_0_SAMPLEINTERVAL_BANK1 0x009298 +#define ACP_SW2_TX_DP0_0_HCTRL_BANK1 0x00929C +#define ACP_SW2_TX_DP0_0_HCTRL_OFFSET_BANK1 0x0092A0 +#define ACP_SW2_TX_DP0_0_LANE_CTRL_BANK1 0x0092A4 +#define ACP_SW2_TX_DP0_0_CHANNEL_ENABLE_BANK1 0x0092A8 +#define ACP_SW2_TX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0092AC +#define ACP_SW2_TX_DP0_1_SAMPLEINTERVAL_BANK0 0x0092B0 +#define ACP_SW2_TX_DP0_1_HCTRL_BANK0 0x0092B4 +#define ACP_SW2_TX_DP0_1_HCTRL_OFFSET_BANK0 0x0092B8 +#define ACP_SW2_TX_DP0_1_LANE_CTRL_BANK0 0x0092BC +#define ACP_SW2_TX_DP0_1_CHANNEL_ENABLE_BANK0 0x0092C0 +#define ACP_SW2_TX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0092C4 +#define ACP_SW2_TX_DP0_1_SAMPLEINTERVAL_BANK1 0x0092C8 +#define ACP_SW2_TX_DP0_1_HCTRL_BANK1 0x0092CC +#define ACP_SW2_TX_DP0_1_HCTRL_OFFSET_BANK1 0x0092D0 +#define ACP_SW2_TX_DP0_1_LANE_CTRL_BANK1 0x0092D4 +#define ACP_SW2_TX_DP0_1_CHANNEL_ENABLE_BANK1 0x0092D8 +#define ACP_SW2_TX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0092DC +#define ACP_SW2_TX_DP0_2_SAMPLEINTERVAL_BANK0 0x0092E0 +#define ACP_SW2_TX_DP0_2_HCTRL_BANK0 0x0092E4 +#define ACP_SW2_TX_DP0_2_HCTRL_OFFSET_BANK0 0x0092E8 +#define ACP_SW2_TX_DP0_2_LANE_CTRL_BANK0 0x0092EC +#define ACP_SW2_TX_DP0_2_CHANNEL_ENABLE_BANK0 0x0092F0 +#define ACP_SW2_TX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0092F4 +#define ACP_SW2_TX_DP0_2_SAMPLEINTERVAL_BANK1 0x0092F8 +#define ACP_SW2_TX_DP0_2_HCTRL_BANK1 0x0092FC +#define ACP_SW2_TX_DP0_2_HCTRL_OFFSET_BANK1 0x009300 +#define ACP_SW2_TX_DP0_2_LANE_CTRL_BANK1 0x009304 +#define ACP_SW2_TX_DP0_2_CHANNEL_ENABLE_BANK1 0x009308 +#define ACP_SW2_TX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00930C +#define ACP_SW2_TX_DP0_3_SAMPLEINTERVAL_BANK0 0x009310 +#define ACP_SW2_TX_DP0_3_HCTRL_BANK0 0x009314 +#define ACP_SW2_TX_DP0_3_HCTRL_OFFSET_BANK0 0x009318 +#define ACP_SW2_TX_DP0_3_LANE_CTRL_BANK0 0x00931C +#define ACP_SW2_TX_DP0_3_CHANNEL_ENABLE_BANK0 0x009320 +#define ACP_SW2_TX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009324 +#define ACP_SW2_TX_DP0_3_SAMPLEINTERVAL_BANK1 0x009328 +#define ACP_SW2_TX_DP0_3_HCTRL_BANK1 0x00932C +#define ACP_SW2_TX_DP0_3_HCTRL_OFFSET_BANK1 0x009330 +#define ACP_SW2_TX_DP0_3_LANE_CTRL_BANK1 0x009334 +#define ACP_SW2_TX_DP0_3_CHANNEL_ENABLE_BANK1 0x009338 +#define ACP_SW2_TX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00933C +#define ACP_SW2_TX_DP1_SAMPLEINTERVAL_BANK0 0x009370 +#define ACP_SW2_TX_DP1_HCTRL_BANK0 0x009374 +#define ACP_SW2_TX_DP1_HCTRL_OFFSET_BANK0 0x009378 +#define ACP_SW2_TX_DP1_LANE_CTRL_BANK0 0x00937C +#define ACP_SW2_TX_DP1_CHANNEL_ENABLE_BANK0 0x009380 +#define ACP_SW2_TX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009384 +#define ACP_SW2_TX_DP1_SAMPLEINTERVAL_BANK1 0x009388 +#define ACP_SW2_TX_DP1_HCTRL_BANK1 0x00938C +#define ACP_SW2_TX_DP1_HCTRL_OFFSET_BANK1 0x009390 +#define ACP_SW2_TX_DP1_LANE_CTRL_BANK1 0x009394 +#define ACP_SW2_TX_DP1_CHANNEL_ENABLE_BANK1 0x009398 +#define ACP_SW2_TX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00939C +#define ACP_SW2_TX_DP2_SAMPLEINTERVAL_BANK0 0x0093A0 +#define ACP_SW2_TX_DP2_HCTRL_BANK0 0x0093A4 +#define ACP_SW2_TX_DP2_HCTRL_OFFSET_BANK0 0x0093A8 +#define ACP_SW2_TX_DP2_LANE_CTRL_BANK0 0x0093AC +#define ACP_SW2_TX_DP2_CHANNEL_ENABLE_BANK0 0x0093B0 +#define ACP_SW2_TX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0093B4 +#define ACP_SW2_TX_DP2_SAMPLEINTERVAL_BANK1 0x0093B8 +#define ACP_SW2_TX_DP2_HCTRL_BANK1 0x0093BC +#define ACP_SW2_TX_DP2_HCTRL_OFFSET_BANK1 0x0093C0 +#define ACP_SW2_TX_DP2_LANE_CTRL_BANK1 0x0093C4 +#define ACP_SW2_TX_DP2_CHANNEL_ENABLE_BANK1 0x0093C8 +#define ACP_SW2_TX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0093CC +#define ACP_SW2_TX_DP3_SAMPLEINTERVAL_BANK0 0x0093D0 +#define ACP_SW2_TX_DP3_HCTRL_BANK0 0x0093D4 +#define ACP_SW2_TX_DP3_HCTRL_OFFSET_BANK0 0x0093D8 +#define ACP_SW2_TX_DP3_LANE_CTRL_BANK0 0x0093DC +#define ACP_SW2_TX_DP3_CHANNEL_ENABLE_BANK0 0x0093E0 +#define ACP_SW2_TX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0093E4 +#define ACP_SW2_TX_DP3_SAMPLEINTERVAL_BANK1 0x0093E8 +#define ACP_SW2_TX_DP3_HCTRL_BANK1 0x0093EC +#define ACP_SW2_TX_DP3_HCTRL_OFFSET_BANK1 0x0093F0 +#define ACP_SW2_TX_DP3_LANE_CTRL_BANK1 0x0093F4 +#define ACP_SW2_TX_DP3_CHANNEL_ENABLE_BANK1 0x0093F8 +#define ACP_SW2_TX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0093FC +#define ACP_SW2_TX_DP4_SAMPLEINTERVAL_BANK0 0x009400 +#define ACP_SW2_TX_DP4_HCTRL_BANK0 0x009404 +#define ACP_SW2_TX_DP4_HCTRL_OFFSET_BANK0 0x009408 +#define ACP_SW2_TX_DP4_LANE_CTRL_BANK0 0x00940C +#define ACP_SW2_TX_DP4_CHANNEL_ENABLE_BANK0 0x009410 +#define ACP_SW2_TX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009414 +#define ACP_SW2_TX_DP4_SAMPLEINTERVAL_BANK1 0x009418 +#define ACP_SW2_TX_DP4_HCTRL_BANK1 0x00941C +#define ACP_SW2_TX_DP4_HCTRL_OFFSET_BANK1 0x009420 +#define ACP_SW2_TX_DP4_LANE_CTRL_BANK1 0x009424 +#define ACP_SW2_TX_DP4_CHANNEL_ENABLE_BANK1 0x009428 +#define ACP_SW2_TX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00942C +#define ACP_SW2_TX_DP5_SAMPLEINTERVAL_BANK0 0x009430 +#define ACP_SW2_TX_DP5_HCTRL_BANK0 0x009434 +#define ACP_SW2_TX_DP5_HCTRL_OFFSET_BANK0 0x009438 +#define ACP_SW2_TX_DP5_LANE_CTRL_BANK0 0x00943C +#define ACP_SW2_TX_DP5_CHANNEL_ENABLE_BANK0 0x009440 +#define ACP_SW2_TX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009444 +#define ACP_SW2_TX_DP5_SAMPLEINTERVAL_BANK1 0x009448 +#define ACP_SW2_TX_DP5_HCTRL_BANK1 0x00944C +#define ACP_SW2_TX_DP5_HCTRL_OFFSET_BANK1 0x009450 +#define ACP_SW2_TX_DP5_LANE_CTRL_BANK1 0x009454 +#define ACP_SW2_TX_DP5_CHANNEL_ENABLE_BANK1 0x009458 +#define ACP_SW2_TX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00945C +#define ACP_SW2_TX_DP6_SAMPLEINTERVAL_BANK0 0x009460 +#define ACP_SW2_TX_DP6_HCTRL_BANK0 0x009464 +#define ACP_SW2_TX_DP6_HCTRL_OFFSET_BANK0 0x009468 +#define ACP_SW2_TX_DP6_LANE_CTRL_BANK0 0x00946C +#define ACP_SW2_TX_DP6_CHANNEL_ENABLE_BANK0 0x009470 +#define ACP_SW2_TX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009474 +#define ACP_SW2_TX_DP6_SAMPLEINTERVAL_BANK1 0x009478 +#define ACP_SW2_TX_DP6_HCTRL_BANK1 0x00947C +#define ACP_SW2_TX_DP6_HCTRL_OFFSET_BANK1 0x009480 +#define ACP_SW2_TX_DP6_LANE_CTRL_BANK1 0x009484 +#define ACP_SW2_TX_DP6_CHANNEL_ENABLE_BANK1 0x009488 +#define ACP_SW2_TX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00948C +#define ACP_SW2_TX_DP7_SAMPLEINTERVAL_BANK0 0x009490 +#define ACP_SW2_TX_DP7_HCTRL_BANK0 0x009494 +#define ACP_SW2_TX_DP7_HCTRL_OFFSET_BANK0 0x009498 +#define ACP_SW2_TX_DP7_LANE_CTRL_BANK0 0x00949C +#define ACP_SW2_TX_DP7_CHANNEL_ENABLE_BANK0 0x0094A0 +#define ACP_SW2_TX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0094A4 +#define ACP_SW2_TX_DP7_SAMPLEINTERVAL_BANK1 0x0094A8 +#define ACP_SW2_TX_DP7_HCTRL_BANK1 0x0094AC +#define ACP_SW2_TX_DP7_HCTRL_OFFSET_BANK1 0x0094B0 +#define ACP_SW2_TX_DP7_LANE_CTRL_BANK1 0x0094B4 +#define ACP_SW2_TX_DP7_CHANNEL_ENABLE_BANK1 0x0094B8 +#define ACP_SW2_TX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0094BC +#define ACP_SW2_RX_STREAM0_EN 0x009514 +#define ACP_SW2_RX_STREAM1_EN 0x009518 +#define ACP_SW2_RX_STREAM2_EN 0x00951C +#define ACP_SW2_RX_STREAM3_EN 0x009520 +#define ACP_SW2_RX_STREAM4_EN 0x009524 +#define ACP_SW2_RX_STREAM5_EN 0x009528 +#define ACP_SW2_RX_STREAM6_EN 0x00952C +#define ACP_SW2_RX_STREAM7_EN 0x009530 +#define ACP_SW2_RX_STREAM0_EN_STATUS 0x009534 +#define ACP_SW2_RX_STREAM1_EN_STATUS 0x009538 +#define ACP_SW2_RX_STREAM2_EN_STATUS 0x00953C +#define ACP_SW2_RX_STREAM3_EN_STATUS 0x009540 +#define ACP_SW2_RX_STREAM4_EN_STATUS 0x009544 +#define ACP_SW2_RX_STREAM5_EN_STATUS 0x009548 +#define ACP_SW2_RX_STREAM6_EN_STATUS 0x00954C +#define ACP_SW2_RX_STREAM7_EN_STATUS 0x009550 +#define ACP_SW2_RX_DP0_FRAME_FORMAT 0x009554 +#define ACP_SW2_RX_DP1_FRAME_FORMAT 0x009558 +#define ACP_SW2_RX_DP2_FRAME_FORMAT 0x00955C +#define ACP_SW2_RX_DP3_FRAME_FORMAT 0x009560 +#define ACP_SW2_RX_DP4_FRAME_FORMAT 0x009564 +#define ACP_SW2_RX_DP5_FRAME_FORMAT 0x009568 +#define ACP_SW2_RX_DP6_FRAME_FORMAT 0x00956C +#define ACP_SW2_RX_DP7_FRAME_FORMAT 0x009570 +#define ACP_SW2_RX_DP0_0_SAMPLEINTERVAL_BANK0 0x009580 +#define ACP_SW2_RX_DP0_0_HCTRL_BANK0 0x009584 +#define ACP_SW2_RX_DP0_0_HCTRL_OFFSET_BANK0 0x009588 +#define ACP_SW2_RX_DP0_0_LANE_CTRL_BANK0 0x00958C +#define ACP_SW2_RX_DP0_0_CHANNEL_ENABLE_BANK0 0x009590 +#define ACP_SW2_RX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009594 +#define ACP_SW2_RX_DP0_0_SAMPLEINTERVAL_BANK1 0x009598 +#define ACP_SW2_RX_DP0_0_HCTRL_BANK1 0x00959C +#define ACP_SW2_RX_DP0_0_HCTRL_OFFSET_BANK1 0x0095A0 +#define ACP_SW2_RX_DP0_0_LANE_CTRL_BANK1 0x0095A4 +#define ACP_SW2_RX_DP0_0_CHANNEL_ENABLE_BANK1 0x0095A8 +#define ACP_SW2_RX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0095AC +#define ACP_SW2_RX_DP0_1_SAMPLEINTERVAL_BANK0 0x0095B0 +#define ACP_SW2_RX_DP0_1_HCTRL_BANK0 0x0095B4 +#define ACP_SW2_RX_DP0_1_HCTRL_OFFSET_BANK0 0x0095B8 +#define ACP_SW2_RX_DP0_1_LANE_CTRL_BANK0 0x0095BC +#define ACP_SW2_RX_DP0_1_CHANNEL_ENABLE_BANK0 0x0095C0 +#define ACP_SW2_RX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0095C4 +#define ACP_SW2_RX_DP0_1_SAMPLEINTERVAL_BANK1 0x0095C8 +#define ACP_SW2_RX_DP0_1_HCTRL_BANK1 0x0095CC +#define ACP_SW2_RX_DP0_1_HCTRL_OFFSET_BANK1 0x0095D0 +#define ACP_SW2_RX_DP0_1_LANE_CTRL_BANK1 0x0095D4 +#define ACP_SW2_RX_DP0_1_CHANNEL_ENABLE_BANK1 0x0095D8 +#define ACP_SW2_RX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0095DC +#define ACP_SW2_RX_DP0_2_SAMPLEINTERVAL_BANK0 0x0095E0 +#define ACP_SW2_RX_DP0_2_HCTRL_BANK0 0x0095E4 +#define ACP_SW2_RX_DP0_2_HCTRL_OFFSET_BANK0 0x0095E8 +#define ACP_SW2_RX_DP0_2_LANE_CTRL_BANK0 0x0095EC +#define ACP_SW2_RX_DP0_2_CHANNEL_ENABLE_BANK0 0x0095F0 +#define ACP_SW2_RX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0095F4 +#define ACP_SW2_RX_DP0_2_SAMPLEINTERVAL_BANK1 0x0095F8 +#define ACP_SW2_RX_DP0_2_HCTRL_BANK1 0x0095FC +#define ACP_SW2_RX_DP0_2_HCTRL_OFFSET_BANK1 0x009600 +#define ACP_SW2_RX_DP0_2_LANE_CTRL_BANK1 0x009604 +#define ACP_SW2_RX_DP0_2_CHANNEL_ENABLE_BANK1 0x009608 +#define ACP_SW2_RX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00960C +#define ACP_SW2_RX_DP0_3_SAMPLEINTERVAL_BANK0 0x009610 +#define ACP_SW2_RX_DP0_3_HCTRL_BANK0 0x009614 +#define ACP_SW2_RX_DP0_3_HCTRL_OFFSET_BANK0 0x009618 +#define ACP_SW2_RX_DP0_3_LANE_CTRL_BANK0 0x00961C +#define ACP_SW2_RX_DP0_3_CHANNEL_ENABLE_BANK0 0x009620 +#define ACP_SW2_RX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009624 +#define ACP_SW2_RX_DP0_3_SAMPLEINTERVAL_BANK1 0x009628 +#define ACP_SW2_RX_DP0_3_HCTRL_BANK1 0x00962C +#define ACP_SW2_RX_DP0_3_HCTRL_OFFSET_BANK1 0x009630 +#define ACP_SW2_RX_DP0_3_LANE_CTRL_BANK1 0x009634 +#define ACP_SW2_RX_DP0_3_CHANNEL_ENABLE_BANK1 0x009638 +#define ACP_SW2_RX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00963C +#define ACP_SW2_RX_DP1_SAMPLEINTERVAL_BANK0 0x009670 +#define ACP_SW2_RX_DP1_HCTRL_BANK0 0x009674 +#define ACP_SW2_RX_DP1_HCTRL_OFFSET_BANK0 0x009678 +#define ACP_SW2_RX_DP1_LANE_CTRL_BANK0 0x00967C +#define ACP_SW2_RX_DP1_CHANNEL_ENABLE_BANK0 0x009680 +#define ACP_SW2_RX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009684 +#define ACP_SW2_RX_DP1_SAMPLEINTERVAL_BANK1 0x009688 +#define ACP_SW2_RX_DP1_HCTRL_BANK1 0x00968C +#define ACP_SW2_RX_DP1_HCTRL_OFFSET_BANK1 0x009690 +#define ACP_SW2_RX_DP1_LANE_CTRL_BANK1 0x009694 +#define ACP_SW2_RX_DP1_CHANNEL_ENABLE_BANK1 0x009698 +#define ACP_SW2_RX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00969C +#define ACP_SW2_RX_DP2_SAMPLEINTERVAL_BANK0 0x0096A0 +#define ACP_SW2_RX_DP2_HCTRL_BANK0 0x0096A4 +#define ACP_SW2_RX_DP2_HCTRL_OFFSET_BANK0 0x0096A8 +#define ACP_SW2_RX_DP2_LANE_CTRL_BANK0 0x0096AC +#define ACP_SW2_RX_DP2_CHANNEL_ENABLE_BANK0 0x0096B0 +#define ACP_SW2_RX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0096B4 +#define ACP_SW2_RX_DP2_SAMPLEINTERVAL_BANK1 0x0096B8 +#define ACP_SW2_RX_DP2_HCTRL_BANK1 0x0096BC +#define ACP_SW2_RX_DP2_HCTRL_OFFSET_BANK1 0x0096C0 +#define ACP_SW2_RX_DP2_LANE_CTRL_BANK1 0x0096C4 +#define ACP_SW2_RX_DP2_CHANNEL_ENABLE_BANK1 0x0096C8 +#define ACP_SW2_RX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0096CC +#define ACP_SW2_RX_DP3_SAMPLEINTERVAL_BANK0 0x0096D0 +#define ACP_SW2_RX_DP3_HCTRL_BANK0 0x0096D4 +#define ACP_SW2_RX_DP3_HCTRL_OFFSET_BANK0 0x0096D8 +#define ACP_SW2_RX_DP3_LANE_CTRL_BANK0 0x0096DC +#define ACP_SW2_RX_DP3_CHANNEL_ENABLE_BANK0 0x0096E0 +#define ACP_SW2_RX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0096E4 +#define ACP_SW2_RX_DP3_SAMPLEINTERVAL_BANK1 0x0096E8 +#define ACP_SW2_RX_DP3_HCTRL_BANK1 0x0096EC +#define ACP_SW2_RX_DP3_HCTRL_OFFSET_BANK1 0x0096F0 +#define ACP_SW2_RX_DP3_LANE_CTRL_BANK1 0x0096F4 +#define ACP_SW2_RX_DP3_CHANNEL_ENABLE_BANK1 0x0096F8 +#define ACP_SW2_RX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0096FC +#define ACP_SW2_RX_DP4_SAMPLEINTERVAL_BANK0 0x009700 +#define ACP_SW2_RX_DP4_HCTRL_BANK0 0x009704 +#define ACP_SW2_RX_DP4_HCTRL_OFFSET_BANK0 0x009708 +#define ACP_SW2_RX_DP4_LANE_CTRL_BANK0 0x00970C +#define ACP_SW2_RX_DP4_CHANNEL_ENABLE_BANK0 0x009710 +#define ACP_SW2_RX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009714 +#define ACP_SW2_RX_DP4_SAMPLEINTERVAL_BANK1 0x009718 +#define ACP_SW2_RX_DP4_HCTRL_BANK1 0x00971C +#define ACP_SW2_RX_DP4_HCTRL_OFFSET_BANK1 0x009720 +#define ACP_SW2_RX_DP4_LANE_CTRL_BANK1 0x009724 +#define ACP_SW2_RX_DP4_CHANNEL_ENABLE_BANK1 0x009728 +#define ACP_SW2_RX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00972C +#define ACP_SW2_RX_DP5_SAMPLEINTERVAL_BANK0 0x009730 +#define ACP_SW2_RX_DP5_HCTRL_BANK0 0x009734 +#define ACP_SW2_RX_DP5_HCTRL_OFFSET_BANK0 0x009738 +#define ACP_SW2_RX_DP5_LANE_CTRL_BANK0 0x00973C +#define ACP_SW2_RX_DP5_CHANNEL_ENABLE_BANK0 0x009740 +#define ACP_SW2_RX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009744 +#define ACP_SW2_RX_DP5_SAMPLEINTERVAL_BANK1 0x009748 +#define ACP_SW2_RX_DP5_HCTRL_BANK1 0x00974C +#define ACP_SW2_RX_DP5_HCTRL_OFFSET_BANK1 0x009750 +#define ACP_SW2_RX_DP5_LANE_CTRL_BANK1 0x009754 +#define ACP_SW2_RX_DP5_CHANNEL_ENABLE_BANK1 0x009758 +#define ACP_SW2_RX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00975C +#define ACP_SW2_RX_DP6_SAMPLEINTERVAL_BANK0 0x009760 +#define ACP_SW2_RX_DP6_HCTRL_BANK0 0x009764 +#define ACP_SW2_RX_DP6_HCTRL_OFFSET_BANK0 0x009768 +#define ACP_SW2_RX_DP6_LANE_CTRL_BANK0 0x00976C +#define ACP_SW2_RX_DP6_CHANNEL_ENABLE_BANK0 0x009770 +#define ACP_SW2_RX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK0 0x009774 +#define ACP_SW2_RX_DP6_SAMPLEINTERVAL_BANK1 0x009778 +#define ACP_SW2_RX_DP6_HCTRL_BANK1 0x00977C +#define ACP_SW2_RX_DP6_HCTRL_OFFSET_BANK1 0x009780 +#define ACP_SW2_RX_DP6_LANE_CTRL_BANK1 0x009784 +#define ACP_SW2_RX_DP6_CHANNEL_ENABLE_BANK1 0x009788 +#define ACP_SW2_RX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00978C +#define ACP_SW2_RX_DP7_SAMPLEINTERVAL_BANK0 0x009790 +#define ACP_SW2_RX_DP7_HCTRL_BANK0 0x009794 +#define ACP_SW2_RX_DP7_HCTRL_OFFSET_BANK0 0x009798 +#define ACP_SW2_RX_DP7_LANE_CTRL_BANK0 0x00979C +#define ACP_SW2_RX_DP7_CHANNEL_ENABLE_BANK0 0x0097A0 +#define ACP_SW2_RX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK0 0x0097A4 +#define ACP_SW2_RX_DP7_SAMPLEINTERVAL_BANK1 0x0097A8 +#define ACP_SW2_RX_DP7_HCTRL_BANK1 0x0097AC +#define ACP_SW2_RX_DP7_HCTRL_OFFSET_BANK1 0x0097B0 +#define ACP_SW2_RX_DP7_LANE_CTRL_BANK1 0x0097B4 +#define ACP_SW2_RX_DP7_CHANNEL_ENABLE_BANK1 0x0097B8 +#define ACP_SW2_RX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK1 0x0097BC +#define ACP_SW2_BPT_PORT_EN 0x0097C0 +#define ACP_SW2_BPT_PORT_EN_STATUS 0x0097C4 +#define ACP_SW2_BPT_PORT_FRAME_FORMAT 0x0097C8 +#define ACP_SW2_BPT_PORT_SAMPLEINTERVAL_BANK0 0x0097CC +#define ACP_SW2_BPT_PORT_HCTRL_BANK0 0x0097D0 +#define ACP_SW2_BPT_PORT_OFFSET_BANK0 0x0097D4 +#define ACP_SW2_BPT_PORT_LANE_SELECT_BANK0 0x0097D8 +#define ACP_SW2_BPT_PORT_CHANNEL_ENABLE_BANK0 0x0097DC +#define ACP_SW2_BPT_PORT_SAMPLEINTERVAL_BANK1 0x0097E0 +#define ACP_SW2_BPT_PORT_HCTRL_BANK1 0x0097E4 +#define ACP_SW2_BPT_PORT_OFFSET_BANK1 0x0097E8 +#define ACP_SW2_BPT_PORT_LANE_SELECT_BANK1 0x0097EC +#define ACP_SW2_BPT_PORT_CHANNEL_ENABLE_BANK1 0x0097F0 +#define ACP_SW2_BPT_PORT_FIRST_BYTE_ADDR 0x0097F4 +#define ACP_SW2_CLK_RESUME_CTRL 0x0097F8 +#define ACP_SW2_CLK_RESUME_DELAY_CNTR 0x0097FC +#define ACP_SW2_BUS_RESET_CTRL 0x009800 +#define ACP_SW2_PRBS_ERR_STATUS 0x009804 +#define ACP_SW2_WALLCLK_MISC 0x009808 +#define ACP_SW2_WALL_CLK_COUNTER 0x00980C +#define ACP_SW2_PING_STATUS_REGISTER_LOW 0x009810 +#define ACP_SW2_PING_STATUS_REGISTER_HIGH 0x009814 +#define ACP_SW2_PING_STATUS_CURRENT_BANK_SEL 0x009818 +#define ACP_SW2_TZD_CHANGE 0x00981C +#define ACP_SW2_WALLCLK_INTR_CNTL 0x009820 + +#define ACP_SW3_GLOBAL_CAPABILITIES 0x00AE00 +#define ACP_SW3_RX_DMA0_RINGBUFADDR 0x00AE04 +#define ACP_SW3_RX_DMA0_RINGBUFSIZE 0x00AE08 +#define ACP_SW3_RX_DMA0_FIFOADDR 0x00AE0C +#define ACP_SW3_RX_DMA0_FIFOSIZE 0x00AE10 +#define ACP_SW3_RX_DMA0_BURST_SIZE 0x00AE14 +#define ACP_SW3_RX_DMA0_LINKPOSITIONCNTR 0x00AE18 +#define ACP_SW3_RX_DMA0_LINEARPOSITIONCNTR_HIGH 0x00AE1C +#define ACP_SW3_RX_DMA0_LINEARPOSITIONCNTR_LOW 0x00AE20 +#define ACP_SW3_RX_DMA0_INTR_WATERMARK_SIZE 0x00AE24 +#define ACP_SW3_RX_DMA1_RINGBUFADDR 0x00AE28 +#define ACP_SW3_RX_DMA1_RINGBUFSIZE 0x00AE2C +#define ACP_SW3_RX_DMA1_FIFOADDR 0x00AE30 +#define ACP_SW3_RX_DMA1_FIFOSIZE 0x00AE34 +#define ACP_SW3_RX_DMA1_BURST_SIZE 0x00AE38 +#define ACP_SW3_RX_DMA1_LINKPOSITIONCNTR 0x00AE3C +#define ACP_SW3_RX_DMA1_LINEARPOSITIONCNTR_HIGH 0x00AE40 +#define ACP_SW3_RX_DMA1_LINEARPOSITIONCNTR_LOW 0x00AE44 +#define ACP_SW3_RX_DMA1_INTR_WATERMARK_SIZE 0x00AE48 +#define ACP_SW3_RX_DMA2_RINGBUFADDR 0x00AE4C +#define ACP_SW3_RX_DMA2_RINGBUFSIZE 0x00AE50 +#define ACP_SW3_RX_DMA2_FIFOADDR 0x00AE54 +#define ACP_SW3_RX_DMA2_FIFOSIZE 0x00AE58 +#define ACP_SW3_RX_DMA2_BURST_SIZE 0x00AE5C +#define ACP_SW3_RX_DMA2_LINKPOSITIONCNTR 0x00AE60 +#define ACP_SW3_RX_DMA2_LINEARPOSITIONCNTR_HIGH 0x00AE64 +#define ACP_SW3_RX_DMA2_LINEARPOSITIONCNTR_LOW 0x00AE68 +#define ACP_SW3_RX_DMA2_INTR_WATERMARK_SIZE 0x00AE6C +#define ACP_SW3_RX_DMA3_RINGBUFADDR 0x00AE70 +#define ACP_SW3_RX_DMA3_RINGBUFSIZE 0x00AE74 +#define ACP_SW3_RX_DMA3_FIFOADDR 0x00AE78 +#define ACP_SW3_RX_DMA3_FIFOSIZE 0x00AE7C +#define ACP_SW3_RX_DMA3_BURST_SIZE 0x00AE80 +#define ACP_SW3_RX_DMA3_LINKPOSITIONCNTR 0x00AE84 +#define ACP_SW3_RX_DMA3_LINEARPOSITIONCNTR_HIGH 0x00AE88 +#define ACP_SW3_RX_DMA3_LINEARPOSITIONCNTR_LOW 0x00AE8C +#define ACP_SW3_RX_DMA3_INTR_WATERMARK_SIZE 0x00AE90 +#define ACP_SW3_RX_DMA4_RINGBUFADDR 0x00AE94 +#define ACP_SW3_RX_DMA4_RINGBUFSIZE 0x00AE98 +#define ACP_SW3_RX_DMA4_FIFOADDR 0x00AE9C +#define ACP_SW3_RX_DMA4_FIFOSIZE 0x00AEA0 +#define ACP_SW3_RX_DMA4_BURST_SIZE 0x00AEA4 +#define ACP_SW3_RX_DMA4_LINKPOSITIONCNTR 0x00AEA8 +#define ACP_SW3_RX_DMA4_LINEARPOSITIONCNTR_HIGH 0x00AEAC +#define ACP_SW3_RX_DMA4_LINEARPOSITIONCNTR_LOW 0x00AEB0 +#define ACP_SW3_RX_DMA4_INTR_WATERMARK_SIZE 0x00AEB4 +#define ACP_SW3_RX_DMA5_RINGBUFADDR 0x00AEB8 +#define ACP_SW3_RX_DMA5_RINGBUFSIZE 0x00AEBC +#define ACP_SW3_RX_DMA5_FIFOADDR 0x00AEC0 +#define ACP_SW3_RX_DMA5_FIFOSIZE 0x00AEC4 +#define ACP_SW3_RX_DMA5_BURST_SIZE 0x00AEC8 +#define ACP_SW3_RX_DMA5_LINKPOSITIONCNTR 0x00AECC +#define ACP_SW3_RX_DMA5_LINEARPOSITIONCNTR_HIGH 0x00AED0 +#define ACP_SW3_RX_DMA5_LINEARPOSITIONCNTR_LOW 0x00AED4 +#define ACP_SW3_RX_DMA5_INTR_WATERMARK_SIZE 0x00AED8 +#define ACP_SW3_RX_DMA6_RINGBUFADDR 0x00AEDC +#define ACP_SW3_RX_DMA6_RINGBUFSIZE 0x00AEE0 +#define ACP_SW3_RX_DMA6_FIFOADDR 0x00AEE4 +#define ACP_SW3_RX_DMA6_FIFOSIZE 0x00AEE8 +#define ACP_SW3_RX_DMA6_BURST_SIZE 0x00AEEC +#define ACP_SW3_RX_DMA6_LINKPOSITIONCNTR 0x00AEF0 +#define ACP_SW3_RX_DMA6_LINEARPOSITIONCNTR_HIGH 0x00AEF4 +#define ACP_SW3_RX_DMA6_LINEARPOSITIONCNTR_LOW 0x00AEF8 +#define ACP_SW3_RX_DMA6_INTR_WATERMARK_SIZE 0x00AEFC +#define ACP_SW3_RX_DMA7_RINGBUFADDR 0x00AF00 +#define ACP_SW3_RX_DMA7_RINGBUFSIZE 0x00AF04 +#define ACP_SW3_RX_DMA7_FIFOADDR 0x00AF08 +#define ACP_SW3_RX_DMA7_FIFOSIZE 0x00AF0C +#define ACP_SW3_RX_DMA7_BURST_SIZE 0x00AF10 +#define ACP_SW3_RX_DMA7_LINKPOSITIONCNTR 0x00AF14 +#define ACP_SW3_RX_DMA7_LINEARPOSITIONCNTR_HIGH 0x00AF18 +#define ACP_SW3_RX_DMA7_LINEARPOSITIONCNTR_LOW 0x00AF1C +#define ACP_SW3_RX_DMA7_INTR_WATERMARK_SIZE 0x00AF20 +#define ACP_SW3_TX_DMA0_RINGBUFADDR 0x00AF24 +#define ACP_SW3_TX_DMA0_RINGBUFSIZE 0x00AF28 +#define ACP_SW3_TX_DMA0_FIFOADDR 0x00AF2C +#define ACP_SW3_TX_DMA0_FIFOSIZE 0x00AF30 +#define ACP_SW3_TX_DMA0_BURST_SIZE 0x00AF34 +#define ACP_SW3_TX_DMA0_LINKPOSITIONCNTR 0x00AF38 +#define ACP_SW3_TX_DMA0_LINEARPOSITIONCNTR_HIGH 0x00AF3C +#define ACP_SW3_TX_DMA0_LINEARPOSITIONCNTR_LOW 0x00AF40 +#define ACP_SW3_TX_DMA0_INTR_WATERMARK_SIZE 0x00AF44 +#define ACP_SW3_TX_DMA1_RINGBUFADDR 0x00AF48 +#define ACP_SW3_TX_DMA1_RINGBUFSIZE 0x00AF4C +#define ACP_SW3_TX_DMA1_FIFOADDR 0x00AF50 +#define ACP_SW3_TX_DMA1_FIFOSIZE 0x00AF54 +#define ACP_SW3_TX_DMA1_BURST_SIZE 0x00AF58 +#define ACP_SW3_TX_DMA1_LINKPOSITIONCNTR 0x00AF5C +#define ACP_SW3_TX_DMA1_LINEARPOSITIONCNTR_HIGH 0x00AF60 +#define ACP_SW3_TX_DMA1_LINEARPOSITIONCNTR_LOW 0x00AF64 +#define ACP_SW3_TX_DMA1_INTR_WATERMARK_SIZE 0x00AF68 +#define ACP_SW3_TX_DMA2_RINGBUFADDR 0x00AF6C +#define ACP_SW3_TX_DMA2_RINGBUFSIZE 0x00AF70 +#define ACP_SW3_TX_DMA2_FIFOADDR 0x00AF74 +#define ACP_SW3_TX_DMA2_FIFOSIZE 0x00AF78 +#define ACP_SW3_TX_DMA2_BURST_SIZE 0x00AF7C +#define ACP_SW3_TX_DMA2_LINKPOSITIONCNTR 0x00AF80 +#define ACP_SW3_TX_DMA2_LINEARPOSITIONCNTR_HIGH 0x00AF84 +#define ACP_SW3_TX_DMA2_LINEARPOSITIONCNTR_LOW 0x00AF88 +#define ACP_SW3_TX_DMA2_INTR_WATERMARK_SIZE 0x00AF8C +#define ACP_SW3_TX_DMA3_RINGBUFADDR 0x00AF90 +#define ACP_SW3_TX_DMA3_RINGBUFSIZE 0x00AF94 +#define ACP_SW3_TX_DMA3_FIFOADDR 0x00AF98 +#define ACP_SW3_TX_DMA3_FIFOSIZE 0x00AF9C +#define ACP_SW3_TX_DMA3_BURST_SIZE 0x00AFA0 +#define ACP_SW3_TX_DMA3_LINKPOSITIONCNTR 0x00AFA4 +#define ACP_SW3_TX_DMA3_LINEARPOSITIONCNTR_HIGH 0x00AFA8 +#define ACP_SW3_TX_DMA3_LINEARPOSITIONCNTR_LOW 0x00AFAC +#define ACP_SW3_TX_DMA3_INTR_WATERMARK_SIZE 0x00AFB0 +#define ACP_SW3_TX_DMA4_RINGBUFADDR 0x00AFB4 +#define ACP_SW3_TX_DMA4_RINGBUFSIZE 0x00AFB8 +#define ACP_SW3_TX_DMA4_FIFOADDR 0x00AFBC +#define ACP_SW3_TX_DMA4_FIFOSIZE 0x00AFC0 +#define ACP_SW3_TX_DMA4_BURST_SIZE 0x00AFC4 +#define ACP_SW3_TX_DMA4_LINKPOSITIONCNTR 0x00AFC8 +#define ACP_SW3_TX_DMA4_LINEARPOSITIONCNTR_HIGH 0x00AFCC +#define ACP_SW3_TX_DMA4_LINEARPOSITIONCNTR_LOW 0x00AFD0 +#define ACP_SW3_TX_DMA4_INTR_WATERMARK_SIZE 0x00AFD4 +#define ACP_SW3_TX_DMA5_RINGBUFADDR 0x00AFD8 +#define ACP_SW3_TX_DMA5_RINGBUFSIZE 0x00AFDC +#define ACP_SW3_TX_DMA5_FIFOADDR 0x00AFE0 +#define ACP_SW3_TX_DMA5_FIFOSIZE 0x00AFE4 +#define ACP_SW3_TX_DMA5_BURST_SIZE 0x00AFE8 +#define ACP_SW3_TX_DMA5_LINKPOSITIONCNTR 0x00AFEC +#define ACP_SW3_TX_DMA5_LINEARPOSITIONCNTR_HIGH 0x00AFF0 +#define ACP_SW3_TX_DMA5_LINEARPOSITIONCNTR_LOW 0x00AFF4 +#define ACP_SW3_TX_DMA5_INTR_WATERMARK_SIZE 0x00AFF8 +#define ACP_SW3_TX_DMA6_RINGBUFADDR 0x00AFFC +#define ACP_SW3_TX_DMA6_RINGBUFSIZE 0x00B000 +#define ACP_SW3_TX_DMA6_FIFOADDR 0x00B004 +#define ACP_SW3_TX_DMA6_FIFOSIZE 0x00B008 +#define ACP_SW3_TX_DMA6_BURST_SIZE 0x00B00C +#define ACP_SW3_TX_DMA6_LINKPOSITIONCNTR 0x00B010 +#define ACP_SW3_TX_DMA6_LINEARPOSITIONCNTR_HIGH 0x00B014 +#define ACP_SW3_TX_DMA6_LINEARPOSITIONCNTR_LOW 0x00B018 +#define ACP_SW3_TX_DMA6_INTR_WATERMARK_SIZE 0x00B01C +#define ACP_SW3_TX_DMA7_RINGBUFADDR 0x00B020 +#define ACP_SW3_TX_DMA7_RINGBUFSIZE 0x00B024 +#define ACP_SW3_TX_DMA7_FIFOADDR 0x00B028 +#define ACP_SW3_TX_DMA7_FIFOSIZE 0x00B02C +#define ACP_SW3_TX_DMA7_BURST_SIZE 0x00B030 +#define ACP_SW3_TX_DMA7_LINKPOSITIONCNTR 0x00B034 +#define ACP_SW3_TX_DMA7_LINEARPOSITIONCNTR_HIGH 0x00B038 +#define ACP_SW3_TX_DMA7_LINEARPOSITIONCNTR_LOW 0x00B03C +#define ACP_SW3_TX_DMA7_INTR_WATERMARK_SIZE 0x00B040 +#define ACP_SW3_RX_DMA0_POS_TRACK 0x00B044 +#define ACP_SW3_RX_DMA0_POS 0x00B048 +#define ACP_SW3_RX_DMA1_POS_TRACK 0x00B04C +#define ACP_SW3_RX_DMA1_POS 0x00B050 +#define ACP_SW3_RX_DMA2_POS_TRACK 0x00B054 +#define ACP_SW3_RX_DMA2_POS 0x00B058 +#define ACP_SW3_RX_DMA3_POS_TRACK 0x00B05C +#define ACP_SW3_RX_DMA3_POS 0x00B060 +#define ACP_SW3_RX_DMA4_POS_TRACK 0x00B064 +#define ACP_SW3_RX_DMA4_POS 0x00B068 +#define ACP_SW3_RX_DMA5_POS_TRACK 0x00B06C +#define ACP_SW3_RX_DMA5_POS 0x00B070 +#define ACP_SW3_RX_DMA6_POS_TRACK 0x00B074 +#define ACP_SW3_RX_DMA6_POS 0x00B078 +#define ACP_SW3_RX_DMA7_POS_TRACK 0x00B07C +#define ACP_SW3_RX_DMA7_POS 0x00B080 +#define ACP_SW3_TX_DMA0_POS_TRACK 0x00B084 +#define ACP_SW3_TX_DMA0_POS 0x00B088 +#define ACP_SW3_TX_DMA1_POS_TRACK 0x00B08C +#define ACP_SW3_TX_DMA1_POS 0x00B090 +#define ACP_SW3_TX_DMA2_POS_TRACK 0x00B094 +#define ACP_SW3_TX_DMA2_POS 0x00B098 +#define ACP_SW3_TX_DMA3_POS_TRACK 0x00B09C +#define ACP_SW3_TX_DMA3_POS 0x00B0A0 +#define ACP_SW3_TX_DMA4_POS_TRACK 0x00B0A4 +#define ACP_SW3_TX_DMA4_POS 0x00B0A8 +#define ACP_SW3_TX_DMA5_POS_TRACK 0x00B0AC +#define ACP_SW3_TX_DMA5_POS 0x00B0B0 +#define ACP_SW3_TX_DMA6_POS_TRACK 0x00B0B4 +#define ACP_SW3_TX_DMA6_POS 0x00B0B8 +#define ACP_SW3_TX_DMA7_POS_TRACK 0x00B0BC +#define ACP_SW3_TX_DMA7_POS 0x00B0C0 +#define ACP_SW3_FIFO_ERROR_REASON 0x00B0C4 +#define ACP_SW3_FIFO_ERROR_INTR_MASK 0x00B0C8 +#define ACP_SW3_ERROR_REASON1 0x00B0CC +#define ACP_SW3_ERROR_INTR_MASK1 0x00B0D0 +#define ACP_SW3_ERROR_REASON2 0x00B0D4 +#define ACP_SW3_ERROR_INTR_MASK2 0x00B0D8 + +#define ACP_SW3_CORB_BASE_ADDRESS 0x00B100 +#define ACP_SW3_CORB_WRITE_POINTER 0x00B104 +#define ACP_SW3_CORB_READ_POINTER 0x00B108 +#define ACP_SW3_CORB_CONTROL 0x00B10C +#define ACP_SW3_CORB_SIZE 0x00B114 +#define ACP_SW3_RIRB_BASE_ADDRESS 0x00B118 +#define ACP_SW3_RIRB_WRITE_POINTER 0x00B11C +#define ACP_SW3_RIRB_RESPONSE_INTERRUPT_COUNT 0x00B120 +#define ACP_SW3_RIRB_CONTROL 0x00B124 +#define ACP_SW3_RIRB_SIZE 0x00B128 +#define ACP_SW3_RIRB_FIFO_MIN_THDL 0x00B12C +#define ACP_SW3_IMM_CMD_UPPER_WORD 0x00B130 +#define ACP_SW3_IMM_CMD_LOWER_QWORD 0x00B134 +#define ACP_SW3_IMM_RESP_UPPER_WORD 0x00B138 +#define ACP_SW3_IMM_RESP_LOWER_QWORD 0x00B13C +#define ACP_SW3_IMM_CMD_STS 0x00B140 +#define ACP_SW3_BRA_BASE_ADDRESS 0x00B144 +#define ACP_SW3_BRA_TRANSFER_SIZE 0x00B148 +#define ACP_SW3_BRA_DMA_BUSY 0x00B14C +#define ACP_SW3_BRA_RESP 0x00B150 +#define ACP_SW3_BRA_RESP_FRAME_ADDR 0x00B154 +#define ACP_SW3_BRA_CURRENT_TRANSFER_SIZE 0x00B158 +#define ACP_SW3_STATE_CHANGE_STATUS_0TO7 0x00B15C +#define ACP_SW3_STATE_CHANGE_STATUS_8TO11 0x00B160 +#define ACP_SW3_STATE_CHANGE_STATUS_MASK_0TO7 0x00B164 +#define ACP_SW3_STATE_CHANGE_STATUS_MASK_8TO11 0x00B168 +#define ACP_SW3_CLK_FREQUENCY_CTRL_BANK0 0x00B16C +#define ACP_SW3_CLK_FREQUENCY_CTRL_BANK1 0x00B170 +#define ACP_SW3_ERROR_INTR_MASK 0x00B174 +#define ACP_SW3_PHY_TEST_MODE_DATA_OFF 0x00B178 +#define ACP_SW3_DATA_TO_PDM_EN 0x00B17C + +#define ACP_SW3_EN 0x00B200 +#define ACP_SW3_EN_STATUS 0x00B204 +#define ACP_SW3_FRAMESIZE_BANK0 0x00B208 +#define ACP_SW3_FRAMESIZE_BANK1 0x00B20C +#define ACP_SW3_SSP_COUNTER 0x00B210 +#define ACP_SW3_TX_STREAM0_EN 0x00B214 +#define ACP_SW3_TX_STREAM1_EN 0x00B218 +#define ACP_SW3_TX_STREAM2_EN 0x00B21C +#define ACP_SW3_TX_STREAM3_EN 0x00B220 +#define ACP_SW3_TX_STREAM4_EN 0x00B224 +#define ACP_SW3_TX_STREAM5_EN 0x00B228 +#define ACP_SW3_TX_STREAM6_EN 0x00B22C +#define ACP_SW3_TX_STREAM7_EN 0x00B230 +#define ACP_SW3_TX_STREAM0_EN_STATUS 0x00B234 +#define ACP_SW3_TX_STREAM1_EN_STATUS 0x00B238 +#define ACP_SW3_TX_STREAM2_EN_STATUS 0x00B23C +#define ACP_SW3_TX_STREAM3_EN_STATUS 0x00B240 +#define ACP_SW3_TX_STREAM4_EN_STATUS 0x00B244 +#define ACP_SW3_TX_STREAM5_EN_STATUS 0x00B248 +#define ACP_SW3_TX_STREAM6_EN_STATUS 0x00B24C +#define ACP_SW3_TX_STREAM7_EN_STATUS 0x00B250 +#define ACP_SW3_TX_DP0_FRAME_FORMAT 0x00B254 +#define ACP_SW3_TX_DP1_FRAME_FORMAT 0x00B258 +#define ACP_SW3_TX_DP2_FRAME_FORMAT 0x00B25C +#define ACP_SW3_TX_DP3_FRAME_FORMAT 0x00B260 +#define ACP_SW3_TX_DP4_FRAME_FORMAT 0x00B264 +#define ACP_SW3_TX_DP5_FRAME_FORMAT 0x00B268 +#define ACP_SW3_TX_DP6_FRAME_FORMAT 0x00B26C +#define ACP_SW3_TX_DP7_FRAME_FORMAT 0x00B270 +#define ACP_SW3_TX_DP0_0_SAMPLEINTERVAL_BANK0 0x00B280 +#define ACP_SW3_TX_DP0_0_HCTRL_BANK0 0x00B284 +#define ACP_SW3_TX_DP0_0_HCTRL_OFFSET_BANK0 0x00B288 +#define ACP_SW3_TX_DP0_0_LANE_CTRL_BANK0 0x00B28C +#define ACP_SW3_TX_DP0_0_CHANNEL_ENABLE_BANK0 0x00B290 +#define ACP_SW3_TX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B294 +#define ACP_SW3_TX_DP0_0_SAMPLEINTERVAL_BANK1 0x00B298 +#define ACP_SW3_TX_DP0_0_HCTRL_BANK1 0x00B29C +#define ACP_SW3_TX_DP0_0_HCTRL_OFFSET_BANK1 0x00B2A0 +#define ACP_SW3_TX_DP0_0_LANE_CTRL_BANK1 0x00B2A4 +#define ACP_SW3_TX_DP0_0_CHANNEL_ENABLE_BANK1 0x00B2A8 +#define ACP_SW3_TX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B2AC +#define ACP_SW3_TX_DP0_1_SAMPLEINTERVAL_BANK0 0x00B2B0 +#define ACP_SW3_TX_DP0_1_HCTRL_BANK0 0x00B2B4 +#define ACP_SW3_TX_DP0_1_HCTRL_OFFSET_BANK0 0x00B2B8 +#define ACP_SW3_TX_DP0_1_LANE_CTRL_BANK0 0x00B2BC +#define ACP_SW3_TX_DP0_1_CHANNEL_ENABLE_BANK0 0x00B2C0 +#define ACP_SW3_TX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B2C4 +#define ACP_SW3_TX_DP0_1_SAMPLEINTERVAL_BANK1 0x00B2C8 +#define ACP_SW3_TX_DP0_1_HCTRL_BANK1 0x00B2CC +#define ACP_SW3_TX_DP0_1_HCTRL_OFFSET_BANK1 0x00B2D0 +#define ACP_SW3_TX_DP0_1_LANE_CTRL_BANK1 0x00B2D4 +#define ACP_SW3_TX_DP0_1_CHANNEL_ENABLE_BANK1 0x00B2D8 +#define ACP_SW3_TX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B2DC +#define ACP_SW3_TX_DP0_2_SAMPLEINTERVAL_BANK0 0x00B2E0 +#define ACP_SW3_TX_DP0_2_HCTRL_BANK0 0x00B2E4 +#define ACP_SW3_TX_DP0_2_HCTRL_OFFSET_BANK0 0x00B2E8 +#define ACP_SW3_TX_DP0_2_LANE_CTRL_BANK0 0x00B2EC +#define ACP_SW3_TX_DP0_2_CHANNEL_ENABLE_BANK0 0x00B2F0 +#define ACP_SW3_TX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B2F4 +#define ACP_SW3_TX_DP0_2_SAMPLEINTERVAL_BANK1 0x00B2F8 +#define ACP_SW3_TX_DP0_2_HCTRL_BANK1 0x00B2FC +#define ACP_SW3_TX_DP0_2_HCTRL_OFFSET_BANK1 0x00B300 +#define ACP_SW3_TX_DP0_2_LANE_CTRL_BANK1 0x00B304 +#define ACP_SW3_TX_DP0_2_CHANNEL_ENABLE_BANK1 0x00B308 +#define ACP_SW3_TX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B30C +#define ACP_SW3_TX_DP0_3_SAMPLEINTERVAL_BANK0 0x00B310 +#define ACP_SW3_TX_DP0_3_HCTRL_BANK0 0x00B314 +#define ACP_SW3_TX_DP0_3_HCTRL_OFFSET_BANK0 0x00B318 +#define ACP_SW3_TX_DP0_3_LANE_CTRL_BANK0 0x00B31C +#define ACP_SW3_TX_DP0_3_CHANNEL_ENABLE_BANK0 0x00B320 +#define ACP_SW3_TX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B324 +#define ACP_SW3_TX_DP0_3_SAMPLEINTERVAL_BANK1 0x00B328 +#define ACP_SW3_TX_DP0_3_HCTRL_BANK1 0x00B32C +#define ACP_SW3_TX_DP0_3_HCTRL_OFFSET_BANK1 0x00B330 +#define ACP_SW3_TX_DP0_3_LANE_CTRL_BANK1 0x00B334 +#define ACP_SW3_TX_DP0_3_CHANNEL_ENABLE_BANK1 0x00B338 +#define ACP_SW3_TX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B33C +#define ACP_SW3_TX_DP1_SAMPLEINTERVAL_BANK0 0x00B370 +#define ACP_SW3_TX_DP1_HCTRL_BANK0 0x00B374 +#define ACP_SW3_TX_DP1_HCTRL_OFFSET_BANK0 0x00B378 +#define ACP_SW3_TX_DP1_LANE_CTRL_BANK0 0x00B37C +#define ACP_SW3_TX_DP1_CHANNEL_ENABLE_BANK0 0x00B380 +#define ACP_SW3_TX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B384 +#define ACP_SW3_TX_DP1_SAMPLEINTERVAL_BANK1 0x00B388 +#define ACP_SW3_TX_DP1_HCTRL_BANK1 0x00B38C +#define ACP_SW3_TX_DP1_HCTRL_OFFSET_BANK1 0x00B390 +#define ACP_SW3_TX_DP1_LANE_CTRL_BANK1 0x00B394 +#define ACP_SW3_TX_DP1_CHANNEL_ENABLE_BANK1 0x00B398 +#define ACP_SW3_TX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B39C +#define ACP_SW3_TX_DP2_SAMPLEINTERVAL_BANK0 0x00B3A0 +#define ACP_SW3_TX_DP2_HCTRL_BANK0 0x00B3A4 +#define ACP_SW3_TX_DP2_HCTRL_OFFSET_BANK0 0x00B3A8 +#define ACP_SW3_TX_DP2_LANE_CTRL_BANK0 0x00B3AC +#define ACP_SW3_TX_DP2_CHANNEL_ENABLE_BANK0 0x00B3B0 +#define ACP_SW3_TX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B3B4 +#define ACP_SW3_TX_DP2_SAMPLEINTERVAL_BANK1 0x00B3B8 +#define ACP_SW3_TX_DP2_HCTRL_BANK1 0x00B3BC +#define ACP_SW3_TX_DP2_HCTRL_OFFSET_BANK1 0x00B3C0 +#define ACP_SW3_TX_DP2_LANE_CTRL_BANK1 0x00B3C4 +#define ACP_SW3_TX_DP2_CHANNEL_ENABLE_BANK1 0x00B3C8 +#define ACP_SW3_TX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B3CC +#define ACP_SW3_TX_DP3_SAMPLEINTERVAL_BANK0 0x00B3D0 +#define ACP_SW3_TX_DP3_HCTRL_BANK0 0x00B3D4 +#define ACP_SW3_TX_DP3_HCTRL_OFFSET_BANK0 0x00B3D8 +#define ACP_SW3_TX_DP3_LANE_CTRL_BANK0 0x00B3DC +#define ACP_SW3_TX_DP3_CHANNEL_ENABLE_BANK0 0x00B3E0 +#define ACP_SW3_TX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B3E4 +#define ACP_SW3_TX_DP3_SAMPLEINTERVAL_BANK1 0x00B3E8 +#define ACP_SW3_TX_DP3_HCTRL_BANK1 0x00B3EC +#define ACP_SW3_TX_DP3_HCTRL_OFFSET_BANK1 0x00B3F0 +#define ACP_SW3_TX_DP3_LANE_CTRL_BANK1 0x00B3F4 +#define ACP_SW3_TX_DP3_CHANNEL_ENABLE_BANK1 0x00B3F8 +#define ACP_SW3_TX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B3FC +#define ACP_SW3_TX_DP4_SAMPLEINTERVAL_BANK0 0x00B400 +#define ACP_SW3_TX_DP4_HCTRL_BANK0 0x00B404 +#define ACP_SW3_TX_DP4_HCTRL_OFFSET_BANK0 0x00B408 +#define ACP_SW3_TX_DP4_LANE_CTRL_BANK0 0x00B40C +#define ACP_SW3_TX_DP4_CHANNEL_ENABLE_BANK0 0x00B410 +#define ACP_SW3_TX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B414 +#define ACP_SW3_TX_DP4_SAMPLEINTERVAL_BANK1 0x00B418 +#define ACP_SW3_TX_DP4_HCTRL_BANK1 0x00B41C +#define ACP_SW3_TX_DP4_HCTRL_OFFSET_BANK1 0x00B420 +#define ACP_SW3_TX_DP4_LANE_CTRL_BANK1 0x00B424 +#define ACP_SW3_TX_DP4_CHANNEL_ENABLE_BANK1 0x00B428 +#define ACP_SW3_TX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B42C +#define ACP_SW3_TX_DP5_SAMPLEINTERVAL_BANK0 0x00B430 +#define ACP_SW3_TX_DP5_HCTRL_BANK0 0x00B434 +#define ACP_SW3_TX_DP5_HCTRL_OFFSET_BANK0 0x00B438 +#define ACP_SW3_TX_DP5_LANE_CTRL_BANK0 0x00B43C +#define ACP_SW3_TX_DP5_CHANNEL_ENABLE_BANK0 0x00B440 +#define ACP_SW3_TX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B444 +#define ACP_SW3_TX_DP5_SAMPLEINTERVAL_BANK1 0x00B448 +#define ACP_SW3_TX_DP5_HCTRL_BANK1 0x00B44C +#define ACP_SW3_TX_DP5_HCTRL_OFFSET_BANK1 0x00B450 +#define ACP_SW3_TX_DP5_LANE_CTRL_BANK1 0x00B454 +#define ACP_SW3_TX_DP5_CHANNEL_ENABLE_BANK1 0x00B458 +#define ACP_SW3_TX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B45C +#define ACP_SW3_TX_DP6_SAMPLEINTERVAL_BANK0 0x00B460 +#define ACP_SW3_TX_DP6_HCTRL_BANK0 0x00B464 +#define ACP_SW3_TX_DP6_HCTRL_OFFSET_BANK0 0x00B468 +#define ACP_SW3_TX_DP6_LANE_CTRL_BANK0 0x00B46C +#define ACP_SW3_TX_DP6_CHANNEL_ENABLE_BANK0 0x00B470 +#define ACP_SW3_TX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B474 +#define ACP_SW3_TX_DP6_SAMPLEINTERVAL_BANK1 0x00B478 +#define ACP_SW3_TX_DP6_HCTRL_BANK1 0x00B47C +#define ACP_SW3_TX_DP6_HCTRL_OFFSET_BANK1 0x00B480 +#define ACP_SW3_TX_DP6_LANE_CTRL_BANK1 0x00B484 +#define ACP_SW3_TX_DP6_CHANNEL_ENABLE_BANK1 0x00B488 +#define ACP_SW3_TX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B48C +#define ACP_SW3_TX_DP7_SAMPLEINTERVAL_BANK0 0x00B490 +#define ACP_SW3_TX_DP7_HCTRL_BANK0 0x00B494 +#define ACP_SW3_TX_DP7_HCTRL_OFFSET_BANK0 0x00B498 +#define ACP_SW3_TX_DP7_LANE_CTRL_BANK0 0x00B49C +#define ACP_SW3_TX_DP7_CHANNEL_ENABLE_BANK0 0x00B4A0 +#define ACP_SW3_TX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B4A4 +#define ACP_SW3_TX_DP7_SAMPLEINTERVAL_BANK1 0x00B4A8 +#define ACP_SW3_TX_DP7_HCTRL_BANK1 0x00B4AC +#define ACP_SW3_TX_DP7_HCTRL_OFFSET_BANK1 0x00B4B0 +#define ACP_SW3_TX_DP7_LANE_CTRL_BANK1 0x00B4B4 +#define ACP_SW3_TX_DP7_CHANNEL_ENABLE_BANK1 0x00B4B8 +#define ACP_SW3_TX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B4BC +#define ACP_SW3_RX_STREAM0_EN 0x00B514 +#define ACP_SW3_RX_STREAM1_EN 0x00B518 +#define ACP_SW3_RX_STREAM2_EN 0x00B51C +#define ACP_SW3_RX_STREAM3_EN 0x00B520 +#define ACP_SW3_RX_STREAM4_EN 0x00B524 +#define ACP_SW3_RX_STREAM5_EN 0x00B528 +#define ACP_SW3_RX_STREAM6_EN 0x00B52C +#define ACP_SW3_RX_STREAM7_EN 0x00B530 +#define ACP_SW3_RX_STREAM0_EN_STATUS 0x00B534 +#define ACP_SW3_RX_STREAM1_EN_STATUS 0x00B538 +#define ACP_SW3_RX_STREAM2_EN_STATUS 0x00B53C +#define ACP_SW3_RX_STREAM3_EN_STATUS 0x00B540 +#define ACP_SW3_RX_STREAM4_EN_STATUS 0x00B544 +#define ACP_SW3_RX_STREAM5_EN_STATUS 0x00B548 +#define ACP_SW3_RX_STREAM6_EN_STATUS 0x00B54C +#define ACP_SW3_RX_STREAM7_EN_STATUS 0x00B550 +#define ACP_SW3_RX_DP0_FRAME_FORMAT 0x00B554 +#define ACP_SW3_RX_DP1_FRAME_FORMAT 0x00B558 +#define ACP_SW3_RX_DP2_FRAME_FORMAT 0x00B55C +#define ACP_SW3_RX_DP3_FRAME_FORMAT 0x00B560 +#define ACP_SW3_RX_DP4_FRAME_FORMAT 0x00B564 +#define ACP_SW3_RX_DP5_FRAME_FORMAT 0x00B568 +#define ACP_SW3_RX_DP6_FRAME_FORMAT 0x00B56C +#define ACP_SW3_RX_DP7_FRAME_FORMAT 0x00B570 +#define ACP_SW3_RX_DP0_0_SAMPLEINTERVAL_BANK0 0x00B580 +#define ACP_SW3_RX_DP0_0_HCTRL_BANK0 0x00B584 +#define ACP_SW3_RX_DP0_0_HCTRL_OFFSET_BANK0 0x00B588 +#define ACP_SW3_RX_DP0_0_LANE_CTRL_BANK0 0x00B58C +#define ACP_SW3_RX_DP0_0_CHANNEL_ENABLE_BANK0 0x00B590 +#define ACP_SW3_RX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B594 +#define ACP_SW3_RX_DP0_0_SAMPLEINTERVAL_BANK1 0x00B598 +#define ACP_SW3_RX_DP0_0_HCTRL_BANK1 0x00B59C +#define ACP_SW3_RX_DP0_0_HCTRL_OFFSET_BANK1 0x00B5A0 +#define ACP_SW3_RX_DP0_0_LANE_CTRL_BANK1 0x00B5A4 +#define ACP_SW3_RX_DP0_0_CHANNEL_ENABLE_BANK1 0x00B5A8 +#define ACP_SW3_RX_DP0_0_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B5AC +#define ACP_SW3_RX_DP0_1_SAMPLEINTERVAL_BANK0 0x00B5B0 +#define ACP_SW3_RX_DP0_1_HCTRL_BANK0 0x00B5B4 +#define ACP_SW3_RX_DP0_1_HCTRL_OFFSET_BANK0 0x00B5B8 +#define ACP_SW3_RX_DP0_1_LANE_CTRL_BANK0 0x00B5BC +#define ACP_SW3_RX_DP0_1_CHANNEL_ENABLE_BANK0 0x00B5C0 +#define ACP_SW3_RX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B5C4 +#define ACP_SW3_RX_DP0_1_SAMPLEINTERVAL_BANK1 0x00B5C8 +#define ACP_SW3_RX_DP0_1_HCTRL_BANK1 0x00B5CC +#define ACP_SW3_RX_DP0_1_HCTRL_OFFSET_BANK1 0x00B5D0 +#define ACP_SW3_RX_DP0_1_LANE_CTRL_BANK1 0x00B5D4 +#define ACP_SW3_RX_DP0_1_CHANNEL_ENABLE_BANK1 0x00B5D8 +#define ACP_SW3_RX_DP0_1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B5DC +#define ACP_SW3_RX_DP0_2_SAMPLEINTERVAL_BANK0 0x00B5E0 +#define ACP_SW3_RX_DP0_2_HCTRL_BANK0 0x00B5E4 +#define ACP_SW3_RX_DP0_2_HCTRL_OFFSET_BANK0 0x00B5E8 +#define ACP_SW3_RX_DP0_2_LANE_CTRL_BANK0 0x00B5EC +#define ACP_SW3_RX_DP0_2_CHANNEL_ENABLE_BANK0 0x00B5F0 +#define ACP_SW3_RX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B5F4 +#define ACP_SW3_RX_DP0_2_SAMPLEINTERVAL_BANK1 0x00B5F8 +#define ACP_SW3_RX_DP0_2_HCTRL_BANK1 0x00B5FC +#define ACP_SW3_RX_DP0_2_HCTRL_OFFSET_BANK1 0x00B600 +#define ACP_SW3_RX_DP0_2_LANE_CTRL_BANK1 0x00B604 +#define ACP_SW3_RX_DP0_2_CHANNEL_ENABLE_BANK1 0x00B608 +#define ACP_SW3_RX_DP0_2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B60C +#define ACP_SW3_RX_DP0_3_SAMPLEINTERVAL_BANK0 0x00B610 +#define ACP_SW3_RX_DP0_3_HCTRL_BANK0 0x00B614 +#define ACP_SW3_RX_DP0_3_HCTRL_OFFSET_BANK0 0x00B618 +#define ACP_SW3_RX_DP0_3_LANE_CTRL_BANK0 0x00B61C +#define ACP_SW3_RX_DP0_3_CHANNEL_ENABLE_BANK0 0x00B620 +#define ACP_SW3_RX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B624 +#define ACP_SW3_RX_DP0_3_SAMPLEINTERVAL_BANK1 0x00B628 +#define ACP_SW3_RX_DP0_3_HCTRL_BANK1 0x00B62C +#define ACP_SW3_RX_DP0_3_HCTRL_OFFSET_BANK1 0x00B630 +#define ACP_SW3_RX_DP0_3_LANE_CTRL_BANK1 0x00B634 +#define ACP_SW3_RX_DP0_3_CHANNEL_ENABLE_BANK1 0x00B638 +#define ACP_SW3_RX_DP0_3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B63C +#define ACP_SW3_RX_DP1_SAMPLEINTERVAL_BANK0 0x00B670 +#define ACP_SW3_RX_DP1_HCTRL_BANK0 0x00B674 +#define ACP_SW3_RX_DP1_HCTRL_OFFSET_BANK0 0x00B678 +#define ACP_SW3_RX_DP1_LANE_CTRL_BANK0 0x00B67C +#define ACP_SW3_RX_DP1_CHANNEL_ENABLE_BANK0 0x00B680 +#define ACP_SW3_RX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B684 +#define ACP_SW3_RX_DP1_SAMPLEINTERVAL_BANK1 0x00B688 +#define ACP_SW3_RX_DP1_HCTRL_BANK1 0x00B68C +#define ACP_SW3_RX_DP1_HCTRL_OFFSET_BANK1 0x00B690 +#define ACP_SW3_RX_DP1_LANE_CTRL_BANK1 0x00B694 +#define ACP_SW3_RX_DP1_CHANNEL_ENABLE_BANK1 0x00B698 +#define ACP_SW3_RX_DP1_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B69C +#define ACP_SW3_RX_DP2_SAMPLEINTERVAL_BANK0 0x00B6A0 +#define ACP_SW3_RX_DP2_HCTRL_BANK0 0x00B6A4 +#define ACP_SW3_RX_DP2_HCTRL_OFFSET_BANK0 0x00B6A8 +#define ACP_SW3_RX_DP2_LANE_CTRL_BANK0 0x00B6AC +#define ACP_SW3_RX_DP2_CHANNEL_ENABLE_BANK0 0x00B6B0 +#define ACP_SW3_RX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B6B4 +#define ACP_SW3_RX_DP2_SAMPLEINTERVAL_BANK1 0x00B6B8 +#define ACP_SW3_RX_DP2_HCTRL_BANK1 0x00B6BC +#define ACP_SW3_RX_DP2_HCTRL_OFFSET_BANK1 0x00B6C0 +#define ACP_SW3_RX_DP2_LANE_CTRL_BANK1 0x00B6C4 +#define ACP_SW3_RX_DP2_CHANNEL_ENABLE_BANK1 0x00B6C8 +#define ACP_SW3_RX_DP2_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B6CC +#define ACP_SW3_RX_DP3_SAMPLEINTERVAL_BANK0 0x00B6D0 +#define ACP_SW3_RX_DP3_HCTRL_BANK0 0x00B6D4 +#define ACP_SW3_RX_DP3_HCTRL_OFFSET_BANK0 0x00B6D8 +#define ACP_SW3_RX_DP3_LANE_CTRL_BANK0 0x00B6DC +#define ACP_SW3_RX_DP3_CHANNEL_ENABLE_BANK0 0x00B6E0 +#define ACP_SW3_RX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B6E4 +#define ACP_SW3_RX_DP3_SAMPLEINTERVAL_BANK1 0x00B6E8 +#define ACP_SW3_RX_DP3_HCTRL_BANK1 0x00B6EC +#define ACP_SW3_RX_DP3_HCTRL_OFFSET_BANK1 0x00B6F0 +#define ACP_SW3_RX_DP3_LANE_CTRL_BANK1 0x00B6F4 +#define ACP_SW3_RX_DP3_CHANNEL_ENABLE_BANK1 0x00B6F8 +#define ACP_SW3_RX_DP3_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B6FC +#define ACP_SW3_RX_DP4_SAMPLEINTERVAL_BANK0 0x00B700 +#define ACP_SW3_RX_DP4_HCTRL_BANK0 0x00B704 +#define ACP_SW3_RX_DP4_HCTRL_OFFSET_BANK0 0x00B708 +#define ACP_SW3_RX_DP4_LANE_CTRL_BANK0 0x00B70C +#define ACP_SW3_RX_DP4_CHANNEL_ENABLE_BANK0 0x00B710 +#define ACP_SW3_RX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B714 +#define ACP_SW3_RX_DP4_SAMPLEINTERVAL_BANK1 0x00B718 +#define ACP_SW3_RX_DP4_HCTRL_BANK1 0x00B71C +#define ACP_SW3_RX_DP4_HCTRL_OFFSET_BANK1 0x00B720 +#define ACP_SW3_RX_DP4_LANE_CTRL_BANK1 0x00B724 +#define ACP_SW3_RX_DP4_CHANNEL_ENABLE_BANK1 0x00B728 +#define ACP_SW3_RX_DP4_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B72C +#define ACP_SW3_RX_DP5_SAMPLEINTERVAL_BANK0 0x00B730 +#define ACP_SW3_RX_DP5_HCTRL_BANK0 0x00B734 +#define ACP_SW3_RX_DP5_HCTRL_OFFSET_BANK0 0x00B738 +#define ACP_SW3_RX_DP5_LANE_CTRL_BANK0 0x00B73C +#define ACP_SW3_RX_DP5_CHANNEL_ENABLE_BANK0 0x00B740 +#define ACP_SW3_RX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B744 +#define ACP_SW3_RX_DP5_SAMPLEINTERVAL_BANK1 0x00B748 +#define ACP_SW3_RX_DP5_HCTRL_BANK1 0x00B74C +#define ACP_SW3_RX_DP5_HCTRL_OFFSET_BANK1 0x00B750 +#define ACP_SW3_RX_DP5_LANE_CTRL_BANK1 0x00B754 +#define ACP_SW3_RX_DP5_CHANNEL_ENABLE_BANK1 0x00B758 +#define ACP_SW3_RX_DP5_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B75C +#define ACP_SW3_RX_DP6_SAMPLEINTERVAL_BANK0 0x00B760 +#define ACP_SW3_RX_DP6_HCTRL_BANK0 0x00B764 +#define ACP_SW3_RX_DP6_HCTRL_OFFSET_BANK0 0x00B768 +#define ACP_SW3_RX_DP6_LANE_CTRL_BANK0 0x00B76C +#define ACP_SW3_RX_DP6_CHANNEL_ENABLE_BANK0 0x00B770 +#define ACP_SW3_RX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B774 +#define ACP_SW3_RX_DP6_SAMPLEINTERVAL_BANK1 0x00B778 +#define ACP_SW3_RX_DP6_HCTRL_BANK1 0x00B77C +#define ACP_SW3_RX_DP6_HCTRL_OFFSET_BANK1 0x00B780 +#define ACP_SW3_RX_DP6_LANE_CTRL_BANK1 0x00B784 +#define ACP_SW3_RX_DP6_CHANNEL_ENABLE_BANK1 0x00B788 +#define ACP_SW3_RX_DP6_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B78C +#define ACP_SW3_RX_DP7_SAMPLEINTERVAL_BANK0 0x00B790 +#define ACP_SW3_RX_DP7_HCTRL_BANK0 0x00B794 +#define ACP_SW3_RX_DP7_HCTRL_OFFSET_BANK0 0x00B798 +#define ACP_SW3_RX_DP7_LANE_CTRL_BANK0 0x00B79C +#define ACP_SW3_RX_DP7_CHANNEL_ENABLE_BANK0 0x00B7A0 +#define ACP_SW3_RX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK0 0x00B7A4 +#define ACP_SW3_RX_DP7_SAMPLEINTERVAL_BANK1 0x00B7A8 +#define ACP_SW3_RX_DP7_HCTRL_BANK1 0x00B7AC +#define ACP_SW3_RX_DP7_HCTRL_OFFSET_BANK1 0x00B7B0 +#define ACP_SW3_RX_DP7_LANE_CTRL_BANK1 0x00B7B4 +#define ACP_SW3_RX_DP7_CHANNEL_ENABLE_BANK1 0x00B7B8 +#define ACP_SW3_RX_DP7_BLOCK_PKGMODE_GRPCTRL_BANK1 0x00B7BC +#define ACP_SW3_BPT_PORT_EN 0x00B7C0 +#define ACP_SW3_BPT_PORT_EN_STATUS 0x00B7C4 +#define ACP_SW3_BPT_PORT_FRAME_FORMAT 0x00B7C8 +#define ACP_SW3_BPT_PORT_SAMPLEINTERVAL_BANK0 0x00B7CC +#define ACP_SW3_BPT_PORT_HCTRL_BANK0 0x00B7D0 +#define ACP_SW3_BPT_PORT_OFFSET_BANK0 0x00B7D4 +#define ACP_SW3_BPT_PORT_LANE_SELECT_BANK0 0x00B7D8 +#define ACP_SW3_BPT_PORT_CHANNEL_ENABLE_BANK0 0x00B7DC +#define ACP_SW3_BPT_PORT_SAMPLEINTERVAL_BANK1 0x00B7E0 +#define ACP_SW3_BPT_PORT_HCTRL_BANK1 0x00B7E4 +#define ACP_SW3_BPT_PORT_OFFSET_BANK1 0x00B7E8 +#define ACP_SW3_BPT_PORT_LANE_SELECT_BANK1 0x00B7EC +#define ACP_SW3_BPT_PORT_CHANNEL_ENABLE_BANK1 0x00B7F0 +#define ACP_SW3_BPT_PORT_FIRST_BYTE_ADDR 0x00B7F4 +#define ACP_SW3_CLK_RESUME_CTRL 0x00B7F8 +#define ACP_SW3_CLK_RESUME_DELAY_CNTR 0x00B7FC +#define ACP_SW3_BUS_RESET_CTRL 0x00B800 +#define ACP_SW3_PRBS_ERR_STATUS 0x00B804 +#define ACP_SW3_WALLCLK_MISC 0x00B808 +#define ACP_SW3_WALL_CLK_COUNTER 0x00B80C +#define ACP_SW3_PING_STATUS_REGISTER_LOW 0x00B810 +#define ACP_SW3_PING_STATUS_REGISTER_HIGH 0x00B814 +#define ACP_SW3_PING_STATUS_CURRENT_BANK_SEL 0x00B818 +#define ACP_SW3_TZD_CHANGE 0x00B81C +#define ACP_SW3_WALLCLK_INTR_CNTL 0x00B820 + +#define ACP_PDM_ENABLE 0x002C04 +#define ACP_PDM_DMA_ENABLE 0x002C08 +#define ACP_PDM_RX_RINGBUFADDR 0x002C0C +#define ACP_PDM_RX_RINGBUFSIZE 0x002C10 +#define ACP_PDM_RX_LINKPOSITIONCNTR 0x002C14 +#define ACP_PDM_RX_LINEARPOSITIONCNTR_HIGH 0x002C18 +#define ACP_PDM_RX_LINEARPOSITIONCNTR_LOW 0x002C1C +#define ACP_PDM_RX_INTR_WATERMARK_SIZE 0x002C20 +#define ACP_PDM_FIFO_FLUSH 0x002C24 +#define ACP_PDM_NO_OF_CHANNELS 0x002C28 +#define ACP_PDM_DECIMATION_FACTOR 0x002C2C +#define ACP_PDM_VAD_CTRL 0x002C30 +#define ACP_PDM_WAKE 0x002C54 +#define ACP_PDM_BUFFER_STATUS 0x002C58 +#define ACP_PDM_MISC_CTRL 0x002C5C +#define ACP_PDM_CLK_CTRL 0x002C60 +#define ACP_PDM_VAD_DYNAMIC_CLK_GATING_EN 0x002C64 +#define ACP_PDM_ERROR_STATUS_REGISTER 0x002C68 +#define ACP_PDM_CLKDIV 0x002C6C +#define ACP_PDM_WALLCLK_MISC 0x002C70 +#define ACP_PDM_WALL_CLK_COUNTER 0x002C74 +#define ACP_PDM_SW_ENABLE_REG 0x002CC4 +#define ACP_PDM_SW_CTRLREG 0x002CC8 +#define ACP_PDM_WALLCLK_INTR_CNTL 0x002CCC + +#define ACP_PDM_2_ENABLE 0x002D04 +#define ACP_PDM_2_DMA_ENABLE 0x002D08 +#define ACP_PDM_2_RX_RINGBUFADDR_96K 0x002D0C +#define ACP_PDM_2_RX_RINGBUFADDR_48K 0x002D10 +#define ACP_PDM_2_RX_RINGBUFADDR_16K 0x002D14 +#define ACP_PDM_2_RX_RINGBUFSIZE_96K 0x002D18 +#define ACP_PDM_2_RX_RINGBUFSIZE_48K 0x002D1C +#define ACP_PDM_2_RX_RINGBUFSIZE_16K 0x002D20 +#define ACP_PDM_2_RX_LINKPOSITIONCNTR_96K 0x002D24 +#define ACP_PDM_2_RX_LINKPOSITIONCNTR_48K 0x002D28 +#define ACP_PDM_2_RX_LINKPOSITIONCNTR_16K 0x002D2C +#define ACP_PDM_2_RX_LINEARPOSITIONCNTR_HIGH_96K 0x002D30 +#define ACP_PDM_2_RX_LINEARPOSITIONCNTR_LOW_96K 0x002D34 +#define ACP_PDM_2_RX_LINEARPOSITIONCNTR_HIGH_48K 0x002D38 +#define ACP_PDM_2_RX_LINEARPOSITIONCNTR_LOW_48K 0x002D3C +#define ACP_PDM_2_RX_LINEARPOSITIONCNTR_HIGH_16K 0x002D40 +#define ACP_PDM_2_RX_LINEARPOSITIONCNTR_LOW_16K 0x002D44 +#define ACP_PDM_2_RX_INTR_WATERMARK_SIZE_96K 0x002D48 +#define ACP_PDM_2_RX_INTR_WATERMARK_SIZE_48K 0x002D4C +#define ACP_PDM_2_RX_INTR_WATERMARK_SIZE_16K 0x002D50 +#define ACP_PDM_2_FIFO_FLUSH_96K 0x002D54 +#define ACP_PDM_2_FIFO_FLUSH_48K 0x002D58 +#define ACP_PDM_2_FIFO_FLUSH_16K 0x002D5C +#define ACP_PDM_2_NO_OF_CHANNELS 0x002D60 +#define ACP_PDM_2_DECIMATION_FACTOR 0x002D64 +#define ACP_PDM_2_VAD_CTRL 0x002D68 +#define ACP_PDM_2_WAKE 0x002D6C +#define ACP_PDM_2_BUFFER_STATUS_96K 0x002D70 +#define ACP_PDM_2_BUFFER_STATUS_48K 0x002D74 +#define ACP_PDM_2_BUFFER_STATUS_16K 0x002D78 +#define ACP_PDM_2_MISC_CTRL 0x002D7C +#define ACP_PDM_2_CLK_CTRL 0x002D80 +#define ACP_PDM_2_VAD_DYNAMIC_CLK_GATING_EN 0x002D84 +#define ACP_PDM_2_ERROR_STATUS_REGISTER 0x002D8C +#define ACP_PDM_2_CLKDIV 0x002D90 +#define ACP_PDM_2_WALLCLK_MISC 0x002D94 +#define ACP_PDM_2_WALL_CLK_COUNTER 0x002D98 +#define ACP_PDM_2_SW_ENABLE_REG 0x002D9C +#define ACP_PDM_2_SW_CTRLREG 0x002DA0 +#define ACP_PDM_2_WALLCLK_INTR_CNTL 0x002DA4 + +#define ACP_SCRATCH_REG_0 0x0010000 +#endif -- cgit v1.2.3 From 978152b2cab5375f5f8f03871bd4a1f1842dd0e4 Mon Sep 17 00:00:00 2001 From: Peter Ujfalusi Date: Wed, 20 May 2026 18:06:38 +0300 Subject: ASoC: SOF: Intel: hda-mlink/lnl: Convert offload enable functions to void hdac_bus_eml_enable_offload() can only fail in case the IP is not enabled in the platform, which is not really an error as the ACE IP can be configured differently when integrated into a specific SoC. While it is unlikely, but it is a valid configuration that for example the DMIC is disabled. In this case we will just skip setting the offload for a link that is not present. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20260520150639.25301-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown --- include/sound/hda-mlink.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/sound/hda-mlink.h b/include/sound/hda-mlink.h index 4327317be6af..fed69998c93f 100644 --- a/include/sound/hda-mlink.h +++ b/include/sound/hda-mlink.h @@ -60,7 +60,7 @@ struct hdac_ext_link *hdac_bus_eml_sdw_get_hlink(struct hdac_bus *bus); struct mutex *hdac_bus_eml_get_mutex(struct hdac_bus *bus, bool alt, int elid); -int hdac_bus_eml_enable_offload(struct hdac_bus *bus, bool alt, int elid, bool enable); +void hdac_bus_eml_enable_offload(struct hdac_bus *bus, bool alt, int elid, bool enable); /* microphone privacy specific function supported by ACE3+ architecture */ void hdac_bus_eml_set_mic_privacy_mask(struct hdac_bus *bus, bool alt, int elid, @@ -186,10 +186,9 @@ hdac_bus_eml_sdw_get_hlink(struct hdac_bus *bus) { return NULL; } static inline struct mutex * hdac_bus_eml_get_mutex(struct hdac_bus *bus, bool alt, int elid) { return NULL; } -static inline int +static inline void hdac_bus_eml_enable_offload(struct hdac_bus *bus, bool alt, int elid, bool enable) { - return 0; } static inline void -- cgit v1.2.3 From 83f9efcce93f8574be2279090ee2aec58b86cda7 Mon Sep 17 00:00:00 2001 From: Lorenzo Stoakes Date: Tue, 12 May 2026 17:06:43 +0100 Subject: Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" This reverts commit ea52cb24cd3f ("mm/hugetlbfs: update hugetlbfs to use mmap_prepare") with conflict resolution to account for changes in commit ea52cb24cd3f ("mm/hugetlbfs: update hugetlbfs to use mmap_prepare"). The patch incorrectly handled hugetlb VMA lock allocation at the mmap_prepare stage, where a failed allocation occurring after mmap_prepare is called might result in the lock leaking. There is no risk of a merge causing a similar issues, as VMA_DONTEXPAND_BIT is set for hugetlb mappings. As a first step in addressing this issue, simply revert the change so we can rework how we do this having corrected the underlying issues. We maintain the VMA flags changes as best we can, accounting for the fact that we were working with a VMA descriptor previously and propagating like-for-like changes for this. Note that we invoke vma_set_flags() and do not call vma_start_write() as vm_flags_set() does. This is OK as it's being done in an .mmap hook where the VMA is not yet linked into the tree so nobody else can be accessing it. Link: https://lore.kernel.org/20260512160643.266960-1-ljs@kernel.org Fixes: ea52cb24cd3f ("mm/hugetlbfs: update hugetlbfs to use mmap_prepare") Signed-off-by: Lorenzo Stoakes Reported-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> Closes: https://lore.kernel.org/linux-mm/20260425070700.562229-1-25181214217@stu.xidian.edu.cn/ Acked-by: Muchun Song Acked-by: Oscar Salvador Cc: David Hildenbrand Cc: Liam R. Howlett Cc: Pedro Falcato Cc: Signed-off-by: Andrew Morton --- include/linux/hugetlb.h | 8 +------- include/linux/hugetlb_inline.h | 14 ++------------ 2 files changed, 3 insertions(+), 19 deletions(-) (limited to 'include') diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 93418625d3c5..5957bc25efa8 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -148,7 +148,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte, struct folio **foliop); #endif /* CONFIG_USERFAULTFD */ long hugetlb_reserve_pages(struct inode *inode, long from, long to, - struct vm_area_desc *desc, vma_flags_t vma_flags); + struct vm_area_struct *vma, vma_flags_t vma_flags); long hugetlb_unreserve_pages(struct inode *inode, long start, long end, long freed); bool folio_isolate_hugetlb(struct folio *folio, struct list_head *list); @@ -276,7 +276,6 @@ long hugetlb_change_protection(struct vm_area_struct *vma, void hugetlb_unshare_all_pmds(struct vm_area_struct *vma); void fixup_hugetlb_reservations(struct vm_area_struct *vma); void hugetlb_split(struct vm_area_struct *vma, unsigned long addr); -int hugetlb_vma_lock_alloc(struct vm_area_struct *vma); unsigned int arch_hugetlb_cma_order(void); @@ -469,11 +468,6 @@ static inline void fixup_hugetlb_reservations(struct vm_area_struct *vma) static inline void hugetlb_split(struct vm_area_struct *vma, unsigned long addr) {} -static inline int hugetlb_vma_lock_alloc(struct vm_area_struct *vma) -{ - return 0; -} - #endif /* !CONFIG_HUGETLB_PAGE */ #ifndef pgd_write diff --git a/include/linux/hugetlb_inline.h b/include/linux/hugetlb_inline.h index 565b473fd135..5c29cd3223a1 100644 --- a/include/linux/hugetlb_inline.h +++ b/include/linux/hugetlb_inline.h @@ -6,23 +6,13 @@ #ifdef CONFIG_HUGETLB_PAGE -static inline bool is_vm_hugetlb_flags(vm_flags_t vm_flags) -{ - return !!(vm_flags & VM_HUGETLB); -} - static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags) { - return vma_flags_test_any(flags, VMA_HUGETLB_BIT); + return vma_flags_test(flags, VMA_HUGETLB_BIT); } #else -static inline bool is_vm_hugetlb_flags(vm_flags_t vm_flags) -{ - return false; -} - static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags) { return false; @@ -32,7 +22,7 @@ static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags) static inline bool is_vm_hugetlb_page(const struct vm_area_struct *vma) { - return is_vm_hugetlb_flags(vma->vm_flags); + return is_vma_hugetlb_flags(&vma->flags); } #endif -- cgit v1.2.3 From 54cf41c969da6637cce790b7400da1451609db9b Mon Sep 17 00:00:00 2001 From: Byungchul Park Date: Fri, 15 May 2026 12:47:01 +0900 Subject: Revert "mm: introduce a new page type for page pool in page type" This reverts commit db359fccf212 ("mm: introduce a new page type for page pool in page type") and a part of 735a309b4bfb9e ("net: add net_iov_init() and use it to initialize ->page_type"). Netpp page_type'ed pages might be used in mapping so as to use @_mapcount. However, since @page_type and @_mapcount are union'ed in struct page, these two can't be used at the same time. Revert the commit introducing page_type for Netpp for now. The patch will be retried once @page_type and @_mapcount get allowed to be used at the same time. The revert also includes removal of @page_type initialization part introduced by commit 735a309b4bfb9e ("net: add net_iov_init() and use it to initialize ->page_type"), which will be restored on the retry. Link: https://lore.kernel.org/20260515034701.17027-1-byungchul@sk.com Fixes: db359fccf212 ("mm: introduce a new page type for page pool in page type") Signed-off-by: Byungchul Park Reported-by: Dragos Tatulea Closes: https://lore.kernel.org/all/982b9bc1-0a0a-4fc5-8e3a-3672db2b29a1@nvidia.com Acked-by: Jakub Kicinski Acked-by: David Hildenbrand (Arm) Acked-by: Harry Yoo (Oracle) Reviewed-by: Lorenzo Stoakes Cc: Alexei Starovoitov Cc: Baolin Wang Cc: Brendan Jackman Cc: David S. Miller Cc: Eric Dumazet Cc: Ilias Apalodimas Cc: Jesper Dangaard Brouer Cc: Johannes Weiner Cc: John Fastabend Cc: Leon Romanovsky Cc: Liam R. Howlett Cc: Mark Bloch Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Paolo Abeni Cc: Pavel Begunkov Cc: Saeed Mahameed Cc: Simon Horman Cc: Stanislav Fomichev Cc: Suren Baghdasaryan Cc: Tariq Toukan Cc: Toke Hoiland-Jorgensen Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/mm.h | 27 ++++++++++++++++++++++++--- include/linux/page-flags.h | 6 ------ include/net/netmem.h | 19 ++----------------- 3 files changed, 26 insertions(+), 26 deletions(-) (limited to 'include') diff --git a/include/linux/mm.h b/include/linux/mm.h index af23453e9dbd..06bbe9eba636 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -5174,9 +5174,10 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status); * DMA mapping IDs for page_pool * * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and - * stashes it in the upper bits of page->pp_magic. Non-PP pages can have - * arbitrary kernel pointers stored in the same field as pp_magic (since - * it overlaps with page->lru.next), so we must ensure that we cannot + * stashes it in the upper bits of page->pp_magic. We always want to be able to + * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP + * pages can have arbitrary kernel pointers stored in the same field as pp_magic + * (since it overlaps with page->lru.next), so we must ensure that we cannot * mistake a valid kernel pointer with any of the values we write into this * field. * @@ -5211,6 +5212,26 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status); #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \ PP_DMA_INDEX_SHIFT) +/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is + * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for + * the head page of compound page and bit 1 for pfmemalloc page, as well as the + * bits used for the DMA index. page_is_pfmemalloc() is checked in + * __page_pool_put_page() to avoid recycling the pfmemalloc page. + */ +#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL) + +#ifdef CONFIG_PAGE_POOL +static inline bool page_pool_page_is_pp(const struct page *page) +{ + return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE; +} +#else +static inline bool page_pool_page_is_pp(const struct page *page) +{ + return false; +} +#endif + #define PAGE_SNAPSHOT_FAITHFUL (1 << 0) #define PAGE_SNAPSHOT_PG_BUDDY (1 << 1) #define PAGE_SNAPSHOT_PG_IDLE (1 << 2) diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h index 0e03d816e8b9..7223f6f4e2b4 100644 --- a/include/linux/page-flags.h +++ b/include/linux/page-flags.h @@ -923,7 +923,6 @@ enum pagetype { PGTY_zsmalloc = 0xf6, PGTY_unaccepted = 0xf7, PGTY_large_kmalloc = 0xf8, - PGTY_netpp = 0xf9, PGTY_mapcount_underflow = 0xff }; @@ -1056,11 +1055,6 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc) PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted) PAGE_TYPE_OPS(LargeKmalloc, large_kmalloc, large_kmalloc) -/* - * Marks page_pool allocated pages. - */ -PAGE_TYPE_OPS(Netpp, netpp, netpp) - /** * PageHuge - Determine if the page belongs to hugetlbfs * @page: The page to test. diff --git a/include/net/netmem.h b/include/net/netmem.h index 78fe51e5756b..bccacd21b6c3 100644 --- a/include/net/netmem.h +++ b/include/net/netmem.h @@ -94,20 +94,10 @@ enum net_iov_type { */ struct net_iov { struct netmem_desc desc; - unsigned int page_type; enum net_iov_type type; struct net_iov_area *owner; }; -/* Make sure 'the offset of page_type in struct page == the offset of - * type in struct net_iov'. - */ -#define NET_IOV_ASSERT_OFFSET(pg, iov) \ - static_assert(offsetof(struct page, pg) == \ - offsetof(struct net_iov, iov)) -NET_IOV_ASSERT_OFFSET(page_type, page_type); -#undef NET_IOV_ASSERT_OFFSET - struct net_iov_area { /* Array of net_iovs for this area. */ struct net_iov *niovs; @@ -127,11 +117,7 @@ static inline unsigned int net_iov_idx(const struct net_iov *niov) return niov - net_iov_owner(niov)->niovs; } -/* Initialize a niov: stamp the owning area, the memory provider type, - * and the page_type "no type" sentinel expected by the page-type API - * (see PAGE_TYPE_OPS in ) so that - * page_pool_set_pp_info() can later call __SetPageNetpp() on a niov - * cast to struct page. +/* Initialize a niov: stamp the owning area, the memory provider type. */ static inline void net_iov_init(struct net_iov *niov, struct net_iov_area *owner, @@ -139,7 +125,6 @@ static inline void net_iov_init(struct net_iov *niov, { niov->owner = owner; niov->type = type; - niov->page_type = UINT_MAX; } /* netmem */ @@ -245,7 +230,7 @@ static inline unsigned long netmem_pfn_trace(netmem_ref netmem) */ #define pp_page_to_nmdesc(p) \ ({ \ - DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p)); \ + DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p)); \ __pp_page_to_nmdesc(p); \ }) -- cgit v1.2.3 From d62b0e3104cfd2171281867196cb1365098a25e0 Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Mon, 18 May 2026 12:34:32 +0200 Subject: dt-bindings: clock: qcom: add the definition for the USB2 PHY reset Provide the USB2 PHY reset definition in dt-bindings for the Nord negcc module in order to enable adding the USB nodes in DTS. Signed-off-by: Bartosz Golaszewski Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20260518-nord-clk-usb2-phy-v2-1-17a86cb307c3@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/clock/qcom,nord-negcc.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/dt-bindings/clock/qcom,nord-negcc.h b/include/dt-bindings/clock/qcom,nord-negcc.h index 95f333d8e1aa..a7024317e90b 100644 --- a/include/dt-bindings/clock/qcom,nord-negcc.h +++ b/include/dt-bindings/clock/qcom,nord-negcc.h @@ -120,5 +120,6 @@ #define NE_GCC_USB3_PHY_SEC_BCR 10 #define NE_GCC_USB3PHY_PHY_PRIM_BCR 11 #define NE_GCC_USB3PHY_PHY_SEC_BCR 12 +#define NE_GCC_QUSB2PHY_PRIM_BCR 13 #endif -- cgit v1.2.3 From f746fedb892872cbcee698696303609f0ea76fd7 Mon Sep 17 00:00:00 2001 From: Praveen Talari Date: Fri, 27 Feb 2026 11:45:33 +0530 Subject: soc: qcom: geni-se: Add geni_icc_set_bw_ab() function Add a new function geni_icc_set_bw_ab() that allows callers to set average bandwidth values for all ICC (Interconnect) paths in a single call. This function takes separate parameters for core, config, and DDR average bandwidth values and applies them to the respective ICC paths. This provides a more convenient API for drivers that need to configure specific average bandwidth values. Co-developed-by: Konrad Dybcio Signed-off-by: Konrad Dybcio Signed-off-by: Praveen Talari Tested-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20260227061544.1785978-3-praveen.talari@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/geni-se.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/soc/qcom/geni-se.h b/include/linux/soc/qcom/geni-se.h index 0a984e2579fe..980aabea2157 100644 --- a/include/linux/soc/qcom/geni-se.h +++ b/include/linux/soc/qcom/geni-se.h @@ -528,6 +528,7 @@ void geni_se_rx_dma_unprep(struct geni_se *se, dma_addr_t iova, size_t len); int geni_icc_get(struct geni_se *se, const char *icc_ddr); int geni_icc_set_bw(struct geni_se *se); +int geni_icc_set_bw_ab(struct geni_se *se, u32 core_ab, u32 cfg_ab, u32 ddr_ab); void geni_icc_set_tag(struct geni_se *se, u32 tag); int geni_icc_enable(struct geni_se *se); -- cgit v1.2.3 From 5b8a39dcf909a4723a58e424ae1b0595d6f5032d Mon Sep 17 00:00:00 2001 From: Praveen Talari Date: Fri, 27 Feb 2026 11:45:34 +0530 Subject: soc: qcom: geni-se: Introduce helper API for resource initialization The GENI Serial Engine drivers (I2C, SPI, and SERIAL) currently duplicate code for initializing shared resources such as clocks and interconnect paths. Introduce a new helper API, geni_se_resources_init(), to centralize this initialization logic, improving modularity and simplifying the probe function. Reviewed-by: Konrad Dybcio Signed-off-by: Praveen Talari Tested-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20260227061544.1785978-4-praveen.talari@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/geni-se.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/soc/qcom/geni-se.h b/include/linux/soc/qcom/geni-se.h index 980aabea2157..c182dd0f0bde 100644 --- a/include/linux/soc/qcom/geni-se.h +++ b/include/linux/soc/qcom/geni-se.h @@ -60,18 +60,22 @@ struct geni_icc_path { * @dev: Pointer to the Serial Engine device * @wrapper: Pointer to the parent QUP Wrapper core * @clk: Handle to the core serial engine clock + * @core_clk: Auxiliary clock, which may be required by a protocol * @num_clk_levels: Number of valid clock levels in clk_perf_tbl * @clk_perf_tbl: Table of clock frequency input to serial engine clock * @icc_paths: Array of ICC paths for SE + * @has_opp: Indicates if OPP is supported */ struct geni_se { void __iomem *base; struct device *dev; struct geni_wrapper *wrapper; struct clk *clk; + struct clk *core_clk; unsigned int num_clk_levels; unsigned long *clk_perf_tbl; struct geni_icc_path icc_paths[3]; + bool has_opp; }; /* Common SE registers */ @@ -535,6 +539,8 @@ int geni_icc_enable(struct geni_se *se); int geni_icc_disable(struct geni_se *se); +int geni_se_resources_init(struct geni_se *se); + int geni_load_se_firmware(struct geni_se *se, enum geni_se_protocol_type protocol); #endif #endif -- cgit v1.2.3 From 8f4ce470ff8c0d7d820d319f64f05ed9a239a240 Mon Sep 17 00:00:00 2001 From: Praveen Talari Date: Fri, 27 Feb 2026 11:45:36 +0530 Subject: soc: qcom: geni-se: Add resources activation/deactivation helpers The GENI SE protocol drivers (I2C, SPI, UART) implement similar resource activation/deactivation sequences independently, leading to code duplication. Introduce geni_se_resources_activate()/geni_se_resources_deactivate() to power on/off resources.The activate function enables ICC, clocks, and TLMM whereas the deactivate function disables resources in reverse order including OPP rate reset, clocks, ICC and TLMM. Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Tested-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20260227061544.1785978-6-praveen.talari@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/geni-se.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/soc/qcom/geni-se.h b/include/linux/soc/qcom/geni-se.h index c182dd0f0bde..36a68149345c 100644 --- a/include/linux/soc/qcom/geni-se.h +++ b/include/linux/soc/qcom/geni-se.h @@ -541,6 +541,10 @@ int geni_icc_disable(struct geni_se *se); int geni_se_resources_init(struct geni_se *se); +int geni_se_resources_activate(struct geni_se *se); + +int geni_se_resources_deactivate(struct geni_se *se); + int geni_load_se_firmware(struct geni_se *se, enum geni_se_protocol_type protocol); #endif #endif -- cgit v1.2.3 From f1a325d2812797166c744ff7ffb2ccbafbac20ad Mon Sep 17 00:00:00 2001 From: Praveen Talari Date: Fri, 27 Feb 2026 11:45:37 +0530 Subject: soc: qcom: geni-se: Introduce helper API for attaching power domains The GENI Serial Engine drivers (I2C, SPI, and SERIAL) currently handle the attachment of power domains. This often leads to duplicated code logic across different driver probe functions. Introduce a new helper API, geni_se_domain_attach(), to centralize the logic for attaching "power" and "perf" domains to the GENI SE device. Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Tested-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20260227061544.1785978-7-praveen.talari@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/geni-se.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/soc/qcom/geni-se.h b/include/linux/soc/qcom/geni-se.h index 36a68149345c..5f75159c5531 100644 --- a/include/linux/soc/qcom/geni-se.h +++ b/include/linux/soc/qcom/geni-se.h @@ -64,6 +64,7 @@ struct geni_icc_path { * @num_clk_levels: Number of valid clock levels in clk_perf_tbl * @clk_perf_tbl: Table of clock frequency input to serial engine clock * @icc_paths: Array of ICC paths for SE + * @pd_list: Power domain list for managing power domains * @has_opp: Indicates if OPP is supported */ struct geni_se { @@ -75,6 +76,7 @@ struct geni_se { unsigned int num_clk_levels; unsigned long *clk_perf_tbl; struct geni_icc_path icc_paths[3]; + struct dev_pm_domain_list *pd_list; bool has_opp; }; @@ -546,5 +548,7 @@ int geni_se_resources_activate(struct geni_se *se); int geni_se_resources_deactivate(struct geni_se *se); int geni_load_se_firmware(struct geni_se *se, enum geni_se_protocol_type protocol); + +int geni_se_domain_attach(struct geni_se *se); #endif #endif -- cgit v1.2.3 From c012e28e9a4a84b0fe7bf9ef7db334a9a4f31687 Mon Sep 17 00:00:00 2001 From: Praveen Talari Date: Fri, 27 Feb 2026 11:45:38 +0530 Subject: soc: qcom: geni-se: Introduce helper APIs for performance control The GENI Serial Engine (SE) drivers (I2C, SPI, and SERIAL) currently manage performance levels and operating points directly. This resulting in code duplication across drivers. such as configuring a specific level or find and apply an OPP based on a clock frequency. Introduce two new helper APIs, geni_se_set_perf_level() and geni_se_set_perf_opp(), addresses this issue by providing a streamlined method for the GENI Serial Engine (SE) drivers to find and set the OPP based on the desired performance level, thereby eliminating redundancy. Signed-off-by: Praveen Talari Reviewed-by: Konrad Dybcio Tested-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20260227061544.1785978-8-praveen.talari@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/linux/soc/qcom/geni-se.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/soc/qcom/geni-se.h b/include/linux/soc/qcom/geni-se.h index 5f75159c5531..c5e6ab85df09 100644 --- a/include/linux/soc/qcom/geni-se.h +++ b/include/linux/soc/qcom/geni-se.h @@ -550,5 +550,9 @@ int geni_se_resources_deactivate(struct geni_se *se); int geni_load_se_firmware(struct geni_se *se, enum geni_se_protocol_type protocol); int geni_se_domain_attach(struct geni_se *se); + +int geni_se_set_perf_level(struct geni_se *se, unsigned long level); + +int geni_se_set_perf_opp(struct geni_se *se, unsigned long clk_freq); #endif #endif -- cgit v1.2.3 From 2e83ac3b3b1a1b3b248a4af07efb19a1acb29845 Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Wed, 20 May 2026 10:19:33 +0100 Subject: KVM: arm64: vgic-v5: Move PPI caps into kvm_vgic_global_state Constant vgic properties are usually kept in kvm_vgic_global_state, but the vgic-v5 code does its own thing. Move the ppi_caps data into the global structure, which has the modest additional advantage of making it ro_after_init. Link: https://lore.kernel.org/r/20260520091949.542365-3-maz@kernel.org Signed-off-by: Marc Zyngier --- include/kvm/arm_vgic.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h index 1388dc6028a9..ea793479ab25 100644 --- a/include/kvm/arm_vgic.h +++ b/include/kvm/arm_vgic.h @@ -177,6 +177,11 @@ struct vgic_global { bool has_gcie_v3_compat; u32 ich_vtr_el2; + + /* GICv5 PPI capabilities */ + struct { + DECLARE_BITMAP(impl_ppi_mask, VGIC_V5_NR_PRIVATE_IRQS); + } vgic_v5_ppi_caps; }; extern struct vgic_global kvm_vgic_global_state; @@ -492,11 +497,6 @@ struct vgic_v5_cpu_if { struct gicv5_vpe gicv5_vpe; }; -/* What PPI capabilities does a GICv5 host have */ -struct vgic_v5_ppi_caps { - DECLARE_BITMAP(impl_ppi_mask, VGIC_V5_NR_PRIVATE_IRQS); -}; - struct vgic_cpu { /* CPU vif control registers for world switch */ union { -- cgit v1.2.3 From c4a1191f802792fe22fc261fa0e918d048915911 Mon Sep 17 00:00:00 2001 From: Marc Zyngier Date: Wed, 20 May 2026 10:19:36 +0100 Subject: KVM: arm64: vgic: Constify struct irq_ops usage vgic-v5 has introduced much more prevalent usage of the struct irq_ops mechanism. In the process, it becomes evident that suffers from two related problems: - it contains flags, rather than only callbacks - it is mutable, because we need to update the above flags Swap the flags for a helper retrieving the flags, and make all irq_ops const, something that is slightly satisfying. Reviewed-by: Joey Gouly Link: https://lore.kernel.org/r/20260520091949.542365-6-maz@kernel.org Signed-off-by: Marc Zyngier --- include/kvm/arm_vgic.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h index ea793479ab25..fe49fb56dc3c 100644 --- a/include/kvm/arm_vgic.h +++ b/include/kvm/arm_vgic.h @@ -205,7 +205,7 @@ struct vgic_irq; */ struct irq_ops { /* Per interrupt flags for special-cased interrupts */ - unsigned long flags; + unsigned long (*get_flags)(void); #define VGIC_IRQ_SW_RESAMPLE BIT(0) /* Clear the active state for resampling */ @@ -271,7 +271,7 @@ struct vgic_irq { u8 priority; u8 group; /* 0 == group 0, 1 == group 1 */ - struct irq_ops *ops; + const struct irq_ops *ops; void *owner; /* Opaque pointer to reserve an interrupt for in-kernel devices. */ @@ -279,7 +279,8 @@ struct vgic_irq { static inline bool vgic_irq_needs_resampling(struct vgic_irq *irq) { - return irq->ops && (irq->ops->flags & VGIC_IRQ_SW_RESAMPLE); + return irq->ops && irq->ops->get_flags && + (irq->ops->get_flags() & VGIC_IRQ_SW_RESAMPLE); } struct vgic_register_region; @@ -557,7 +558,7 @@ void kvm_vgic_init_cpu_hardware(void); int kvm_vgic_inject_irq(struct kvm *kvm, struct kvm_vcpu *vcpu, unsigned int intid, bool level, void *owner); void kvm_vgic_set_irq_ops(struct kvm_vcpu *vcpu, u32 vintid, - struct irq_ops *ops); + const struct irq_ops *ops); void kvm_vgic_clear_irq_ops(struct kvm_vcpu *vcpu, u32 vintid); int kvm_vgic_map_phys_irq(struct kvm_vcpu *vcpu, unsigned int host_irq, u32 vintid); -- cgit v1.2.3 From 5e6dfb87b191f34b1bb7cfb4d668665e5b70687b Mon Sep 17 00:00:00 2001 From: John Ogness Date: Mon, 11 May 2026 17:33:02 +0206 Subject: serial: 8250: Add support for console flow control The kernel documentation specifies that the console option 'r' can be used to enable hardware flow control for console writes. The 8250 driver does include code for hardware flow control on the console if cons_flow is set, but there is no code path that actually sets this. However, that is not the only issue. The problems are: 1. Specifying the console option 'r' does not lead to cons_flow being set. 2. Even if cons_flow would be set, serial8250_register_8250_port() clears it. 3. When the console option 'r' is specified, uart_set_options() attempts to initialize the port for CRTSCTS. However, afterwards it does not set the UPSTAT_CTS_ENABLE status bit and therefore on boot, uart_cts_enabled() is always false. This policy bit is important for console drivers as a criteria if they may poll CTS. 4. Even though uart_set_options() attempts to initialize the port for CRTSCTS, the 8250 set_termios() callback does not enable the RTS signal (TIOCM_RTS) and thus the hardware is not properly initialized for CTS polling. 5. Even if modem control was properly setup for CTS polling (TIOCM_RTS), uart_configure_port() clears TIOCM_RTS, thus breaking CTS polling. 6. wait_for_xmitr() and serial8250_console_write() use cons_flow to decide if CTS polling should occur. However, the condition should also include a check that it is not in RS485 mode and CRTSCTS is actually enabled in the hardware. Address all these issues as conservatively as possible by gating them behind checks focussed on the user specifying console hardware flow control support and the hardware being configured for CTS polling at the time of the write to the UART. Since checking the UPSTAT_CTS_ENABLE status bit is a part of the new condition gate, these changes also support runtime termios updates to disable/enable CRTSCTS. Signed-off-by: John Ogness Link: https://patch.msgid.link/20260511152706.151498-4-john.ogness@linutronix.de Signed-off-by: Greg Kroah-Hartman --- include/linux/serial_core.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h index 4f7bbdd90017..17fcff466e30 100644 --- a/include/linux/serial_core.h +++ b/include/linux/serial_core.h @@ -1175,6 +1175,14 @@ static inline bool uart_cons_flow_enabled(const struct uart_port *uport) return uport->cons_flow; } +static inline bool uart_console_hwflow_active(struct uart_port *uport) +{ + return uart_console(uport) && + !(uport->rs485.flags & SER_RS485_ENABLED) && + uart_cons_flow_enabled(uport) && + uart_cts_enabled(uport); +} + /* * The following are helper functions for the low level drivers. */ -- cgit v1.2.3 From 578b269e2f5c6d990d3970a11ef43606f80dc5f8 Mon Sep 17 00:00:00 2001 From: Praveen Talari Date: Mon, 18 May 2026 23:26:55 +0530 Subject: serial: qcom-geni: trace: Add tracepoint support for Qualcomm GENI serial Add tracepoint support to the Qualcomm GENI serial driver to provide runtime visibility into driver behavior without requiring invasive debug patches. The trace events cover UART termios configuration, clock setup, modem control state, interrupt status, and TX/RX data, making it easier to diagnose communication issues in the field. Reviewed-by: Konrad Dybcio Signed-off-by: Praveen Talari Link: https://patch.msgid.link/20260518-add-tracepoints-for-qcom-geni-serial-v3-1-b4addb151376@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman --- include/trace/events/qcom_geni_serial.h | 164 ++++++++++++++++++++++++++++++++ 1 file changed, 164 insertions(+) create mode 100644 include/trace/events/qcom_geni_serial.h (limited to 'include') diff --git a/include/trace/events/qcom_geni_serial.h b/include/trace/events/qcom_geni_serial.h new file mode 100644 index 000000000000..417ec01f9fc8 --- /dev/null +++ b/include/trace/events/qcom_geni_serial.h @@ -0,0 +1,164 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#undef TRACE_SYSTEM +#define TRACE_SYSTEM qcom_geni_serial + +#if !defined(_TRACE_QCOM_GENI_SERIAL_H) || defined(TRACE_HEADER_MULTI_READ) +#define _TRACE_QCOM_GENI_SERIAL_H + +#include +#include + +TRACE_EVENT(geni_serial_set_termios, + TP_PROTO(struct device *dev, unsigned int baud, + unsigned int bits_per_char, u32 tx_trans_cfg, + u32 tx_parity_cfg, u32 rx_trans_cfg, + u32 rx_parity_cfg, u32 stop_bit_len), + TP_ARGS(dev, baud, bits_per_char, tx_trans_cfg, tx_parity_cfg, + rx_trans_cfg, rx_parity_cfg, stop_bit_len), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(unsigned int, baud) + __field(unsigned int, bits_per_char) + __field(u32, tx_trans_cfg) + __field(u32, tx_parity_cfg) + __field(u32, rx_trans_cfg) + __field(u32, rx_parity_cfg) + __field(u32, stop_bit_len) + ), + + TP_fast_assign(__assign_str(name); + __entry->baud = baud; + __entry->bits_per_char = bits_per_char; + __entry->tx_trans_cfg = tx_trans_cfg; + __entry->tx_parity_cfg = tx_parity_cfg; + __entry->rx_trans_cfg = rx_trans_cfg; + __entry->rx_parity_cfg = rx_parity_cfg; + __entry->stop_bit_len = stop_bit_len; + ), + + TP_printk("%s: baud=%u bpc=%u tx_trans=0x%08x tx_par=0x%08x rx_trans=0x%08x rx_par=0x%08x stop=%u", + __get_str(name), __entry->baud, __entry->bits_per_char, + __entry->tx_trans_cfg, __entry->tx_parity_cfg, + __entry->rx_trans_cfg, __entry->rx_parity_cfg, + __entry->stop_bit_len) +); + +TRACE_EVENT(geni_serial_clk_cfg, + TP_PROTO(struct device *dev, unsigned int desired_rate, + unsigned long clk_rate, unsigned int clk_div, + unsigned int clk_idx), + TP_ARGS(dev, desired_rate, clk_rate, clk_div, clk_idx), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(unsigned int, desired_rate) + __field(unsigned long, clk_rate) + __field(unsigned int, clk_div) + __field(unsigned int, clk_idx) + ), + + TP_fast_assign(__assign_str(name); + __entry->desired_rate = desired_rate; + __entry->clk_rate = clk_rate; + __entry->clk_div = clk_div; + __entry->clk_idx = clk_idx; + ), + + TP_printk("%s: desired_rate=%u clk_rate=%lu clk_div=%u clk_idx=%u", + __get_str(name), __entry->desired_rate, __entry->clk_rate, + __entry->clk_div, __entry->clk_idx) +); + +TRACE_EVENT(geni_serial_irq, + TP_PROTO(struct device *dev, u32 m_irq, u32 s_irq, + u32 dma_tx, u32 dma_rx), + TP_ARGS(dev, m_irq, s_irq, dma_tx, dma_rx), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(u32, m_irq) + __field(u32, s_irq) + __field(u32, dma_tx) + __field(u32, dma_rx) + ), + + TP_fast_assign(__assign_str(name); + __entry->m_irq = m_irq; + __entry->s_irq = s_irq; + __entry->dma_tx = dma_tx; + __entry->dma_rx = dma_rx; + ), + + TP_printk("%s: m_irq=0x%08x s_irq=0x%08x dma_tx=0x%08x dma_rx=0x%08x", + __get_str(name), __entry->m_irq, __entry->s_irq, + __entry->dma_tx, __entry->dma_rx) +); + +DECLARE_EVENT_CLASS(geni_serial_data, + TP_PROTO(struct device *dev, const u8 *buf, unsigned int len), + TP_ARGS(dev, buf, len), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(unsigned int, len) + __dynamic_array(u8, data, len) + ), + + TP_fast_assign(__assign_str(name); + __entry->len = len; + memcpy(__get_dynamic_array(data), buf, len); + ), + + TP_printk("%s: len=%u data=%s", + __get_str(name), __entry->len, + __print_hex(__get_dynamic_array(data), __entry->len)) +); + +DEFINE_EVENT(geni_serial_data, geni_serial_tx_data, + TP_PROTO(struct device *dev, const u8 *buf, unsigned int len), + TP_ARGS(dev, buf, len) +); + +DEFINE_EVENT(geni_serial_data, geni_serial_rx_data, + TP_PROTO(struct device *dev, const u8 *buf, unsigned int len), + TP_ARGS(dev, buf, len) +); + +TRACE_EVENT(geni_serial_set_mctrl, + TP_PROTO(struct device *dev, unsigned int mctrl, + u32 uart_manual_rfr), + TP_ARGS(dev, mctrl, uart_manual_rfr), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(unsigned int, mctrl) + __field(u32, uart_manual_rfr) + ), + + TP_fast_assign(__assign_str(name); + __entry->mctrl = mctrl; + __entry->uart_manual_rfr = uart_manual_rfr; + ), + + TP_printk("%s: mctrl=0x%04x uart_manual_rfr=0x%08x", + __get_str(name), __entry->mctrl, __entry->uart_manual_rfr) +); + +TRACE_EVENT(geni_serial_get_mctrl, + TP_PROTO(struct device *dev, unsigned int mctrl, u32 geni_ios), + TP_ARGS(dev, mctrl, geni_ios), + + TP_STRUCT__entry(__string(name, dev_name(dev)) + __field(unsigned int, mctrl) + __field(u32, geni_ios) + ), + + TP_fast_assign(__assign_str(name); + __entry->mctrl = mctrl; + __entry->geni_ios = geni_ios; + ), + + TP_printk("%s: mctrl=0x%04x geni_ios=0x%08x", + __get_str(name), __entry->mctrl, __entry->geni_ios) +); + +#endif /* _TRACE_QCOM_GENI_SERIAL_H */ + +/* This part must be outside protection */ +#include -- cgit v1.2.3 From 255dc0ec0b79c354bff017f6d6202adaa092a1c9 Mon Sep 17 00:00:00 2001 From: Nicolas Pitre Date: Thu, 14 May 2026 23:48:57 -0400 Subject: vt: merge ucs_is_zero_width()/ucs_is_double_width() into ucs_get_width() The hot path in vc_process_ucs() asks two independent questions about the same code point -- "is it double-width?" and "is it zero-width?" -- and was answering each with its own bsearch over its own table. For anything past the leading bounds check that meant two scans of the BMP width tables back to back for what is logically a single lookup. Replace both with one ucs_get_width(cp) returning 0, 1, or 2 in a single bsearch, while keeping the total table footprint at the same 2384 B as before. To do so, merge the zero-width and double-width ranges per region into one sorted-by-`first` table. BMP entries stay 4 bytes; per-entry width is hosted in spare bits of the non-BMP table's `last` field. Non-BMP code points use only 20 of 32 bits, so each u32 has 12 unused high bits. Store first/last shifted left by 12 and use the low 12 bits of `last` for metadata: bit 11 is this entry's own width flag, bits 0..7 host an 8-bit chunk of the BMP double-width bitmap. Because the metadata bits sit strictly below the lowest cp-scale bit, the bsearch comparator remains a plain u32 compare on shifted keys with no masking. In vc_process_ucs() the overwhelmingly common single-width path now collapses to a single predicted branch: if (likely(w == 1)) return 1; Note: scripts/checkpatch.pl complains about "Macros with complex values should be enclosed in parentheses" for the BMP_*WIDTH and RANGE_*WIDTH macros. They are deliberately defined to expand to a comma-separated (first, last) pair so they can populate the two adjacent fields of a struct initializer; wrapping them in parentheses would turn that into a comma-expression and defeat the whole construction. Please ignore. Signed-off-by: Nicolas Pitre Link: https://patch.msgid.link/20260515034857.2514225-1-nico@fluxnic.net Signed-off-by: Greg Kroah-Hartman --- include/linux/consolemap.h | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/linux/consolemap.h b/include/linux/consolemap.h index 6180b803795c..539d488fdc03 100644 --- a/include/linux/consolemap.h +++ b/include/linux/consolemap.h @@ -28,8 +28,7 @@ int conv_uni_to_pc(struct vc_data *conp, long ucs); u32 conv_8bit_to_uni(unsigned char c); int conv_uni_to_8bit(u32 uni); void console_map_init(void); -bool ucs_is_double_width(uint32_t cp); -bool ucs_is_zero_width(uint32_t cp); +unsigned int ucs_get_width(uint32_t cp); u32 ucs_recompose(u32 base, u32 mark); u32 ucs_get_fallback(u32 cp); #else @@ -62,14 +61,9 @@ static inline int conv_uni_to_8bit(u32 uni) static inline void console_map_init(void) { } -static inline bool ucs_is_double_width(uint32_t cp) +static inline unsigned int ucs_get_width(uint32_t cp) { - return false; -} - -static inline bool ucs_is_zero_width(uint32_t cp) -{ - return false; + return 1; } static inline u32 ucs_recompose(u32 base, u32 mark) -- cgit v1.2.3 From c3cce2e67bb22a223f5b8ef05db0fcde70994068 Mon Sep 17 00:00:00 2001 From: Jacques Nilo Date: Wed, 13 May 2026 15:30:23 +0200 Subject: serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit uart_handle_break() and uart_prepare_sysrq_char() (in include/linux/serial_core.h) capture a SysRq character into port->sysrq_ch while the port lock is held and rely on the unlock helper -- uart_unlock_and_check_sysrq_irqrestore() -- to dispatch the captured character to handle_sysrq() on scope exit. The existing guard(uart_port_lock_irqsave) cannot be used by IRQ handlers that process RX, because its destructor calls plain uart_port_unlock_irqrestore() and silently drops port->sysrq_ch. Add a dedicated guard(uart_port_lock_check_sysrq_irqsave) variant whose destructor is the sysrq-aware unlock helper. The lock side is identical to uart_port_lock_irqsave -- only the unlock-time behaviour differs. Callers that may capture SysRq characters must use guard(uart_port_lock_check_sysrq_irqsave); the existing guard(uart_port_lock_irqsave) keeps its current plain-unlock semantics for the many callers that do not process RX. The new macro is placed after the CONFIG_MAGIC_SYSRQ_SERIAL block so both definitions of uart_unlock_and_check_sysrq_irqrestore() (sysrq enabled and disabled) are visible at expansion time. When CONFIG_MAGIC_SYSRQ_SERIAL=n the destructor degenerates to plain uart_port_unlock_irqrestore(), so there is no overhead. No functional change on its own; users are converted in the following patches. Cc: stable@vger.kernel.org Signed-off-by: Jacques Nilo Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/3849af4bc55d5d2a424fa850844e94d641b2f8a6.1778675349.git.jnilo@free.fr Signed-off-by: Greg Kroah-Hartman --- include/linux/serial_core.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h index 666430b47899..110ad4e2aef9 100644 --- a/include/linux/serial_core.h +++ b/include/linux/serial_core.h @@ -1274,6 +1274,18 @@ static inline void uart_unlock_and_check_sysrq_irqrestore(struct uart_port *port } #endif /* CONFIG_MAGIC_SYSRQ_SERIAL */ +/* + * Variant of guard(uart_port_lock_irqsave) for IRQ handlers that may capture + * a SysRq character via uart_prepare_sysrq_char(). The destructor uses the + * sysrq-aware unlock helper so that a captured port->sysrq_ch is dispatched + * to handle_sysrq() on scope exit. The plain guard variant silently drops + * sysrq_ch and must not be used by callers that process RX. + */ +DEFINE_LOCK_GUARD_1(uart_port_lock_check_sysrq_irqsave, struct uart_port, + uart_port_lock_irqsave(_T->lock, &_T->flags), + uart_unlock_and_check_sysrq_irqrestore(_T->lock, _T->flags), + unsigned long flags); + /* * We do the SysRQ and SAK checking like this... */ -- cgit v1.2.3 From 31c1d19ead2c26a63859a2757d8b786765ba9cdd Mon Sep 17 00:00:00 2001 From: Baokun Li Date: Thu, 21 May 2026 17:50:16 +0800 Subject: writeback: use a per-sb counter to drain inode wb switches at umount Tracking in-flight inode wb switches with a single global counter (isw_nr_in_flight) plus a synchronize_rcu() based wait in cgroup_writeback_umount() forces every umount to take a global hit whenever any other superblock on the system has wb switches in flight, even if the superblock being unmounted has none of its own. Replace the global synchronize_rcu()/flush_workqueue() pair with a per-sb counter, s_isw_nr_in_flight, plus three small helpers: - cgroup_writeback_pin(sb) - increment counter - cgroup_writeback_unpin(sb) - decrement and wake drainer if last - cgroup_writeback_drain(sb) - wait for counter to reach zero The wiring is: - inode_prepare_wbs_switch() pins before checking SB_ACTIVE and grabbing the inode; failure paths unpin before returning. A lockless SB_ACTIVE check at the top of the function lets us skip the atomic_inc/smp_mb dance once SB_ACTIVE has been cleared (it is monotonic and never set back). - process_inode_switch_wbs() unpins after the matching iput(). - cgroup_writeback_umount() drains the per-sb counter via wait_var_event(). The smp_mb() pair between inode_prepare_wbs_switch() and cgroup_writeback_umount() keeps the SB_ACTIVE / counter ordering: either the umounter sees a non-zero counter and waits, or the switcher sees SB_ACTIVE cleared and aborts before grabbing the inode. The global isw_nr_in_flight is left in place, since it is still used to throttle in-flight switches via WB_FRN_MAX_IN_FLIGHT. The rcu_read_lock() extension in inode_switch_wbs() and cleanup_offline_cgwb() that the race fix added is no longer needed and is reverted; the synchronize_rcu() that the race fix added to cgroup_writeback_umount() is dropped as well. The following numbers were measured on a 16 vCPU QEMU guest with 4 background superblocks each churning "create memcg -> write 1 MiB -> rmdir memcg" to keep the global isw_nr_in_flight non-zero. Latencies are wall-clock around umount(8); only the target sb's umount is measured. Target sb runs its own cgwb churn: p50 p95 p99 max global synchronize_rcu() 67.6 ms 88.3 ms 88.3 ms 96.8 ms per-sb counter (this) 7.9 ms 10.0 ms 10.0 ms 10.1 ms Idle target umount latency under cross-sb cgwb-switch pressure: p50 p95 p99 max global synchronize_rcu() 62.7 ms 95.4 ms 108.1 ms 108.6 ms per-sb counter (this) 5.3 ms 6.9 ms 7.4 ms 7.4 ms no-pressure baseline 4.9 ms 5.9 ms 6.3 ms 6.7 ms 8 concurrent umounts of idle sbs under the same pressure: p50 p95 max global synchronize_rcu() 61.3 ms 99.5 ms 113.7 ms per-sb counter (this) 8.1 ms 9.1 ms 9.5 ms In-kernel cgroup_writeback_umount() time across the same run (bpftrace, ~340 calls covering all scenarios): global synchronize_rcu() 12371 ms total (~36 ms / call) per-sb counter (this) 1.37 ms total ( ~4 us / call) Suggested-by: Christian Brauner Link: https://lore.kernel.org/r/177910456953.488929.2169908940676707307.b4-review@b4 Reviewed-by: Jan Kara Signed-off-by: Baokun Li Link: https://patch.msgid.link/20260521095016.2791354-4-libaokun@linux.alibaba.com Acked-by: Tejun Heo Signed-off-by: Christian Brauner (Amutable) --- include/linux/fs/super_types.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/fs/super_types.h b/include/linux/fs/super_types.h index 383050e7fdf5..1ab4e2265129 100644 --- a/include/linux/fs/super_types.h +++ b/include/linux/fs/super_types.h @@ -274,6 +274,14 @@ struct super_block { /* number of fserrors that are being sent to fsnotify/filesystems */ refcount_t s_pending_errors; + +#ifdef CONFIG_CGROUP_WRITEBACK + /* + * Number of in-flight inode wb switches for this sb. Drained by + * cgroup_writeback_umount() before tear-down. + */ + atomic_t s_isw_nr_in_flight; +#endif } __randomize_layout; /* -- cgit v1.2.3 From ef15ccbb3e8640a723c42ad90eaf81d66ae02017 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Tue, 5 May 2026 20:45:12 +0200 Subject: parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to ports that are not completely initialised or even being torn down. When the port and client drivers are built as modules and loaded around the same time during boot, this occasionally results in a crash. I was able to make this happen reliably in a VM with a PC-style parallel port by patching parport_pc to fail probing: > --- a/drivers/parport/parport_pc.c > +++ b/drivers/parport/parport_pc.c > @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base, > if (!p) > goto out3; > > - base_res = request_region(base, 3, p->name); > + base_res = NULL; > if (!base_res) > goto out4; > and then running: while true; do modprobe lp & modprobe parport_pc wait rmmod lp parport_pc done for a few seconds. In the long term I think port registration should be changed to put the call to device_add() inside parport_announce_port(), but since the latter currently cannot fail this will require changing all port drivers. For now, add a flag to indicate whether a port has been "announced" and only try to attach client drivers to ports when the flag is set. Fixes: 6fa45a226897 ("parport: add device-model to parport subsystem") Closes: https://bugs.debian.org/1130365 Closes: https://lore.kernel.org/all/6ba903ad-9897-42bb-8c2d-337385cc3746@molgen.mpg.de/ Cc: stable Signed-off-by: Ben Hutchings Acked-by: Sudip Mukherjee Link: https://patch.msgid.link/afo6uBv68GDevbMD@decadent.org.uk Signed-off-by: Greg Kroah-Hartman --- include/linux/parport.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/parport.h b/include/linux/parport.h index 464c2ad28039..f64cb0676e3b 100644 --- a/include/linux/parport.h +++ b/include/linux/parport.h @@ -240,6 +240,7 @@ struct parport { unsigned long devflags; #define PARPORT_DEVPROC_REGISTERED 0 +#define PARPORT_ANNOUNCED 1 struct pardevice *proc_device; /* Currently register proc device */ struct list_head full_list; -- cgit v1.2.3 From 215c90ee656114f5e8c32408228d97082f8e0eef Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Wed, 6 May 2026 13:57:00 +0200 Subject: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. Cc: stable Fixes: 01bb86b380a3 ("driver core: Add fwnode_init()") Signed-off-by: Bartosz Golaszewski Reviewed-by: Rafael J. Wysocki (Intel) Reviewed-by: Andy Shevchenko Reviewed-by: Sakari Ailus Link: https://patch.msgid.link/20260506115701.23035-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman --- include/linux/fwnode.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h index 80b38fbf2121..31df7608737e 100644 --- a/include/linux/fwnode.h +++ b/include/linux/fwnode.h @@ -208,6 +208,7 @@ struct fwnode_operations { static inline void fwnode_init(struct fwnode_handle *fwnode, const struct fwnode_operations *ops) { + fwnode->secondary = NULL; fwnode->ops = ops; INIT_LIST_HEAD(&fwnode->consumers); INIT_LIST_HEAD(&fwnode->suppliers); -- cgit v1.2.3 From 47980b6dbf83961eec1c1363ea986e9c06ff8054 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Thu, 14 May 2026 14:21:57 +0200 Subject: netfilter: nf_conntrack_gre: fix gre keymap list corruption Quoting reporter: A race between GRE keymap insertion and destruction can corrupt the kernel list or use a freed object. `nf_ct_gre_keymap_add()` publishes a new keymap pointer before the embedded `list_head` is linked, while `nf_ct_gre_keymap_destroy()` can concurrently delete and free that same object. An unprivileged user can reach this through the PPTP conntrack helper by racing PPTP control messages or helper teardown, leading to KASAN-detectable list corruption/UAF in kernel context. ## Root Cause Analysis `exp_gre()` installs GRE expectations for a PPTP control flow and then adds two GRE keymap entries [..] The add path publishes `ct_pptp_info->keymap[dir]` before linking the embedded list node [..] Concurrent teardown deletes that partially initialized object. Make add/destroy symmetric: install both, destroy both while under lock. Furthermore, we should refuse to publish a new mapping in case ct is going away, else we may leak the allocation. The "retrans" detection is strange: existing mapping is checked for key equality with the new mapping, then for "is on the list" via list walk. But I can't see how an existing keymap entry can be NOT on list. Change this to only check if we're asked to map same tuple again -- if so, skip re-install, else signal failure. Last, add a bug trap for the keymap list; it has to be empty when namespace is going away. Reported-by: Leo Lin Signed-off-by: Florian Westphal --- include/linux/netfilter/nf_conntrack_proto_gre.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/netfilter/nf_conntrack_proto_gre.h b/include/linux/netfilter/nf_conntrack_proto_gre.h index 9ee7014400e8..ad5563f0f864 100644 --- a/include/linux/netfilter/nf_conntrack_proto_gre.h +++ b/include/linux/netfilter/nf_conntrack_proto_gre.h @@ -18,9 +18,10 @@ struct nf_ct_gre_keymap { struct rcu_head rcu; }; -/* add new tuple->key_reply pair to keymap */ -int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir, - struct nf_conntrack_tuple *t); +/* add tuple->key_reply pairs to keymap */ +bool nf_ct_gre_keymap_add(struct nf_conn *ct, + const struct nf_conntrack_tuple *orig, + const struct nf_conntrack_tuple *repl); /* delete keymap entries */ void nf_ct_gre_keymap_destroy(struct nf_conn *ct); -- cgit v1.2.3 From 18014147d3ee7831dce53fe65d7fc8d428b02552 Mon Sep 17 00:00:00 2001 From: Fernando Fernandez Mancera Date: Mon, 11 May 2026 16:37:56 +0200 Subject: netfilter: nf_tables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then immediately reads from src to calculate the carry for the next iteration. Because src and dst could point to the same memory location, the carry is incorrectly calculated using the newly modified dst value instead of the original src value. Adding a temporary local variable to cache the original value before writing to dst and using it for the carry calculation solves the problem. In addition, partial overlap is rejected from control plane for all kind of operations including byteorder. This was tested with the following bytecode: table test_table ip flags 0 use 1 handle 1 ip test_table test_chain use 3 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1 ip test_table test_chain 2 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x66443322 0x00887766 ] [ counter pkts 0 bytes 0 ] ip test_table test_chain 4 3 [ immediate reg 1 0x44332211 0x88776655 ] [ bitwise reg 1 = ( reg 1 << 0x08000000 ) ] [ cmp eq reg 1 0x55443322 0x00887766 ] [ counter pkts 21794 bytes 1917798 ] Fixes: 567d746b55bc ("netfilter: bitwise: add support for shifts.") Acked-by: Jeremy Sowden Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Florian Westphal --- include/net/netfilter/nf_tables.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index cff7b773e972..9d844354c4d9 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -180,6 +180,13 @@ static inline u64 nft_reg_load64(const u32 *sreg) return get_unaligned((u64 *)sreg); } +static inline bool nft_reg_overlap(u8 src, u8 dst, u32 len) +{ + unsigned int n = DIV_ROUND_UP(len, sizeof(u32)); + + return src != dst && src < dst + n && dst < src + n; +} + static inline void nft_data_copy(u32 *dst, const struct nft_data *src, unsigned int len) { -- cgit v1.2.3 From b382754793b1af27899164a5b412ff2f49eb24d5 Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Sun, 17 May 2026 19:17:47 +0300 Subject: driver core: delete useless forward declaration of "struct class" "struct class" is defined earlier on both cases. Signed-off-by: Alexey Dobriyan Link: https://patch.msgid.link/6d5937c5-9d41-4cfe-9e42-0946e12dc72d@p183 Signed-off-by: Greg Kroah-Hartman --- include/linux/device.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index d54c86d77764..ac05c6e0af1b 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -38,7 +38,6 @@ struct device_private; struct device_driver; struct driver_private; struct module; -struct class; struct subsys_private; struct device_node; struct fwnode_handle; -- cgit v1.2.3 From f1462b97684b5d0cef0a4d026c7c9c9c42cd192c Mon Sep 17 00:00:00 2001 From: Heiner Kallweit Date: Mon, 16 Mar 2026 23:10:31 +0100 Subject: driver core: make struct bus_type groups members constant arrays Constify the groups arrays, allowing to assign constant arrays. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/265f6584-8edd-48a0-9568-a9d584b9ec3a@gmail.com Signed-off-by: Greg Kroah-Hartman --- include/linux/device/bus.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/device/bus.h b/include/linux/device/bus.h index c1b463cd6464..a38f7229b8f4 100644 --- a/include/linux/device/bus.h +++ b/include/linux/device/bus.h @@ -83,9 +83,9 @@ struct fwnode_handle; struct bus_type { const char *name; const char *dev_name; - const struct attribute_group **bus_groups; - const struct attribute_group **dev_groups; - const struct attribute_group **drv_groups; + const struct attribute_group *const *bus_groups; + const struct attribute_group *const *dev_groups; + const struct attribute_group *const *drv_groups; int (*match)(struct device *dev, const struct device_driver *drv); int (*uevent)(const struct device *dev, struct kobj_uevent_env *env); -- cgit v1.2.3 From a9c12b783cc711de3ac7f188bed07d529bb818af Mon Sep 17 00:00:00 2001 From: Heiner Kallweit Date: Mon, 16 Mar 2026 23:11:12 +0100 Subject: device core: make struct device_driver groups members constant arrays Constify the groups arrays, allowing to assign constant arrays. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/42624513-923c-4970-834d-036282e24e24@gmail.com Signed-off-by: Greg Kroah-Hartman --- include/linux/device/driver.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/device/driver.h b/include/linux/device/driver.h index bbc67ec513ed..c882daaef012 100644 --- a/include/linux/device/driver.h +++ b/include/linux/device/driver.h @@ -114,8 +114,8 @@ struct device_driver { void (*shutdown) (struct device *dev); int (*suspend) (struct device *dev, pm_message_t state); int (*resume) (struct device *dev); - const struct attribute_group **groups; - const struct attribute_group **dev_groups; + const struct attribute_group *const *groups; + const struct attribute_group *const *dev_groups; const struct dev_pm_ops *pm; void (*coredump) (struct device *dev); -- cgit v1.2.3 From 81e7c6befa36cecdcbf7244393bd67e8f8c59bf5 Mon Sep 17 00:00:00 2001 From: Saravana Kannan Date: Mon, 11 May 2026 17:57:49 +0200 Subject: of: dynamic: Fix overlayed devices not probing because of fw_devlink When an overlay is applied, if the target device has already probed successfully and bound to a device, then some of the fw_devlink logic that ran when the device was probed needs to be rerun. This allows newly created dangling consumers of the overlayed device tree nodes to be moved to become consumers of the target device. [Herve: Add the call to driver_deferred_probe_trigger()] [Herve: Use fwnode_test_flag() to test fwnode flags value] Fixes: 1a50d9403fb9 ("treewide: Fix probing of devices in DT overlays") Reported-by: Herve Codina Closes: https://lore.kernel.org/lkml/CAMuHMdXEnSD4rRJ-o90x4OprUacN_rJgyo8x6=9F9rZ+-KzjOg@mail.gmail.com/ Closes: https://lore.kernel.org/all/20240221095137.616d2aaa@bootlin.com/ Closes: https://lore.kernel.org/lkml/20240312151835.29ef62a0@bootlin.com/ Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/lkml/20240411235623.1260061-3-saravanak@google.com/ [Herve: Rebase on top of recent kernel] Signed-off-by: Herve Codina Tested-by: Kalle Niemi Tested-by: Geert Uytterhoeven Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20260511155755.34428-3-herve.codina@bootlin.com Signed-off-by: Greg Kroah-Hartman --- include/linux/fwnode.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h index c30a9baafc0d..4e86e6990d28 100644 --- a/include/linux/fwnode.h +++ b/include/linux/fwnode.h @@ -253,6 +253,7 @@ int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup, u8 flags); void fwnode_links_purge(struct fwnode_handle *fwnode); void fw_devlink_purge_absent_suppliers(struct fwnode_handle *fwnode); +void fw_devlink_refresh_fwnode(struct fwnode_handle *fwnode); bool fw_devlink_is_strict(void); #endif -- cgit v1.2.3 From cdd4c98d5a0e320b18fcdbd37a30a732aec624da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Tue, 12 May 2026 18:39:11 +0200 Subject: driver core: Delete DEVICE_ATTR_PREALLOC() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This macro is unused and would create extra work during the upcoming constification of device attributes. Remove it. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260512-sysfs-const-attr-device_attr-prep-v3-1-cb7c17b34d52@weissschuh.net Signed-off-by: Greg Kroah-Hartman --- include/linux/device.h | 13 ------------- 1 file changed, 13 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index ac05c6e0af1b..5daed9c92979 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -156,19 +156,6 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, #define DEVICE_ATTR(_name, _mode, _show, _store) \ struct device_attribute dev_attr_##_name = __ATTR(_name, _mode, _show, _store) -/** - * DEVICE_ATTR_PREALLOC - Define a preallocated device attribute. - * @_name: Attribute name. - * @_mode: File mode. - * @_show: Show handler. Optional, but mandatory if attribute is readable. - * @_store: Store handler. Optional, but mandatory if attribute is writable. - * - * Like DEVICE_ATTR(), but ``SYSFS_PREALLOC`` is set on @_mode. - */ -#define DEVICE_ATTR_PREALLOC(_name, _mode, _show, _store) \ - struct device_attribute dev_attr_##_name = \ - __ATTR_PREALLOC(_name, _mode, _show, _store) - /** * DEVICE_ATTR_RW - Define a read-write device attribute. * @_name: Attribute name. -- cgit v1.2.3 From 56e733f78c223032368e500af58402840a56e243 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Tue, 12 May 2026 18:39:12 +0200 Subject: driver core: Add low-level macros for device attributes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For the upcoming constification of device attributes the generic __ATTR() macros are insufficient. Prepare for a split by introducing new low-level macros specific to device attributes. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260512-sysfs-const-attr-device_attr-prep-v3-2-cb7c17b34d52@weissschuh.net Signed-off-by: Greg Kroah-Hartman --- include/linux/device.h | 43 ++++++++++++++++++++++++++++++++----------- 1 file changed, 32 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index 5daed9c92979..7d6796532313 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -134,6 +134,27 @@ ssize_t device_store_bool(struct device *dev, struct device_attribute *attr, ssize_t device_show_string(struct device *dev, struct device_attribute *attr, char *buf); +#define __DEVICE_ATTR(_name, _mode, _show, _store) \ + __ATTR(_name, _mode, _show, _store) + +#define __DEVICE_ATTR_RO_MODE(_name, _mode) \ + __ATTR_RO_MODE(_name, _mode) + +#define __DEVICE_ATTR_RO(_name) \ + __ATTR_RO(_name) + +#define __DEVICE_ATTR_WO(_name) \ + __ATTR_WO(_name) + +#define __DEVICE_ATTR_RW_MODE(_name, _mode) \ + __ATTR_RW_MODE(_name, _mode) + +#define __DEVICE_ATTR_RW(_name) \ + __ATTR_RW(_name) + +#define __DEVICE_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) \ + __ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) + /** * DEVICE_ATTR - Define a device attribute. * @_name: Attribute name. @@ -154,7 +175,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, * }; */ #define DEVICE_ATTR(_name, _mode, _show, _store) \ - struct device_attribute dev_attr_##_name = __ATTR(_name, _mode, _show, _store) + struct device_attribute dev_attr_##_name = __DEVICE_ATTR(_name, _mode, _show, _store) /** * DEVICE_ATTR_RW - Define a read-write device attribute. @@ -164,7 +185,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, * and @_store is <_name>_store. */ #define DEVICE_ATTR_RW(_name) \ - struct device_attribute dev_attr_##_name = __ATTR_RW(_name) + struct device_attribute dev_attr_##_name = __DEVICE_ATTR_RW(_name) /** * DEVICE_ATTR_ADMIN_RW - Define an admin-only read-write device attribute. @@ -173,7 +194,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, * Like DEVICE_ATTR_RW(), but @_mode is 0600. */ #define DEVICE_ATTR_ADMIN_RW(_name) \ - struct device_attribute dev_attr_##_name = __ATTR_RW_MODE(_name, 0600) + struct device_attribute dev_attr_##_name = __DEVICE_ATTR_RW_MODE(_name, 0600) /** * DEVICE_ATTR_RW_NAMED - Define a read-write device attribute with a sysfs name @@ -198,7 +219,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, * Like DEVICE_ATTR(), but @_mode is 0444 and @_show is <_name>_show. */ #define DEVICE_ATTR_RO(_name) \ - struct device_attribute dev_attr_##_name = __ATTR_RO(_name) + struct device_attribute dev_attr_##_name = __DEVICE_ATTR_RO(_name) /** * DEVICE_ATTR_ADMIN_RO - Define an admin-only readable device attribute. @@ -207,7 +228,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, * Like DEVICE_ATTR_RO(), but @_mode is 0400. */ #define DEVICE_ATTR_ADMIN_RO(_name) \ - struct device_attribute dev_attr_##_name = __ATTR_RO_MODE(_name, 0400) + struct device_attribute dev_attr_##_name = __DEVICE_ATTR_RO_MODE(_name, 0400) /** * DEVICE_ATTR_RO_NAMED - Define a read-only device attribute with a sysfs name @@ -231,7 +252,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, * Like DEVICE_ATTR(), but @_mode is 0200 and @_store is <_name>_store. */ #define DEVICE_ATTR_WO(_name) \ - struct device_attribute dev_attr_##_name = __ATTR_WO(_name) + struct device_attribute dev_attr_##_name = __DEVICE_ATTR_WO(_name) /** * DEVICE_ATTR_WO_NAMED - Define a read-only device attribute with a sysfs name @@ -259,7 +280,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, */ #define DEVICE_ULONG_ATTR(_name, _mode, _var) \ struct dev_ext_attribute dev_attr_##_name = \ - { __ATTR(_name, _mode, device_show_ulong, device_store_ulong), &(_var) } + { __DEVICE_ATTR(_name, _mode, device_show_ulong, device_store_ulong), &(_var) } /** * DEVICE_INT_ATTR - Define a device attribute backed by an int. @@ -271,7 +292,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, */ #define DEVICE_INT_ATTR(_name, _mode, _var) \ struct dev_ext_attribute dev_attr_##_name = \ - { __ATTR(_name, _mode, device_show_int, device_store_int), &(_var) } + { __DEVICE_ATTR(_name, _mode, device_show_int, device_store_int), &(_var) } /** * DEVICE_BOOL_ATTR - Define a device attribute backed by a bool. @@ -283,7 +304,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, */ #define DEVICE_BOOL_ATTR(_name, _mode, _var) \ struct dev_ext_attribute dev_attr_##_name = \ - { __ATTR(_name, _mode, device_show_bool, device_store_bool), &(_var) } + { __DEVICE_ATTR(_name, _mode, device_show_bool, device_store_bool), &(_var) } /** * DEVICE_STRING_ATTR_RO - Define a device attribute backed by a r/o string. @@ -296,11 +317,11 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, */ #define DEVICE_STRING_ATTR_RO(_name, _mode, _var) \ struct dev_ext_attribute dev_attr_##_name = \ - { __ATTR(_name, (_mode) & ~0222, device_show_string, NULL), (_var) } + { __DEVICE_ATTR(_name, (_mode) & ~0222, device_show_string, NULL), (_var) } #define DEVICE_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) \ struct device_attribute dev_attr_##_name = \ - __ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) + __DEVICE_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) int device_create_file(struct device *device, const struct device_attribute *entry); -- cgit v1.2.3 From 13443fbf62414e42afb1675ab2d3b767c6466915 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Tue, 12 May 2026 18:39:13 +0200 Subject: driver core: Stop using generic sysfs macros for device attributes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The constification of device attributes will require a transition phase, where 'struct device_attribute' contains a classic non-const and a new const variant of the 'show' and 'store' callbacks. As __ATTR() and friends can not handle this duplication stop using them. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260512-sysfs-const-attr-device_attr-prep-v3-3-cb7c17b34d52@weissschuh.net Signed-off-by: Greg Kroah-Hartman --- include/linux/device.h | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index 7d6796532313..62985a8a78d3 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -134,26 +134,38 @@ ssize_t device_store_bool(struct device *dev, struct device_attribute *attr, ssize_t device_show_string(struct device *dev, struct device_attribute *attr, char *buf); -#define __DEVICE_ATTR(_name, _mode, _show, _store) \ - __ATTR(_name, _mode, _show, _store) +#define __DEVICE_ATTR(_name, _mode, _show, _store) { \ + .attr = {.name = __stringify(_name), \ + .mode = VERIFY_OCTAL_PERMISSIONS(_mode) }, \ + .show = _show, \ + .store = _store, \ +} #define __DEVICE_ATTR_RO_MODE(_name, _mode) \ - __ATTR_RO_MODE(_name, _mode) + __DEVICE_ATTR(_name, _mode, _name##_show, NULL) #define __DEVICE_ATTR_RO(_name) \ - __ATTR_RO(_name) + __DEVICE_ATTR_RO_MODE(_name, 0444) #define __DEVICE_ATTR_WO(_name) \ - __ATTR_WO(_name) + __DEVICE_ATTR(_name, 0200, NULL, _name##_store) #define __DEVICE_ATTR_RW_MODE(_name, _mode) \ - __ATTR_RW_MODE(_name, _mode) + __DEVICE_ATTR(_name, _mode, _name##_show, _name##_store) #define __DEVICE_ATTR_RW(_name) \ - __ATTR_RW(_name) - -#define __DEVICE_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) \ - __ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) + __DEVICE_ATTR_RW_MODE(_name, 0644) + +#ifdef CONFIG_DEBUG_LOCK_ALLOC +#define __DEVICE_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) { \ + .attr = {.name = __stringify(_name), .mode = _mode, \ + .ignore_lockdep = true }, \ + .show = _show, \ + .store = _store, \ +} +#else +#define __DEVICE_ATTR_IGNORE_LOCKDEP __DEVICE_ATTR +#endif /** * DEVICE_ATTR - Define a device attribute. -- cgit v1.2.3 From 434506b86a6cde84a0ef19daa9e3b1926e2f96a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Tue, 12 May 2026 18:39:14 +0200 Subject: driver core: Allow the constification of device attributes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Allow device attribute to reside in read-only memory. Both const and non-const attributes are handled by the utility macros and attributes can be migrated one-by-one. Signed-off-by: Thomas Weißschuh Link: https://patch.msgid.link/20260512-sysfs-const-attr-device_attr-prep-v3-4-cb7c17b34d52@weissschuh.net Signed-off-by: Greg Kroah-Hartman --- include/linux/device.h | 69 +++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 57 insertions(+), 12 deletions(-) (limited to 'include') diff --git a/include/linux/device.h b/include/linux/device.h index 62985a8a78d3..7b2baffdd2f5 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -103,10 +103,18 @@ struct device_type { */ struct device_attribute { struct attribute attr; - ssize_t (*show)(struct device *dev, struct device_attribute *attr, - char *buf); - ssize_t (*store)(struct device *dev, struct device_attribute *attr, - const char *buf, size_t count); + __SYSFS_FUNCTION_ALTERNATIVE( + ssize_t (*show)(struct device *dev, struct device_attribute *attr, + char *buf); + ssize_t (*show_const)(struct device *dev, const struct device_attribute *attr, + char *buf); + ); + __SYSFS_FUNCTION_ALTERNATIVE( + ssize_t (*store)(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count); + ssize_t (*store_const)(struct device *dev, const struct device_attribute *attr, + const char *buf, size_t count); + ); }; /** @@ -134,11 +142,50 @@ ssize_t device_store_bool(struct device *dev, struct device_attribute *attr, ssize_t device_show_string(struct device *dev, struct device_attribute *attr, char *buf); +typedef ssize_t __device_show_handler_const(struct device *dev, const struct device_attribute *attr, + char *buf); +typedef ssize_t __device_store_handler_const(struct device *dev, const struct device_attribute *attr, + const char *buf, size_t count); + +#ifdef CONFIG_CFI + +#define __DEVICE_ATTR_SHOW_STORE(_show, _store) \ + .show = _Generic(_show, \ + __device_show_handler_const * : NULL, \ + default : _show \ + ), \ + .show_const = _Generic(_show, \ + __device_show_handler_const * : _show, \ + default : NULL \ + ), \ + .store = _Generic(_store, \ + __device_store_handler_const * : NULL, \ + default : _store \ + ), \ + .store_const = _Generic(_store, \ + __device_store_handler_const * : _store, \ + default : NULL \ + ), + +#else + +#define __DEVICE_ATTR_SHOW_STORE(_show, _store) \ + .show = _Generic(_show, \ + __device_show_handler_const * : (void *)_show, \ + default : _show \ + ), \ + .store = _Generic(_store, \ + __device_store_handler_const * : (void *)_store, \ + default : _store \ + ), \ + +#endif + + #define __DEVICE_ATTR(_name, _mode, _show, _store) { \ .attr = {.name = __stringify(_name), \ .mode = VERIFY_OCTAL_PERMISSIONS(_mode) }, \ - .show = _show, \ - .store = _store, \ + __DEVICE_ATTR_SHOW_STORE(_show, _store) \ } #define __DEVICE_ATTR_RO_MODE(_name, _mode) \ @@ -160,8 +207,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, #define __DEVICE_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) { \ .attr = {.name = __stringify(_name), .mode = _mode, \ .ignore_lockdep = true }, \ - .show = _show, \ - .store = _store, \ + __DEVICE_ATTR_SHOW_STORE(_show, _store) \ } #else #define __DEVICE_ATTR_IGNORE_LOCKDEP __DEVICE_ATTR @@ -220,8 +266,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, #define DEVICE_ATTR_RW_NAMED(_name, _attrname) \ struct device_attribute dev_attr_##_name = { \ .attr = { .name = _attrname, .mode = 0644 }, \ - .show = _name##_show, \ - .store = _name##_store, \ + __DEVICE_ATTR_SHOW_STORE(_name##_show, _name##_store) \ } /** @@ -254,7 +299,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, #define DEVICE_ATTR_RO_NAMED(_name, _attrname) \ struct device_attribute dev_attr_##_name = { \ .attr = { .name = _attrname, .mode = 0444 }, \ - .show = _name##_show, \ + __DEVICE_ATTR_SHOW_STORE(_name##_show, NULL) \ } /** @@ -278,7 +323,7 @@ ssize_t device_show_string(struct device *dev, struct device_attribute *attr, #define DEVICE_ATTR_WO_NAMED(_name, _attrname) \ struct device_attribute dev_attr_##_name = { \ .attr = { .name = _attrname, .mode = 0200 }, \ - .store = _name##_store, \ + __DEVICE_ATTR_SHOW_STORE(NULL, _name##_store) \ } /** -- cgit v1.2.3 From 43079e21ff53c6a77e669cec5b5b673b45f46e87 Mon Sep 17 00:00:00 2001 From: Costa Shulyupin Date: Fri, 15 May 2026 22:02:14 +0300 Subject: include: Remove unused crypto-ux500.h The UX500 crypto drivers were removed in commit 453de3eb08c4 ("crypto: ux500/cryp - delete driver") and commit dd7b7972cb89 ("crypto: ux500/hash - delete driver"). No file includes this header. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Costa Shulyupin Reviewed-by: Linus Walleij Signed-off-by: Herbert Xu --- include/linux/platform_data/crypto-ux500.h | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 include/linux/platform_data/crypto-ux500.h (limited to 'include') diff --git a/include/linux/platform_data/crypto-ux500.h b/include/linux/platform_data/crypto-ux500.h deleted file mode 100644 index 5d43350e32cc..000000000000 --- a/include/linux/platform_data/crypto-ux500.h +++ /dev/null @@ -1,22 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * Copyright (C) ST-Ericsson SA 2011 - * - * Author: Joakim Bech for ST-Ericsson - */ -#ifndef _CRYPTO_UX500_H -#define _CRYPTO_UX500_H -#include -#include - -struct hash_platform_data { - void *mem_to_engine; - bool (*dma_filter)(struct dma_chan *chan, void *filter_param); -}; - -struct cryp_platform_data { - struct stedma40_chan_cfg mem_to_engine; - struct stedma40_chan_cfg engine_to_mem; -}; - -#endif -- cgit v1.2.3 From 999722b34441b4ab65b7ca7fb16dd4b62fc3c354 Mon Sep 17 00:00:00 2001 From: Caleb Sander Mateos Date: Wed, 13 May 2026 15:18:45 -0600 Subject: blk-mq: introduce blk_rq_has_data() Add blk_rq_has_data(), an analogue of bio_has_data() for struct request. This skips one dereference relative to bio_has_data(rq->bio). Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://patch.msgid.link/20260513211846.1956810-2-csander@purestorage.com Signed-off-by: Jens Axboe --- include/linux/blk-mq.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 18a2388ba581..4349aefdbc87 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -1104,6 +1104,7 @@ struct req_iterator { /* * blk_rq_pos() : the current sector * blk_rq_bytes() : bytes left in the entire request + * blk_rq_has_data() : whether the request carries data * blk_rq_cur_bytes() : bytes left in the current segment * blk_rq_sectors() : sectors left in the entire request * blk_rq_cur_sectors() : sectors left in the current segment @@ -1119,6 +1120,14 @@ static inline unsigned int blk_rq_bytes(const struct request *rq) return rq->__data_len; } +static inline bool blk_rq_has_data(const struct request *rq) +{ + return blk_rq_bytes(rq) && + req_op(rq) != REQ_OP_DISCARD && + req_op(rq) != REQ_OP_SECURE_ERASE && + req_op(rq) != REQ_OP_WRITE_ZEROES; +} + static inline int blk_rq_cur_bytes(const struct request *rq) { if (!rq->bio) -- cgit v1.2.3 From 89818517c2ac011c753d328e048e6bffdc31f9bf Mon Sep 17 00:00:00 2001 From: Matt Evans Date: Fri, 22 May 2026 05:42:11 -0700 Subject: vfio/pci: Fix sparse warning in vfio_pci_core_get_iomap() Use IOMEM_ERR_PTR() when returning a void __iomem * rather than ERR_PTR(). This fixes a sparse warning, "different address spaces". Fixes: 859dc0f6253b ("vfio/pci: Replace vfio_pci_core_setup_barmap() with vfio_pci_core_get_iomap()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605211601.U1OvmuqY-lkp@intel.com/ Signed-off-by: Matt Evans Link: https://lore.kernel.org/r/20260522124215.3268565-1-mattev@meta.com Signed-off-by: Alex Williamson --- include/linux/vfio_pci_core.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 7accd0eac457..4fa129fc5c64 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -244,10 +244,10 @@ static inline void __iomem __must_check * vfio_pci_core_get_iomap(struct vfio_pci_core_device *vdev, unsigned int bar) { if (WARN_ON_ONCE(bar >= PCI_STD_NUM_BARS)) - return ERR_PTR(-EINVAL); + return IOMEM_ERR_PTR(-EINVAL); if (WARN_ON_ONCE(!vdev->barmap[bar])) - return ERR_PTR(-ENODEV); + return IOMEM_ERR_PTR(-ENODEV); return vdev->barmap[bar]; } -- cgit v1.2.3 From 40ef3edf151e184d021917a5c4c771cc0870844a Mon Sep 17 00:00:00 2001 From: Raghavendra Rao Ananta Date: Thu, 14 May 2026 17:34:49 +0000 Subject: vfio/pci: Use a private flag to prevent power state change with VFs The current implementation uses pci_num_vf() while holding the memory_lock to prevent changing the power state of a PF when VFs are enabled. This creates a lockdep circular dependency warning because memory_lock is held during device probing. [ 286.997167] ====================================================== [ 287.003363] WARNING: possible circular locking dependency detected [ 287.009562] 7.0.0-dbg-DEV #3 Tainted: G S [ 287.015074] ------------------------------------------------------ [ 287.021270] vfio_pci_sriov_/18636 is trying to acquire lock: [ 287.026942] ff45bea2294d4968 (&vdev->memory_lock){+.+.}-{4:4}, at: vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.036530] [ 287.036530] but task is already holding lock: [ 287.042383] ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4}, at: vfio_group_fops_unl_ioctl+0x44d/0x7b0 [ 287.051879] [ 287.051879] which lock already depends on the new lock. [ 287.051879] [ 287.060070] [ 287.060070] the existing dependency chain (in reverse order) is: [ 287.067568] [ 287.067568] -> #2 (&new_dev_set->lock){+.+.}-{4:4}: [ 287.073941] __mutex_lock+0x92/0xb80 [ 287.078058] vfio_assign_device_set+0x66/0x1b0 [ 287.083042] vfio_pci_core_register_device+0xd1/0x2a0 [ 287.088638] vfio_pci_probe+0xd2/0x100 [ 287.092933] local_pci_probe_callback+0x4d/0xa0 [ 287.098001] process_scheduled_works+0x2ca/0x680 [ 287.103158] worker_thread+0x1e8/0x2f0 [ 287.107452] kthread+0x10c/0x140 [ 287.111230] ret_from_fork+0x18e/0x360 [ 287.115519] ret_from_fork_asm+0x1a/0x30 [ 287.119983] [ 287.119983] -> #1 ((work_completion)(&arg.work)){+.+.}-{0:0}: [ 287.127219] __flush_work+0x345/0x490 [ 287.131429] pci_device_probe+0x2e3/0x490 [ 287.135979] really_probe+0x1f9/0x4e0 [ 287.140180] __driver_probe_device+0x77/0x100 [ 287.145079] driver_probe_device+0x1e/0x110 [ 287.149803] __device_attach_driver+0xe3/0x170 [ 287.154789] bus_for_each_drv+0x125/0x150 [ 287.159346] __device_attach+0xca/0x1a0 [ 287.163720] device_initial_probe+0x34/0x50 [ 287.168445] pci_bus_add_device+0x6e/0x90 [ 287.172995] pci_iov_add_virtfn+0x3c9/0x3e0 [ 287.177719] sriov_add_vfs+0x2c/0x60 [ 287.181838] sriov_enable+0x306/0x4a0 [ 287.186038] vfio_pci_core_sriov_configure+0x184/0x220 [ 287.191715] sriov_numvfs_store+0xd9/0x1c0 [ 287.196351] kernfs_fop_write_iter+0x13f/0x1d0 [ 287.201338] vfs_write+0x2be/0x3b0 [ 287.205286] ksys_write+0x73/0x100 [ 287.209233] do_syscall_64+0x14d/0x750 [ 287.213529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.219120] [ 287.219120] -> #0 (&vdev->memory_lock){+.+.}-{4:4}: [ 287.225491] __lock_acquire+0x14c6/0x2800 [ 287.230048] lock_acquire+0xd3/0x2f0 [ 287.234168] down_write+0x3a/0xc0 [ 287.238019] vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.243436] __rpm_callback+0x8c/0x310 [ 287.247730] rpm_resume+0x529/0x6f0 [ 287.251765] __pm_runtime_resume+0x68/0x90 [ 287.256402] vfio_pci_core_enable+0x44/0x310 [ 287.261216] vfio_pci_open_device+0x1c/0x80 [ 287.265947] vfio_df_open+0x10f/0x150 [ 287.270148] vfio_group_fops_unl_ioctl+0x4a4/0x7b0 [ 287.275476] __se_sys_ioctl+0x71/0xc0 [ 287.279679] do_syscall_64+0x14d/0x750 [ 287.283975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.289559] [ 287.289559] other info that might help us debug this: [ 287.289559] [ 287.297582] Chain exists of: [ 287.297582] &vdev->memory_lock --> (work_completion)(&arg.work) --> &new_dev_set->lock [ 287.297582] [ 287.310023] Possible unsafe locking scenario: [ 287.310023] [ 287.315961] CPU0 CPU1 [ 287.320510] ---- ---- [ 287.325059] lock(&new_dev_set->lock); [ 287.328917] lock((work_completion)(&arg.work)); [ 287.336153] lock(&new_dev_set->lock); [ 287.342523] lock(&vdev->memory_lock); [ 287.346382] [ 287.346382] *** DEADLOCK *** [ 287.346382] [ 287.352315] 2 locks held by vfio_pci_sriov_/18636: [ 287.357125] #0: ff45bea208ed3e18 (&group->group_lock){+.+.}-{4:4}, at: vfio_group_fops_unl_ioctl+0x3e3/0x7b0 [ 287.367048] #1: ff45bea3a96b8230 (&new_dev_set->lock){+.+.}-{4:4}, at: vfio_group_fops_unl_ioctl+0x44d/0x7b0 [ 287.376976] [ 287.376976] stack backtrace: [ 287.381353] CPU: 191 UID: 0 PID: 18636 Comm: vfio_pci_sriov_ Tainted: G S 7.0.0-dbg-DEV #3 PREEMPTLAZY [ 287.381355] Tainted: [S]=CPU_OUT_OF_SPEC [ 287.381356] Call Trace: [ 287.381357] [ 287.381358] dump_stack_lvl+0x54/0x70 [ 287.381361] print_circular_bug+0x2e1/0x300 [ 287.381363] check_noncircular+0xf9/0x120 [ 287.381364] ? __lock_acquire+0x5b4/0x2800 [ 287.381366] __lock_acquire+0x14c6/0x2800 [ 287.381368] ? pci_mmcfg_read+0x4f/0x220 [ 287.381370] ? pci_mmcfg_write+0x57/0x220 [ 287.381371] ? lock_acquire+0xd3/0x2f0 [ 287.381373] ? pci_mmcfg_write+0x57/0x220 [ 287.381374] ? lock_release+0xef/0x360 [ 287.381376] ? vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.381377] lock_acquire+0xd3/0x2f0 [ 287.381378] ? vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.381379] ? lock_is_held_type+0x76/0x100 [ 287.381382] down_write+0x3a/0xc0 [ 287.381382] ? vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.381383] vfio_pci_core_runtime_resume+0x1f/0xa0 [ 287.381384] ? __pfx_pci_pm_runtime_resume+0x10/0x10 [ 287.381385] __rpm_callback+0x8c/0x310 [ 287.381386] ? ktime_get_mono_fast_ns+0x3d/0xb0 [ 287.381389] ? __pfx_pci_pm_runtime_resume+0x10/0x10 [ 287.381390] rpm_resume+0x529/0x6f0 [ 287.381392] ? lock_is_held_type+0x76/0x100 [ 287.381394] __pm_runtime_resume+0x68/0x90 [ 287.381396] vfio_pci_core_enable+0x44/0x310 [ 287.381398] vfio_pci_open_device+0x1c/0x80 [ 287.381399] vfio_df_open+0x10f/0x150 [ 287.381401] vfio_group_fops_unl_ioctl+0x4a4/0x7b0 [ 287.381402] __se_sys_ioctl+0x71/0xc0 [ 287.381404] do_syscall_64+0x14d/0x750 [ 287.381405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.381406] ? trace_irq_disable+0x25/0xd0 [ 287.381409] entry_SYSCALL_64_after_hwframe+0x77/0x7f Introduce a private flag 'sriov_active' in the vfio_pci_core_device struct. This allows the driver to track the SR-IOV power state requirement without relying on pci_num_vf() while holding the memory_lock. The lock is now only held to set the flag and ensure the device is in D0, after which pci_enable_sriov() can be called without the lock. Fixes: f4162eb1e2fc ("vfio/pci: Change the PF power state to D0 before enabling VFs") Cc: stable@vger.kernel.org Suggested-by: Jason Gunthorpe Suggested-by: Alex Williamson Signed-off-by: Raghavendra Rao Ananta Link: https://lore.kernel.org/r/20260514173449.3282188-1-rananta@google.com [promote bitfield to plain bool to avoid storage-unit races] Signed-off-by: Alex Williamson --- include/linux/vfio_pci_core.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 4fa129fc5c64..5fc6ce4dd786 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -127,6 +127,7 @@ struct vfio_pci_core_device { bool needs_pm_restore:1; bool pm_intx_masked:1; bool pm_runtime_engaged:1; + bool sriov_active; struct pci_saved_state *pci_saved_state; struct pci_saved_state *pm_save; int ioeventfds_nr; -- cgit v1.2.3 From aa70232cc7431d517e0402d90c38e11b67414049 Mon Sep 17 00:00:00 2001 From: Viresh Kumar Date: Fri, 22 May 2026 09:49:08 +0530 Subject: cpufreq: Fix typo in comment Replace "diver" with "driver" in the comment describing CPUFREQ_NEED_UPDATE_LIMITS. Signed-off-by: Viresh Kumar Reviewed-by: Zhongqiu Han Reviewed-by: Lifeng Zheng Link: https://patch.msgid.link/396f64411431ffbb5b4f07d1f2e0bbf9763d468f.1779423281.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki --- include/linux/cpufreq.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 2ab691828e48..4d4b4ed24b30 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -434,7 +434,7 @@ struct cpufreq_driver { /* * Set by drivers that need to update internal upper and lower boundaries along * with the target frequency and so the core and governors should also invoke - * the diver if the target frequency does not change, but the policy min or max + * the driver if the target frequency does not change, but the policy min or max * may have changed. */ #define CPUFREQ_NEED_UPDATE_LIMITS BIT(0) -- cgit v1.2.3 From 9801be8bef65dbcbc40c1a9c2f03d70ed67a5d30 Mon Sep 17 00:00:00 2001 From: Viresh Kumar Date: Fri, 22 May 2026 09:49:09 +0530 Subject: cpufreq: Avoid redundant target() calls for unchanged limits Drivers setting CPUFREQ_NEED_UPDATE_LIMITS expect target() to be invoked even if the target frequency remains unchanged, so they can update their internal policy limits state. Currently the core invokes target() unconditionally whenever the requested frequency matches policy->cur for such drivers, even if policy->min and policy->max haven't changed since the previous update. Track pending policy limit updates explicitly and skip redundant target() invocations when neither the target frequency nor the effective limits changed. Signed-off-by: Viresh Kumar Reviewed-by: Lifeng Zheng Reviewed-by: Zhongqiu Han Link: https://patch.msgid.link/d0107c364b709abca21acf88072220bc05478594.1779423281.git.viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki --- include/linux/cpufreq.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 4d4b4ed24b30..ae9d1ce4f49c 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -146,6 +146,9 @@ struct cpufreq_policy { /* Per policy boost supported flag. */ bool boost_supported; + /* Pending policy->min/max update for the driver */ + bool update_limits; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- cgit v1.2.3 From c227f8aaf22cf5acc3a55a4fef1dd2bf110caebe Mon Sep 17 00:00:00 2001 From: Erni Sri Satya Vennela Date: Mon, 18 May 2026 23:46:10 -0700 Subject: net: mana: Expose hardware diagnostic info via debugfs Add debugfs entries to expose hardware configuration and diagnostic information that aids in debugging driver initialization and runtime operations without adding noise to dmesg. The debugfs directory for each PCI device is named using pci_name() (the unique BDF address), and its creation and removal is integrated into mana_gd_setup() and mana_gd_cleanup_device() respectively, so that all callers (probe, remove, suspend, resume, shutdown) share a single code path. Device-level entries (under /sys/kernel/debug/mana//): - num_msix_usable, max_num_queues: Max resources from hardware - gdma_protocol_ver, pf_cap_flags1: VF version negotiation results - num_vports, bm_hostmode: Device configuration Per-vPort entries (under /sys/kernel/debug/mana//vportN/): - port_handle: Hardware vPort handle - max_sq, max_rq: Max queues from vPort config - indir_table_sz: Indirection table size - steer_rx, steer_rss, steer_update_tab, steer_cqe_coalescing: Last applied steering configuration parameters Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260519064621.772154-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/gdma.h | 1 + include/net/mana/mana.h | 8 ++++++++ 2 files changed, 9 insertions(+) (limited to 'include') diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h index 6d836060976a..70d62bc32837 100644 --- a/include/net/mana/gdma.h +++ b/include/net/mana/gdma.h @@ -442,6 +442,7 @@ struct gdma_context { struct gdma_dev mana_ib; u64 pf_cap_flags1; + u64 gdma_protocol_ver; struct workqueue_struct *service_wq; diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h index aa90a858c8e3..d9c27310fd04 100644 --- a/include/net/mana/mana.h +++ b/include/net/mana/mana.h @@ -568,6 +568,14 @@ struct mana_port_context { /* Debugfs */ struct dentry *mana_port_debugfs; + + /* Cached vport/steering config for debugfs */ + u32 vport_max_sq; + u32 vport_max_rq; + u32 steer_rx; + u32 steer_rss; + bool steer_update_tab; + u32 steer_cqe_coalescing; }; netdev_tx_t mana_start_xmit(struct sk_buff *skb, struct net_device *ndev); -- cgit v1.2.3 From b7b1b8464b4712da8cce2015709ead71050c5a8b Mon Sep 17 00:00:00 2001 From: David Yang Date: Thu, 21 May 2026 09:03:06 +0800 Subject: net/sched: tbf: add extack to offload params Drivers might have error messages to propagate to user space. Propagate the netlink extack so that they can inform user space in a verbal way of their limitations. Signed-off-by: David Yang Link: https://patch.msgid.link/20260521010320.208138-3-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski --- include/net/pkt_cls.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h index 99ac747b7906..3bd08d7f39c1 100644 --- a/include/net/pkt_cls.h +++ b/include/net/pkt_cls.h @@ -1046,6 +1046,7 @@ struct tc_tbf_qopt_offload_replace_params { }; struct tc_tbf_qopt_offload { + struct netlink_ext_ack *extack; enum tc_tbf_command command; u32 handle; u32 parent; -- cgit v1.2.3 From 7409fad779e271f252d844ae16e1a7429626b13e Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 21 May 2026 17:14:39 +0000 Subject: dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used We plan to no longer hold RTNL in "ip link show", and use RCU instead. Assume rtnl_fill_dpll_pin() will have to fill DPLL_A_PIN_ID. It is fine to over-estimate skb size (by 8 bytes) in if_nlmsg_size(). Signed-off-by: Eric Dumazet Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260521171440.114956-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/dpll.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/dpll.h b/include/linux/dpll.h index 82dfadd9f593..4071fd974dd7 100644 --- a/include/linux/dpll.h +++ b/include/linux/dpll.h @@ -13,6 +13,7 @@ #include #include #include +#include struct dpll_device; struct dpll_pin; @@ -238,7 +239,11 @@ struct dpll_pin_notifier_info { void dpll_netdev_pin_set(struct net_device *dev, struct dpll_pin *dpll_pin); void dpll_netdev_pin_clear(struct net_device *dev); -size_t dpll_netdev_pin_handle_size(const struct net_device *dev); +static inline size_t dpll_netdev_pin_handle_size(void) +{ + return nla_total_size(4); /* DPLL_A_PIN_ID */ +} + int dpll_netdev_add_pin_handle(struct sk_buff *msg, const struct net_device *dev); @@ -249,7 +254,7 @@ static inline void dpll_netdev_pin_set(struct net_device *dev, struct dpll_pin *dpll_pin) { } static inline void dpll_netdev_pin_clear(struct net_device *dev) { } -static inline size_t dpll_netdev_pin_handle_size(const struct net_device *dev) +static inline size_t dpll_netdev_pin_handle_size(void) { return 0; } -- cgit v1.2.3 From 8933fa6695aaea6559d3469581139a4c1f427369 Mon Sep 17 00:00:00 2001 From: Can Guo Date: Fri, 1 May 2026 06:16:40 -0700 Subject: scsi: ufs: core: Add a quirk for extended TX EQTR Adapt L0L1L2L3 length Add a quirk to support TX Equalization Training (EQTR) using Adapt L0L1L2L3 length which is larger than what is allowed by M-PHY spec ver 6.0. Signed-off-by: Can Guo Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Reviewed-by: Ziqi Chen Link: https://patch.msgid.link/20260501131641.826258-2-can.guo@oss.qualcomm.com Signed-off-by: Martin K. Petersen --- include/ufs/ufshcd.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h index f48d6416e299..3eaae082329c 100644 --- a/include/ufs/ufshcd.h +++ b/include/ufs/ufshcd.h @@ -806,6 +806,13 @@ enum ufshcd_quirks { * delay after enabling VCC to ensure it's stable. */ UFSHCD_QUIRK_VCC_ON_DELAY = 1 << 27, + + /* + * This quirk indicates that Host supports TX Equalization Training + * (EQTR) using Adapt L0L1L2L3 length which is larger than what is + * allowed by M-PHY spec ver 6.0. + */ + UFSHCD_QUIRK_EXTENDED_TX_EQTR_ADAPT_LENGTH_L0L1L2L3 = 1 << 28, }; enum ufshcd_caps { -- cgit v1.2.3 From b1968f46509e077d3241ac509e41fd14ec2395db Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Fri, 15 May 2026 13:52:19 -0700 Subject: scsi: core: target: Add INQUIRY-related constants to scsi_common.h Move three constants from target/target_core_base.h into scsi/scsi_common.h. Add three new constants in the scsi_common.h header file. This patch prepares for using these constants in the SCSI core. Signed-off-by: Bart Van Assche Tested-by: Brian Bunker Link: https://patch.msgid.link/20260515205222.1754621-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen --- include/scsi/scsi_common.h | 8 ++++++++ include/target/target_core_base.h | 5 +---- 2 files changed, 9 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h index fb58715fac86..00c8a16d3cd2 100644 --- a/include/scsi/scsi_common.h +++ b/include/scsi/scsi_common.h @@ -10,6 +10,14 @@ #include #include +/* From the standard INQUIRY data description in SPC-6. */ +#define INQUIRY_VENDOR_OFFSET 8 +#define INQUIRY_VENDOR_LEN 8 +#define INQUIRY_MODEL_OFFSET 16 +#define INQUIRY_MODEL_LEN 16 +#define INQUIRY_REVISION_OFFSET 32 +#define INQUIRY_REVISION_LEN 4 + enum scsi_pr_type { SCSI_PR_WRITE_EXCLUSIVE = 0x01, SCSI_PR_EXCLUSIVE_ACCESS = 0x03, diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h index 9a0e9f9e1ec4..002b0fc57587 100644 --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h @@ -8,6 +8,7 @@ #include #include /* struct semaphore */ #include +#include #define TARGET_CORE_VERSION "v5.0" @@ -46,10 +47,6 @@ /* Used by transport_get_inquiry_vpd_device_ident() */ #define INQUIRY_VPD_DEVICE_IDENTIFIER_LEN 254 -#define INQUIRY_VENDOR_LEN 8 -#define INQUIRY_MODEL_LEN 16 -#define INQUIRY_REVISION_LEN 4 - /* Attempts before moving from SHORT to LONG */ #define PYX_TRANSPORT_WINDOW_CLOSED_THRESHOLD 3 #define PYX_TRANSPORT_WINDOW_CLOSED_WAIT_SHORT 3 /* In milliseconds */ -- cgit v1.2.3 From 20fd1648f35399f114351b67c14ff8d3233a30e2 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Fri, 15 May 2026 13:52:21 -0700 Subject: scsi: core: Convert INQUIRY information Currently the vendor, model, and revision members of struct scsi_device are pointers to fixed-length strings that are not NUL-terminated. Fixed-precision format specifiers (e.g., "%.8s") are required whenever they are printed and strncmp() must be used to compare these fields. This is error-prone. Convert these fields to fixed-size character arrays within struct scsi_device. Remove an !sdev->model check because sdev->model is now guaranteed not to be NULL. This patch fixes a bug in the qla2xxx driver. It makes the following code safe: if (state_flags & BIT_4) scmd_printk(KERN_WARNING, cp, "Unsupported device '%s' found.\n", cp->device->vendor); Signed-off-by: Bart Van Assche Tested-by: Brian Bunker Link: https://patch.msgid.link/20260515205222.1754621-4-bvanassche@acm.org Signed-off-by: Martin K. Petersen --- include/scsi/scsi_device.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h index 9c2a7bbe5891..029f5115b2ea 100644 --- a/include/scsi/scsi_device.h +++ b/include/scsi/scsi_device.h @@ -7,6 +7,7 @@ #include #include #include +#include #include #include @@ -137,9 +138,9 @@ struct scsi_device { struct mutex inquiry_mutex; unsigned char inquiry_len; /* valid bytes in 'inquiry' */ unsigned char * inquiry; /* INQUIRY response data */ - const char * vendor; /* [back_compat] point into 'inquiry' ... */ - const char * model; /* ... after scan; point to static string */ - const char * rev; /* ... "nullnullnullnull" before scan */ + char vendor[INQUIRY_VENDOR_LEN + 1]; + char model[INQUIRY_MODEL_LEN + 1]; + char rev[INQUIRY_REVISION_LEN + 1]; #define SCSI_DEFAULT_VPD_LEN 255 /* default SCSI VPD page size (max) */ struct scsi_vpd __rcu *vpd_pg0; -- cgit v1.2.3 From 258df8fce42fecc23cd04242de3d39f1fe836433 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Fri, 22 May 2026 07:22:12 -1000 Subject: mm: Add ptep_try_set() for lockless empty-slot installs Add ptep_try_set(ptep, new_pte): atomically set *ptep to new_pte iff it is currently pte_none(). Returns true on success, false if the slot was already populated or the arch has no implementation. The intended caller is the upcoming bpf_arena kernel-side fault recovery path. The install runs from a page fault that can be nested under locks held by the faulting kernel caller (e.g. a BPF program holding raw_res_spin_lock_irqsave on its arena's spinlock), so trylock-and-retry would A-A deadlock. Lock-free cmpxchg is the only viable option, which constrains this helper to special kernel page tables where concurrent writers cooperate via atomic accessors. The generic version in returns false. x86 and arm64 override with try_cmpxchg-based implementations on the underlying pteval. Other architectures get the false stub - the callers there already fall through to oops. v2: Rename to ptep_try_set(). Tighten kerneldoc. (David, Alexei) v3: Note that strict-zero cmpxchg is narrower than pte_none(). (Andrea) Suggested-by: Kumar Kartikeya Dwivedi Suggested-by: Alexei Starovoitov Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi Cc: David Hildenbrand Acked-by: David Hildenbrand (arm) Link: https://lore.kernel.org/r/20260522172219.1423324-2-tj@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/pgtable.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'include') diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h index cdd68ed3ae1a..b5739bb99fc1 100644 --- a/include/linux/pgtable.h +++ b/include/linux/pgtable.h @@ -1036,6 +1036,31 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres } #endif +#ifndef ptep_try_set +/** + * ptep_try_set - atomically set an empty kernel PTE + * @ptep: page table entry + * @new_pte: value to install + * + * Atomically set *@ptep to @new_pte iff *@ptep is pte_none(). Return true on + * success, false if the slot was already populated or the arch has no + * implementation. + * + * For special kernel page tables only - never user page tables. The caller must + * prevent concurrent teardown of @ptep and must accept that other writers may + * race. Concurrent clearers must use ptep_get_and_clear() so racing accesses + * agree on the outcome. + * + * Architectures opt in by providing a cmpxchg-based override and defining + * ptep_try_set as an identity macro. The generic stub returns false, which is + * correct for callers that fall through to oops on failure. + */ +static inline bool ptep_try_set(pte_t *ptep, pte_t new_pte) +{ + return false; +} +#endif + #ifndef wrprotect_ptes /** * wrprotect_ptes - Write-protect PTEs that map consecutive pages of the same -- cgit v1.2.3 From dc11a4dba2464e5144c318ffaf7fb16b1a5c74d6 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 22 May 2026 07:22:13 -1000 Subject: bpf: Recover arena kernel faults with scratch page BPF arena usage is becoming more prevalent, but kernel <-> BPF communication over arena memory is awkward today. Data has to be staged through a trusted kernel pointer with extra code and copying on the BPF side. While reads through arena pointers can use a fault-safe helper, writes don't have a good solution. The in-line alternative would need instruction emulation or asm fixup labels. Enable direct kernel-side reads and writes within GUARD_SZ / 2 of any handed-in arena pointer, without bounds checking. A per-arena scratch page is installed by the arch fault path into empty arena kernel PTEs - x86 from page_fault_oops() for not-present faults, arm64 from __do_kernel_fault() for translation faults, both after the existing exception-table and KFENCE handling. The faulting instruction retries and the access is also reported through the program's BPF stream, preserving error reporting. bpf_prog_find_from_stack() resolves the current BPF program (and its arena) from the kernel stack - no new bpf_run_ctx state is added. Recovery covers the 4 GiB arena plus the upper half-guard (GUARD_SZ / 2). The lower half-guard is excluded because well-behaved kfuncs only access forward from arena pointers. The kfunc-author contract - access at most GUARD_SZ / 2 past a handed-in pointer - is documented in Documentation/bpf/kfuncs.rst. The install is lock-free via ptep_try_set(). On race-loss the winning installer's PTE is already valid, so the access retry succeeds. The arena clear path uses ptep_get_and_clear() so installer and clearer race through atomic accessors. No flush_tlb_kernel_range() afterwards. Stale "not mapped" entries just cause one extra re-fault, cheaper than a global IPI on every install. Scratch exists only to keep the kernel from oopsing on an in-line arena access. Its presence at a PTE means the BPF program has already malfunctioned, and the violation is reported through the program's BPF stream. The only requirement for behavior on a scratched PTE is that the kernel doesn't crash. In particular, any user-side access through such a PTE may segfault. The shared scratch page is freed once during map destruction. BPF instruction faults continue to use the existing JIT exception-table path. This patch changes only the kernel-text fault path. No UAPI flag is added. The new behavior is the default. v2: Use ptep_get_and_clear() in apply_range_clear_cb(). (David) v3: Stub bpf_arena_handle_page_fault() for !CONFIG_BPF_SYSCALL. (lkp) Suggested-by: Alexei Starovoitov Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Cc: David Hildenbrand Link: https://lore.kernel.org/r/20260522172219.1423324-3-tj@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 1 + include/linux/bpf_defs.h | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 include/linux/bpf_defs.h (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 01e203964892..bb4261a5df64 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -6,6 +6,7 @@ #include #include +#include #include #include diff --git a/include/linux/bpf_defs.h b/include/linux/bpf_defs.h new file mode 100644 index 000000000000..2185cd3966d4 --- /dev/null +++ b/include/linux/bpf_defs.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* + * Subset of bpf.h declarations, split out so files that need only these + * declarations can avoid bpf.h's full include cost. + */ +#ifndef _LINUX_BPF_DEFS_H +#define _LINUX_BPF_DEFS_H + +#ifdef CONFIG_BPF_SYSCALL +bool bpf_arena_handle_page_fault(unsigned long addr, bool is_write, unsigned long fault_ip); +#else +static inline bool bpf_arena_handle_page_fault(unsigned long addr, bool is_write, + unsigned long fault_ip) +{ + return false; +} +#endif + +#endif /* _LINUX_BPF_DEFS_H */ -- cgit v1.2.3 From f211c81ddc368e5cc6ad69d171bca0fa52e71ad7 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Fri, 22 May 2026 07:22:14 -1000 Subject: bpf: Add sleepable variant of bpf_arena_alloc_pages for kernel callers The existing kernel-side export of bpf_arena_alloc_pages is _non_sleepable only - it's used by the verifier to inline the kfunc when the call site is non-sleepable. There is no sleepable equivalent for kernel callers. The kfunc bpf_arena_alloc_pages itself is BPF-only. sched_ext needs sleepable kernel-side allocs for its arena pool init/grow paths. Add bpf_arena_alloc_pages_sleepable() mirroring the _non_sleepable wrapper but passing sleepable=true to arena_alloc_pages(). Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260522172219.1423324-4-tj@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index bb4261a5df64..c00be24e7244 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -679,6 +679,8 @@ int bpf_dynptr_from_file_sleepable(struct file *file, u32 flags, void *bpf_arena_alloc_pages_non_sleepable(void *p__map, void *addr__ign, u32 page_cnt, int node_id, u64 flags); void bpf_arena_free_pages_non_sleepable(void *p__map, void *ptr__ign, u32 page_cnt); +void *bpf_arena_alloc_pages_sleepable(void *p__map, void *addr__ign, u32 page_cnt, int node_id, + u64 flags); #else static inline void *bpf_arena_alloc_pages_non_sleepable(void *p__map, void *addr__ign, u32 page_cnt, int node_id, u64 flags) @@ -689,6 +691,12 @@ static inline void *bpf_arena_alloc_pages_non_sleepable(void *p__map, void *addr static inline void bpf_arena_free_pages_non_sleepable(void *p__map, void *ptr__ign, u32 page_cnt) { } + +static inline void *bpf_arena_alloc_pages_sleepable(void *p__map, void *addr__ign, u32 page_cnt, + int node_id, u64 flags) +{ + return NULL; +} #endif extern const struct bpf_map_ops bpf_map_offload_ops; -- cgit v1.2.3 From 7c48a28c1bbe26e272bc978a42adb757fc6aa639 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Fri, 22 May 2026 07:22:15 -1000 Subject: bpf: Add bpf_struct_ops_for_each_prog() Add a helper that walks the member progs of the struct_ops map containing a given @kdata vmtable. struct_ops ->reg() callbacks (and similar) sometimes need to inspect the loaded BPF programs, e.g. to discover maps they reference via prog->aux->used_maps. The implementation mirrors bpf_struct_ops_id(): container_of @kdata to recover the bpf_struct_ops_map, then iterate st_map->links[i]->prog for i in [0, funcs_cnt). Same access pattern, no new locking - by the time ->reg() fires st_map is fully populated and stable. A sched_ext follow-up walks the member progs of a cid-form scheduler's struct_ops map, reads prog->aux->arena directly, and requires all member progs to reference exactly one arena, without requiring the BPF program to call a registration kfunc. Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260522172219.1423324-5-tj@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index c00be24e7244..491cc6750504 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2131,6 +2131,9 @@ int bpf_prog_assoc_struct_ops(struct bpf_prog *prog, struct bpf_map *map); void bpf_prog_disassoc_struct_ops(struct bpf_prog *prog); void *bpf_prog_get_assoc_struct_ops(const struct bpf_prog_aux *aux); u32 bpf_struct_ops_id(const void *kdata); +int bpf_struct_ops_for_each_prog(const void *kdata, + int (*cb)(struct bpf_prog *prog, void *data), + void *data); #ifdef CONFIG_NET /* Define it here to avoid the use of forward declaration */ -- cgit v1.2.3 From 53cc12a2dc88c2c6f62f507548640885a70a56a8 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Fri, 22 May 2026 07:22:16 -1000 Subject: bpf/arena: Add bpf_arena_map_kern_vm_start() and bpf_prog_arena() struct bpf_arena is opaque to callers outside arena.c. Add two helpers for struct_ops subsystems that need to reach into an arena: bpf_arena_map_kern_vm_start(struct bpf_map *map) returns @map's kern_vm_start. A sched_ext follow-up needs this to translate kern_va <-> uaddr. bpf_prog_arena(struct bpf_prog *prog) returns the bpf_map of the arena referenced by @prog (NULL if @prog references no arena). The verifier enforces at most one arena per program. Used by struct_ops callers that auto-discover an arena from a member prog and need to take a map reference. Suggested-by: Kumar Kartikeya Dwivedi Signed-off-by: Tejun Heo Reviewed-by: Emil Tsalapatis Link: https://lore.kernel.org/r/20260522172219.1423324-6-tj@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 491cc6750504..c323b3e027fe 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -618,6 +618,8 @@ void bpf_rb_root_free(const struct btf_field *field, void *rb_root, struct bpf_spin_lock *spin_lock); u64 bpf_arena_get_kern_vm_start(struct bpf_arena *arena); u64 bpf_arena_get_user_vm_start(struct bpf_arena *arena); +u64 bpf_arena_map_kern_vm_start(struct bpf_map *map); +struct bpf_map *bpf_prog_arena(struct bpf_prog *prog); int bpf_obj_name_cpy(char *dst, const char *src, unsigned int size); struct bpf_offload_dev; -- cgit v1.2.3 From ada02d0894fd0ae65bda4d5fbf88dad0a6cb0788 Mon Sep 17 00:00:00 2001 From: Manivannan Sadhasivam Date: Tue, 19 May 2026 13:41:20 +0530 Subject: PCI: Add pci_suspend_retains_context() to check if device state is preserved during suspend Currently, PCI endpoint drivers (e.g. nvme) use pm_suspend_via_firmware() to check whether device state is preserved during system suspend. If firmware will be invoked at the end of suspend, we don't know whether devices will retain their internal state. But device context might be lost due to platform issues as well. Having those checks in endpoint drivers will not scale and will cause a lot of code duplication. Add pci_suspend_retains_context() as a sole point of truth that the endpoint drivers can rely on to check whether they can expect the device context to be retained or not. If pci_suspend_retains_context() returns 'false', drivers need to prepare for context loss by performing actions such as resetting the device, saving the context, shutting it down etc. If it returns 'true', drivers do not need to perform any special action and can leave the device in active state. Right now, this API only incorporates pm_suspend_via_firmware(), but will be extended in future commits. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260519-l1ss-fix-v2-1-b2c3a4bdeb15@oss.qualcomm.com --- include/linux/pci.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index 2c4454583c11..f60f9e4e7b39 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -2086,6 +2086,8 @@ pci_release_mem_regions(struct pci_dev *pdev) pci_select_bars(pdev, IORESOURCE_MEM)); } +bool pci_suspend_retains_context(struct pci_dev *pdev); + #else /* CONFIG_PCI is not enabled */ static inline void pci_set_flags(int flags) { } @@ -2244,6 +2246,11 @@ pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs, static inline void pci_free_irq_vectors(struct pci_dev *dev) { } + +static inline bool pci_suspend_retains_context(struct pci_dev *pdev) +{ + return true; +} #endif /* CONFIG_PCI */ /* Include architecture-dependent settings and functions */ -- cgit v1.2.3 From 160625174ab4058855452d0340ce25f2c76c335b Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Fri, 1 May 2026 21:33:28 -0700 Subject: char: dtlk: remove driver for ISA speech synthesizer card The dtlk driver supports the RC Systems DoubleTalk PC ISA speech synthesizer card. It has severe coding style issues and has only received tree-wide fixes and drive-by cleanups in the entire Git history (since Linux 2.6.12-rc2). The same hardware is supported by drivers/accessibility/speakup for screen reader use, but that implementation does not share any code with this driver. Given all of these factors, it is likely the driver is entirely unused. Remove it to reduce future maintenance workload. Note: The removed maintainer is already listed in CREDITS. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260502043341.34324-1-enelsonmoore@gmail.com Signed-off-by: Greg Kroah-Hartman --- include/linux/dtlk.h | 86 ---------------------------------------------------- 1 file changed, 86 deletions(-) delete mode 100644 include/linux/dtlk.h (limited to 'include') diff --git a/include/linux/dtlk.h b/include/linux/dtlk.h deleted file mode 100644 index 27b95e70bde3..000000000000 --- a/include/linux/dtlk.h +++ /dev/null @@ -1,86 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#define DTLK_MINOR 0 -#define DTLK_IO_EXTENT 0x02 - - /* ioctl's use magic number of 0xa3 */ -#define DTLK_INTERROGATE 0xa390 /* get settings from the DoubleTalk */ -#define DTLK_STATUS 0xa391 /* get status from the DoubleTalk */ - - -#define DTLK_CLEAR 0x18 /* stops speech */ - -#define DTLK_MAX_RETRIES (loops_per_jiffy/(10000/HZ)) - - /* TTS Port Status Flags */ -#define TTS_READABLE 0x80 /* mask for bit which is nonzero if a - byte can be read from the TTS port */ -#define TTS_SPEAKING 0x40 /* mask for SYNC bit, which is nonzero - while DoubleTalk is producing - output with TTS, PCM or CVSD - synthesizers or tone generators - (that is, all but LPC) */ -#define TTS_SPEAKING2 0x20 /* mask for SYNC2 bit, - which falls to zero up to 0.4 sec - before speech stops */ -#define TTS_WRITABLE 0x10 /* mask for RDY bit, which when set to - 1, indicates the TTS port is ready - to accept a byte of data. The RDY - bit goes zero 2-3 usec after - writing, and goes 1 again 180-190 - usec later. */ -#define TTS_ALMOST_FULL 0x08 /* mask for AF bit: When set to 1, - indicates that less than 300 free - bytes are available in the TTS - input buffer. AF is always 0 in the - PCM, TGN and CVSD modes. */ -#define TTS_ALMOST_EMPTY 0x04 /* mask for AE bit: When set to 1, - indicates that less than 300 bytes - of data remain in DoubleTalk's - input (TTS or PCM) buffer. AE is - always 1 in the TGN and CVSD - modes. */ - - /* LPC speak commands */ -#define LPC_5220_NORMAL 0x60 /* 5220 format decoding table, normal rate */ -#define LPC_5220_FAST 0x64 /* 5220 format decoding table, fast rate */ -#define LPC_D6_NORMAL 0x20 /* D6 format decoding table, normal rate */ -#define LPC_D6_FAST 0x24 /* D6 format decoding table, fast rate */ - - /* LPC Port Status Flags (valid only after one of the LPC - speak commands) */ -#define LPC_SPEAKING 0x80 /* mask for TS bit: When set to 1, - indicates the LPC synthesizer is - producing speech.*/ -#define LPC_BUFFER_LOW 0x40 /* mask for BL bit: When set to 1, - indicates that the hardware LPC - data buffer has less than 30 bytes - remaining. (Total internal buffer - size = 4096 bytes.) */ -#define LPC_BUFFER_EMPTY 0x20 /* mask for BE bit: When set to 1, - indicates that the LPC data buffer - ran out of data (error condition if - TS is also 1). */ - - /* data returned by Interrogate command */ -struct dtlk_settings -{ - unsigned short serial_number; /* 0-7Fh:0-7Fh */ - unsigned char rom_version[24]; /* null terminated string */ - unsigned char mode; /* 0=Character; 1=Phoneme; 2=Text */ - unsigned char punc_level; /* nB; 0-7 */ - unsigned char formant_freq; /* nF; 0-9 */ - unsigned char pitch; /* nP; 0-99 */ - unsigned char speed; /* nS; 0-9 */ - unsigned char volume; /* nV; 0-9 */ - unsigned char tone; /* nX; 0-2 */ - unsigned char expression; /* nE; 0-9 */ - unsigned char ext_dict_loaded; /* 1=exception dictionary loaded */ - unsigned char ext_dict_status; /* 1=exception dictionary enabled */ - unsigned char free_ram; /* # pages (truncated) remaining for - text buffer */ - unsigned char articulation; /* nA; 0-9 */ - unsigned char reverb; /* nR; 0-9 */ - unsigned char eob; /* 7Fh value indicating end of - parameter block */ - unsigned char has_indexing; /* nonzero if indexing is implemented */ -}; -- cgit v1.2.3 From b583b8fda6ddcf81fe1b02bec0d3c7fb43efc6de Mon Sep 17 00:00:00 2001 From: Manivannan Sadhasivam Date: Tue, 19 May 2026 13:41:21 +0530 Subject: PCI: Indicate context lost if L1SS exit is broken during resume from system suspend Per PCIe v7.0, sec 5.5.3.3.1, when exiting L1.2 due to an endpoint asserting CLKREQ# signal, the REFCLK must be turned on within the latency advertised in the LTR message. This requirement applies to L1.1 as well. On some platforms like Qcom, these requirements are satisfied during OS runtime, but not while resuming from the system suspend. This happens because the PCIe RC driver may remove all resource votes and turn off the PHY analog circuitry during suspend to maximize power savings while keeping the link in L1SS. Consequently, when the endpoint asserts CLKREQ# to wake up, the RC driver must restore the PHY and enable the REFCLK. When this recovery process exceeds the L1SS exit latency time (roughly L10_REFCLK_ON + T_COMMONMODE), the endpoint may treat it as a fatal condition and trigger Link Down (LDn). This results in a reset that destroys the internal device state. So to indicate this platform limitation to the client drivers, introduce a new flag 'pci_host_bridge::broken_l1ss_resume' and check it in pci_suspend_retains_context(). If the flag is set by the RC driver, the API will return 'false' indicating the client drivers that the device context may not be retained and the drivers must be prepared for context loss. Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260519-l1ss-fix-v2-2-b2c3a4bdeb15@oss.qualcomm.com --- include/linux/pci.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index f60f9e4e7b39..4fee00ec59d7 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -660,6 +660,8 @@ struct pci_host_bridge { unsigned int preserve_config:1; /* Preserve FW resource setup */ unsigned int size_windows:1; /* Enable root bus sizing */ unsigned int msi_domain:1; /* Bridge wants MSI domain */ + unsigned int broken_l1ss_resume:1; /* Resuming from L1SS during + system suspend is broken */ /* Resource alignment requirements */ resource_size_t (*align_resource)(struct pci_dev *dev, -- cgit v1.2.3 From 59cf5dbcc95f11a6b03fad9fe9723ff31149459b Mon Sep 17 00:00:00 2001 From: "Paul E. McKenney" Date: Thu, 7 May 2026 09:57:16 -0700 Subject: torture: Add torture_sched_set_normal() for user-specified nice values This new torture_sched_set_normal() function clamps the nice value at the MIN_NICE..MAX_NICE limits, splatting it these limits are exceeded. It then invokes sched_set_normal() to set the new value. This prevents more difficult-to-debug failures within the scheduler. Signed-off-by: Paul E. McKenney Signed-off-by: Uladzislau Rezki (Sony) --- include/linux/torture.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/torture.h b/include/linux/torture.h index 1b59056c3b18..c9b47d138302 100644 --- a/include/linux/torture.h +++ b/include/linux/torture.h @@ -129,6 +129,7 @@ void _torture_stop_kthread(char *m, struct task_struct **tp); #else #define torture_preempt_schedule() do { } while (0) #endif +void torture_sched_set_normal(struct task_struct *t, int nice); #if IS_ENABLED(CONFIG_RCU_TORTURE_TEST) || IS_MODULE(CONFIG_RCU_TORTURE_TEST) || IS_ENABLED(CONFIG_LOCK_TORTURE_TEST) || IS_MODULE(CONFIG_LOCK_TORTURE_TEST) long torture_sched_setaffinity(pid_t pid, const struct cpumask *in_mask, bool dowarn); -- cgit v1.2.3 From e2f08cefcf483f56366e4daa292bb9ba113ec138 Mon Sep 17 00:00:00 2001 From: "Paul E. McKenney" Date: Fri, 8 May 2026 10:43:49 -0700 Subject: srcu: Fix kerneldoc header comment typo in srcu_down_read_fast() s/srcu_read_lock_safe()/srcu_read_lock_fast_updown(), there being no such thing as srcu_read_lock_safe(). Signed-off-by: Paul E. McKenney Signed-off-by: Uladzislau Rezki (Sony) --- include/linux/srcu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/srcu.h b/include/linux/srcu.h index 81b1938512d5..a54ce9e808b9 100644 --- a/include/linux/srcu.h +++ b/include/linux/srcu.h @@ -397,7 +397,7 @@ static inline struct srcu_ctr __percpu *srcu_read_lock_fast_notrace(struct srcu_ * * The same srcu_struct may be used concurrently by srcu_down_read_fast() * and srcu_read_lock_fast(). However, the same definition/initialization - * requirements called out for srcu_read_lock_safe() apply. + * requirements called out for srcu_read_lock_fast_updown() apply. */ static inline struct srcu_ctr __percpu *srcu_down_read_fast(struct srcu_struct *ssp) __acquires_shared(ssp) { -- cgit v1.2.3 From e6cb527255c9f873851bd18d2bc375f6e6abb311 Mon Sep 17 00:00:00 2001 From: "Paul E. McKenney" Date: Fri, 8 May 2026 10:43:53 -0700 Subject: rcu: Document rcu_access_pointer() feeding into cmpxchg() This commit documents the rcu_access_pointer() use case for fetching the old value of an RCU-protected pointer within a lockless updater for use by an atomic cmpxchg() operation. Reviewed-by: Frederic Weisbecker Reported-by: Maxim Mikityanskiy Signed-off-by: Paul E. McKenney Signed-off-by: Uladzislau Rezki (Sony) --- include/linux/rcupdate.h | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h index bfa765132de8..5e95acc33989 100644 --- a/include/linux/rcupdate.h +++ b/include/linux/rcupdate.h @@ -592,11 +592,13 @@ context_unsafe( \ * lockdep checks for being in an RCU read-side critical section. This is * useful when the value of this pointer is accessed, but the pointer is * not dereferenced, for example, when testing an RCU-protected pointer - * against NULL. Although rcu_access_pointer() may also be used in cases - * where update-side locks prevent the value of the pointer from changing, - * you should instead use rcu_dereference_protected() for this use case. - * Within an RCU read-side critical section, there is little reason to - * use rcu_access_pointer(). + * against NULL. Within an RCU read-side critical section, there is little + * reason to use rcu_access_pointer(). Although rcu_access_pointer() may + * also be used in cases where update-side locks prevent the value of the + * pointer from changing, you should instead use rcu_dereference_protected() + * for this use case. It is also permissible to use rcu_access_pointer() + * within lockless updaters to obtain the old value for an atomic operation, + * for example, for cmpxchg(). * * It is usually best to test the rcu_access_pointer() return value * directly in order to avoid accidental dereferences being introduced -- cgit v1.2.3 From 9ce2a8c81c3099f68d371d040d77aab8cd1a9ed5 Mon Sep 17 00:00:00 2001 From: Sriharsha Basavapatna Date: Tue, 19 May 2026 20:30:36 +0530 Subject: RDMA/bnxt_re: Update msn table size for app allocated QPs For app allocated QPs, the driver shouldn't use slots/round-up logic to compute the msn table size. The application handles this logic and computes 'sq_npsn' and passes it to the driver using a new uapi parameter. Link: https://patch.msgid.link/r/20260519150041.7251-5-sriharsha.basavapatna@broadcom.com Signed-off-by: Sriharsha Basavapatna Reviewed-by: Selvin Xavier Signed-off-by: Jason Gunthorpe --- include/uapi/rdma/bnxt_re-abi.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/rdma/bnxt_re-abi.h b/include/uapi/rdma/bnxt_re-abi.h index 40955eaba32e..db8400f2ce3b 100644 --- a/include/uapi/rdma/bnxt_re-abi.h +++ b/include/uapi/rdma/bnxt_re-abi.h @@ -135,6 +135,7 @@ struct bnxt_re_qp_req { __aligned_u64 qp_handle; __aligned_u64 comp_mask; __u32 sq_slots; + __u32 sq_npsn; }; struct bnxt_re_qp_resp { -- cgit v1.2.3 From 7e812673a948395675e9893e75b0fc60d19bbf27 Mon Sep 17 00:00:00 2001 From: Sriharsha Basavapatna Date: Tue, 19 May 2026 20:30:40 +0530 Subject: RDMA/bnxt_re: Support doorbells for app allocated QPs App allocated QPs can use a separate doorbell for each QP. This doorbell region can be passed through a new driver specific DBR_HANDLE attribute, during QP creation. When this attribute is set, associate the QP with the given doorbell region. While the QP holds a reference to the dbr, the dbr itself cannot be destroyed and is rejected with EBUSY error. Link: https://patch.msgid.link/r/20260519150041.7251-9-sriharsha.basavapatna@broadcom.com Signed-off-by: Sriharsha Basavapatna Reviewed-by: Selvin Xavier Signed-off-by: Jason Gunthorpe --- include/uapi/rdma/bnxt_re-abi.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/uapi/rdma/bnxt_re-abi.h b/include/uapi/rdma/bnxt_re-abi.h index db8400f2ce3b..4da8cda337dc 100644 --- a/include/uapi/rdma/bnxt_re-abi.h +++ b/include/uapi/rdma/bnxt_re-abi.h @@ -138,6 +138,10 @@ struct bnxt_re_qp_req { __u32 sq_npsn; }; +enum bnxt_re_create_qp_attrs { + BNXT_RE_CREATE_QP_ATTR_DBR_HANDLE = UVERBS_ID_DRIVER_NS_WITH_UHW, +}; + struct bnxt_re_qp_resp { __u32 qpid; __u32 rsvd; -- cgit v1.2.3 From 47b730054f05a05acd497c138bf3255a5de1a973 Mon Sep 17 00:00:00 2001 From: Sriharsha Basavapatna Date: Tue, 19 May 2026 20:30:41 +0530 Subject: RDMA/bnxt_re: Enable app allocated QPs The driver supports a new comp_mask: REQ_MASK_FIXED_QUE_ATTR. The application sets this comp_mask bit in the CREATE_QP ureq to indicate direct control of the QP. The driver goes through the required processing for app allocated QPs (previous patches). Only variable WQE mode is supported for these QPs. This patch removes an unused comp_mask: BNXT_RE_QP_REQ_MASK_VAR_WQE_SQ_SLOTS Link: https://patch.msgid.link/r/20260519150041.7251-10-sriharsha.basavapatna@broadcom.com Signed-off-by: Sriharsha Basavapatna Reviewed-by: Selvin Xavier Signed-off-by: Jason Gunthorpe --- include/uapi/rdma/bnxt_re-abi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/rdma/bnxt_re-abi.h b/include/uapi/rdma/bnxt_re-abi.h index 4da8cda337dc..a4599d7b736a 100644 --- a/include/uapi/rdma/bnxt_re-abi.h +++ b/include/uapi/rdma/bnxt_re-abi.h @@ -126,7 +126,7 @@ struct bnxt_re_resize_cq_req { }; enum bnxt_re_qp_mask { - BNXT_RE_QP_REQ_MASK_VAR_WQE_SQ_SLOTS = 0x1, + BNXT_RE_QP_REQ_MASK_FIXED_QUE_ATTR = 0x1, }; struct bnxt_re_qp_req { -- cgit v1.2.3 From ec1806a730a1c0b3d68a7f9afe81514fb0dd7991 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Sat, 25 Apr 2026 15:00:50 +0200 Subject: netfilter: x_tables: disable 32bit compat interface in user namespaces This feature is required to use 32bit arp/ip/ip6/ebtables binaries on 64bit kernels. I don't think there are many users left. Support has been a compile-time option since 2021 and defaults to off since 2023. The XTABLES_COMPAT config option is already off in many distributions including Debian and Fedora. Give a few more months before complete removal but disable support in user namespaces already. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Florian Westphal --- include/linux/netfilter/x_tables.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'include') diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h index 5a1c5c336fa4..20d70dddbe50 100644 --- a/include/linux/netfilter/x_tables.h +++ b/include/linux/netfilter/x_tables.h @@ -534,4 +534,21 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems, unsigned int next_offset); #endif /* CONFIG_NETFILTER_XTABLES_COMPAT */ + +static inline bool xt_compat_check(void) +{ +#ifdef CONFIG_NETFILTER_XTABLES_COMPAT + if (!in_compat_syscall()) + return true; + + pr_warn_once("%s %s\n", + "xtables 32bit compat interface no longer supported", + "in namespaces and will be removed soon."); + + if (!capable(CAP_NET_ADMIN)) + return false; +#endif + return true; +} + #endif /* _X_TABLES_H */ -- cgit v1.2.3 From a004b8f0d3bc5d82d3f2c91ff93f4b4b7ccb8f76 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Fri, 22 May 2026 16:52:10 +0200 Subject: ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time Prior to commit 57c31e6d620f ("ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons"), ACPI button wakeup GPEs having handler methods remained enabled after acpi_wakeup_gpe_init(), but currently they are not enabled because acpi_setup_gpe_for_wake() disables them. That causes function keys to stop working on some systems [1] and there may be other related issues elsewhere. To address that, make the ACPI button driver enable wakeup GPEs for ACPI buttons so long as they have handler methods. While this does not restore the old behavior exactly (the ACPI button driver needs to be bound to the button devices for the GPEs to be enabled), it should be sufficient to restore the missing functionality. For this purpose, introduce acpi_enable_gpe_cond() that enables a GPE if its dispatch type matches the supplied one and modify acpi_button_probe() to use that function for enabling the GPEs in question. Fixes: 57c31e6d620f ("ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons") Reported-by: Nick Closes: https://lore.kernel.org/linux-acpi/E2OXET.4X5GTP37VTNC3@kousu.ca/ [1] Signed-off-by: Rafael J. Wysocki Tested-by: Nick Cc: 7.0+ # 7.0+ Link: https://patch.msgid.link/9629117.CDJkKcVGEf@rafael.j.wysocki --- include/acpi/acpixf.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h index 49d1749f30bb..a4b562700151 100644 --- a/include/acpi/acpixf.h +++ b/include/acpi/acpixf.h @@ -725,6 +725,11 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status */ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_update_all_gpes(void)) +ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status + acpi_enable_gpe_cond(acpi_handle gpe_device, + u32 gpe_number, + u8 dispatch_type)) + ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_gpe(acpi_handle gpe_device, u32 gpe_number)) -- cgit v1.2.3 From ce44b78512e9102aea54ff6b6e521d6c8de9f31c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= Date: Wed, 20 May 2026 12:16:13 +0200 Subject: drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Nobody makes any use of it. Possible internal future users can instead use the _index variable. External users shouldn't use it since the array it's pointing into is internal drm_exec state. v2: - Use a unique id for the loop variable (Christian) Assisted-by: GitHub Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström Reviewed-by: Christian König Link: https://patch.msgid.link/20260520101616.41284-2-thomas.hellstrom@linux.intel.com --- include/drm/drm_exec.h | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/drm/drm_exec.h b/include/drm/drm_exec.h index aa786b828a0a..dee6ebdbe416 100644 --- a/include/drm/drm_exec.h +++ b/include/drm/drm_exec.h @@ -65,31 +65,35 @@ drm_exec_obj(struct drm_exec *exec, unsigned long index) return index < exec->num_objects ? exec->objects[index] : NULL; } +/* Helper for drm_exec_for_each_locked_object(). Internal use only. */ +#define __drm_exec_for_each_locked_object(exec, obj, __index) \ + for (unsigned long __index = 0; ((obj) = drm_exec_obj(exec, __index)); ++__index) /** * drm_exec_for_each_locked_object - iterate over all the locked objects * @exec: drm_exec object - * @index: unsigned long index for the iteration * @obj: the current GEM object * * Iterate over all the locked GEM objects inside the drm_exec object. */ -#define drm_exec_for_each_locked_object(exec, index, obj) \ - for ((index) = 0; ((obj) = drm_exec_obj(exec, index)); ++(index)) +#define drm_exec_for_each_locked_object(exec, obj) \ + __drm_exec_for_each_locked_object(exec, obj, __UNIQUE_ID(drm_exec)) +/* Helper for drm_exec_for_each_locked_object_reverse(). Internal use only. */ +#define __drm_exec_for_each_locked_object_reverse(exec, obj, __index) \ + for (unsigned long __index = (exec)->num_objects - 1; \ + ((obj) = drm_exec_obj(exec, __index)); --__index) /** * drm_exec_for_each_locked_object_reverse - iterate over all the locked * objects in reverse locking order * @exec: drm_exec object - * @index: unsigned long index for the iteration * @obj: the current GEM object * * Iterate over all the locked GEM objects inside the drm_exec object in - * reverse locking order. Note that @index may go below zero and wrap, + * reverse locking order. Note that the internal index may wrap around, * but that will be caught by drm_exec_obj(), returning a NULL object. */ -#define drm_exec_for_each_locked_object_reverse(exec, index, obj) \ - for ((index) = (exec)->num_objects - 1; \ - ((obj) = drm_exec_obj(exec, index)); --(index)) +#define drm_exec_for_each_locked_object_reverse(exec, obj) \ + __drm_exec_for_each_locked_object_reverse(exec, obj, __UNIQUE_ID(drm_exec)) /** * drm_exec_until_all_locked - loop until all GEM objects are locked -- cgit v1.2.3 From 25331d9d40d093dfe2805ab558e8ad238bd2a2dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= Date: Wed, 20 May 2026 12:16:14 +0200 Subject: drm/exec: Make the drm_exec_until_all_locked() macro more readable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use __UNIQUE_ID as done elsewhere in the kernel rather than a hand-rolled __PASTE to craft a unique id. Also use __maybe_unused rather than (void) to signify that a variable, althrough written to, may not actually be used. v2: - Move assignment to declaration (Christian) - Declare the retry pointer as void *const. Signed-off-by: Thomas Hellström Reviewed-by: Christian König Link: https://patch.msgid.link/20260520101616.41284-3-thomas.hellstrom@linux.intel.com --- include/drm/drm_exec.h | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/drm/drm_exec.h b/include/drm/drm_exec.h index dee6ebdbe416..18f84faabbb9 100644 --- a/include/drm/drm_exec.h +++ b/include/drm/drm_exec.h @@ -95,6 +95,17 @@ drm_exec_obj(struct drm_exec *exec, unsigned long index) #define drm_exec_for_each_locked_object_reverse(exec, obj) \ __drm_exec_for_each_locked_object_reverse(exec, obj, __UNIQUE_ID(drm_exec)) +/* + * Helper to drm_exec_until_all_locked(). Don't use directly. + * + * Since labels can't be defined local to the loop's body we use a jump pointer + * to make sure that the retry is only used from within the loop's body. + */ +#define __drm_exec_until_all_locked(exec, _label) \ +_label: \ + for (void *const __maybe_unused __drm_exec_retry_ptr = &&_label; \ + drm_exec_cleanup(exec);) + /** * drm_exec_until_all_locked - loop until all GEM objects are locked * @exec: drm_exec object @@ -102,17 +113,9 @@ drm_exec_obj(struct drm_exec *exec, unsigned long index) * Core functionality of the drm_exec object. Loops until all GEM objects are * locked and no more contention exists. At the beginning of the loop it is * guaranteed that no GEM object is locked. - * - * Since labels can't be defined local to the loops body we use a jump pointer - * to make sure that the retry is only used from within the loops body. */ #define drm_exec_until_all_locked(exec) \ -__PASTE(__drm_exec_, __LINE__): \ - for (void *__drm_exec_retry_ptr; ({ \ - __drm_exec_retry_ptr = &&__PASTE(__drm_exec_, __LINE__);\ - (void)__drm_exec_retry_ptr; \ - drm_exec_cleanup(exec); \ - });) + __drm_exec_until_all_locked(exec, __UNIQUE_ID(drm_exec)) /** * drm_exec_retry_on_contention - restart the loop to grap all locks -- cgit v1.2.3 From bba175a2d4be400312a64bd3d1e0481ef28a1681 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= Date: Wed, 20 May 2026 12:16:15 +0200 Subject: drm/exec, drm/xe: Avoid abusing the drm_exec retry pointer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The xe driver was using the drm_exec retry pointer directly to restart the locking loop after out-of-memory errors. This is relying on undocumented behaviour. Instead add a drm_exec_retry() macro that can be used in this situation, and that also warns if the struct drm_exec is not newly (re-)initialized. Use that macro in xe. v2: - Only allow if the drm_exec context is newly initialized. (Christian) Signed-off-by: Thomas Hellström Reviewed-by: Christian König Link: https://patch.msgid.link/20260520101616.41284-4-thomas.hellstrom@linux.intel.com --- include/drm/drm_exec.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'include') diff --git a/include/drm/drm_exec.h b/include/drm/drm_exec.h index 18f84faabbb9..99c7e1bb3c5b 100644 --- a/include/drm/drm_exec.h +++ b/include/drm/drm_exec.h @@ -9,6 +9,12 @@ #define DRM_EXEC_INTERRUPTIBLE_WAIT BIT(0) #define DRM_EXEC_IGNORE_DUPLICATES BIT(1) +/* + * Dummy value used to initially enter the retry loop. + * internal use only. + */ +#define DRM_EXEC_DUMMY ((void *)~0) + struct drm_gem_object; /** @@ -142,6 +148,19 @@ static inline bool drm_exec_is_contended(struct drm_exec *exec) return !!exec->contended; } +/** + * drm_exec_retry() - Unconditionally restart the loop to grab all locks. + * @exec: drm_exec object + * + * Unconditionally retry the loop to lock all objects. For consistency, + * the exec object needs to be newly initialized. + */ +#define drm_exec_retry(_exec) \ + do { \ + WARN_ON((_exec)->contended != DRM_EXEC_DUMMY); \ + goto *__drm_exec_retry_ptr; \ + } while (0) + void drm_exec_init(struct drm_exec *exec, u32 flags, unsigned nr); void drm_exec_fini(struct drm_exec *exec); bool drm_exec_cleanup(struct drm_exec *exec); -- cgit v1.2.3 From b34bafc38cd9573694f5049bb308387ba8d8c042 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= Date: Wed, 20 May 2026 12:16:16 +0200 Subject: drm/exec, drm/xe, drm/amdgpu: Add an accessor for struct drm_exec::ticket MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drivers were accessing this drm_exec member directly. While that may seem harmless, it will require action if the drm_exec utility is made a subclass of a dma-resv transaction utility as outlined in the cover-letter. Provide an accessor, drm_exec_ticket() to avoid that. v2: - Fix amdgpu compile error (Intel CI) - Update the commit message. Signed-off-by: Thomas Hellström Reviewed-by: Christian König Link: https://patch.msgid.link/20260520101616.41284-5-thomas.hellstrom@linux.intel.com --- include/drm/drm_exec.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include') diff --git a/include/drm/drm_exec.h b/include/drm/drm_exec.h index 99c7e1bb3c5b..8725ba92ff91 100644 --- a/include/drm/drm_exec.h +++ b/include/drm/drm_exec.h @@ -161,6 +161,17 @@ static inline bool drm_exec_is_contended(struct drm_exec *exec) goto *__drm_exec_retry_ptr; \ } while (0) +/** + * drm_exec_ticket - return the ww_acquire_ctx for this exec context + * @exec: drm_exec object + * + * Return: Pointer to the ww_acquire_ctx embedded in @exec. + */ +static inline struct ww_acquire_ctx *drm_exec_ticket(struct drm_exec *exec) +{ + return &exec->ticket; +} + void drm_exec_init(struct drm_exec *exec, u32 flags, unsigned nr); void drm_exec_fini(struct drm_exec *exec); bool drm_exec_cleanup(struct drm_exec *exec); -- cgit v1.2.3 From 94bdfad3a665da68731deb56b0fe80f00a3e6da8 Mon Sep 17 00:00:00 2001 From: Troy Mitchell Date: Fri, 22 May 2026 21:33:57 +0800 Subject: ASoC: soc-dai: add shared BCLK clock for cross-DAI rate constraints Add a bclk field to struct snd_soc_dai and a helper function snd_soc_dai_set_bclk_clk() that platform drivers can use to declare which clock is their BCLK. Also cache the bclk_ratio in snd_soc_dai_set_bclk_ratio() so that the framework can use it later in hw_rule evaluation for TDM configurations where BCLK = rate * slots * slot_width. When multiple DAIs on the same card share the same physical BCLK (detected via clk_is_match()), the ASoC core can automatically constrain their hw_params so that the resulting BCLK rates are compatible. This commit adds the data structure support; the actual constraint logic follows in the next patch. Signed-off-by: Troy Mitchell Link: https://patch.msgid.link/20260522-i2s-same-blk-v4-1-a71a86faaa20@linux.spacemit.com Signed-off-by: Mark Brown --- include/sound/soc-dai.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h index 6a42812bba8c..df010a91b350 100644 --- a/include/sound/soc-dai.h +++ b/include/sound/soc-dai.h @@ -17,6 +17,7 @@ struct snd_pcm_substream; struct snd_soc_dapm_widget; struct snd_compr_stream; +struct clk; /* * DAI hardware audio formats. @@ -188,6 +189,8 @@ int snd_soc_dai_set_pll(struct snd_soc_dai *dai, int snd_soc_dai_set_bclk_ratio(struct snd_soc_dai *dai, unsigned int ratio); +void snd_soc_dai_set_bclk_clk(struct snd_soc_dai *dai, struct clk *bclk); + /* Digital Audio interface formatting */ int snd_soc_dai_get_fmt_max_priority(const struct snd_soc_pcm_runtime *rtd); u64 snd_soc_dai_get_fmt(const struct snd_soc_dai *dai, int priority); @@ -473,6 +476,10 @@ struct snd_soc_dai { unsigned int symmetric_channels; unsigned int symmetric_sample_bits; + /* shared BCLK clock for cross-DAI rate constraints */ + struct clk *bclk; + unsigned int bclk_ratio; /* BCLK = rate * bclk_ratio (0 = use channels * sample_bits) */ + /* parent platform/codec */ struct snd_soc_component *component; -- cgit v1.2.3 From 8468c8aafe8b5807e5acba2f8aa96d0b3ce0c248 Mon Sep 17 00:00:00 2001 From: Chancel Liu Date: Thu, 7 May 2026 10:36:52 +0900 Subject: ASoC: dapm: Fix widget lookup with prefixed names across DAPM contexts Currently dapm_find_widget() manually constructs a prefixed widget name based on the provided DAPM context and compares it using strcmp(). This happens to work in most cases because callers usually know which DAPM context the target widget belongs to and pass in the matching DAPM context. However, this assumption breaks when search_other_contexts is enabled. In such cases, callers may intentionally pass a different DAPM context, while searching for a widget that actually belongs to another DAPM context. For example, when searching for a "DAC" widget, the widget belongs to the codec DAPM and be registered with a codec prefix, while the caller passes card->dapm and intends to search across all DAPM contexts. The current implementation incorrectly applies the caller card DAPM causing the lookup to fail even though the widget exists on the card. Improve the matching strategy to support both use cases: 1. When the caller provides a fully qualified name with prefix, perform exact string matching. This preserves the ability to use prefixes for disambiguation. 2. When the caller provides a bare widget name without prefix, try exact matching first, then fall back to prefix-stripped comparison using snd_soc_dapm_widget_name_cmp(). To determine whether the pin name includes a prefix, a new helper function snd_soc_dapm_pin_has_prefix() is introduced. It checks if the pin name starts with any known component prefix on the card. This fixes widget lookup failures when searching across different DAPM contexts while maintaining backward compatibility for explicitly prefixed lookups. Fixes: ae4fc532244b ("ASoC: dapm: use component prefix when checking widget names") Signed-off-by: Chancel Liu Assisted-by: Cody:Claude-4.5-Sonnet Link: https://patch.msgid.link/20260507013654.2945915-2-chancel.liu@nxp.com Signed-off-by: Mark Brown --- include/sound/soc-dapm.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h index 4f8fb7622a13..c1e4f467efda 100644 --- a/include/sound/soc-dapm.h +++ b/include/sound/soc-dapm.h @@ -685,6 +685,7 @@ int snd_soc_dapm_sync_unlocked(struct snd_soc_dapm_context *dapm); int snd_soc_dapm_force_enable_pin(struct snd_soc_dapm_context *dapm, const char *pin); int snd_soc_dapm_force_enable_pin_unlocked(struct snd_soc_dapm_context *dapm, const char *pin); int snd_soc_dapm_ignore_suspend(struct snd_soc_dapm_context *dapm, const char *pin); +bool snd_soc_dapm_pin_has_prefix(struct snd_soc_card *card, const char *pin); void snd_soc_dapm_mark_endpoints_dirty(struct snd_soc_card *card); /* dapm path query */ -- cgit v1.2.3 From 51271184a06d4f7bbc7f1abcc2d0c824f55323cb Mon Sep 17 00:00:00 2001 From: Chancel Liu Date: Thu, 7 May 2026 10:36:53 +0900 Subject: ASoC: soc-core: Add core support for ignoring suspend on selected DAPM widgets Some audio systems require specific DAPM widgets to remain powered during system suspend. Introduce a generic and reusable mechanism in the ASoC core to mark selected DAPM widgets as ignore_suspend. The unified mechanism consists of two parts: 1. Parse and store the name list of widgets to ignore suspend in struct snd_soc_card The list of widgets can be provided either by the machine driver or parsed from Device Tree. Different machines have different routing and power requirements. Each machine can specify its own widgets to ignore suspend through DT property. It enables flexible policy without hard code. A new helper, snd_soc_of_parse_ignore_suspend_widgets() is added for this purpose. 2. Apply ignore_suspend flags during snd_soc_bind_card() After all components have been probed and all DAPM widgets have been registered, snd_soc_bind_card() performs a unified lookup of the configured widget names across all DAPM contexts of the card and marks the matching widgets with ignore_suspend = 1. Signed-off-by: Chancel Liu Link: https://patch.msgid.link/20260507013654.2945915-3-chancel.liu@nxp.com Signed-off-by: Mark Brown --- include/sound/soc-dapm.h | 1 + include/sound/soc.h | 5 +++++ 2 files changed, 6 insertions(+) (limited to 'include') diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h index c1e4f467efda..b0a135b9af50 100644 --- a/include/sound/soc-dapm.h +++ b/include/sound/soc-dapm.h @@ -636,6 +636,7 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm, struct snd_s void snd_soc_dapm_free_widget(struct snd_soc_dapm_widget *w); int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card); void snd_soc_dapm_connect_dai_link_widgets(struct snd_soc_card *card); +int snd_soc_dapm_ignore_suspend_widgets(struct snd_soc_card *card); int snd_soc_dapm_update_dai(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params, struct snd_soc_dai *dai); diff --git a/include/sound/soc.h b/include/sound/soc.h index 5e3eb617d832..7d6fa79f48e3 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -1057,10 +1057,14 @@ struct snd_soc_card { int num_dapm_widgets; const struct snd_soc_dapm_route *dapm_routes; int num_dapm_routes; + const char **ignore_suspend_widgets; + int num_ignore_suspend_widgets; const struct snd_soc_dapm_widget *of_dapm_widgets; int num_of_dapm_widgets; const struct snd_soc_dapm_route *of_dapm_routes; int num_of_dapm_routes; + const char **of_ignore_suspend_widgets; + int num_of_ignore_suspend_widgets; /* lists of probed devices belonging to this card */ struct list_head component_dev_list; @@ -1339,6 +1343,7 @@ void snd_soc_of_parse_node_prefix(struct device_node *np, int snd_soc_of_parse_audio_routing(struct snd_soc_card *card, const char *propname); int snd_soc_of_parse_aux_devs(struct snd_soc_card *card, const char *propname); +int snd_soc_of_parse_ignore_suspend_widgets(struct snd_soc_card *card, const char *propname); unsigned int snd_soc_daifmt_clock_provider_flipped(unsigned int dai_fmt); unsigned int snd_soc_daifmt_clock_provider_from_bitmap(unsigned int bit_frame); -- cgit v1.2.3 From 47d7bca76dd4f36ba0525d761f247c76ec9e4b17 Mon Sep 17 00:00:00 2001 From: Ronak Jain Date: Wed, 20 May 2026 02:36:54 -0700 Subject: firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface Add support for dynamically discovering and exposing Configuration Security Unit (CSU) registers through sysfs. Leverage the existing PM_QUERY_DATA API to discover available registers at runtime, making the interface flexible and maintainable. Key features: - Dynamic register discovery using PM_QUERY_DATA API * PM_QID_GET_NODE_COUNT: Query number of available registers * PM_QID_GET_NODE_NAME: Query register names by index - Automatic sysfs attribute creation under csu_registers/ group - Read operations via existing IOCTL_READ_REG API - Write operations via existing IOCTL_MASK_WRITE_REG API The sysfs interface is created at: /sys/devices/platform/firmware:zynqmp-firmware/csu_registers/ Currently supported registers include: - multiboot (CSU_MULTI_BOOT) - idcode (CSU_IDCODE, read-only) - pcap-status (CSU_PCAP_STATUS, read-only) The dynamic discovery approach allows firmware to control which registers are exposed without requiring kernel changes, improving maintainability and security. The firmware does not currently expose per-register access mode information, so the kernel cannot distinguish read-only registers from read-write ones at discovery time. All discovered registers are therefore created with sysfs mode 0644, and the firmware is responsible for rejecting writes to registers it treats as read-only (for example idcode and pcap-status); that error is propagated back to userspace from the store callback. If a per-register access-mode query is added to the firmware in the future, sysfs permissions can be tightened to match. CSU register discovery is an optional feature: on firmware that lacks support for PM_QID_GET_NODE_COUNT or PM_QID_GET_NODE_NAME, the probe returns gracefully without exposing any sysfs entries. To keep the memory footprint minimal on that path, partial devm allocations made during discovery are explicitly released on failure so that no memory lingers until device unbind when the feature is unavailable. Signed-off-by: Ronak Jain Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/20260520093654.3303917-3-ronak.jain@amd.com --- include/linux/firmware/xlnx-zynqmp.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h index d70dcd462b44..a4b293eb96ce 100644 --- a/include/linux/firmware/xlnx-zynqmp.h +++ b/include/linux/firmware/xlnx-zynqmp.h @@ -3,7 +3,7 @@ * Xilinx Zynq MPSoC Firmware layer * * Copyright (C) 2014-2021 Xilinx - * Copyright (C) 2022 - 2025 Advanced Micro Devices, Inc. + * Copyright (C) 2022 - 2026 Advanced Micro Devices, Inc. * * Michal Simek * Davorin Mista @@ -262,6 +262,8 @@ enum pm_query_id { PM_QID_CLOCK_GET_NUM_CLOCKS = 12, PM_QID_CLOCK_GET_MAX_DIVISOR = 13, PM_QID_PINCTRL_GET_ATTRIBUTES = 15, + PM_QID_GET_NODE_NAME = 16, + PM_QID_GET_NODE_COUNT = 17, }; enum rpu_oper_mode { -- cgit v1.2.3 From ca70ce555a1eb8edf5fb1d5575f1fe19c9ae17f4 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Thu, 21 May 2026 15:59:50 +0200 Subject: ACPI: bus: Introduce devm_acpi_install_notify_handler() Introduce devm_acpi_install_notify_handler() for installing an ACPI notify handler managed by devres that will be removed automatically on driver detach. It installs the notify handler on the device object in the ACPI namespace that corresponds to the owner device's ACPI companion, if present (an error is returned if the owner device doesn't have an ACPI companion). Currently, there is no way to manually remove the notify handler installed by it because none of its users brought on subsequently will need to do that. Signed-off-by: Rafael J. Wysocki [ rjw: Kerneldoc comment refinement ] Link: https://patch.msgid.link/2268031.irdbgypaU6@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki --- include/acpi/acpi_bus.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h index c41d9a7565cf..7e57f9698f7c 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h @@ -629,6 +629,8 @@ int acpi_dev_install_notify_handler(struct acpi_device *adev, void acpi_dev_remove_notify_handler(struct acpi_device *adev, u32 handler_type, acpi_notify_handler handler); +int devm_acpi_install_notify_handler(struct device *dev, u32 handler_type, + acpi_notify_handler handler, void *context); extern int acpi_notifier_call_chain(const char *device_class, const char *bus_id, u32 type, u32 data); extern int register_acpi_notifier(struct notifier_block *); -- cgit v1.2.3 From 0590420c2f90de497d342c9a41a618f46f4d09ab Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Wed, 6 May 2026 10:31:03 +0530 Subject: remoteproc: Move resource table data structure to its own header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The resource table data structure has traditionally been associated with the remoteproc framework, where the resource table is included as a section within the remote processor firmware binary. However, it is also possible to obtain the resource table through other means—such as from a reserved memory region populated by the boot firmware, statically maintained driver data, or via a secure SMC call—when it is not embedded in the firmware. There are multiple Qualcomm remote processors (e.g., Venus, Iris, GPU, etc.) in the upstream kernel that do not use the remoteproc framework to manage their lifecycle for various reasons. When Linux is running at EL2, similar to the Qualcomm PAS driver (qcom_q6v5_pas.c), client drivers for subsystems like video and GPU may also want to use the resource table SMC call to retrieve and map resources before they are used by the remote processor. In such cases, the resource table data structure is no longer tightly coupled with the remoteproc headers. Client drivers that do not use the remoteproc framework should still be able to parse the resource table obtained through alternative means. Therefore, there is a need to decouple the resource table definitions from the remoteproc headers. Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260506050107.1985033-2-mukesh.ojha@oss.qualcomm.com --- include/linux/remoteproc.h | 269 +-------------------------------------- include/linux/rsc_table.h | 306 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 307 insertions(+), 268 deletions(-) create mode 100644 include/linux/rsc_table.h (limited to 'include') diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h index b4795698d8c2..7c1546d48008 100644 --- a/include/linux/remoteproc.h +++ b/include/linux/remoteproc.h @@ -42,274 +42,7 @@ #include #include #include - -/** - * struct resource_table - firmware resource table header - * @ver: version number - * @num: number of resource entries - * @reserved: reserved (must be zero) - * @offset: array of offsets pointing at the various resource entries - * - * A resource table is essentially a list of system resources required - * by the remote processor. It may also include configuration entries. - * If needed, the remote processor firmware should contain this table - * as a dedicated ".resource_table" ELF section. - * - * Some resources entries are mere announcements, where the host is informed - * of specific remoteproc configuration. Other entries require the host to - * do something (e.g. allocate a system resource). Sometimes a negotiation - * is expected, where the firmware requests a resource, and once allocated, - * the host should provide back its details (e.g. address of an allocated - * memory region). - * - * The header of the resource table, as expressed by this structure, - * contains a version number (should we need to change this format in the - * future), the number of available resource entries, and their offsets - * in the table. - * - * Immediately following this header are the resource entries themselves, - * each of which begins with a resource entry header (as described below). - */ -struct resource_table { - u32 ver; - u32 num; - u32 reserved[2]; - u32 offset[]; -} __packed; - -/** - * struct fw_rsc_hdr - firmware resource entry header - * @type: resource type - * @data: resource data - * - * Every resource entry begins with a 'struct fw_rsc_hdr' header providing - * its @type. The content of the entry itself will immediately follow - * this header, and it should be parsed according to the resource type. - */ -struct fw_rsc_hdr { - u32 type; - u8 data[]; -} __packed; - -/** - * enum fw_resource_type - types of resource entries - * - * @RSC_CARVEOUT: request for allocation of a physically contiguous - * memory region. - * @RSC_DEVMEM: request to iommu_map a memory-based peripheral. - * @RSC_TRACE: announces the availability of a trace buffer into which - * the remote processor will be writing logs. - * @RSC_VDEV: declare support for a virtio device, and serve as its - * virtio header. - * @RSC_LAST: just keep this one at the end of standard resources - * @RSC_VENDOR_START: start of the vendor specific resource types range - * @RSC_VENDOR_END: end of the vendor specific resource types range - * - * For more details regarding a specific resource type, please see its - * dedicated structure below. - * - * Please note that these values are used as indices to the rproc_handle_rsc - * lookup table, so please keep them sane. Moreover, @RSC_LAST is used to - * check the validity of an index before the lookup table is accessed, so - * please update it as needed. - */ -enum fw_resource_type { - RSC_CARVEOUT = 0, - RSC_DEVMEM = 1, - RSC_TRACE = 2, - RSC_VDEV = 3, - RSC_LAST = 4, - RSC_VENDOR_START = 128, - RSC_VENDOR_END = 512, -}; - -#define FW_RSC_ADDR_ANY (-1) - -/** - * struct fw_rsc_carveout - physically contiguous memory request - * @da: device address - * @pa: physical address - * @len: length (in bytes) - * @flags: iommu protection flags - * @reserved: reserved (must be zero) - * @name: human-readable name of the requested memory region - * - * This resource entry requests the host to allocate a physically contiguous - * memory region. - * - * These request entries should precede other firmware resource entries, - * as other entries might request placing other data objects inside - * these memory regions (e.g. data/code segments, trace resource entries, ...). - * - * Allocating memory this way helps utilizing the reserved physical memory - * (e.g. CMA) more efficiently, and also minimizes the number of TLB entries - * needed to map it (in case @rproc is using an IOMMU). Reducing the TLB - * pressure is important; it may have a substantial impact on performance. - * - * If the firmware is compiled with static addresses, then @da should specify - * the expected device address of this memory region. If @da is set to - * FW_RSC_ADDR_ANY, then the host will dynamically allocate it, and then - * overwrite @da with the dynamically allocated address. - * - * We will always use @da to negotiate the device addresses, even if it - * isn't using an iommu. In that case, though, it will obviously contain - * physical addresses. - * - * Some remote processors needs to know the allocated physical address - * even if they do use an iommu. This is needed, e.g., if they control - * hardware accelerators which access the physical memory directly (this - * is the case with OMAP4 for instance). In that case, the host will - * overwrite @pa with the dynamically allocated physical address. - * Generally we don't want to expose physical addresses if we don't have to - * (remote processors are generally _not_ trusted), so we might want to - * change this to happen _only_ when explicitly required by the hardware. - * - * @flags is used to provide IOMMU protection flags, and @name should - * (optionally) contain a human readable name of this carveout region - * (mainly for debugging purposes). - */ -struct fw_rsc_carveout { - u32 da; - u32 pa; - u32 len; - u32 flags; - u32 reserved; - u8 name[32]; -} __packed; - -/** - * struct fw_rsc_devmem - iommu mapping request - * @da: device address - * @pa: physical address - * @len: length (in bytes) - * @flags: iommu protection flags - * @reserved: reserved (must be zero) - * @name: human-readable name of the requested region to be mapped - * - * This resource entry requests the host to iommu map a physically contiguous - * memory region. This is needed in case the remote processor requires - * access to certain memory-based peripherals; _never_ use it to access - * regular memory. - * - * This is obviously only needed if the remote processor is accessing memory - * via an iommu. - * - * @da should specify the required device address, @pa should specify - * the physical address we want to map, @len should specify the size of - * the mapping and @flags is the IOMMU protection flags. As always, @name may - * (optionally) contain a human readable name of this mapping (mainly for - * debugging purposes). - * - * Note: at this point we just "trust" those devmem entries to contain valid - * physical addresses, but this isn't safe and will be changed: eventually we - * want remoteproc implementations to provide us ranges of physical addresses - * the firmware is allowed to request, and not allow firmwares to request - * access to physical addresses that are outside those ranges. - */ -struct fw_rsc_devmem { - u32 da; - u32 pa; - u32 len; - u32 flags; - u32 reserved; - u8 name[32]; -} __packed; - -/** - * struct fw_rsc_trace - trace buffer declaration - * @da: device address - * @len: length (in bytes) - * @reserved: reserved (must be zero) - * @name: human-readable name of the trace buffer - * - * This resource entry provides the host information about a trace buffer - * into which the remote processor will write log messages. - * - * @da specifies the device address of the buffer, @len specifies - * its size, and @name may contain a human readable name of the trace buffer. - * - * After booting the remote processor, the trace buffers are exposed to the - * user via debugfs entries (called trace0, trace1, etc..). - */ -struct fw_rsc_trace { - u32 da; - u32 len; - u32 reserved; - u8 name[32]; -} __packed; - -/** - * struct fw_rsc_vdev_vring - vring descriptor entry - * @da: device address - * @align: the alignment between the consumer and producer parts of the vring - * @num: num of buffers supported by this vring (must be power of two) - * @notifyid: a unique rproc-wide notify index for this vring. This notify - * index is used when kicking a remote processor, to let it know that this - * vring is triggered. - * @pa: physical address - * - * This descriptor is not a resource entry by itself; it is part of the - * vdev resource type (see below). - * - * Note that @da should either contain the device address where - * the remote processor is expecting the vring, or indicate that - * dynamically allocation of the vring's device address is supported. - */ -struct fw_rsc_vdev_vring { - u32 da; - u32 align; - u32 num; - u32 notifyid; - u32 pa; -} __packed; - -/** - * struct fw_rsc_vdev - virtio device header - * @id: virtio device id (as in virtio_ids.h) - * @notifyid: a unique rproc-wide notify index for this vdev. This notify - * index is used when kicking a remote processor, to let it know that the - * status/features of this vdev have changes. - * @dfeatures: specifies the virtio device features supported by the firmware - * @gfeatures: a place holder used by the host to write back the - * negotiated features that are supported by both sides. - * @config_len: the size of the virtio config space of this vdev. The config - * space lies in the resource table immediate after this vdev header. - * @status: a place holder where the host will indicate its virtio progress. - * @num_of_vrings: indicates how many vrings are described in this vdev header - * @reserved: reserved (must be zero) - * @vring: an array of @num_of_vrings entries of 'struct fw_rsc_vdev_vring'. - * - * This resource is a virtio device header: it provides information about - * the vdev, and is then used by the host and its peer remote processors - * to negotiate and share certain virtio properties. - * - * By providing this resource entry, the firmware essentially asks remoteproc - * to statically allocate a vdev upon registration of the rproc (dynamic vdev - * allocation is not yet supported). - * - * Note: - * 1. unlike virtualization systems, the term 'host' here means - * the Linux side which is running remoteproc to control the remote - * processors. We use the name 'gfeatures' to comply with virtio's terms, - * though there isn't really any virtualized guest OS here: it's the host - * which is responsible for negotiating the final features. - * Yeah, it's a bit confusing. - * - * 2. immediately following this structure is the virtio config space for - * this vdev (which is specific to the vdev; for more info, read the virtio - * spec). The size of the config space is specified by @config_len. - */ -struct fw_rsc_vdev { - u32 id; - u32 notifyid; - u32 dfeatures; - u32 gfeatures; - u32 config_len; - u8 status; - u8 num_of_vrings; - u8 reserved[2]; - struct fw_rsc_vdev_vring vring[]; -} __packed; +#include struct rproc; diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h new file mode 100644 index 000000000000..c32c8b6cd2a7 --- /dev/null +++ b/include/linux/rsc_table.h @@ -0,0 +1,306 @@ +/* + * Resource table and its types data structure + * + * Copyright(c) 2011 Texas Instruments, Inc. + * Copyright(c) 2011 Google, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * * Neither the name Texas Instruments nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef RSC_TABLE_H +#define RSC_TABLE_H + +/** + * struct resource_table - firmware resource table header + * @ver: version number + * @num: number of resource entries + * @reserved: reserved (must be zero) + * @offset: array of offsets pointing at the various resource entries + * + * A resource table is essentially a list of system resources required + * by the remote processor. It may also include configuration entries. + * If needed, the remote processor firmware should contain this table + * as a dedicated ".resource_table" ELF section. + * + * Some resources entries are mere announcements, where the host is informed + * of specific remoteproc configuration. Other entries require the host to + * do something (e.g. allocate a system resource). Sometimes a negotiation + * is expected, where the firmware requests a resource, and once allocated, + * the host should provide back its details (e.g. address of an allocated + * memory region). + * + * The header of the resource table, as expressed by this structure, + * contains a version number (should we need to change this format in the + * future), the number of available resource entries, and their offsets + * in the table. + * + * Immediately following this header are the resource entries themselves, + * each of which begins with a resource entry header (as described below). + */ +struct resource_table { + u32 ver; + u32 num; + u32 reserved[2]; + u32 offset[]; +} __packed; + +/** + * struct fw_rsc_hdr - firmware resource entry header + * @type: resource type + * @data: resource data + * + * Every resource entry begins with a 'struct fw_rsc_hdr' header providing + * its @type. The content of the entry itself will immediately follow + * this header, and it should be parsed according to the resource type. + */ +struct fw_rsc_hdr { + u32 type; + u8 data[]; +} __packed; + +/** + * enum fw_resource_type - types of resource entries + * + * @RSC_CARVEOUT: request for allocation of a physically contiguous + * memory region. + * @RSC_DEVMEM: request to iommu_map a memory-based peripheral. + * @RSC_TRACE: announces the availability of a trace buffer into which + * the remote processor will be writing logs. + * @RSC_VDEV: declare support for a virtio device, and serve as its + * virtio header. + * @RSC_LAST: just keep this one at the end of standard resources + * @RSC_VENDOR_START: start of the vendor specific resource types range + * @RSC_VENDOR_END: end of the vendor specific resource types range + * + * For more details regarding a specific resource type, please see its + * dedicated structure below. + * + * Please note that these values are used as indices to the rproc_handle_rsc + * lookup table, so please keep them sane. Moreover, @RSC_LAST is used to + * check the validity of an index before the lookup table is accessed, so + * please update it as needed. + */ +enum fw_resource_type { + RSC_CARVEOUT = 0, + RSC_DEVMEM = 1, + RSC_TRACE = 2, + RSC_VDEV = 3, + RSC_LAST = 4, + RSC_VENDOR_START = 128, + RSC_VENDOR_END = 512, +}; + +#define FW_RSC_ADDR_ANY (-1) + +/** + * struct fw_rsc_carveout - physically contiguous memory request + * @da: device address + * @pa: physical address + * @len: length (in bytes) + * @flags: iommu protection flags + * @reserved: reserved (must be zero) + * @name: human-readable name of the requested memory region + * + * This resource entry requests the host to allocate a physically contiguous + * memory region. + * + * These request entries should precede other firmware resource entries, + * as other entries might request placing other data objects inside + * these memory regions (e.g. data/code segments, trace resource entries, ...). + * + * Allocating memory this way helps utilizing the reserved physical memory + * (e.g. CMA) more efficiently, and also minimizes the number of TLB entries + * needed to map it (in case @rproc is using an IOMMU). Reducing the TLB + * pressure is important; it may have a substantial impact on performance. + * + * If the firmware is compiled with static addresses, then @da should specify + * the expected device address of this memory region. If @da is set to + * FW_RSC_ADDR_ANY, then the host will dynamically allocate it, and then + * overwrite @da with the dynamically allocated address. + * + * We will always use @da to negotiate the device addresses, even if it + * isn't using an iommu. In that case, though, it will obviously contain + * physical addresses. + * + * Some remote processors needs to know the allocated physical address + * even if they do use an iommu. This is needed, e.g., if they control + * hardware accelerators which access the physical memory directly (this + * is the case with OMAP4 for instance). In that case, the host will + * overwrite @pa with the dynamically allocated physical address. + * Generally we don't want to expose physical addresses if we don't have to + * (remote processors are generally _not_ trusted), so we might want to + * change this to happen _only_ when explicitly required by the hardware. + * + * @flags is used to provide IOMMU protection flags, and @name should + * (optionally) contain a human readable name of this carveout region + * (mainly for debugging purposes). + */ +struct fw_rsc_carveout { + u32 da; + u32 pa; + u32 len; + u32 flags; + u32 reserved; + u8 name[32]; +} __packed; + +/** + * struct fw_rsc_devmem - iommu mapping request + * @da: device address + * @pa: physical address + * @len: length (in bytes) + * @flags: iommu protection flags + * @reserved: reserved (must be zero) + * @name: human-readable name of the requested region to be mapped + * + * This resource entry requests the host to iommu map a physically contiguous + * memory region. This is needed in case the remote processor requires + * access to certain memory-based peripherals; _never_ use it to access + * regular memory. + * + * This is obviously only needed if the remote processor is accessing memory + * via an iommu. + * + * @da should specify the required device address, @pa should specify + * the physical address we want to map, @len should specify the size of + * the mapping and @flags is the IOMMU protection flags. As always, @name may + * (optionally) contain a human readable name of this mapping (mainly for + * debugging purposes). + * + * Note: at this point we just "trust" those devmem entries to contain valid + * physical addresses, but this isn't safe and will be changed: eventually we + * want remoteproc implementations to provide us ranges of physical addresses + * the firmware is allowed to request, and not allow firmwares to request + * access to physical addresses that are outside those ranges. + */ +struct fw_rsc_devmem { + u32 da; + u32 pa; + u32 len; + u32 flags; + u32 reserved; + u8 name[32]; +} __packed; + +/** + * struct fw_rsc_trace - trace buffer declaration + * @da: device address + * @len: length (in bytes) + * @reserved: reserved (must be zero) + * @name: human-readable name of the trace buffer + * + * This resource entry provides the host information about a trace buffer + * into which the remote processor will write log messages. + * + * @da specifies the device address of the buffer, @len specifies + * its size, and @name may contain a human readable name of the trace buffer. + * + * After booting the remote processor, the trace buffers are exposed to the + * user via debugfs entries (called trace0, trace1, etc..). + */ +struct fw_rsc_trace { + u32 da; + u32 len; + u32 reserved; + u8 name[32]; +} __packed; + +/** + * struct fw_rsc_vdev_vring - vring descriptor entry + * @da: device address + * @align: the alignment between the consumer and producer parts of the vring + * @num: num of buffers supported by this vring (must be power of two) + * @notifyid: a unique rproc-wide notify index for this vring. This notify + * index is used when kicking a remote processor, to let it know that this + * vring is triggered. + * @pa: physical address + * + * This descriptor is not a resource entry by itself; it is part of the + * vdev resource type (see below). + * + * Note that @da should either contain the device address where + * the remote processor is expecting the vring, or indicate that + * dynamically allocation of the vring's device address is supported. + */ +struct fw_rsc_vdev_vring { + u32 da; + u32 align; + u32 num; + u32 notifyid; + u32 pa; +} __packed; + +/** + * struct fw_rsc_vdev - virtio device header + * @id: virtio device id (as in virtio_ids.h) + * @notifyid: a unique rproc-wide notify index for this vdev. This notify + * index is used when kicking a remote processor, to let it know that the + * status/features of this vdev have changes. + * @dfeatures: specifies the virtio device features supported by the firmware + * @gfeatures: a place holder used by the host to write back the + * negotiated features that are supported by both sides. + * @config_len: the size of the virtio config space of this vdev. The config + * space lies in the resource table immediate after this vdev header. + * @status: a place holder where the host will indicate its virtio progress. + * @num_of_vrings: indicates how many vrings are described in this vdev header + * @reserved: reserved (must be zero) + * @vring: an array of @num_of_vrings entries of 'struct fw_rsc_vdev_vring'. + * + * This resource is a virtio device header: it provides information about + * the vdev, and is then used by the host and its peer remote processors + * to negotiate and share certain virtio properties. + * + * By providing this resource entry, the firmware essentially asks remoteproc + * to statically allocate a vdev upon registration of the rproc (dynamic vdev + * allocation is not yet supported). + * + * Note: + * 1. unlike virtualization systems, the term 'host' here means + * the Linux side which is running remoteproc to control the remote + * processors. We use the name 'gfeatures' to comply with virtio's terms, + * though there isn't really any virtualized guest OS here: it's the host + * which is responsible for negotiating the final features. + * Yeah, it's a bit confusing. + * + * 2. immediately following this structure is the virtio config space for + * this vdev (which is specific to the vdev; for more info, read the virtio + * spec). The size of the config space is specified by @config_len. + */ +struct fw_rsc_vdev { + u32 id; + u32 notifyid; + u32 dfeatures; + u32 gfeatures; + u32 config_len; + u8 status; + u8 num_of_vrings; + u8 reserved[2]; + struct fw_rsc_vdev_vring vring[]; +} __packed; + +#endif /* RSC_TABLE_H */ -- cgit v1.2.3 From 49abb5d6e1ac8169cdfc0c3aa4408e0d90ee5696 Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Wed, 6 May 2026 10:31:04 +0530 Subject: remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() Replace the open-coded resource table iteration loop in rproc_handle_resources() with the rsc_table_for_each_entry() helper. The remoteproc-specific dispatch logic (vendor resource handling via rproc_handle_rsc(), RSC_LAST bounds check, handler table lookup) is moved into a local callback rproc_handle_rsc_entry(), keeping the iteration mechanics in one canonical place. The callback receives the payload offset within the table so that handlers which write back into the resource table (e.g. rproc_handle_carveout() recording a dynamically allocated address via rsc_offset) continue to work correctly. No functional change. Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/r/20260506050107.1985033-3-mukesh.ojha@oss.qualcomm.com --- include/linux/rsc_table.h | 53 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) (limited to 'include') diff --git a/include/linux/rsc_table.h b/include/linux/rsc_table.h index c32c8b6cd2a7..c6d6d553d8f1 100644 --- a/include/linux/rsc_table.h +++ b/include/linux/rsc_table.h @@ -303,4 +303,57 @@ struct fw_rsc_vdev { struct fw_rsc_vdev_vring vring[]; } __packed; +/** + * rsc_table_for_each_entry() - iterate over all entries in a resource table + * @table: pointer to the resource table + * @table_sz: total size of the table buffer in bytes + * @dev: device used for error logging + * @cb: callback invoked for each entry: + * @type - value from enum fw_resource_type + * @rsc - pointer to the entry payload (past struct fw_rsc_hdr) + * @offset - byte offset of the payload within the table; callers + * that write back into the table (e.g. to record a + * dynamically allocated address) use this to locate the + * entry for later update + * @avail - bytes available in the payload + * @data - caller-supplied private pointer + * Return 0 to continue iteration, non-zero to stop. + * @data: private pointer forwarded to @cb on every call + * + * Iterates over every resource entry in @table, performing the standard + * truncation check, and invokes @cb for each one. Iteration stops on the + * first non-zero return from @cb or on a malformed table. + * + * Returns 0 after a complete iteration, -EINVAL if the table is truncated, + * or the first non-zero value returned by @cb. + */ +static inline int rsc_table_for_each_entry(struct resource_table *table, + size_t table_sz, + struct device *dev, + int (*cb)(u32 type, void *rsc, + int offset, int avail, + void *data), + void *data) { + int i, ret; + + for (i = 0; i < table->num; i++) { + int offset = table->offset[i]; + struct fw_rsc_hdr *hdr = (void *)table + offset; + int avail = table_sz - offset - sizeof(*hdr); + int rsc_offset = offset + sizeof(*hdr); + void *rsc = (void *)hdr + sizeof(*hdr); + + if (avail < 0) { + dev_err(dev, "rsc table is truncated\n"); + return -EINVAL; + } + + ret = cb(hdr->type, rsc, rsc_offset, avail, data); + if (ret) + return ret; + } + + return 0; +} + #endif /* RSC_TABLE_H */ -- cgit v1.2.3 From ea0dada7194e02ff9d2c785cc83949bd51496bf3 Mon Sep 17 00:00:00 2001 From: Moshe Shemesh Date: Thu, 21 May 2026 14:08:43 +0300 Subject: net/mlx5: Add SPF function type for page management Add MLX5_SPF to enum mlx5_func_type so SPFs get their own page counter, and add the corresponding WARN check at page cleanup. Wait for SPF pages to be reclaimed during ECPF teardown, alongside the existing host PF and VF page waits. SPF page requests are always identified by vhca_id, so the legacy func_id_to_type() path is not reached for satellite PFs. Signed-off-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260521110843.367329-13-tariqt@nvidia.com Signed-off-by: Jakub Kicinski --- include/linux/mlx5/driver.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index 9a4bb25d8e0a..b1871c0821d0 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -557,6 +557,7 @@ enum mlx5_func_type { MLX5_VF, MLX5_SF, MLX5_HOST_PF, + MLX5_SPF, MLX5_EC_VF, MLX5_FUNC_TYPE_NUM, MLX5_FUNC_TYPE_NONE = MLX5_FUNC_TYPE_NUM, -- cgit v1.2.3 From d603517771d8e08a2d8fc9e1f7682ce393d3973a Mon Sep 17 00:00:00 2001 From: Ratheesh Kannoth Date: Thu, 21 May 2026 15:22:57 +0530 Subject: devlink: pass param values by pointer union devlink_param_value grows substantially once U64 array parameters are added to devlink (from 32 bytes to over 264 bytes). devlink_nl_param_value_fill_one() and devlink_nl_param_value_put() copy the union by value in several places. Passing two instances as value arguments alone consumes over 528 bytes of stack; combined with deeper call chains the parameter stack can approach 800 bytes and trip CONFIG_FRAME_WARN more easily. Switch internal helpers and exported driver APIs to pass pointers to union devlink_param_value rather than passing the union by value. Reviewed-by: Petr Machata # for mlxsw Acked-by: Przemek Kitszel Reviewed-by: Arthur Kiyanovski #for ena Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260521095303.2395584-4-rkannoth@marvell.com Signed-off-by: Jakub Kicinski --- include/net/devlink.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/devlink.h b/include/net/devlink.h index bcd31de1f890..5f4083dc4345 100644 --- a/include/net/devlink.h +++ b/include/net/devlink.h @@ -501,7 +501,7 @@ struct devlink_param { struct devlink_param_gset_ctx *ctx, struct netlink_ext_ack *extack); int (*validate)(struct devlink *devlink, u32 id, - union devlink_param_value val, + union devlink_param_value *val, struct netlink_ext_ack *extack); int (*get_default)(struct devlink *devlink, u32 id, struct devlink_param_gset_ctx *ctx, @@ -1923,7 +1923,7 @@ void devlink_params_unregister(struct devlink *devlink, int devl_param_driverinit_value_get(struct devlink *devlink, u32 param_id, union devlink_param_value *val); void devl_param_driverinit_value_set(struct devlink *devlink, u32 param_id, - union devlink_param_value init_val); + union devlink_param_value *init_val); void devl_param_value_changed(struct devlink *devlink, u32 param_id); struct devlink_region *devl_region_create(struct devlink *devlink, const struct devlink_region_ops *ops, -- cgit v1.2.3 From 59ebc16276c51fa3c462e5a0d21280249755502d Mon Sep 17 00:00:00 2001 From: "Guo Ren (Alibaba DAMO Academy)" Date: Mon, 25 May 2026 15:19:44 +0530 Subject: irqchip/riscv-imsic: Add nr_guest_files in per-HART local config Add nr_guest_files in per-HART local config to represent the number of guest files available on a particular HART whereas the nr_guest_files in the global config represents the number of guest files available across all HARTs. This allows KVM RISC-V to use nr_guest_files from per-HART local config for asymmetric big.Little systems. Signed-off-by: Guo Ren (Alibaba DAMO Academy) Acked-by: Thomas Gleixner Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20260525094945.3721783-2-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel --- include/linux/irqchip/riscv-imsic.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/irqchip/riscv-imsic.h b/include/linux/irqchip/riscv-imsic.h index 4b348836de7a..61af3a5bea09 100644 --- a/include/linux/irqchip/riscv-imsic.h +++ b/include/linux/irqchip/riscv-imsic.h @@ -40,6 +40,9 @@ struct imsic_local_config { phys_addr_t msi_pa; void __iomem *msi_va; + + /* Number of guest interrupt files per-HART */ + u32 nr_guest_files; }; struct imsic_global_config { @@ -68,7 +71,7 @@ struct imsic_global_config { /* Number of guest interrupt identities */ u32 nr_guest_ids; - /* Number of guest interrupt files per core */ + /* Number of guest interrupt files across all HARTs */ u32 nr_guest_files; /* Per-CPU IMSIC addresses */ -- cgit v1.2.3 From d64b0372760e09de6d18a0616d7bc652c8c6891d Mon Sep 17 00:00:00 2001 From: George Guo Date: Sat, 9 May 2026 10:44:15 +0800 Subject: kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes KHO_TREE_MAX_DEPTH is calculated as: DIV_ROUND_UP(KHO_ORDER_0_LOG2 - KHO_BITMAP_SIZE_LOG2, KHO_TABLE_SIZE_LOG2) + 1 For systems with 16KB pages (e.g. arm64 with CONFIG_ARM64_16K_PAGES=y or LoongArch), this gives a depth of 4. Since levels are 0 based, with depth = 4 the effective top level is 3 and the top-level shift at bit 39. PAGE_SHIFT = 14 KHO_BITMAP_SIZE_LOG2 = PAGE_SHIFT + 3 = 17 KHO_TABLE_SIZE_LOG2 = log(2; (1 << PAGE_SHIFT) / 8) = 11 shift = ((3 - 1) * KHO_TABLE_SIZE_LOG2) + KHO_BITMAP_SIZE_LOG2 = 39 The order-0 bit sits at bit 50 (KHO_ORDER_0_LOG2 = 64 - PAGE_SHIFT = 50). When inserting or reading a key, the index extracted at the top level is: (1 << 50) >> 39 = 2048 2048 is exactly the table size (PAGE_SIZE / sizeof(phys_addr_t) = 2048 for 16KB pages), so it wraps to 0, aliasing the order bit to index 0 and losing it silently. On the second kernel, kho_radix_decode_key() sees a key without the order bit, calls fls64() on the wrong bit, computes a wrong order and thus a garbage physical address. phys_to_page() of that address faults in kho_preserved_memory_reserve(), causing a kernel panic early in boot. Fix by adding +1 to the DIV_ROUND_UP numerator so the formula accounts for the order bit itself, giving depth 5 for 16KB pages. The top-level shift becomes 50, and (1 << 50) >> 50 = 1, which is nonzero and unambiguous. For 4KB and 64KB page sizes the depth is unchanged. Link: https://patch.msgid.link/20260509024415.33190-1-dongtai.guo@linux.dev Fixes: 3f2ad90060f6 ("kho: adopt radix tree for preserved memory tracking") Tested-by: Kexin Liu Signed-off-by: George Guo Reviewed-by: Pasha Tatashin [rppt: added actual math to the changelog] Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/kho/abi/kexec_handover.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/kho/abi/kexec_handover.h b/include/linux/kho/abi/kexec_handover.h index 7e847a2339b0..db9bda6dd310 100644 --- a/include/linux/kho/abi/kexec_handover.h +++ b/include/linux/kho/abi/kexec_handover.h @@ -274,7 +274,7 @@ enum kho_radix_consts { * and 1 bitmap level. */ KHO_TREE_MAX_DEPTH = - DIV_ROUND_UP(KHO_ORDER_0_LOG2 - KHO_BITMAP_SIZE_LOG2, + DIV_ROUND_UP(KHO_ORDER_0_LOG2 - KHO_BITMAP_SIZE_LOG2 + 1, KHO_TABLE_SIZE_LOG2) + 1, }; -- cgit v1.2.3 From 820017813b818a9b6411e481fcc98f5260b6e6c1 Mon Sep 17 00:00:00 2001 From: Jun Yan Date: Sun, 24 May 2026 23:49:53 +0800 Subject: dt-bindings: gpio: meson-axg: Fix whitespace issue Clean up whitespace misalignment in meson-axg-gpio.h Signed-off-by: Jun Yan Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260524154954.385778-1-jerrysteve1101@gmail.com Signed-off-by: Bartosz Golaszewski --- include/dt-bindings/gpio/meson-axg-gpio.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/dt-bindings/gpio/meson-axg-gpio.h b/include/dt-bindings/gpio/meson-axg-gpio.h index 25bb1fffa97a..a0d42bcd9bd3 100644 --- a/include/dt-bindings/gpio/meson-axg-gpio.h +++ b/include/dt-bindings/gpio/meson-axg-gpio.h @@ -23,7 +23,7 @@ #define GPIOAO_11 11 #define GPIOAO_12 12 #define GPIOAO_13 13 -#define GPIO_TEST_N 14 +#define GPIO_TEST_N 14 /* Second GPIO chip */ #define GPIOZ_0 0 @@ -52,7 +52,7 @@ #define BOOT_12 23 #define BOOT_13 24 #define BOOT_14 25 -#define GPIOA_0 26 +#define GPIOA_0 26 #define GPIOA_1 27 #define GPIOA_2 28 #define GPIOA_3 29 -- cgit v1.2.3 From 4f365e7a5d448dab7e0bb56ed32ff2bfddd134bd Mon Sep 17 00:00:00 2001 From: "Christian Brauner (Amutable)" Date: Wed, 20 May 2026 23:48:52 +0200 Subject: sched/coredump: introduce enum task_dumpable Replace the SUID_DUMP_DISABLE/USER/ROOT preprocessor constants with enum task_dumpable. Numeric values are preserved (kernel.suid_dumpable sysctl and prctl(PR_SET_DUMPABLE) ABI), so this is a pure rename with no behavioral change. Subsequent commits relocate dumpability onto a per-task structure where the enum type will allow stronger type-checking on the new API. Reviewed-by: Jann Horn Reviewed-by: David Hildenbrand (arm) Link: https://patch.msgid.link/20260520-work-task_exec_state-v3-1-69f895bc1385@kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/mm_types.h | 2 +- include/linux/sched/coredump.h | 15 +++++++++++---- 2 files changed, 12 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index a308e2c23b82..51ea37b2a0aa 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -1908,7 +1908,7 @@ enum { /* * The first two bits represent core dump modes for set-user-ID, - * the modes are SUID_DUMP_* defined in linux/sched/coredump.h + * the modes are TASK_DUMPABLE_* defined in linux/sched/coredump.h */ #define MMF_DUMPABLE_BITS 2 #define MMF_DUMPABLE_MASK (BIT(MMF_DUMPABLE_BITS) - 1) diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h index 624fda17a785..ed6547692b61 100644 --- a/include/linux/sched/coredump.h +++ b/include/linux/sched/coredump.h @@ -4,9 +4,16 @@ #include -#define SUID_DUMP_DISABLE 0 /* No setuid dumping */ -#define SUID_DUMP_USER 1 /* Dump as user of process */ -#define SUID_DUMP_ROOT 2 /* Dump as root */ +/* + * Task dumpability mode. Gates core dump production and ptrace_attach() + * authorization. The numeric values are stable ABI (suid_dumpable + * sysctl, prctl(PR_SET_DUMPABLE)); do not renumber. + */ +enum task_dumpable { + TASK_DUMPABLE_OFF = 0, /* no dump; ptrace needs CAP_SYS_PTRACE */ + TASK_DUMPABLE_OWNER = 1, /* default; dump and ptrace by uid match */ + TASK_DUMPABLE_ROOT = 2, /* dump as root; ptrace needs CAP_SYS_PTRACE */ +}; static inline unsigned long __mm_flags_get_dumpable(const struct mm_struct *mm) { @@ -26,7 +33,7 @@ extern void set_dumpable(struct mm_struct *mm, int value); /* * This returns the actual value of the suid_dumpable flag. For things * that are using this for checking for privilege transitions, it must - * test against SUID_DUMP_USER rather than treating it as a boolean + * test against TASK_DUMPABLE_OWNER rather than treating it as a boolean * value. */ static inline int __get_dumpable(unsigned long mm_flags) -- cgit v1.2.3 From b092062cb6d799fa3504c5975cbb1b05c8b67d6d Mon Sep 17 00:00:00 2001 From: "Christian Brauner (Amutable)" Date: Wed, 20 May 2026 23:48:53 +0200 Subject: exec: introduce struct task_exec_state Introduce struct task_exec_state, a per-task RCU-protected structure that holds the dumpable mode and the user namespace and stays attached to the task for its full lifetime. task_exec_state_rcu() is the canonical reader: asserts RCU or task_lock is held, WARNs on a NULL state, returns the rcu_dereference()'d pointer. Reviewed-by: Jann Horn Link: https://patch.msgid.link/20260520-work-task_exec_state-v3-2-69f895bc1385@kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/sched.h | 2 ++ include/linux/sched/exec_state.h | 31 +++++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+) create mode 100644 include/linux/sched/exec_state.h (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index ee06cba5c6f5..6674dbf960b5 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -962,6 +962,8 @@ struct task_struct { struct mm_struct *mm; struct mm_struct *active_mm; + struct task_exec_state __rcu *exec_state; + int exit_state; int exit_code; int exit_signal; diff --git a/include/linux/sched/exec_state.h b/include/linux/sched/exec_state.h new file mode 100644 index 000000000000..dc5a795cbfe2 --- /dev/null +++ b/include/linux/sched/exec_state.h @@ -0,0 +1,31 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2026 Christian Brauner */ +#ifndef _LINUX_SCHED_EXEC_STATE_H +#define _LINUX_SCHED_EXEC_STATE_H + +#include +#include +#include +#include +#include + +struct task_exec_state { + refcount_t count; + enum task_dumpable dumpable; + struct user_namespace *user_ns; + struct rcu_head rcu; +}; + +struct task_exec_state *alloc_task_exec_state(struct user_namespace *user_ns); +void put_task_exec_state(struct task_exec_state *exec_state); +struct task_exec_state *task_exec_state_rcu(const struct task_struct *tsk); +struct task_exec_state *task_exec_state_replace(struct task_struct *tsk, + struct task_exec_state *exec_state); +void task_exec_state_set_dumpable(enum task_dumpable value); +enum task_dumpable task_exec_state_get_dumpable(struct task_struct *task); +int task_exec_state_copy(struct task_struct *tsk); +void __init exec_state_init(void); + +DEFINE_FREE(put_task_exec_state, struct task_exec_state *, put_task_exec_state(_T)) + +#endif /* _LINUX_SCHED_EXEC_STATE_H */ -- cgit v1.2.3 From 92f829f6b2faad37a5582df73df01c93d4429821 Mon Sep 17 00:00:00 2001 From: "Christian Brauner (Amutable)" Date: Wed, 20 May 2026 23:48:54 +0200 Subject: ptrace: add ptracer_access_allowed() Add a helper that encapsulates all of the logic for checking ptrace access and remove open-coded versions in follow-up patches. Reviewed-by: Jann Horn Reviewed-by: David Hildenbrand (arm) Link: https://patch.msgid.link/20260520-work-task_exec_state-v3-3-69f895bc1385@kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/ptrace.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h index 90507d4afcd6..ef314f7a9ecc 100644 --- a/include/linux/ptrace.h +++ b/include/linux/ptrace.h @@ -17,6 +17,7 @@ struct syscall_info { struct seccomp_data data; }; +bool ptracer_access_allowed(struct task_struct *tsk); extern int ptrace_access_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, unsigned int gup_flags); -- cgit v1.2.3 From 6b1c66c9cca99bf00386481c7b2aa7394c26d8b8 Mon Sep 17 00:00:00 2001 From: "Christian Brauner (Amutable)" Date: Wed, 20 May 2026 23:48:55 +0200 Subject: exec_state: relocate dumpable information The dumpable flag captured at execve() is consulted by __ptrace_may_access() and several /proc owner / visibility checks. It lives on mm_struct today, which exit_mm() clears from the task long before the task itself is reaped. exec_state is anchored to the execve() that established the current privilege domain. CLONE_VM siblings refcount-share the parent's exec_state via copy_exec_state(); non-CLONE_VM clones allocate a fresh exec_state inheriting the parent's dumpable mode and user_ns reference via task_exec_state_copy(). execve() allocates a fresh instance (via alloc_task_exec_state() in begin_new_exec()) and installs it under task_lock + exec_update_lock with task_exec_state_replace(). init_task uses a static instance. The dumpable mode now lives on task->exec_state->dumpable. task->mm->flags no longer carries dumpability; MMF_DUMPABLE_MASK is removed, but MMF_DUMPABLE_BITS is reserved so MMF_DUMP_FILTER_* bit positions remain stable for the /proc//coredump_filter ABI. The task->user_dumpable cache bit and its assignment in exit_mm() are removed; readers go through get_dumpable(task) directly. coredump_params gains a snapshot field cprm.dumpable, populated from get_dumpable(current) at vfs_coredump() entry, replacing the previous __get_dumpable(cprm->mm_flags) consumers in fs/coredump.c and fs/pidfs.c. The user namespace recorded at execve() is consulted by __ptrace_may_access() and by /proc/PID/* owner derivation. Move the captured user_ns onto task_exec_state, which stays attached to the task past exit_mm() and across exit_files(). bprm grows a user_ns field staged in bprm_mm_init() with the caller's user_ns, narrowed by would_dump() to the closest privileged ancestor, and consumed by exec_mmap() via alloc_task_exec_state(bprm->user_ns). free_bprm() releases the staging reference. mm_struct loses ->user_ns entirely. Initializers in init-mm, efi_mm, and the implicit one in mm_init()/dup_mm()/mm_alloc() are removed; __mmdrop() drops the matching put_user_ns(). The kthread_use_mm() WARN_ON_ONCE(!mm->user_ns) is no longer meaningful and goes too. Reviewed-by: Jann Horn Link: https://patch.msgid.link/20260520-work-task_exec_state-v3-4-69f895bc1385@kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/binfmts.h | 2 ++ include/linux/coredump.h | 4 ++++ include/linux/mm_types.h | 9 ++++----- include/linux/sched.h | 4 +--- include/linux/sched/coredump.h | 36 ++---------------------------------- include/linux/sched/exec_state.h | 4 ++-- 6 files changed, 15 insertions(+), 44 deletions(-) (limited to 'include') diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h index 65abd5ab8836..a8379f4eee61 100644 --- a/include/linux/binfmts.h +++ b/include/linux/binfmts.h @@ -25,6 +25,8 @@ struct linux_binprm { struct page *page[MAX_ARG_PAGES]; #endif struct mm_struct *mm; + /* user_ns published to task->exec_state at execve, narrowed by would_dump(). */ + struct user_namespace *user_ns; unsigned long p; /* current top of mem */ unsigned int /* Should an execfd be passed to userspace? */ diff --git a/include/linux/coredump.h b/include/linux/coredump.h index 68861da4cf7c..7b38ee2e7913 100644 --- a/include/linux/coredump.h +++ b/include/linux/coredump.h @@ -5,6 +5,7 @@ #include #include #include +#include #include #ifdef CONFIG_COREDUMP @@ -20,7 +21,10 @@ struct coredump_params { const kernel_siginfo_t *siginfo; struct file *file; unsigned long limit; + /* MMF_DUMP_FILTER_* bits, snapshot of mm->flags at dump start. */ unsigned long mm_flags; + /* Snapshot of dumpable at dump start. */ + enum task_dumpable dumpable; int cpu; loff_t written; loff_t pos; diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 51ea37b2a0aa..9588ce3b16df 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -1342,7 +1342,6 @@ struct mm_struct { */ struct task_struct __rcu *owner; #endif - struct user_namespace *user_ns; /* store ref to file /proc//exe symlink points to */ struct file __rcu *exe_file; @@ -1907,11 +1906,11 @@ enum { /* mm flags */ /* - * The first two bits represent core dump modes for set-user-ID, - * the modes are TASK_DUMPABLE_* defined in linux/sched/coredump.h + * Bits 0 and 1 were dumpability; that moved to task->exec_state. Reserve + * the bits so MMF_DUMP_FILTER_* positions stay stable for the + * /proc//coredump_filter ABI. */ #define MMF_DUMPABLE_BITS 2 -#define MMF_DUMPABLE_MASK (BIT(MMF_DUMPABLE_BITS) - 1) /* coredump filter bits */ #define MMF_DUMP_ANON_PRIVATE 2 #define MMF_DUMP_ANON_SHARED 3 @@ -1972,7 +1971,7 @@ enum { #define MMF_TOPDOWN 31 /* mm searches top down by default */ #define MMF_TOPDOWN_MASK BIT(MMF_TOPDOWN) -#define MMF_INIT_LEGACY_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\ +#define MMF_INIT_LEGACY_MASK (MMF_DUMP_FILTER_MASK |\ MMF_DISABLE_THP_MASK | MMF_HAS_MDWE_MASK |\ MMF_VM_MERGE_ANY_MASK | MMF_TOPDOWN_MASK) diff --git a/include/linux/sched.h b/include/linux/sched.h index 6674dbf960b5..258cb075478d 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -85,6 +85,7 @@ struct seq_file; struct sighand_struct; struct signal_struct; struct task_delay_info; +struct task_exec_state; struct task_group; struct task_struct; struct timespec64; @@ -1004,9 +1005,6 @@ struct task_struct { unsigned sched_rt_mutex:1; #endif - /* Save user-dumpable when mm goes away */ - unsigned user_dumpable:1; - /* Bit to tell TOMOYO we're in execve(): */ unsigned in_execve:1; unsigned in_iowait:1; diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h index ed6547692b61..20957ccde3b5 100644 --- a/include/linux/sched/coredump.h +++ b/include/linux/sched/coredump.h @@ -2,8 +2,6 @@ #ifndef _LINUX_SCHED_COREDUMP_H #define _LINUX_SCHED_COREDUMP_H -#include - /* * Task dumpability mode. Gates core dump production and ptrace_attach() * authorization. The numeric values are stable ABI (suid_dumpable @@ -15,37 +13,7 @@ enum task_dumpable { TASK_DUMPABLE_ROOT = 2, /* dump as root; ptrace needs CAP_SYS_PTRACE */ }; -static inline unsigned long __mm_flags_get_dumpable(const struct mm_struct *mm) -{ - /* - * By convention, dumpable bits are contained in first 32 bits of the - * bitmap, so we can simply access this first unsigned long directly. - */ - return __mm_flags_get_word(mm); -} - -static inline void __mm_flags_set_mask_dumpable(struct mm_struct *mm, int value) -{ - __mm_flags_set_mask_bits_word(mm, MMF_DUMPABLE_MASK, value); -} - -extern void set_dumpable(struct mm_struct *mm, int value); -/* - * This returns the actual value of the suid_dumpable flag. For things - * that are using this for checking for privilege transitions, it must - * test against TASK_DUMPABLE_OWNER rather than treating it as a boolean - * value. - */ -static inline int __get_dumpable(unsigned long mm_flags) -{ - return mm_flags & MMF_DUMPABLE_MASK; -} - -static inline int get_dumpable(struct mm_struct *mm) -{ - unsigned long flags = __mm_flags_get_dumpable(mm); - - return __get_dumpable(flags); -} +void task_exec_state_set_dumpable(enum task_dumpable value); +enum task_dumpable task_exec_state_get_dumpable(struct task_struct *task); #endif /* _LINUX_SCHED_COREDUMP_H */ diff --git a/include/linux/sched/exec_state.h b/include/linux/sched/exec_state.h index dc5a795cbfe2..9b61782510b8 100644 --- a/include/linux/sched/exec_state.h +++ b/include/linux/sched/exec_state.h @@ -16,13 +16,13 @@ struct task_exec_state { struct rcu_head rcu; }; +extern struct task_exec_state init_task_exec_state; + struct task_exec_state *alloc_task_exec_state(struct user_namespace *user_ns); void put_task_exec_state(struct task_exec_state *exec_state); struct task_exec_state *task_exec_state_rcu(const struct task_struct *tsk); struct task_exec_state *task_exec_state_replace(struct task_struct *tsk, struct task_exec_state *exec_state); -void task_exec_state_set_dumpable(enum task_dumpable value); -enum task_dumpable task_exec_state_get_dumpable(struct task_struct *task); int task_exec_state_copy(struct task_struct *tsk); void __init exec_state_init(void); -- cgit v1.2.3 From 38205ecbe6b6dc47968ad4e9c978e2117720969e Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Fri, 22 May 2026 16:03:30 +0200 Subject: exec: free the old mm outside the exec locks exec_mmap() installs the new mm and then tears the old one down while still holding exec_update_lock for writing -- and with cred_guard_mutex held all the way to setup_new_exec(): setmax_mm_hiwater_rss(&tsk->signal->maxrss, old_mm); mm_update_next_owner(old_mm); mmput(old_mm); Neither lock is needed for this. exec_update_lock only exists to make the mm swap atomic with the later commit_creds(), so that permission-checking readers (proc, ptrace, the futex robust list, perf, kcmp, mm_access()) never observe the new mm together with the old credentials. Those readers all operate on task->mm, i.e. the new mm after the swap; none looks at the detached old mm, its ->owner or signal->maxrss. cred_guard_mutex guards credential calculation and is equally irrelevant here. The cost is real: __mmput() runs exit_mmap() over the entire old address space and can block in exit_aio() waiting for in-flight AIO, all while holding exec_update_lock for writing and cred_guard_mutex. For execve() of a large process this blocks ptrace_attach() and every exec_update_lock reader for the duration of the teardown. Stash the old mm in bprm->old_mm and release it from setup_new_exec() after both locks are dropped. setup_new_exec() still runs before setup_arg_pages() and the segment mappings, so the old address space is freed before the new one is populated and peak memory is unchanged. The ordering constraints are kept: old_mm's mmap_lock is still dropped in exec_mmap() before mm_update_next_owner() (required since commit 31a78f23bac0 ("mm owner: fix race between swapoff and exit")), and mm_update_next_owner() still precedes mmput(); both run in the execing task's context, as mm_update_next_owner() requires. If exec swaps the mm but fails before setup_new_exec() runs the old mm would leak, so add a backstop in free_bprm(). The lazy-tlb case (old_mm == NULL, e.g. kernel_execve()) has no address space to free and is left in exec_mmap(). Link: https://patch.msgid.link/20260522-work-exit_mm-v1-1-bd32d5a560bb@kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/binfmts.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h index a8379f4eee61..2c77e383e737 100644 --- a/include/linux/binfmts.h +++ b/include/linux/binfmts.h @@ -25,6 +25,7 @@ struct linux_binprm { struct page *page[MAX_ARG_PAGES]; #endif struct mm_struct *mm; + struct mm_struct *old_mm; /* replaced address space, freed by setup_new_exec() */ /* user_ns published to task->exec_state at execve, narrowed by would_dump(). */ struct user_namespace *user_ns; unsigned long p; /* current top of mem */ -- cgit v1.2.3 From 4c237ab773c93959aa2a7750f9dba772b5f1baee Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Fri, 22 May 2026 15:42:16 +0200 Subject: kunit: provide kunit_platform_device_register_full() Provide a kunit-managed variant of platform_device_register_full(). Reviewed-by: David Gow Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260522-gpiolib-kunit-v3-1-b15fe6987430@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski --- include/kunit/platform_device.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/kunit/platform_device.h b/include/kunit/platform_device.h index f8236a8536f7..8cad6e1c3e7e 100644 --- a/include/kunit/platform_device.h +++ b/include/kunit/platform_device.h @@ -6,10 +6,14 @@ struct completion; struct kunit; struct platform_device; struct platform_driver; +struct platform_device_info; struct platform_device * kunit_platform_device_alloc(struct kunit *test, const char *name, int id); int kunit_platform_device_add(struct kunit *test, struct platform_device *pdev); +struct platform_device * +kunit_platform_device_register_full(struct kunit *test, + const struct platform_device_info *pdevinfo); int kunit_platform_device_prepare_wait_for_probe(struct kunit *test, struct platform_device *pdev, -- cgit v1.2.3 From 136569e6bc7b2d62e6777ef47caf0a417d70bf4a Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Fri, 22 May 2026 15:42:17 +0200 Subject: kunit: provide kunit_platform_device_unregister() Tests may want to unregister a platform device as part of the test case logic. Using the regular platform_device_register() with kunit assertions may result in a platform device leak or otherwise requires cumbersome error handling. Provide a function that unregisters a kunit-managed platform device and drops the release action from the test's list. Reviewed-by: David Gow Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260522-gpiolib-kunit-v3-2-b15fe6987430@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski --- include/kunit/platform_device.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/kunit/platform_device.h b/include/kunit/platform_device.h index 8cad6e1c3e7e..eee565d5d1d3 100644 --- a/include/kunit/platform_device.h +++ b/include/kunit/platform_device.h @@ -14,6 +14,8 @@ int kunit_platform_device_add(struct kunit *test, struct platform_device *pdev); struct platform_device * kunit_platform_device_register_full(struct kunit *test, const struct platform_device_info *pdevinfo); +void kunit_platform_device_unregister(struct kunit *test, + struct platform_device *pdev); int kunit_platform_device_prepare_wait_for_probe(struct kunit *test, struct platform_device *pdev, -- cgit v1.2.3 From d0bf38194bc908468e06c0ae7fba7281046c12d8 Mon Sep 17 00:00:00 2001 From: Ronald Claveau Date: Fri, 24 Apr 2026 17:45:10 +0200 Subject: firmware: meson: sm: Thermal calibration read via secure monitor Add SM_THERMAL_CALIB_READ to the secure monitor command enum and introduce meson_sm_get_thermal_calib() to allow drivers to retrieve thermal sensor calibration data through the firmware interface. Signed-off-by: Ronald Claveau Signed-off-by: Daniel Lezcano Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20260424-add-thermal-t7-vim4-v5-2-9040ca36afe2@aliel.fr --- include/linux/firmware/meson/meson_sm.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/firmware/meson/meson_sm.h b/include/linux/firmware/meson/meson_sm.h index 8eaf8922ab02..3ebc2bd9a976 100644 --- a/include/linux/firmware/meson/meson_sm.h +++ b/include/linux/firmware/meson/meson_sm.h @@ -12,6 +12,7 @@ enum { SM_EFUSE_WRITE, SM_EFUSE_USER_MAX, SM_GET_CHIP_ID, + SM_THERMAL_CALIB_READ, SM_A1_PWRC_SET, SM_A1_PWRC_GET, }; @@ -27,5 +28,7 @@ int meson_sm_call_read(struct meson_sm_firmware *fw, void *buffer, unsigned int bsize, unsigned int cmd_index, u32 arg0, u32 arg1, u32 arg2, u32 arg3, u32 arg4); struct meson_sm_firmware *meson_sm_get(struct device_node *firmware_node); +int meson_sm_get_thermal_calib(struct meson_sm_firmware *fw, u32 *trim_info, + u32 tsensor_id); #endif /* _MESON_SM_FW_H_ */ -- cgit v1.2.3 From 33d1117eb506dbea0fc0995711686179aed22ff2 Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Mon, 25 May 2026 22:22:37 -0300 Subject: RDMA/core: Do not compile ib_core_uverbs without USER_ACCESS Remove the entire ib_core_uverbs.c from the build if CONFIG_INFINIBAND_USER_ACCESS is not set. These functions are only used to support uverbs and are never callable even if they happen to get linked in. Provide inlines for the missing ones to return errors to further push code elimination in drivers. Link: https://patch.msgid.link/r/1-v3-43aba1969751+1988-ib_uverbs_support_ko_jgg@nvidia.com Signed-off-by: Jason Gunthorpe --- include/rdma/ib_verbs.h | 67 +++++++++++++++++++++++++++++++++++++++++---- include/rdma/uverbs_ioctl.h | 13 +++++---- 2 files changed, 69 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 9dd76f489a0b..01e0eea0703f 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -3101,6 +3101,7 @@ void ib_set_client_data(struct ib_device *device, struct ib_client *client, void ib_set_device_ops(struct ib_device *device, const struct ib_device_ops *ops); +#if IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS) int rdma_user_mmap_io(struct ib_ucontext *ucontext, struct vm_area_struct *vma, unsigned long pfn, unsigned long size, pgprot_t prot, struct rdma_user_mmap_entry *entry); @@ -3112,13 +3113,7 @@ int rdma_user_mmap_entry_insert_range(struct ib_ucontext *ucontext, size_t length, u32 min_pgoff, u32 max_pgoff); -#if IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS) void rdma_user_mmap_disassociate(struct ib_device *device); -#else -static inline void rdma_user_mmap_disassociate(struct ib_device *device) -{ -} -#endif static inline int rdma_user_mmap_entry_insert_exact(struct ib_ucontext *ucontext, @@ -3138,6 +3133,66 @@ rdma_user_mmap_entry_get(struct ib_ucontext *ucontext, void rdma_user_mmap_entry_put(struct rdma_user_mmap_entry *entry); void rdma_user_mmap_entry_remove(struct rdma_user_mmap_entry *entry); +#else +static inline int rdma_user_mmap_io(struct ib_ucontext *ucontext, + struct vm_area_struct *vma, + unsigned long pfn, unsigned long size, + pgprot_t prot, + struct rdma_user_mmap_entry *entry) +{ + return -EINVAL; +} + +static inline int +rdma_user_mmap_entry_insert(struct ib_ucontext *ucontext, + struct rdma_user_mmap_entry *entry, size_t length) +{ + return -EINVAL; +} + +static inline int +rdma_user_mmap_entry_insert_range(struct ib_ucontext *ucontext, + struct rdma_user_mmap_entry *entry, + size_t length, u32 min_pgoff, u32 max_pgoff) +{ + return -EINVAL; +} + +static inline void rdma_user_mmap_disassociate(struct ib_device *device) +{ +} + +static inline int +rdma_user_mmap_entry_insert_exact(struct ib_ucontext *ucontext, + struct rdma_user_mmap_entry *entry, + size_t length, u32 pgoff) +{ + return -EINVAL; +} + +static inline struct rdma_user_mmap_entry * +rdma_user_mmap_entry_get_pgoff(struct ib_ucontext *ucontext, + unsigned long pgoff) +{ + return NULL; +} + +static inline struct rdma_user_mmap_entry * +rdma_user_mmap_entry_get(struct ib_ucontext *ucontext, + struct vm_area_struct *vma) +{ + return NULL; +} + +static inline void rdma_user_mmap_entry_put(struct rdma_user_mmap_entry *entry) +{ +} + +static inline void +rdma_user_mmap_entry_remove(struct rdma_user_mmap_entry *entry) +{ +} +#endif static inline int ib_copy_from_udata(void *dest, struct ib_udata *udata, size_t len) { diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h index c89428030d61..9d7575d999e1 100644 --- a/include/rdma/uverbs_ioctl.h +++ b/include/rdma/uverbs_ioctl.h @@ -668,8 +668,6 @@ rdma_udata_to_uverbs_attr_bundle(struct ib_udata *udata) (udata ? container_of(rdma_udata_to_uverbs_attr_bundle(udata)->context, \ drv_dev_struct, member) : (drv_dev_struct *)NULL) -struct ib_device *rdma_udata_to_dev(struct ib_udata *udata); - #define IS_UVERBS_COPY_ERR(_ret) ((_ret) && (_ret) != -ENOENT) static inline const struct uverbs_attr *uverbs_attr_get(const struct uverbs_attr_bundle *attrs_bundle, @@ -902,6 +900,8 @@ int uverbs_copy_to_struct_or_zero(const struct uverbs_attr_bundle *bundle, int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req, size_t kernel_size, size_t minimum_size); int _ib_respond_udata(struct ib_udata *udata, const void *src, size_t len); +int _ib_copy_validate_udata_cm_fail(struct ib_udata *udata, u64 req_cm, + u64 valid_cm); #else static inline int uverbs_get_flags64(u64 *to, const struct uverbs_attr_bundle *attrs_bundle, @@ -971,6 +971,12 @@ static inline int _ib_respond_udata(struct ib_udata *udata, const void *src, { return -EINVAL; } + +static inline int _ib_copy_validate_udata_cm_fail(struct ib_udata *udata, + u64 req_cm, u64 valid_cm) +{ + return -EINVAL; +} #endif #define uverbs_get_const_signed(_to, _attrs_bundle, _idx) \ @@ -1051,9 +1057,6 @@ uverbs_get_raw_fd(int *to, const struct uverbs_attr_bundle *attrs_bundle, _ib_copy_validate_udata_in(_udata, &(_req), sizeof(_req), \ offsetofend(typeof(_req), _end_member)) -int _ib_copy_validate_udata_cm_fail(struct ib_udata *udata, u64 req_cm, - u64 valid_cm); - /** * ib_copy_validate_udata_in_cm - Copy the req structure and check the comp_mask * @_udata: The system calls ib_udata struct -- cgit v1.2.3 From 2c296df0add86a75356f8bb099ecfcfc42419600 Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Mon, 25 May 2026 22:22:39 -0300 Subject: RDMA/core: Remove uverbs_async_event_release() Instead of having an alternative fops release always use the standard uverbs_uobject_fd_release() and route the special async behavior back up through uverbs_obj_fd_type ops pointer. This removes a dependency where the technically lower level rdma_core.c is referring to a symbol from uverbs_std_types_async_fd.c. Link: https://patch.msgid.link/r/3-v3-43aba1969751+1988-ib_uverbs_support_ko_jgg@nvidia.com Signed-off-by: Jason Gunthorpe --- include/rdma/uverbs_types.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h index 6a253b7dc5ea..5a07f9a6dcd1 100644 --- a/include/rdma/uverbs_types.h +++ b/include/rdma/uverbs_types.h @@ -147,6 +147,7 @@ struct uverbs_obj_fd_type { struct uverbs_obj_type type; void (*destroy_object)(struct ib_uobject *uobj, enum rdma_remove_reason why); + void (*release_cleanup)(struct ib_uobject *uobj); const struct file_operations *fops; const char *name; int flags; @@ -190,7 +191,8 @@ int uverbs_uobject_release(struct ib_uobject *uobj); #define UVERBS_BUILD_BUG_ON(cond) (sizeof(char[1 - 2 * !!(cond)]) - \ sizeof(char)) -#define UVERBS_TYPE_ALLOC_FD(_obj_size, _destroy_object, _fops, _name, _flags) \ +#define UVERBS_TYPE_ALLOC_FD_RELEASE(_obj_size, _destroy_object, \ + _release_cleanup, _fops, _name, _flags) \ ((&((const struct uverbs_obj_fd_type) \ {.type = { \ .type_class = &uverbs_fd_class, \ @@ -199,9 +201,13 @@ int uverbs_uobject_release(struct ib_uobject *uobj); sizeof(struct ib_uobject)), \ }, \ .destroy_object = _destroy_object, \ + .release_cleanup = _release_cleanup, \ .fops = _fops, \ .name = _name, \ .flags = _flags}))->type) +#define UVERBS_TYPE_ALLOC_FD(_obj_size, _destroy_object, _fops, _name, _flags) \ + UVERBS_TYPE_ALLOC_FD_RELEASE(_obj_size, _destroy_object, NULL, \ + _fops, _name, _flags) #define UVERBS_TYPE_ALLOC_IDR_SZ(_size, _destroy_object) \ ((&((const struct uverbs_obj_idr_type) \ {.type = { \ -- cgit v1.2.3 From 1a76adc9b38c678a176edc04db6dd057bcb2298c Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Mon, 25 May 2026 22:22:41 -0300 Subject: RDMA/core: Move ucaps into ib_uverbs_support.ko mlx5 uses these move them into the support module from ib_uverbs.ko. Link: https://patch.msgid.link/r/5-v3-43aba1969751+1988-ib_uverbs_support_ko_jgg@nvidia.com Signed-off-by: Jason Gunthorpe --- include/rdma/ib_ucaps.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/rdma/ib_ucaps.h b/include/rdma/ib_ucaps.h index d9f96be3a553..b629c99117d8 100644 --- a/include/rdma/ib_ucaps.h +++ b/include/rdma/ib_ucaps.h @@ -14,7 +14,6 @@ enum rdma_user_cap { RDMA_UCAP_MAX }; -void ib_cleanup_ucaps(void); int ib_get_ucaps(int *fds, int fd_count, uint64_t *idx_mask); #if IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS) int ib_create_ucap(enum rdma_user_cap type); -- cgit v1.2.3 From 95c33a64f203be444954a1e1d855a4820c4f0efa Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Sun, 17 May 2026 22:01:38 +0200 Subject: genirq/proc: Avoid formatting zero counts in /proc/interrupts A large portion of interrupt count entries are zero. There is no point in formatting the zero value as it is way cheeper to just emit a constant string. Collect the number of consecutive zero counts and emit them in one go before a non-zero count and at the end of the line. Signed-off-by: Thomas Gleixner Tested-by: Michael Kelley Reviewed-by: Dmitry Ilvokhin Reviewed-by: Radu Rendec Reviewed-by: Shrikanth Hegde Link: https://patch.msgid.link/20260517194931.034728540@kernel.org --- include/linux/interrupt.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h index 6cd26ffb0505..3bf969ad8fe0 100644 --- a/include/linux/interrupt.h +++ b/include/linux/interrupt.h @@ -864,6 +864,7 @@ static inline void init_irq_proc(void) struct seq_file; int show_interrupts(struct seq_file *p, void *v); int arch_show_interrupts(struct seq_file *p, int prec); +void irq_proc_emit_counts(struct seq_file *p, unsigned int __percpu *cnts); extern int early_irq_init(void); extern int arch_probe_nr_irqs(void); -- cgit v1.2.3 From 0179464391af9a01b911f441d2dda42ea253dfbd Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Sun, 17 May 2026 22:01:43 +0200 Subject: genirq/proc: Utilize irq_desc::tot_count to avoid evaluation Interrupts which are not marked per CPU increment not only the per CPU statistics, but also the accumulation counter irq_desc::tot_count. Change the counter to type unsigned long so it does not produce sporadic zeros due to wrap arounds on 64-bit machines and do a quick check for non per CPU interrupts. If the counter is zero, then simply emit a full set of zero strings. That spares the evaluation of the per CPU counters completely for interrupts with zero events. Signed-off-by: Thomas Gleixner Tested-by: Michael Kelley Reviewed-by: Dmitry Ilvokhin Reviewed-by: Radu Rendec Link: https://patch.msgid.link/20260517194931.115522199@kernel.org --- include/linux/irqdesc.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h index dae9a9b93665..1058786d76eb 100644 --- a/include/linux/irqdesc.h +++ b/include/linux/irqdesc.h @@ -52,8 +52,8 @@ struct irq_redirect { * @depth: disable-depth, for nested irq_disable() calls * @wake_depth: enable depth, for multiple irq_set_irq_wake() callers * @tot_count: stats field for non-percpu irqs - * @irq_count: stats field to detect stalled irqs * @last_unhandled: aging timer for unhandled count + * @irq_count: stats field to detect stalled irqs * @irqs_unhandled: stats field for spurious unhandled interrupts * @threads_handled: stats field for deferred spurious detection of threaded handlers * @threads_handled_last: comparator field for deferred spurious detection of threaded handlers @@ -87,9 +87,9 @@ struct irq_desc { unsigned int core_internal_state__do_not_mess_with_it; unsigned int depth; /* nested irq disables */ unsigned int wake_depth; /* nested wake enables */ - unsigned int tot_count; - unsigned int irq_count; /* For detecting broken IRQs */ + unsigned long tot_count; unsigned long last_unhandled; /* Aging timer for unhandled count */ + unsigned int irq_count; /* For detecting broken IRQs */ unsigned int irqs_unhandled; atomic_t threads_handled; int threads_handled_last; -- cgit v1.2.3 From 4892e5e71ec9c942293cea7fd26e0c76179211ed Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Sun, 17 May 2026 22:02:19 +0200 Subject: genirq: Cache the condition for /proc/interrupts exposure show_interrupts() evaluates a boatload of conditions to establish whether it should expose an interrupt in /proc/interrupts or not. That can be simplified by caching the condition in an internal status flag, which is updated when one of the relevant inputs changes. The irq_desc::kstat_irq check is dropped because visible interrupt descriptors always have a valid pointer. As a result the number of instructions and branches for reading /proc/interrupts is reduced significantly. Signed-off-by: Thomas Gleixner Tested-by: Michael Kelley Reviewed-by: Dmitry Ilvokhin Reviewed-by: Radu Rendec Link: https://patch.msgid.link/20260517194931.680943749@kernel.org --- include/linux/irq.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/irq.h b/include/linux/irq.h index efa514ee562f..f485369b1b4f 100644 --- a/include/linux/irq.h +++ b/include/linux/irq.h @@ -103,6 +103,7 @@ enum { IRQ_DISABLE_UNLAZY = (1 << 19), IRQ_HIDDEN = (1 << 20), IRQ_NO_DEBUG = (1 << 21), + IRQ_RESERVED = (1 << 22), }; #define IRQF_MODIFY_MASK \ -- cgit v1.2.3 From 1d9c4745bfb6773712751f5068c23ebad9cd30a0 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Sun, 17 May 2026 22:02:34 +0200 Subject: genirq: Add rcuref count to struct irq_desc Prepare for a smarter iterator for /proc/interrupts so that the next interrupt descriptor can be cached after lookup. Signed-off-by: Thomas Gleixner Tested-by: Michael Kelley Reviewed-by: Dmitry Ilvokhin Link: https://patch.msgid.link/20260517194931.917415190@kernel.org --- include/linux/irqdesc.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h index 1058786d76eb..8080db17c1b1 100644 --- a/include/linux/irqdesc.h +++ b/include/linux/irqdesc.h @@ -70,6 +70,7 @@ struct irq_redirect { * IRQF_NO_SUSPEND set * @force_resume_depth: number of irqactions on a irq descriptor with * IRQF_FORCE_RESUME set + * @refcnt: Reference count mainly for /proc/interrupts * @rcu: rcu head for delayed free * @kobj: kobject used to represent this struct in sysfs * @request_mutex: mutex to protect request/free before locking desc->lock @@ -119,6 +120,7 @@ struct irq_desc { struct dentry *debugfs_file; const char *dev_name; #endif + rcuref_t refcnt; #ifdef CONFIG_SPARSE_IRQ struct rcu_head rcu; struct kobject kobj; -- cgit v1.2.3 From 56388011db71026e04ffe9963c816269f0bb3165 Mon Sep 17 00:00:00 2001 From: Costa Shulyupin Date: Fri, 15 May 2026 21:42:23 +0300 Subject: include: Remove unused jz4740-adc.h The last user was the JZ4740 MFD ADC driver, removed in commit ff71266aa490 ("mfd: Drop obsolete JZ4740 driver") and replaced by a self-contained IIO driver. No file includes or references this header. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Costa Shulyupin Signed-off-by: Thomas Bogendoerfer --- include/linux/jz4740-adc.h | 33 --------------------------------- 1 file changed, 33 deletions(-) delete mode 100644 include/linux/jz4740-adc.h (limited to 'include') diff --git a/include/linux/jz4740-adc.h b/include/linux/jz4740-adc.h deleted file mode 100644 index 19d995c8bf06..000000000000 --- a/include/linux/jz4740-adc.h +++ /dev/null @@ -1,33 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ - -#ifndef __LINUX_JZ4740_ADC -#define __LINUX_JZ4740_ADC - -struct device; - -/* - * jz4740_adc_set_config - Configure a JZ4740 adc device - * @dev: Pointer to a jz4740-adc device - * @mask: Mask for the config value to be set - * @val: Value to be set - * - * This function can be used by the JZ4740 ADC mfd cells to configure their - * options in the shared config register. -*/ -int jz4740_adc_set_config(struct device *dev, uint32_t mask, uint32_t val); - -#define JZ_ADC_CONFIG_SPZZ BIT(31) -#define JZ_ADC_CONFIG_EX_IN BIT(30) -#define JZ_ADC_CONFIG_DNUM_MASK (0x7 << 16) -#define JZ_ADC_CONFIG_DMA_ENABLE BIT(15) -#define JZ_ADC_CONFIG_XYZ_MASK (0x2 << 13) -#define JZ_ADC_CONFIG_SAMPLE_NUM_MASK (0x7 << 10) -#define JZ_ADC_CONFIG_CLKDIV_MASK (0xf << 5) -#define JZ_ADC_CONFIG_BAT_MB BIT(4) - -#define JZ_ADC_CONFIG_DNUM(dnum) ((dnum) << 16) -#define JZ_ADC_CONFIG_XYZ_OFFSET(dnum) ((xyz) << 13) -#define JZ_ADC_CONFIG_SAMPLE_NUM(x) ((x) << 10) -#define JZ_ADC_CONFIG_CLKDIV(div) ((div) << 5) - -#endif -- cgit v1.2.3 From eb013e9685e2ec6e608bbeb79e7ce98782fdcc63 Mon Sep 17 00:00:00 2001 From: Costa Shulyupin Date: Fri, 15 May 2026 21:50:41 +0300 Subject: include: Remove unused jz4740-battery.h The last user was removed in commit aea12071d6fc ("power/supply: Drop obsolete JZ4740 driver") and replaced by a self-contained IIO-based driver. No file includes this header. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Costa Shulyupin Signed-off-by: Thomas Bogendoerfer --- include/linux/power/jz4740-battery.h | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 include/linux/power/jz4740-battery.h (limited to 'include') diff --git a/include/linux/power/jz4740-battery.h b/include/linux/power/jz4740-battery.h deleted file mode 100644 index 10da211678c8..000000000000 --- a/include/linux/power/jz4740-battery.h +++ /dev/null @@ -1,15 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* - * Copyright (C) 2009, Jiejing Zhang - */ - -#ifndef __JZ4740_BATTERY_H -#define __JZ4740_BATTERY_H - -struct jz_battery_platform_data { - struct power_supply_info info; - int gpio_charge; /* GPIO port of Charger state */ - int gpio_charge_active_low; -}; - -#endif -- cgit v1.2.3 From 7c4e909b176f661e834853fa726a6e58acab00e1 Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Tue, 26 May 2026 16:56:29 +0200 Subject: mtd: spi-nor: Improve opcodes documentation There are two status registers, named 1 and 2. The current wording is misleading as "1" may refer to the status register ID as well as the number of bytes required (which, in this case can be 1 or 2). Clarify the comments by aligning them on the same pattern: "{read,write} status {1,2} register" Reviewed-by: Michael Walle Signed-off-by: Miquel Raynal Signed-off-by: Pratyush Yadav --- include/linux/mtd/spi-nor.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h index cdcfe0fd2e7d..90a0cf583512 100644 --- a/include/linux/mtd/spi-nor.h +++ b/include/linux/mtd/spi-nor.h @@ -21,8 +21,8 @@ /* Flash opcodes. */ #define SPINOR_OP_WRDI 0x04 /* Write disable */ #define SPINOR_OP_WREN 0x06 /* Write enable */ -#define SPINOR_OP_RDSR 0x05 /* Read status register */ -#define SPINOR_OP_WRSR 0x01 /* Write status register 1 byte */ +#define SPINOR_OP_RDSR 0x05 /* Read status register 1 */ +#define SPINOR_OP_WRSR 0x01 /* Write status register 1 */ #define SPINOR_OP_RDSR2 0x3f /* Read status register 2 */ #define SPINOR_OP_WRSR2 0x3e /* Write status register 2 */ #define SPINOR_OP_READ 0x03 /* Read data bytes (low frequency) */ -- cgit v1.2.3 From b7b63475903cc9967ae53c579bc1ad9ed2519080 Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Tue, 26 May 2026 16:56:41 +0200 Subject: mtd: spi-nor: Create a local SR cache In order to be able to generate debugfs output without having to actually reach the flash, create a SPI NOR local cache of the status registers. What matters in our case are all the bits related to sector locking. As such, in order to make it clear that this cache is not intended to be used anywhere else, we zero the irrelevant bits. The cache is initialized once during the early init, and then maintained every time the write protection scheme is updated. Suggested-by: Michael Walle Signed-off-by: Miquel Raynal Signed-off-by: Pratyush Yadav --- include/linux/mtd/spi-nor.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h index 90a0cf583512..9ad77f9e76c2 100644 --- a/include/linux/mtd/spi-nor.h +++ b/include/linux/mtd/spi-nor.h @@ -371,6 +371,7 @@ struct spi_nor_flash_parameter; * @reg_proto: the SPI protocol for read_reg/write_reg/erase operations * @sfdp: the SFDP data of the flash * @debugfs_root: pointer to the debugfs directory + * @dfs_sr_cache: Status Register cached value for debugfs use only * @controller_ops: SPI NOR controller driver specific operations. * @params: [FLASH-SPECIFIC] SPI NOR flash parameters and settings. * The structure includes legacy flash parameters and @@ -409,6 +410,7 @@ struct spi_nor { enum spi_nor_cmd_ext cmd_ext_type; struct sfdp *sfdp; struct dentry *debugfs_root; + u8 dfs_sr_cache[2]; const struct spi_nor_controller_ops *controller_ops; -- cgit v1.2.3 From 0719e10d826aa0ba4840917d0261986eaead9a51 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Tue, 19 May 2026 12:44:32 +0100 Subject: io_uring/zcrx: notify user when out of buffers There are currently no easy ways for the user to know if zcrx is out of buffers and page pool fails to allocate. Add uapi for zcrx to communicate it back. It's implemented as a separate CQE, which for now is posted to the creator ctx. To use it, on registration the user space needs to pass an instance of struct zcrx_notification_desc, which tells the kernel the user_data for resulting CQEs and which event types are expected / allowed. When an allowed event happens, zcrx will post a CQE containing the specified user_data, and lower bits of cqe->res will be set to the event mask. Before the kernel could post another notification of the given type, the user needs to acknowledge that it processed the previous one by issuing IORING_REGISTER_ZCRX_CTRL with ZCRX_CTRL_ARM_NOTIFICATION. The only notification type the patch implements is ZCRX_NOTIF_NO_BUFFERS, but we'll need more of them in the future. Co-developed-by: Vishwanath Seshagiri Signed-off-by: Pavel Begunkov Signed-off-by: Vishwanath Seshagiri Link: https://patch.msgid.link/35cd307a03a43583838a2e151fc641c69abd786f.1779189667.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- include/uapi/linux/io_uring/zcrx.h | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/io_uring/zcrx.h b/include/uapi/linux/io_uring/zcrx.h index 5ce02c7a6096..67185566ad3c 100644 --- a/include/uapi/linux/io_uring/zcrx.h +++ b/include/uapi/linux/io_uring/zcrx.h @@ -65,6 +65,20 @@ enum zcrx_features { * value in struct io_uring_zcrx_ifq_reg::rx_buf_len. */ ZCRX_FEATURE_RX_PAGE_SIZE = 1 << 0, + ZCRX_FEATURE_NOTIFICATION = 1 << 1, +}; + +enum zcrx_notification_type { + ZCRX_NOTIF_NO_BUFFERS, + + __ZCRX_NOTIF_TYPE_LAST, +}; + +struct zcrx_notification_desc { + __u64 user_data; + __u32 type_mask; + __u32 __resv1; + __u64 __resv2[10]; }; /* @@ -82,12 +96,14 @@ struct io_uring_zcrx_ifq_reg { struct io_uring_zcrx_offsets offsets; __u32 zcrx_id; __u32 rx_buf_len; - __u64 __resv[3]; + __u64 notif_desc; /* see struct zcrx_notification_desc */ + __u64 __resv[2]; }; enum zcrx_ctrl_op { ZCRX_CTRL_FLUSH_RQ, ZCRX_CTRL_EXPORT, + ZCRX_CTRL_ARM_NOTIFICATION, __ZCRX_CTRL_LAST, }; @@ -101,6 +117,11 @@ struct zcrx_ctrl_export { __u32 __resv1[11]; }; +struct zcrx_ctrl_arm_notif { + __u32 notif_type; + __u32 __resv[11]; +}; + struct zcrx_ctrl { __u32 zcrx_id; __u32 op; /* see enum zcrx_ctrl_op */ @@ -109,6 +130,7 @@ struct zcrx_ctrl { union { struct zcrx_ctrl_export zc_export; struct zcrx_ctrl_flush_rq zc_flush; + struct zcrx_ctrl_arm_notif zc_arm_notif; }; }; -- cgit v1.2.3 From 255180f7034f48aa5b0c8df70228307394bddbb9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20L=C3=A9ger?= Date: Tue, 19 May 2026 12:44:33 +0100 Subject: io_uring/zcrx: notify user on frag copy fallback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a ZCRX_NOTIF_COPY notification type to signal userspace when a received fragment could not be delivered using zero-copy and was instead copied into a buffer. Signed-off-by: Clément Léger Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/3d54bcd8bf10b3a1e88beb0cd39c40c3937bea4f.1779189667.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- include/uapi/linux/io_uring/zcrx.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/io_uring/zcrx.h b/include/uapi/linux/io_uring/zcrx.h index 67185566ad3c..3f7b72b09878 100644 --- a/include/uapi/linux/io_uring/zcrx.h +++ b/include/uapi/linux/io_uring/zcrx.h @@ -70,6 +70,7 @@ enum zcrx_features { enum zcrx_notification_type { ZCRX_NOTIF_NO_BUFFERS, + ZCRX_NOTIF_COPY, __ZCRX_NOTIF_TYPE_LAST, }; -- cgit v1.2.3 From 6935f631465f5f60205978a59228a26db4723d51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20L=C3=A9ger?= Date: Tue, 19 May 2026 12:44:34 +0100 Subject: io_uring/zcrx: add shared-memory notification statistics MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add support for an optional stats struct embedded in the refill queue region, allowing userspace to monitor copy-fallback in real-time. Userspace queries the stats struct size and alignment via IO_URING_QUERY_ZCRX_NOTIF (notif_stats_size / notif_stats_alignment), then provides a stats_offset in zcrx_notification_desc pointing to a location within the refill queue region. The kernel updates the stats counters in-place on every copy-fallback event. Signed-off-by: Clément Léger [pavel: rename io_uring_zcrx_notif_stats] Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/f6af5a21015efea4b733b9d77aba22c637788fe4.1779189667.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- include/uapi/linux/io_uring/query.h | 12 ++++++++++++ include/uapi/linux/io_uring/zcrx.h | 15 +++++++++++++-- 2 files changed, 25 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/io_uring/query.h b/include/uapi/linux/io_uring/query.h index 95500759cc13..1a68eca7c6b4 100644 --- a/include/uapi/linux/io_uring/query.h +++ b/include/uapi/linux/io_uring/query.h @@ -23,6 +23,7 @@ enum { IO_URING_QUERY_OPCODES = 0, IO_URING_QUERY_ZCRX = 1, IO_URING_QUERY_SCQ = 2, + IO_URING_QUERY_ZCRX_NOTIF = 3, __IO_URING_QUERY_MAX, }; @@ -62,6 +63,17 @@ struct io_uring_query_zcrx { __u64 __resv2; }; +struct io_uring_query_zcrx_notif { + /* Bitmask of supported ZCRX_NOTIF_* flags */ + __u32 notif_flags; + /* Size of io_uring_zcrx_notif_stats */ + __u32 notif_stats_size; + /* Required alignment for the stats struct within the region (ie stats_offset) */ + __u32 notif_stats_off_alignment; + __u32 __resv1; + __u64 __resv2[4]; +}; + struct io_uring_query_scq { /* The SQ/CQ rings header size */ __u64 hdr_size; diff --git a/include/uapi/linux/io_uring/zcrx.h b/include/uapi/linux/io_uring/zcrx.h index 3f7b72b09878..15c05c45ce36 100644 --- a/include/uapi/linux/io_uring/zcrx.h +++ b/include/uapi/linux/io_uring/zcrx.h @@ -75,11 +75,22 @@ enum zcrx_notification_type { __ZCRX_NOTIF_TYPE_LAST, }; +enum zcrx_notification_desc_flags { + /* If set, stats_offset holds a valid offset to a notif_stats struct */ + ZCRX_NOTIF_DESC_FLAG_STATS = 1 << 0, +}; + +struct zcrx_notif_stats { + __u64 copy_count; /* cumulative copy-fallback CQEs */ + __u64 copy_bytes; /* cumulative bytes copied */ +}; + struct zcrx_notification_desc { __u64 user_data; __u32 type_mask; - __u32 __resv1; - __u64 __resv2[10]; + __u32 flags; /* see enum zcrx_notification_desc_flags */ + __u64 stats_offset; /* offset from the beginning of refill ring region for stats */ + __u64 __resv2[9]; }; /* -- cgit v1.2.3 From f13e900599089b10113ceb36013423f0837c6792 Mon Sep 17 00:00:00 2001 From: Sean Christopherson Date: Fri, 22 May 2026 15:46:06 -0700 Subject: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. Fixes: 2a62345b30529 ("KVM: guest_memfd: GUP source pages prior to populating guest memory") Cc: stable@vger.kernel.org Signed-off-by: Ackerley Tng Link: https://patch.msgid.link/20260522-fix-sev-gmem-post-populate-v2-1-3f196bfad5a1@google.com [sean: rewrite shortlog and changelog, tag for stable@] Signed-off-by: Sean Christopherson --- include/linux/kvm_host.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 4c14aee1fb06..2c5ad9a6d5ce 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -2596,7 +2596,8 @@ int kvm_arch_gmem_prepare(struct kvm *kvm, gfn_t gfn, kvm_pfn_t pfn, int max_ord typedef int (*kvm_gmem_populate_cb)(struct kvm *kvm, gfn_t gfn, kvm_pfn_t pfn, struct page *page, void *opaque); -long kvm_gmem_populate(struct kvm *kvm, gfn_t gfn, void __user *src, long npages, +long kvm_gmem_populate(struct kvm *kvm, gfn_t start_gfn, void __user *src, + long npages, bool may_writeback_src, kvm_gmem_populate_cb post_populate, void *opaque); #endif -- cgit v1.2.3 From 4d94ec1bc12c4d9d6fe428e4cf2652e187058373 Mon Sep 17 00:00:00 2001 From: Aaron Tomlin Date: Sun, 24 May 2026 20:51:23 -0400 Subject: blk-mq: add tracepoint block_rq_tag_wait In high-performance storage environments, particularly when utilising RAID controllers with shared tag sets (BLK_MQ_F_TAG_HCTX_SHARED), severe latency spikes can occur when fast devices (SSDs) are starved of hardware tags when sharing the same blk_mq_tag_set. Currently, diagnosing this specific hardware queue contention is difficult. When a CPU thread exhausts the tag pool, blk_mq_get_tag() forces the current thread to block uninterruptible via io_schedule(). While this can be inferred via sched:sched_switch or dynamically traced by attaching a kprobe to blk_mq_mark_tag_wait(), there is no dedicated, out-of-the-box observability for this event. This patch introduces the block_rq_tag_wait tracepoint in the tag allocation slow-path. It triggers immediately before the task state is altered to TASK_UNINTERRUPTIBLE (ensuring safety for PREEMPT_RT locks). It exposes the exact hardware context (hctx) that is starved, the specific pool experiencing starvation (driver, software scheduler, or reserved), and the exact pool depth. This provides storage engineers with a zero-configuration, low-overhead mechanism to definitively identify shared-tag bottlenecks. For example, userspace can trivially replicate tag starvation counters using bpftrace: # bpftrace -e 'tracepoint:block:block_rq_tag_wait { @tag_waits[cpu] = count(); }' Attaching 1 probe... ^C @tag_waits[4]: 12 @tag_waits[12]: 87 Signed-off-by: Aaron Tomlin Link: https://patch.msgid.link/20260525005123.722277-1-atomlin@atomlin.com Signed-off-by: Jens Axboe --- include/trace/events/block.h | 59 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) (limited to 'include') diff --git a/include/trace/events/block.h b/include/trace/events/block.h index 6aa79e2d799c..9c97a16850b9 100644 --- a/include/trace/events/block.h +++ b/include/trace/events/block.h @@ -226,6 +226,65 @@ DECLARE_EVENT_CLASS(block_rq, IOPRIO_PRIO_LEVEL(__entry->ioprio), __entry->comm) ); +/** + * block_rq_tag_wait - triggered when a request is starved of a tag + * @q: request queue of the target device + * @hctx: hardware context of the request experiencing starvation + * @is_sched_tag: indicates whether the starved pool is the software scheduler + * @alloc_flags: allocation flags dictating the specific tag pool + * + * Called immediately before the submitting context is forced to block due + * to the exhaustion of available tags (i.e., physical hardware driver + * tags, software scheduler tags, or reserved tags). This trace point + * indicates that the context will be placed into an uninterruptible state + * via sbitmap_prepare_to_wait(). If a tag is not acquired in the final + * lockless retry, the context will yield the CPU via io_schedule() until + * an active request completes and relinquishes its assigned tag. + */ +TRACE_EVENT(block_rq_tag_wait, + + TP_PROTO(struct request_queue *q, struct blk_mq_hw_ctx *hctx, + bool is_sched_tag, unsigned int alloc_flags), + + TP_ARGS(q, hctx, is_sched_tag, alloc_flags), + + TP_STRUCT__entry( + __field( dev_t, dev ) + __field( u32, hctx_id ) + __field( u32, nr_tags ) + __field( bool, is_sched_tag ) + __field( bool, is_reserved ) + ), + + TP_fast_assign( + __entry->dev = q->disk ? disk_devt(q->disk) : 0; + __entry->hctx_id = hctx->queue_num; + __entry->is_sched_tag = is_sched_tag; + __entry->is_reserved = alloc_flags & BLK_MQ_REQ_RESERVED; + + if (__entry->is_reserved) { + __entry->nr_tags = is_sched_tag ? + hctx->sched_tags->nr_reserved_tags : + hctx->tags->nr_reserved_tags; + } else { + if (is_sched_tag) + __entry->nr_tags = hctx->sched_tags->nr_tags - + hctx->sched_tags->nr_reserved_tags; + else + __entry->nr_tags = hctx->tags->nr_tags - + hctx->tags->nr_reserved_tags; + } + + ), + + TP_printk("%d,%d hctx=%u starved on %s%s tags (depth=%u)", + MAJOR(__entry->dev), MINOR(__entry->dev), + __entry->hctx_id, + __entry->is_sched_tag ? "scheduler" : "hardware", + __entry->is_reserved ? " reserved" : "", + __entry->nr_tags) +); + /** * block_rq_insert - insert block operation request into queue * @rq: block IO operation request -- cgit v1.2.3 From b040a1a4523d99a935cb6566b1e2a753c84733cd Mon Sep 17 00:00:00 2001 From: Mateusz Nowicki Date: Sat, 23 May 2026 12:52:35 +0000 Subject: block: switch numa_node to int in blk_mq_hw_ctx and init_request numa_node in blk_mq_hw_ctx and the matching argument of blk_mq_ops::init_request can be NUMA_NO_NODE (-1). Declared as unsigned int, NUMA_NO_NODE becomes UINT_MAX and walks off nvme_dev::descriptor_pools[] on CONFIG_NUMA=n [1]. Switch the field and the callback prototype to int and update all in-tree init_request implementations. No functional change: cpu_to_node(), kmalloc_node() and blk_alloc_flush_queue() already take int. Link: https://lore.kernel.org/linux-nvme/20260522150628.399288-1-mateusz.nowicki@posteo.net/ [1] Link: https://lore.kernel.org/linux-nvme/20260309062840.2937858-2-iam@sung-woo.kim/ Suggested-by: Caleb Sander Mateos Suggested-by: Sung-woo Kim Signed-off-by: Mateusz Nowicki Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260523125210.272274-1-mateusz.nowicki@posteo.net Signed-off-by: Jens Axboe --- include/linux/blk-mq.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 4349aefdbc87..24b4160aeaad 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -428,7 +428,7 @@ struct blk_mq_hw_ctx { struct blk_mq_tags *sched_tags; /** @numa_node: NUMA node the storage adapter has been connected to. */ - unsigned int numa_node; + int numa_node; /** @queue_num: Index of this hardware queue. */ unsigned int queue_num; @@ -653,7 +653,7 @@ struct blk_mq_ops { * flush request. */ int (*init_request)(struct blk_mq_tag_set *set, struct request *, - unsigned int, unsigned int); + unsigned int, int); /** * @exit_request: Ditto for exit/teardown. */ -- cgit v1.2.3 From a148d0a5af1ab60253994047403f9eb41ef709a4 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 08:33:30 +0200 Subject: block: don't set BIO_QUIET for BLK_STS_AGAIN Commit abb30460bda2 ("block: mark bio_wouldblock_error() bio with BIO_QUIET") added this to suppress buffer_head warnings, but neither when this commit was added nor now any buffer_head using code actually ever sets REQ_NOWAIT which can lead to BLK_STS_AGAIN. Remove the special handling for now. If we ever plan to use REQ_NOWAIT for buffer_head based I/O we're better off handling BLK_STS_AGAIN in the completion handler as it actually needs to retry the I/O as well. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260518063336.507369-3-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/bio.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/bio.h b/include/linux/bio.h index 85463981d0f5..7597ae4dc52b 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -379,7 +379,6 @@ static inline void bio_io_error(struct bio *bio) static inline void bio_wouldblock_error(struct bio *bio) { - bio_set_flag(bio, BIO_QUIET); bio->bi_status = BLK_STS_AGAIN; bio_endio(bio); } -- cgit v1.2.3 From 5804f58901af77ab507e199d31dfa263404e177c Mon Sep 17 00:00:00 2001 From: Jiun Jeong Date: Fri, 1 May 2026 23:44:13 +0900 Subject: call_once:: Fix typo in comment for call_once() Change "succesfully" to "successfully" in the kerneldoc comment of call_once(). Signed-off-by: Jiun Jeong Link: https://patch.msgid.link/20260501144413.49419-1-jiun.jeong.cs@gmail.com [sean: don't scope to KVM, massage changelog] Signed-off-by: Sean Christopherson --- include/linux/call_once.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/call_once.h b/include/linux/call_once.h index 13cd6469e7e5..1625a9d6ff5b 100644 --- a/include/linux/call_once.h +++ b/include/linux/call_once.h @@ -36,7 +36,7 @@ do { \ * it returns a zero or positive value, mark @once as completed. Return * the value returned by @cb * - * If @once has completed succesfully before, return 0. + * If @once has completed successfully before, return 0. * * The call to @cb is implicitly surrounded by a mutex, though for * efficiency the * function avoids taking it after the first call. -- cgit v1.2.3 From 8b226771014beab1292081151a99530886ce54b4 Mon Sep 17 00:00:00 2001 From: Ricardo Robaina Date: Thu, 14 May 2026 12:13:20 -0300 Subject: audit: use 'unsigned int' instead of 'unsigned' Address checkpatch.pl warning below, across the audit subsystem: WARNING: Prefer 'unsigned int' to bare use of 'unsigned' Minor cleanup, no functional changes. Signed-off-by: Ricardo Robaina Signed-off-by: Paul Moore --- include/linux/audit.h | 4 ++-- include/linux/audit_arch.h | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/audit.h b/include/linux/audit.h index 803b0183d98d..45abb3722d30 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -133,8 +133,8 @@ enum audit_nfcfgop { AUDIT_NFT_OP_INVALID, }; -extern int __init audit_register_class(int class, unsigned *list); -extern int audit_classify_syscall(int abi, unsigned syscall); +extern int __init audit_register_class(int class, unsigned int *list); +extern int audit_classify_syscall(int abi, unsigned int syscall); extern int audit_classify_arch(int arch); /* audit_names->type values */ diff --git a/include/linux/audit_arch.h b/include/linux/audit_arch.h index 2b8153791e6a..a35069a6c15d 100644 --- a/include/linux/audit_arch.h +++ b/include/linux/audit_arch.h @@ -21,13 +21,13 @@ enum auditsc_class_t { AUDITSC_NVALS /* count */ }; -extern int audit_classify_compat_syscall(int abi, unsigned syscall); +extern int audit_classify_compat_syscall(int abi, unsigned int syscall); /* only for compat system calls */ -extern unsigned compat_write_class[]; -extern unsigned compat_read_class[]; -extern unsigned compat_dir_class[]; -extern unsigned compat_chattr_class[]; -extern unsigned compat_signal_class[]; +extern unsigned int compat_write_class[]; +extern unsigned int compat_read_class[]; +extern unsigned int compat_dir_class[]; +extern unsigned int compat_chattr_class[]; +extern unsigned int compat_signal_class[]; #endif -- cgit v1.2.3 From 0b13c6a618d09b20dbb1a33bc354764cbac6f2bd Mon Sep 17 00:00:00 2001 From: Tim Bird Date: Fri, 22 May 2026 16:55:08 -0600 Subject: llc: Add SPDX id lines to some llc source files Most of the lls source files are missing SPDX-License-Identifier lines. Add appropriate IDs to these files, and remove other license info from the header. In once case, leave the existing id line and just remove the license reference text. Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260522225508.24006-1-tim.bird@sony.com Signed-off-by: Jakub Kicinski --- include/linux/llc.h | 8 +------- include/net/llc.h | 8 +------- include/uapi/linux/llc.h | 7 ------- 3 files changed, 2 insertions(+), 21 deletions(-) (limited to 'include') diff --git a/include/linux/llc.h b/include/linux/llc.h index b965314d017f..944e9e213112 100644 --- a/include/linux/llc.h +++ b/include/linux/llc.h @@ -1,14 +1,8 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* * IEEE 802.2 User Interface SAPs for Linux, data structures and indicators. * * Copyright (c) 2001 by Jay Schulist - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #ifndef __LINUX_LLC_H #define __LINUX_LLC_H diff --git a/include/net/llc.h b/include/net/llc.h index e250dca03963..029ba8a22319 100644 --- a/include/net/llc.h +++ b/include/net/llc.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_H #define LLC_H /* * Copyright (c) 1997 by Procom Technology, Inc. * 2001-2003 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #include diff --git a/include/uapi/linux/llc.h b/include/uapi/linux/llc.h index cf8806b14d5f..2ffd81f9cc01 100644 --- a/include/uapi/linux/llc.h +++ b/include/uapi/linux/llc.h @@ -3,13 +3,6 @@ * IEEE 802.2 User Interface SAPs for Linux, data structures and indicators. * * Copyright (c) 2001 by Jay Schulist - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #ifndef _UAPI__LINUX_LLC_H #define _UAPI__LINUX_LLC_H -- cgit v1.2.3 From 29fb4a26416d851333be909fc313db9147b7099c Mon Sep 17 00:00:00 2001 From: Tim Bird Date: Fri, 22 May 2026 18:23:54 -0600 Subject: llc: Add SPDX id lines to llc header files Add appropriate SPDX-License-Identifier lines to llc header (.h) files, and remove other license text from the files. Signed-off-by: Tim Bird Link: https://patch.msgid.link/20260523002354.28831-1-tim.bird@sony.com Signed-off-by: Jakub Kicinski --- include/net/llc_c_ac.h | 8 +------- include/net/llc_c_ev.h | 8 +------- include/net/llc_c_st.h | 8 +------- include/net/llc_conn.h | 8 +------- include/net/llc_if.h | 8 +------- include/net/llc_pdu.h | 8 +------- include/net/llc_s_ac.h | 8 +------- include/net/llc_s_ev.h | 8 +------- include/net/llc_s_st.h | 8 +------- include/net/llc_sap.h | 8 +------- 10 files changed, 10 insertions(+), 70 deletions(-) (limited to 'include') diff --git a/include/net/llc_c_ac.h b/include/net/llc_c_ac.h index 7620a9196922..af31a49bebb0 100644 --- a/include/net/llc_c_ac.h +++ b/include/net/llc_c_ac.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_C_AC_H #define LLC_C_AC_H /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ /* Connection component state transition actions */ /* diff --git a/include/net/llc_c_ev.h b/include/net/llc_c_ev.h index 241889955157..d45140d4289a 100644 --- a/include/net/llc_c_ev.h +++ b/include/net/llc_c_ev.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_C_EV_H #define LLC_C_EV_H /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #include diff --git a/include/net/llc_c_st.h b/include/net/llc_c_st.h index a4bea0f33188..f52a4cc4880d 100644 --- a/include/net/llc_c_st.h +++ b/include/net/llc_c_st.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_C_ST_H #define LLC_C_ST_H /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #include diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h index 374411b3066c..e1a302696723 100644 --- a/include/net/llc_conn.h +++ b/include/net/llc_conn.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_CONN_H #define LLC_CONN_H /* * Copyright (c) 1997 by Procom Technology, Inc. * 2001, 2002 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #include #include diff --git a/include/net/llc_if.h b/include/net/llc_if.h index c72570a21a4f..a333259613ab 100644 --- a/include/net/llc_if.h +++ b/include/net/llc_if.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_IF_H #define LLC_IF_H /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ /* Defines LLC interface to network layer */ /* Available primitives */ diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h index 86681f29bda7..f165237a3723 100644 --- a/include/net/llc_pdu.h +++ b/include/net/llc_pdu.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_PDU_H #define LLC_PDU_H /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001-2003 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #include diff --git a/include/net/llc_s_ac.h b/include/net/llc_s_ac.h index f71790305bc9..076adc5217fd 100644 --- a/include/net/llc_s_ac.h +++ b/include/net/llc_s_ac.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_S_AC_H #define LLC_S_AC_H /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ struct llc_sap; diff --git a/include/net/llc_s_ev.h b/include/net/llc_s_ev.h index fb7df1d70af3..7b9c94093336 100644 --- a/include/net/llc_s_ev.h +++ b/include/net/llc_s_ev.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_S_EV_H #define LLC_S_EV_H /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #include diff --git a/include/net/llc_s_st.h b/include/net/llc_s_st.h index fca49d483d20..85ce230fd946 100644 --- a/include/net/llc_s_st.h +++ b/include/net/llc_s_st.h @@ -1,15 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_S_ST_H #define LLC_S_ST_H /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ #include diff --git a/include/net/llc_sap.h b/include/net/llc_sap.h index 1e4df9fd9fb2..b259f5993c46 100644 --- a/include/net/llc_sap.h +++ b/include/net/llc_sap.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 */ #ifndef LLC_SAP_H #define LLC_SAP_H @@ -6,13 +7,6 @@ /* * Copyright (c) 1997 by Procom Technology,Inc. * 2001-2003 by Arnaldo Carvalho de Melo - * - * This program can be redistributed or modified under the terms of the - * GNU General Public License as published by the Free Software Foundation. - * This program is distributed without any warranty or implied warranty - * of merchantability or fitness for a particular purpose. - * - * See the GNU General Public License for more details. */ struct llc_sap; struct net_device; -- cgit v1.2.3 From 54e1bc80af0c993afc6a2283722f8d4535b10d40 Mon Sep 17 00:00:00 2001 From: Cheng Ming Lin Date: Tue, 5 May 2026 09:34:52 +0800 Subject: mtd: spinand: Add support for randomizer This patch adds support for the randomizer feature. It introduces a 'set_randomizer' callback in 'struct spinand_info' and 'struct spinand_device'. If a driver implements this callback, the core will invoke it during device initialization (spinand_init) to enable or disable the randomizer feature based on the device tree configuration. Signed-off-by: Cheng Ming Lin Signed-off-by: Miquel Raynal --- include/linux/mtd/spinand.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/linux/mtd/spinand.h b/include/linux/mtd/spinand.h index 44f4347104d6..ec6efcfeef83 100644 --- a/include/linux/mtd/spinand.h +++ b/include/linux/mtd/spinand.h @@ -593,6 +593,7 @@ enum spinand_bus_interface { * @user_otp: SPI NAND user OTP info. * @read_retries: the number of read retry modes supported * @set_read_retry: enable/disable read retry for data recovery + * @set_randomizer: enable/disable randomizer support * * Each SPI NAND manufacturer driver should have a spinand_info table * describing all the chips supported by the driver. @@ -622,6 +623,8 @@ struct spinand_info { unsigned int read_retries; int (*set_read_retry)(struct spinand_device *spinand, unsigned int read_retry); + int (*set_randomizer)(struct spinand_device *spinand, + bool enable); }; #define SPINAND_ID(__method, ...) \ @@ -686,6 +689,9 @@ struct spinand_info { .read_retries = __read_retries, \ .set_read_retry = __set_read_retry +#define SPINAND_RANDOMIZER(__set_randomizer) \ + .set_randomizer = __set_randomizer + #define SPINAND_INFO(__model, __id, __memorg, __eccreq, __op_variants, \ __flags, ...) \ { \ @@ -771,6 +777,7 @@ struct spinand_mem_ops { * @user_otp: SPI NAND user OTP info. * @read_retries: the number of read retry modes supported * @set_read_retry: Enable/disable the read retry feature + * @set_randomizer: Enable/disable the randomizer feature */ struct spinand_device { struct nand_device base; @@ -804,6 +811,8 @@ struct spinand_device { bool cont_read_possible; int (*set_cont_read)(struct spinand_device *spinand, bool enable); + int (*set_randomizer)(struct spinand_device *spinand, + bool enable); const struct spinand_fact_otp *fact_otp; const struct spinand_user_otp *user_otp; -- cgit v1.2.3 From 7fbdbc7d028a20a78b7d28a9510a216c76b5fbfd Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 25 May 2026 15:04:40 -0700 Subject: mtd: rawnand: qcom: embed nand_controller into qcom_nand_controller The qcom_nand_controller had a struct nand_controller *controller pointer that was assigned to (struct nand_controller *)&nandc[1], with the allocation oversized by sizeof(*controller) to make room. get_qcom_nand_controller() then walked backwards from chip->controller using sizeof()-based arithmetic to recover the enclosing nandc. Embed the nand_controller directly into qcom_nand_controller and use container_of() in get_qcom_nand_controller(). The header now needs the full rawnand.h definition rather than a forward declaration. Assisted-by: Claude:Opus-4.7 Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- include/linux/mtd/nand-qpic-common.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/mtd/nand-qpic-common.h b/include/linux/mtd/nand-qpic-common.h index e8201d1b7cf9..006ca8c978a9 100644 --- a/include/linux/mtd/nand-qpic-common.h +++ b/include/linux/mtd/nand-qpic-common.h @@ -9,6 +9,8 @@ #ifndef __MTD_NAND_QPIC_COMMON_H__ #define __MTD_NAND_QPIC_COMMON_H__ +#include + /* NANDc reg offsets */ #define NAND_FLASH_CMD 0x00 #define NAND_ADDR0 0x04 @@ -394,7 +396,7 @@ struct qcom_nand_controller { const struct qcom_nandc_props *props; - struct nand_controller *controller; + struct nand_controller controller; struct qpic_spi_nand *qspi; struct list_head host_list; -- cgit v1.2.3 From e3fb31d8847fef2ce37c5f60bc77d3f731a2419b Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Tue, 26 May 2026 16:56:45 +0200 Subject: mtd: spi-nor: swp: Add support for the complement feature The current locking implementation allows to select a power of two number of blocks, which is going to be the protected amount, as well as telling whether this is the data at the top (end of the device) or the bottom (beginning of the device). This means at most we can cover half of the device or the entire device, but nothing in between. The complement feature allows a much finer grain of configuration, by allowing to invert what is considered locked and unlocked. Add support for this feature. The only known position for the CMP bit is bit 6 of the configuration register. The locking and unlocking logics are kept unchanged if the CMP bit is unavailable. Otherwise, once the regular logic has been applied, we check if we already found an optimal configuration. If not, we try with the CMP bit set. If the coverage is closer to the request, we use it. Signed-off-by: Miquel Raynal Signed-off-by: Pratyush Yadav --- include/linux/mtd/spi-nor.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h index 9ad77f9e76c2..4b92494827b1 100644 --- a/include/linux/mtd/spi-nor.h +++ b/include/linux/mtd/spi-nor.h @@ -125,6 +125,7 @@ #define SR2_LB1 BIT(3) /* Security Register Lock Bit 1 */ #define SR2_LB2 BIT(4) /* Security Register Lock Bit 2 */ #define SR2_LB3 BIT(5) /* Security Register Lock Bit 3 */ +#define SR2_CMP_BIT6 BIT(6) #define SR2_QUAD_EN_BIT7 BIT(7) /* Supported SPI protocols */ -- cgit v1.2.3 From 16868fd4b7ecf241b74123e1bb23fd08d05a2e09 Mon Sep 17 00:00:00 2001 From: Sumit Gupta Date: Mon, 18 May 2026 18:13:05 +0530 Subject: dt-bindings: memory: tegra264: Add full set of MC client IDs Add the complete set of TEGRA264_MEMORY_CLIENT_* IDs exposed by the Tegra264 MC. Signed-off-by: Sumit Gupta Link: https://patch.msgid.link/20260518124306.2071481-3-sumitg@nvidia.com Signed-off-by: Krzysztof Kozlowski --- include/dt-bindings/memory/nvidia,tegra264.h | 287 +++++++++++++++++++++++++++ 1 file changed, 287 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/memory/nvidia,tegra264.h b/include/dt-bindings/memory/nvidia,tegra264.h index 521405c01f84..c65403a76413 100644 --- a/include/dt-bindings/memory/nvidia,tegra264.h +++ b/include/dt-bindings/memory/nvidia,tegra264.h @@ -58,24 +58,108 @@ * memory client IDs */ +/* PTW read client mapped to SOC SMMU0 */ +#define TEGRA264_MEMORY_CLIENT_PTCR 0x00 /* HOST1X read client */ #define TEGRA264_MEMORY_CLIENT_HOST1XR 0x16 +#define TEGRA264_MEMORY_CLIENT_MPCORER 0x27 +/* Platform security (PSC) Read clients */ +#define TEGRA264_MEMORY_CLIENT_PSCR 0x33 +/* PSC Write clients */ +#define TEGRA264_MEMORY_CLIENT_PSCW 0x34 +/* ISP0 Read client */ +#define TEGRA264_MEMORY_CLIENT_ISP0R 0x37 +#define TEGRA264_MEMORY_CLIENT_MPCOREW 0x39 +/* ISP0 Write client */ +#define TEGRA264_MEMORY_CLIENT_ISP0W 0x44 +/* ISP1 Write client */ +#define TEGRA264_MEMORY_CLIENT_ISP1W 0x45 +/* ISP FALCON Read client */ +#define TEGRA264_MEMORY_CLIENT_ISPFALCONR 0x47 +/* ISP FALCON Write client */ +#define TEGRA264_MEMORY_CLIENT_ISPFALCONW 0x4f +/* MGBE2 Read mccif */ +#define TEGRA264_MEMORY_CLIENT_MGBE2R 0x5c +#define TEGRA264_MEMORY_CLIENT_OFAR2MC 0x5d +#define TEGRA264_MEMORY_CLIENT_OFAW2MC 0x5e +/* MGBE2 Write mccif */ +#define TEGRA264_MEMORY_CLIENT_MGBE2W 0x5f +/* MGBE3 Read mccif */ +#define TEGRA264_MEMORY_CLIENT_MGBE3R 0x61 +/* MGBE3 Write mccif */ +#define TEGRA264_MEMORY_CLIENT_MGBE3W 0x65 +/* SEU1 Memory Read Client */ +#define TEGRA264_MEMORY_CLIENT_SEU1RD 0x68 +/* SEU1 Memory Write Client */ +#define TEGRA264_MEMORY_CLIENT_SEU1WR 0x69 /* VIC read client */ #define TEGRA264_MEMORY_CLIENT_VICR 0x6c /* VIC Write client */ #define TEGRA264_MEMORY_CLIENT_VICW 0x6d /* VI R5 Write client */ #define TEGRA264_MEMORY_CLIENT_VIW 0x72 +/* QSPI Read Client */ +#define TEGRA264_MEMORY_CLIENT_XSPI0R 0x75 +/* QSPI Write Client */ +#define TEGRA264_MEMORY_CLIENT_XSPI0W 0x76 #define TEGRA264_MEMORY_CLIENT_NVDECSRD2MC 0x78 #define TEGRA264_MEMORY_CLIENT_NVDECSWR2MC 0x79 /* Audio processor(APE) Read client */ #define TEGRA264_MEMORY_CLIENT_APER 0x7a /* Audio processor(APE) Write client */ #define TEGRA264_MEMORY_CLIENT_APEW 0x7b +/* SEU0 read client */ +#define TEGRA264_MEMORY_CLIENT_SER 0x80 +/* SEU0 write client */ +#define TEGRA264_MEMORY_CLIENT_SEW 0x81 +/* AXI AP and DFD/Coresight1-AUX0/1 Read clients both share the same interface on MSS */ +#define TEGRA264_MEMORY_CLIENT_AXIAPR 0x82 +/* AXI AP and DFD/Coresight1-AUX0/1 Write clients both share the same interface on MSS */ +#define TEGRA264_MEMORY_CLIENT_AXIAPW 0x83 +/* ETR or DFD/Coresight0 Read Client */ +#define TEGRA264_MEMORY_CLIENT_ETRR 0x84 +/* ETR or DFD/Coresight0 Write Client */ +#define TEGRA264_MEMORY_CLIENT_ETRW 0x85 +/* Security(tsec) Read client */ +#define TEGRA264_MEMORY_CLIENT_TSECR 0x86 +/* Security(tsec) Write client */ +#define TEGRA264_MEMORY_CLIENT_TSECW 0x87 +/* BPMP read client */ +#define TEGRA264_MEMORY_CLIENT_BPMPR 0x93 +/* BPMP write client */ +#define TEGRA264_MEMORY_CLIENT_BPMPW 0x94 +/* AON Read Client */ +#define TEGRA264_MEMORY_CLIENT_AONR 0x97 +/* AON write client */ +#define TEGRA264_MEMORY_CLIENT_AONW 0x98 +/* GPCDMA debug Read client */ +#define TEGRA264_MEMORY_CLIENT_GPCDMAR 0x99 +/* GPCDMA debug Write client */ +#define TEGRA264_MEMORY_CLIENT_GPCDMAW 0x9a /* Audio DMA Read client */ #define TEGRA264_MEMORY_CLIENT_APEDMAR 0x9f /* Audio DMA Write client */ #define TEGRA264_MEMORY_CLIENT_APEDMAW 0xa0 +/* mss internal memqual MIU0 reads */ +#define TEGRA264_MEMORY_CLIENT_MIU0R 0xa6 +/* mss internal memqual MIU0 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU0W 0xa7 +/* mss internal memqual MIU1 reads */ +#define TEGRA264_MEMORY_CLIENT_MIU1R 0xa8 +/* mss internal memqual MIU1 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU1W 0xa9 +/* mss internal memqual MIU2 reads */ +#define TEGRA264_MEMORY_CLIENT_MIU2R 0xae +/* mss internal memqual MIU2 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU2W 0xaf +/* mss internal memqual MIU3 reads */ +#define TEGRA264_MEMORY_CLIENT_MIU3R 0xb0 +/* mss internal memqual MIU3 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU3W 0xb1 +/* mss internal memqual MIU4 reads */ +#define TEGRA264_MEMORY_CLIENT_MIU4R 0xb2 +/* mss internal memqual MIU4 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU4W 0xb3 #define TEGRA264_MEMORY_CLIENT_GPUR02MC 0xb6 #define TEGRA264_MEMORY_CLIENT_GPUW02MC 0xb7 /* VI Falcon Read client */ @@ -86,6 +170,8 @@ #define TEGRA264_MEMORY_CLIENT_RCER 0xd2 /* Write client of RCE */ #define TEGRA264_MEMORY_CLIENT_RCEW 0xd3 +#define TEGRA264_MEMORY_CLIENT_NVENC1SRD2MC 0xd6 +#define TEGRA264_MEMORY_CLIENT_NVENC1SWR2MC 0xd7 /* PCIE0/MSI Write clients */ #define TEGRA264_MEMORY_CLIENT_PCIE0W 0xd9 /* PCIE1/RPX4 Read clients */ @@ -108,16 +194,140 @@ #define TEGRA264_MEMORY_CLIENT_PCIE5R 0xe2 /* PCIE5/DMX4 Write clients */ #define TEGRA264_MEMORY_CLIENT_PCIE5W 0xe3 +/* mss internal memqual MIU5 reads */ +#define TEGRA264_MEMORY_CLIENT_MIU5R 0xfc +/* mss internal memqual MIU5 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU5W 0xfd +/* mss internal memqual MIU6 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU6W 0xff +#define TEGRA264_MEMORY_CLIENT_RISTR 0x100 +#define TEGRA264_MEMORY_CLIENT_RISTW 0x101 +/* OESP (Pluton) Read client */ +#define TEGRA264_MEMORY_CLIENT_OESPR 0x102 +/* OESP (Pluton) Write client */ +#define TEGRA264_MEMORY_CLIENT_OESPW 0x103 +/* mss internal memqual MIU7 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU7W 0x105 +/* mss internal memqual MIU8 reads */ +#define TEGRA264_MEMORY_CLIENT_MIU8R 0x106 +/* mss internal memqual MIU8 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU8W 0x107 +/* mss internal memqual MIU9 reads */ +#define TEGRA264_MEMORY_CLIENT_MIU9R 0x108 +/* mss internal memqual MIU9 writes */ +#define TEGRA264_MEMORY_CLIENT_MIU9W 0x109 +/* HWPM Write Interface */ +#define TEGRA264_MEMORY_CLIENT_PMA0AWR 0x122 +#define TEGRA264_MEMORY_CLIENT_NVJPG1SRD2MC 0x123 +#define TEGRA264_MEMORY_CLIENT_NVJPG1SWR2MC 0x124 +/* CTW read client mapped to SMMU0 */ +#define TEGRA264_MEMORY_CLIENT_SMMU0CTWR 0x12e +/* CMDQV read client mapped to SMMU0 */ +#define TEGRA264_MEMORY_CLIENT_SMMU0CMDQVR 0x12f +/* CMDQV write client mapped to SMMU0 */ +#define TEGRA264_MEMORY_CLIENT_SMMU0CMDQVW 0x130 +/* EVNTQ write client mapped to SMMU0 */ +#define TEGRA264_MEMORY_CLIENT_SMMU0EVNTQW 0x131 +/* PTW read client mapped to SMMU1 */ +#define TEGRA264_MEMORY_CLIENT_SMMU1PTWR 0x132 +/* CTW read client mapped to SMMU1 */ +#define TEGRA264_MEMORY_CLIENT_SMMU1CTWR 0x134 +/* CMDQV read client mapped to SMMU1 */ +#define TEGRA264_MEMORY_CLIENT_SMMU1CMDQVR 0x135 +/* CMDQV write client mapped to SMMU1 */ +#define TEGRA264_MEMORY_CLIENT_SMMU1CMDQVW 0x136 +/* EVNTQ write client mapped to SMMU1 */ +#define TEGRA264_MEMORY_CLIENT_SMMU1EVNTQW 0x137 +/* PTW read client mapped to SMMU2 */ +#define TEGRA264_MEMORY_CLIENT_SMMU2PTWR 0x138 +/* CTW read client mapped to SMMU2 */ +#define TEGRA264_MEMORY_CLIENT_SMMU2CTWR 0x13a +/* CMDQV read client mapped to SMMU2 */ +#define TEGRA264_MEMORY_CLIENT_SMMU2CMDQVR 0x13b +/* CMDQV write client mapped to SMMU2 */ +#define TEGRA264_MEMORY_CLIENT_SMMU2CMDQVW 0x13c +/* EVNTQ write client mapped to SMMU2 */ +#define TEGRA264_MEMORY_CLIENT_SMMU2EVNTQW 0x13d +/* CMDQ read client mapped to SMMU0 */ +#define TEGRA264_MEMORY_CLIENT_SMMU0CMDQR 0x144 +/* CMDQ read client mapped to SMMU1 */ +#define TEGRA264_MEMORY_CLIENT_SMMU1CMDQR 0x145 +/* CMDQ read client mapped to SMMU2 */ +#define TEGRA264_MEMORY_CLIENT_SMMU2CMDQR 0x146 +/* Audio processor1(APE1) Read client */ +#define TEGRA264_MEMORY_CLIENT_APE1R 0x150 +/* Audio processor1(APE1) Write client */ +#define TEGRA264_MEMORY_CLIENT_APE1W 0x151 /* UFS Read client */ #define TEGRA264_MEMORY_CLIENT_UFSR 0x15c /* UFS write client */ #define TEGRA264_MEMORY_CLIENT_UFSW 0x15d +/* XUSB HOST Read Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEVR 0x166 +/* XUSB HOST Write Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEVW 0x167 +/* XUSB SS0 Read Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV1R 0x168 +/* XUSB SS1 Write Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV2W 0x169 +/* XUSB SS2 Read Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV3R 0x16a +/* XUSB SS2 Write Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV3W 0x16b +/* XUSB SS3 Read Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV4R 0x16c +/* XUSB SS3 Write Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV4W 0x16d +/* XUSB DEV Read Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV5R 0x16e +/* XUSB DEV Write Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV5W 0x16f +/* DCE Read client */ +#define TEGRA264_MEMORY_CLIENT_DCER 0x17a +/* DCE Write client */ +#define TEGRA264_MEMORY_CLIENT_DCEW 0x17b /* HDA Read client */ #define TEGRA264_MEMORY_CLIENT_HDAR 0x17c /* HDA Write client */ #define TEGRA264_MEMORY_CLIENT_HDAW 0x17d +/* DISPNISO read client */ +#define TEGRA264_MEMORY_CLIENT_DISPNISOR 0x17e +/* DISPNISO write client */ +#define TEGRA264_MEMORY_CLIENT_DISPNISOW 0x17f +/* XUSB SS0 Write Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV1W 0x180 +/* XUSB SS1 Read Client */ +#define TEGRA264_MEMORY_CLIENT_XUSB_DEV2R 0x181 /* Disp ISO Read Client */ #define TEGRA264_MEMORY_CLIENT_DISPR 0x182 +/* MSSSEQ Read Client */ +#define TEGRA264_MEMORY_CLIENT_MSSSEQR 0x185 +/* MSSSEQ Write Client */ +#define TEGRA264_MEMORY_CLIENT_MSSSEQW 0x186 +/* PTW read client mapped to SMMU3 */ +#define TEGRA264_MEMORY_CLIENT_SMMU3PTWR 0x18b +/* CTW read client mapped to SMMU3 */ +#define TEGRA264_MEMORY_CLIENT_SMMU3CTWR 0x18d +/* CMDQV read client mapped to SMMU3 */ +#define TEGRA264_MEMORY_CLIENT_SMMU3CMDQVR 0x18e +/* CMDQV write client mapped to SMMU3 */ +#define TEGRA264_MEMORY_CLIENT_SMMU3CMDQVW 0x18f +/* EVNTQ write client mapped to SMMU3 */ +#define TEGRA264_MEMORY_CLIENT_SMMU3EVNTQW 0x190 +/* CMDQ read client mapped to SMMU3 */ +#define TEGRA264_MEMORY_CLIENT_SMMU3CMDQR 0x191 +/* PTW read client mapped to SMMU4 */ +#define TEGRA264_MEMORY_CLIENT_SMMU4PTWR 0x192 +/* CTW read client mapped to SMMU4 */ +#define TEGRA264_MEMORY_CLIENT_SMMU4CTWR 0x194 +/* CMDQV read client mapped to SMMU4 */ +#define TEGRA264_MEMORY_CLIENT_SMMU4CMDQVR 0x195 +/* CMDQV write client mapped to SMMU4 */ +#define TEGRA264_MEMORY_CLIENT_SMMU4CMDQVW 0x196 +/* EVNTQ write client mapped to SMMU4 */ +#define TEGRA264_MEMORY_CLIENT_SMMU4EVNTQW 0x197 +/* CMDQ read client mapped to SMMU4 */ +#define TEGRA264_MEMORY_CLIENT_SMMU4CMDQR 0x198 /* MGBE0 Read mccif */ #define TEGRA264_MEMORY_CLIENT_MGBE0R 0x1a2 /* MGBE0 Write mccif */ @@ -128,9 +338,86 @@ #define TEGRA264_MEMORY_CLIENT_MGBE1W 0x1a5 /* VI1 R5 Write client */ #define TEGRA264_MEMORY_CLIENT_VI1W 0x1a6 +/* VI Falcon1 Read client */ +#define TEGRA264_MEMORY_CLIENT_VIFALCON1R 0x1a7 +/* VI Falcon1 Write client */ +#define TEGRA264_MEMORY_CLIENT_VIFALCON1W 0x1a8 +/* ISP FALCON1 Read client */ +#define TEGRA264_MEMORY_CLIENT_ISPFALCON1R 0x1a9 +/* ISP FALCON1 Write client */ +#define TEGRA264_MEMORY_CLIENT_ISPFALCON1W 0x1aa +/* Read Client of RCE1 */ +#define TEGRA264_MEMORY_CLIENT_RCE1R 0x1ab +/* Write client of RCE1 */ +#define TEGRA264_MEMORY_CLIENT_RCE1W 0x1ac +/* SEU2 Read client */ +#define TEGRA264_MEMORY_CLIENT_SEU2R 0x1ad +/* SEU2 Write client */ +#define TEGRA264_MEMORY_CLIENT_SEU2W 0x1ae +/* SEU3 Read client */ +#define TEGRA264_MEMORY_CLIENT_SEU3R 0x1af +/* SEU3 Write client */ +#define TEGRA264_MEMORY_CLIENT_SEU3W 0x1b0 +/* PVA0 Falcon Read mccif */ +#define TEGRA264_MEMORY_CLIENT_PVA0R 0x1b1 +/* PVA0 Falcon Write mccif */ +#define TEGRA264_MEMORY_CLIENT_PVA0W 0x1b2 +/* PVA1 Read mccif */ +#define TEGRA264_MEMORY_CLIENT_PVA1R 0x1b3 +/* PVA1 Write mccif */ +#define TEGRA264_MEMORY_CLIENT_PVA1W 0x1b4 +/* PVA2 Read mccif */ +#define TEGRA264_MEMORY_CLIENT_PVA2R 0x1b5 +/* PVA2 Write mccif */ +#define TEGRA264_MEMORY_CLIENT_PVA2W 0x1b6 +/* ISP3 Write client */ +#define TEGRA264_MEMORY_CLIENT_ISP3W 0x1b7 +/* ISP2 Read Client */ +#define TEGRA264_MEMORY_CLIENT_ISP2R 0x1b8 +/* ISP2 Write Client */ +#define TEGRA264_MEMORY_CLIENT_ISP2W 0x1b9 +/* EQOS Read mccif */ +#define TEGRA264_MEMORY_CLIENT_EQOSR 0x1bc +/* EQOS Write mccif */ +#define TEGRA264_MEMORY_CLIENT_EQOSW 0x1bd +/* FSI0 Read mccif */ +#define TEGRA264_MEMORY_CLIENT_FSI0R 0x1be +/* FSI0 Write mccif */ +#define TEGRA264_MEMORY_CLIENT_FSI0W 0x1bf +/* FSI1 Read mccif */ +#define TEGRA264_MEMORY_CLIENT_FSI1R 0x1c0 +/* FSI1 Write mccif */ +#define TEGRA264_MEMORY_CLIENT_FSI1W 0x1c1 /* SDMMC0 Read mccif */ #define TEGRA264_MEMORY_CLIENT_SDMMC0R 0x1c2 /* SDMMC0 Write mccif */ #define TEGRA264_MEMORY_CLIENT_SDMMC0W 0x1c3 +/* Strongbox (SB) read client */ +#define TEGRA264_MEMORY_CLIENT_SBR 0x1c6 +/* Strongbox (SB) write client */ +#define TEGRA264_MEMORY_CLIENT_SBW 0x1c7 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU0R 0x1c8 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU0W 0x1c9 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU1R 0x1ca +#define TEGRA264_MEMORY_CLIENT_HSS_MIU1W 0x1cb +#define TEGRA264_MEMORY_CLIENT_HSS_MIU2R 0x1cc +#define TEGRA264_MEMORY_CLIENT_HSS_MIU2W 0x1cd +#define TEGRA264_MEMORY_CLIENT_HSS_MIU3R 0x1ce +#define TEGRA264_MEMORY_CLIENT_HSS_MIU3W 0x1cf +#define TEGRA264_MEMORY_CLIENT_HSS_MIU4R 0x1d0 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU4W 0x1d1 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU5R 0x1d2 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU5W 0x1d3 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU6R 0x1d4 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU6W 0x1d5 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU7R 0x1d6 +#define TEGRA264_MEMORY_CLIENT_HSS_MIU7W 0x1d7 +#define TEGRA264_MEMORY_CLIENT_GMMUR2MC 0x1d8 +#define TEGRA264_MEMORY_CLIENT_UCFELAR 0x1d9 +#define TEGRA264_MEMORY_CLIENT_UCFELAW 0x1da +#define TEGRA264_MEMORY_CLIENT_SLCR 0x1db +#define TEGRA264_MEMORY_CLIENT_SLCW 0x1dc +#define TEGRA264_MEMORY_CLIENT_REMOTER 0x1dd +#define TEGRA264_MEMORY_CLIENT_REMOTEW 0x1de #endif /* DT_BINDINGS_MEMORY_NVIDIA_TEGRA264_H */ -- cgit v1.2.3 From be31fcf5af751815457102575b816a2bd31b4562 Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Mon, 25 May 2026 22:20:52 +0200 Subject: rust: driver core: drop drvdata before devres release Move the post_unbind_rust callback before devres_release_all() in device_unbind_cleanup(). With drvdata() removed, the driver's bus device private data is only accessible by the owning driver itself. It is hence safe to drop the driver's bus device private data before devres actions are released. This reordering is the key enabler for Higher-Ranked Lifetime Types (HRT) in Rust device drivers -- it allows driver structs to hold direct references to devres-managed resources, because the bus device private data (and with it all such references) is guaranteed to be dropped while the underlying devres resources are still alive. Without this change, devres resources would be freed first, leaving the driver's bus device private data with dangling references during its destructor. Reviewed-by: Alexandre Courbot Reviewed-by: Gary Guo Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260525202921.124698-6-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/device/driver.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/device/driver.h b/include/linux/device/driver.h index bbc67ec513ed..38e9a4679447 100644 --- a/include/linux/device/driver.h +++ b/include/linux/device/driver.h @@ -123,8 +123,8 @@ struct device_driver { struct driver_private *p; struct { /* - * Called after remove() and after all devres entries have been - * processed. This is a Rust only callback. + * Called after remove() but before devres entries are released. + * This is a Rust only callback. */ void (*post_unbind_rust)(struct device *dev); } p_cb; -- cgit v1.2.3 From 958e4450e961d75bd9d8f5bfe245fb15bc78e02a Mon Sep 17 00:00:00 2001 From: Huacai Chen Date: Wed, 27 May 2026 22:08:41 +0800 Subject: ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson Due to a hardware defect, for Loongson PCI HDMI devices with a reversion ID of 2, the pin sense status must be determined via the ELD. Add a codec flag, eld_jack_detect, to indicate this case, and do special handlings in read_pin_sense(). Cc: stable@vger.kernel.org Signed-off-by: Baoqi Zhang Signed-off-by: Haowei Zheng Signed-off-by: Huacai Chen Link: https://patch.msgid.link/20260527140841.3407183-1-chenhuacai@loongson.cn Signed-off-by: Takashi Iwai --- include/sound/hda_codec.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h index 24581080e26a..1a1fe7a904c3 100644 --- a/include/sound/hda_codec.h +++ b/include/sound/hda_codec.h @@ -259,6 +259,7 @@ struct hda_codec { unsigned int forced_resume:1; /* forced resume for jack */ unsigned int no_stream_clean_at_suspend:1; /* do not clean streams at suspend */ unsigned int ctl_dev_id:1; /* old control element id build behaviour */ + unsigned int eld_jack_detect:1; /* Machine jack-detection by ELD */ unsigned long power_on_acct; unsigned long power_off_acct; -- cgit v1.2.3 From 555233110be78901be980f43d08c3b91f0aff388 Mon Sep 17 00:00:00 2001 From: Aymeric Wibo Date: Wed, 27 May 2026 19:51:50 +0200 Subject: ACPICA: actypes: Distinguish between D3hot/cold And default `ACPI_STATE_D3` to D3cold. Link: https://github.com/acpica/acpica/commit/c11cc9c68233 Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5105913.31r3eYUQgx@rafael.j.wysocki --- include/acpi/actypes.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h index 8fe893d776dd..137e1e65cdf4 100644 --- a/include/acpi/actypes.h +++ b/include/acpi/actypes.h @@ -591,9 +591,9 @@ typedef u64 acpi_integer; #define ACPI_STATE_D1 (u8) 1 #define ACPI_STATE_D2 (u8) 2 #define ACPI_STATE_D3_HOT (u8) 3 -#define ACPI_STATE_D3 (u8) 4 -#define ACPI_STATE_D3_COLD ACPI_STATE_D3 -#define ACPI_D_STATES_MAX ACPI_STATE_D3 +#define ACPI_STATE_D3_COLD (u8) 4 +#define ACPI_STATE_D3 ACPI_STATE_D3_COLD +#define ACPI_D_STATES_MAX ACPI_STATE_D3_COLD #define ACPI_D_STATE_COUNT 5 #define ACPI_STATE_C0 (u8) 0 -- cgit v1.2.3 From 7e1f091e1c55b369498c1ff1c5c24bd659d86a0c Mon Sep 17 00:00:00 2001 From: Pawel Chmielewski Date: Wed, 27 May 2026 19:52:32 +0200 Subject: ACPICA: actbl2.h: ACPI 6.6: Updates for MADT MPWakeup ACPI 6.6 introduces "Test" command for Multiprocessor Wakeup as well as resetting the Multiprocessor Wakeup Mailbox Link: https://github.com/acpica/acpica/commit/a4f629dc90fc Signed-off-by: Pawel Chmielewski Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2414431.ElGaqSPkdT@rafael.j.wysocki --- include/acpi/actbl2.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/acpi/actbl2.h b/include/acpi/actbl2.h index 5c0b55e7b3e4..33b10fe3cf35 100644 --- a/include/acpi/actbl2.h +++ b/include/acpi/actbl2.h @@ -1524,7 +1524,7 @@ struct acpi_madt_generic_translator { #define ACPI_MADT_ITS_NON_COHERENT (1) -/* 16: Multiprocessor wakeup (ACPI 6.4) */ +/* 16: Multiprocessor wakeup (ACPI 6.6) */ struct acpi_madt_multiproc_wakeup { struct acpi_subtable_header header; -- cgit v1.2.3 From 3f27eb64c55902ea77c1f88c3ca5edeb4f20e840 Mon Sep 17 00:00:00 2001 From: Daniel Schaefer Date: Wed, 27 May 2026 19:54:43 +0200 Subject: ACPICA: Add modern standby DSM GUIDs Add AMD, Intel and Microsoft GUIDs for Low-power S0 Idle _DSM. Link: https://uefi.org/sites/default/files/resources/Intel_ACPI_Low_Power_S0_Idle.pdf Link: https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby-firmware-notifications Link: https://github.com/torvalds/linux/blob/v6.18/drivers/acpi/x86/s2idle.c Link: https://github.com/acpica/acpica/commit/cae0082158e4 Signed-off-by: Daniel Schaefer Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/3415679.aeNJFYEL58@rafael.j.wysocki --- include/acpi/acuuid.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/acpi/acuuid.h b/include/acpi/acuuid.h index b2e29da6ba0a..ccc536f4bbb5 100644 --- a/include/acpi/acuuid.h +++ b/include/acpi/acuuid.h @@ -63,6 +63,11 @@ #define UUID_CACHE_PROPERTIES "6DC63E77-257E-4E78-A973-A21F2796898D" #define UUID_PHYSICAL_PROPERTY "DDE4D59A-AA42-4349-B407-EA40F57D9FB7" +/* Modern Standby */ +#define UUID_LPS0_MICROSOFT "11E00D56-CE64-47CE-837B-1F898F9AA461" +#define UUID_LPS0_INTEL "C4EB40A0-6CD2-11E2-BCFD-0800200C9A66" +#define UUID_LPS0_AMD "E3F32452-FEBC-43CE-9039-932122D37721" + /* Miscellaneous */ #define UUID_PLATFORM_CAPABILITIES "0811b06e-4a27-44f9-8d60-3cbbc22e7b48" -- cgit v1.2.3 From f0ee0b0927f78adfd9ba4f57b42a07645b1526a3 Mon Sep 17 00:00:00 2001 From: Akhil R Date: Wed, 27 May 2026 19:55:57 +0200 Subject: ACPICA: Add LVR to acrestyp.h Add a new field called lvr to struct acpi_resource_i2c_serialbus. Link: https://github.com/acpica/acpica/commit/e62e74baf7e0 Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2354060.iZASKD2KPV@rafael.j.wysocki --- include/acpi/acrestyp.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/acpi/acrestyp.h b/include/acpi/acrestyp.h index 842f932e2c2b..38a19b1d19ac 100644 --- a/include/acpi/acrestyp.h +++ b/include/acpi/acrestyp.h @@ -423,6 +423,7 @@ struct acpi_resource_i2c_serialbus { ACPI_RESOURCE_SERIAL_COMMON u8 access_mode; u16 slave_address; u32 connection_speed; + u8 lvr; }; /* Values for access_mode field above */ -- cgit v1.2.3 From 6ce2d03bb87cf6fbd31573d0dc92f8482f03ed39 Mon Sep 17 00:00:00 2001 From: Pawel Chmielewski Date: Wed, 27 May 2026 20:08:02 +0200 Subject: ACPICA: Update the copyright year to 2026 Update copyright notices in all ACPICA files. Link: https://github.com/acpica/acpica/commit/9def02549a9c Signed-off-by: Pawel Chmielewski Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/4379132.1IzOArtZ34@rafael.j.wysocki --- include/acpi/acbuffer.h | 2 +- include/acpi/acconfig.h | 2 +- include/acpi/acexcep.h | 2 +- include/acpi/acnames.h | 2 +- include/acpi/acoutput.h | 2 +- include/acpi/acpi.h | 2 +- include/acpi/acpiosxf.h | 2 +- include/acpi/acpixf.h | 2 +- include/acpi/acrestyp.h | 2 +- include/acpi/actbl.h | 2 +- include/acpi/actbl1.h | 2 +- include/acpi/actbl2.h | 2 +- include/acpi/actbl3.h | 2 +- include/acpi/actypes.h | 2 +- include/acpi/acuuid.h | 2 +- include/acpi/platform/acenv.h | 2 +- include/acpi/platform/acenvex.h | 2 +- include/acpi/platform/acgcc.h | 2 +- include/acpi/platform/acgccex.h | 2 +- include/acpi/platform/aclinux.h | 2 +- include/acpi/platform/aclinuxex.h | 2 +- include/acpi/platform/aczephyr.h | 2 +- 22 files changed, 22 insertions(+), 22 deletions(-) (limited to 'include') diff --git a/include/acpi/acbuffer.h b/include/acpi/acbuffer.h index cbc9aeabcd99..7823df1c3894 100644 --- a/include/acpi/acbuffer.h +++ b/include/acpi/acbuffer.h @@ -3,7 +3,7 @@ * * Name: acbuffer.h - Support for buffers returned by ACPI predefined names * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acconfig.h b/include/acpi/acconfig.h index 521d4bfa6ef0..6bce050f0421 100644 --- a/include/acpi/acconfig.h +++ b/include/acpi/acconfig.h @@ -3,7 +3,7 @@ * * Name: acconfig.h - Global configuration constants * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h index a2db36d18419..d7b22c56c131 100644 --- a/include/acpi/acexcep.h +++ b/include/acpi/acexcep.h @@ -3,7 +3,7 @@ * * Name: acexcep.h - Exception codes returned by the ACPI subsystem * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acnames.h b/include/acpi/acnames.h index cb6a4dcc4e8e..714d8f265f8a 100644 --- a/include/acpi/acnames.h +++ b/include/acpi/acnames.h @@ -3,7 +3,7 @@ * * Name: acnames.h - Global names and strings * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acoutput.h b/include/acpi/acoutput.h index 3584f33e352c..a8d846077727 100644 --- a/include/acpi/acoutput.h +++ b/include/acpi/acoutput.h @@ -3,7 +3,7 @@ * * Name: acoutput.h -- debug output * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acpi.h b/include/acpi/acpi.h index 92bf80937e5f..07e3d6e213c9 100644 --- a/include/acpi/acpi.h +++ b/include/acpi/acpi.h @@ -3,7 +3,7 @@ * * Name: acpi.h - Master public include file used to interface to ACPICA * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h index 65c5737b6286..f5bf17fc4e01 100644 --- a/include/acpi/acpiosxf.h +++ b/include/acpi/acpiosxf.h @@ -5,7 +5,7 @@ * interfaces must be implemented by OSL to interface the * ACPI components to the host operating system. * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h index 49d1749f30bb..7719597c05ef 100644 --- a/include/acpi/acpixf.h +++ b/include/acpi/acpixf.h @@ -3,7 +3,7 @@ * * Name: acpixf.h - External interfaces to the ACPI subsystem * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acrestyp.h b/include/acpi/acrestyp.h index 38a19b1d19ac..0e25ef65a323 100644 --- a/include/acpi/acrestyp.h +++ b/include/acpi/acrestyp.h @@ -3,7 +3,7 @@ * * Name: acrestyp.h - Defines, types, and structures for resource descriptors * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h index 8a67d4ea6e3f..606efcb527f3 100644 --- a/include/acpi/actbl.h +++ b/include/acpi/actbl.h @@ -3,7 +3,7 @@ * * Name: actbl.h - Basic ACPI Table Definitions * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/actbl1.h b/include/acpi/actbl1.h index f72e00517eb3..d824838cb7af 100644 --- a/include/acpi/actbl1.h +++ b/include/acpi/actbl1.h @@ -3,7 +3,7 @@ * * Name: actbl1.h - Additional ACPI table definitions * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/actbl2.h b/include/acpi/actbl2.h index 33b10fe3cf35..baef525367b5 100644 --- a/include/acpi/actbl2.h +++ b/include/acpi/actbl2.h @@ -3,7 +3,7 @@ * * Name: actbl2.h - ACPI Table Definitions * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/actbl3.h b/include/acpi/actbl3.h index 7ca456e88377..331ecbfdb6d9 100644 --- a/include/acpi/actbl3.h +++ b/include/acpi/actbl3.h @@ -3,7 +3,7 @@ * * Name: actbl3.h - ACPI Table Definitions * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h index 137e1e65cdf4..00c1eb11d59e 100644 --- a/include/acpi/actypes.h +++ b/include/acpi/actypes.h @@ -3,7 +3,7 @@ * * Name: actypes.h - Common data types for the entire ACPI subsystem * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/acuuid.h b/include/acpi/acuuid.h index ccc536f4bbb5..9ccf5bbaf80e 100644 --- a/include/acpi/acuuid.h +++ b/include/acpi/acuuid.h @@ -3,7 +3,7 @@ * * Name: acuuid.h - ACPI-related UUID/GUID definitions * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h index a11fa83955f8..1c66cfeeea35 100644 --- a/include/acpi/platform/acenv.h +++ b/include/acpi/platform/acenv.h @@ -3,7 +3,7 @@ * * Name: acenv.h - Host and compiler configuration * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/platform/acenvex.h b/include/acpi/platform/acenvex.h index 8ffc4e1c87cf..f7797ca6312d 100644 --- a/include/acpi/platform/acenvex.h +++ b/include/acpi/platform/acenvex.h @@ -3,7 +3,7 @@ * * Name: acenvex.h - Extra host and compiler configuration * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/platform/acgcc.h b/include/acpi/platform/acgcc.h index 8e4cf2f6b383..31c624568852 100644 --- a/include/acpi/platform/acgcc.h +++ b/include/acpi/platform/acgcc.h @@ -3,7 +3,7 @@ * * Name: acgcc.h - GCC specific defines, etc. * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/platform/acgccex.h b/include/acpi/platform/acgccex.h index 4a3c019a4d03..89cd8a66b16c 100644 --- a/include/acpi/platform/acgccex.h +++ b/include/acpi/platform/acgccex.h @@ -3,7 +3,7 @@ * * Name: acgccex.h - Extra GCC specific defines, etc. * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h index edbbc9061d1e..9b30bb9ed711 100644 --- a/include/acpi/platform/aclinux.h +++ b/include/acpi/platform/aclinux.h @@ -3,7 +3,7 @@ * * Name: aclinux.h - OS specific defines, etc. for Linux * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/platform/aclinuxex.h b/include/acpi/platform/aclinuxex.h index 73265650f46b..aeb74e2f9d4f 100644 --- a/include/acpi/platform/aclinuxex.h +++ b/include/acpi/platform/aclinuxex.h @@ -3,7 +3,7 @@ * * Name: aclinuxex.h - Extra OS specific defines, etc. for Linux * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ diff --git a/include/acpi/platform/aczephyr.h b/include/acpi/platform/aczephyr.h index 03d9a4a39c80..b698ec117064 100644 --- a/include/acpi/platform/aczephyr.h +++ b/include/acpi/platform/aczephyr.h @@ -3,7 +3,7 @@ * * Module Name: aczephyr.h - OS specific defines, etc. * - * Copyright (C) 2000 - 2025, Intel Corp. + * Copyright (C) 2000 - 2026, Intel Corp. * *****************************************************************************/ -- cgit v1.2.3 From 296eea4a364d59df5e4ca45c2ff26600cbef293b Mon Sep 17 00:00:00 2001 From: Saket Dumbre Date: Wed, 27 May 2026 20:08:44 +0200 Subject: ACPICA: Update version to 20260408 Update ACPI_CA_VERSION to match the 20260408 upstream release. Link: https://github.com/acpica/acpica/commit/232ff3f8ae1a Signed-off-by: Saket Dumbre Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/1881459.TLkxdtWsSY@rafael.j.wysocki --- include/acpi/acpixf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h index 7719597c05ef..349d07ae2d44 100644 --- a/include/acpi/acpixf.h +++ b/include/acpi/acpixf.h @@ -12,7 +12,7 @@ /* Current ACPICA subsystem version in YYYYMMDD format */ -#define ACPI_CA_VERSION 0x20251212 +#define ACPI_CA_VERSION 0x20260408 #include #include -- cgit v1.2.3 From 83eb00f31eb1b10735d48e469df72cc2b0e06f6d Mon Sep 17 00:00:00 2001 From: Dexuan Cui Date: Wed, 27 May 2026 12:21:01 -0700 Subject: hyperv: Clean up and fix the guest ID comment in hvgdk.h Change the "64 bit" to "64-bit", and the "Os" to "OS". Remove the obsolete paragraph since the guideline has been published in the Hypervisor Top Level Functional Specification for many years. The "OS Type" is 0x1 for Linux, not 0x100. No functional change. Fixes: 83ba0c4f3f31 ("Drivers: hv: Cleanup the guest ID computation") Signed-off-by: Dexuan Cui Reviewed-by: Hamza Mahfooz Signed-off-by: Wei Liu --- include/hyperv/hvgdk.h | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/hyperv/hvgdk.h b/include/hyperv/hvgdk.h index 384c3f3ff4a5..f538144280ca 100644 --- a/include/hyperv/hvgdk.h +++ b/include/hyperv/hvgdk.h @@ -10,18 +10,12 @@ /* * The guest OS needs to register the guest ID with the hypervisor. - * The guest ID is a 64 bit entity and the structure of this ID is + * The guest ID is a 64-bit entity and the structure of this ID is * specified in the Hyper-V TLFS specification. * - * While the current guideline does not specify how Linux guest ID(s) - * need to be generated, our plan is to publish the guidelines for - * Linux and other guest operating systems that currently are hosted - * on Hyper-V. The implementation here conforms to this yet - * unpublished guidelines. - * * Bit(s) * 63 - Indicates if the OS is Open Source or not; 1 is Open Source - * 62:56 - Os Type; Linux is 0x100 + * 62:56 - OS Type; Linux is 0x1 * 55:48 - Distro specific identification * 47:16 - Linux kernel version number * 15:0 - Distro specific identification -- cgit v1.2.3 From 840b740a35bf969734e0f2e44c21289fdd03079e Mon Sep 17 00:00:00 2001 From: Michael Kelley Date: Tue, 26 May 2026 07:13:04 -0700 Subject: mshv: Add conditional VMBus dependency When the VMBus driver is not part of the kernel (CONFIG_HYPERV_VMBUS=n), the MSHV root driver fails to link: ERROR: modpost: "hv_vmbus_exists" [drivers/hv/mshv_root.ko] undefined! Fix this while meeting these requirements: * It must be possible to include the MSHV root driver without the VMBus driver. In such case, the MSHV root driver can be built-in to the kernel image, or it can be built as a separate module. * If both the MSHV root driver and the VMBus driver are present, the MSHV root driver and VMBus driver can both be built-in, or they can both be separate modules. Or the MSHV root driver can be a module while the VMBus driver can be built-in, but the reverse is disallowed. Regardless of the build choices, the VMBus driver must be loaded before the MSHV driver in order for the SynIC to be managed properly (see comments in the MSHV SynIC code). The fix has two parts: * Add a Kconfig entry for MSHV_ROOT to depend on HYPERV_VMBUS if HYPERV_VMBUS is present. The entry disallows MSHV_ROOT being built-in when HYPERV_VMBUS is a module, but without requiring that HYPERV_VMBUS be built. * Add a stub implementation of hv_vmbus_exists() for when the VMBus driver is not present so that the MSHV root driver has no module dependency on VMBus. When the VMBus driver *is* present, the module dependency ensures that the VMBus driver loads first when both are built as modules. Existing code ensures that the VMBus driver loads first if it is built-in. The VMBus driver uses subsys_initcall(), which is initcall level 4. The MSHV root driver uses module_init(), which becomes device_init() when built-in, and device_init() is initcall level 6. Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/all/20260520074044.923728-1-arnd@kernel.org/ Signed-off-by: Michael Kelley Acked-by: Arnd Bergmann Reviewed-by: Jork Loeser Reviewed-by: Hardik Garg Signed-off-by: Wei Liu --- include/linux/hyperv.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h index 41a3d82f0722..734b7ef98f4d 100644 --- a/include/linux/hyperv.h +++ b/include/linux/hyperv.h @@ -1304,7 +1304,11 @@ static inline void *hv_get_drvdata(struct hv_device *dev) struct device *hv_get_vmbus_root_device(void); +#if IS_ENABLED(CONFIG_HYPERV_VMBUS) bool hv_vmbus_exists(void); +#else +static inline bool hv_vmbus_exists(void) { return false; } +#endif struct hv_ring_buffer_debug_info { u32 current_interrupt_mask; -- cgit v1.2.3 From c69eaa687667e529fcc0cce02394cca5a4db2249 Mon Sep 17 00:00:00 2001 From: Nathan Chancellor Date: Sun, 17 May 2026 13:05:18 -1000 Subject: compiler-clang.h: Remove __cleanup -Wunused-variable workaround Now that the minimum supported version of LLVM for building the kernel has been raised to 17.0.1, the redefinition of __cleanup with __maybe_unused added to it is unnecessary because the referenced LLVM change is present in all supported LLVM versions. Drop it. Link: https://patch.msgid.link/20260517-bump-minimum-supported-llvm-version-to-17-v2-15-b3b8cda46bdd@kernel.org Signed-off-by: Nathan Chancellor --- include/linux/compiler-clang.h | 9 --------- 1 file changed, 9 deletions(-) (limited to 'include') diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h index e1123dd28486..eadf48b7b5b1 100644 --- a/include/linux/compiler-clang.h +++ b/include/linux/compiler-clang.h @@ -5,15 +5,6 @@ /* Compiler specific definitions for Clang compiler */ -/* - * Clang prior to 17 is being silly and considers many __cleanup() variables - * as unused (because they are, their sole purpose is to go out of scope). - * - * https://github.com/llvm/llvm-project/commit/877210faa447f4cc7db87812f8ed80e398fedd61 - */ -#undef __cleanup -#define __cleanup(func) __maybe_unused __attribute__((__cleanup__(func))) - /* all clang versions usable with the kernel support KASAN ABI version 5 */ #define KASAN_ABI_VERSION 5 -- cgit v1.2.3 From c919893eabb437d18dee3dddba6bc508bf1b1edd Mon Sep 17 00:00:00 2001 From: Nathan Chancellor Date: Sun, 17 May 2026 13:05:19 -1000 Subject: compiler-clang.h: Drop explicit version number from "all" diagnostic macro This is more consistent with what commit 7efa84b5cdd6 ("compiler-gcc.h: Introduce __diag_GCC_all") did for GCC. Link: https://patch.msgid.link/20260517-bump-minimum-supported-llvm-version-to-17-v2-16-b3b8cda46bdd@kernel.org Signed-off-by: Nathan Chancellor --- include/linux/compiler-clang.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h index eadf48b7b5b1..a105e2e8016c 100644 --- a/include/linux/compiler-clang.h +++ b/include/linux/compiler-clang.h @@ -122,10 +122,10 @@ #define __diag_str(s) __diag_str1(s) #define __diag(s) _Pragma(__diag_str(clang diagnostic s)) -#define __diag_clang_13(s) __diag(s) +#define __diag_clang_all(s) __diag(s) #define __diag_ignore_all(option, comment) \ - __diag_clang(13, ignore, option) + __diag_clang(all, ignore, option) /* * clang has horrible behavior with "g" or "rm" constraints for asm -- cgit v1.2.3 From 507541c2a8eeb76c02bd2511958f73a8cfa3e1bc Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 26 May 2026 14:55:28 +0000 Subject: ipv6: guard against possible NULL deref in __in6_dev_stats_get() dev_get_by_index_rcu() could return NULL if the original physical device is unregistered. Found by Sashiko. Fixes: e1ae5c2ea478 ("vrf: Increment Icmp6InMsgs on the original netdev") Signed-off-by: Eric Dumazet Cc: Stephen Suryaputra Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260526145529.3587126-2-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/addrconf.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 9e96776945e5..539bbbe54b14 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -369,8 +369,11 @@ static inline struct inet6_dev *__in6_dev_get_rtnl_net(const struct net_device * static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device *dev, const struct sk_buff *skb) { - if (netif_is_l3_master(dev)) + if (netif_is_l3_master(dev)) { dev = dev_get_by_index_rcu(dev_net(dev), inet6_iif(skb)); + if (!dev) + return NULL; + } return __in6_dev_get(dev); } -- cgit v1.2.3 From 4c9ad387aa2d6785299722e54224d34764edaeb3 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Wed, 13 May 2026 16:53:54 +0200 Subject: iommu, debugobjects: avoid gcc-16.1 section mismatch warnings gcc-16 has gained some more advanced inter-procedual optimization techniques that enable it to inline the dummy_tlb_add_page() and dummy_tlb_flush() function pointers into a specialized version of __arm_v7s_unmap: WARNING: modpost: vmlinux: section mismatch in reference: __arm_v7s_unmap+0x2cc (section: .text) -> dummy_tlb_add_page (section: .init.text) ERROR: modpost: Section mismatches detected. >From what I can tell, the transformation is correct, as this is only called when __arm_v7s_unmap() is called from arm_v7s_do_selftests(), which is also __init. Since __arm_v7s_unmap() however is not __init, gcc cannot inline the inner function calls directly. In debug_objects_selftest(), the same thing happens. Both the caller and the leaf function are __init, but the IPA pulls it into a non-init one: WARNING: modpost: vmlinux: section mismatch in reference: lookup_object_or_alloc+0x7c (section: .text.lookup_object_or_alloc) -> is_static_object (section: .init.text) Marking the affected functions as not "__init" would reliably avoid this issue but is not a good solution because it removes an otherwise correct annotation. I tried marking the functions as 'noinline', but that ended up not covering all the affected configurations. With some more experimenting, I found that marking these functions as __attribute__((noipa)) is both logical and reliable. In order to keep the syntax readable, add a custom macro for this in include/linux/compiler_attributes.h next to other related macros and use it to annotate both files. Link: https://lore.kernel.org/all/abRB6g-48ZX6Yl2r@willie-the-truck/ Cc: Will Deacon Cc: Thomas Gleixner Cc: Andrew Morton Cc: Miguel Ojeda Cc: linux-kbuild@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Acked-by: Will Deacon Acked-by: Thomas Gleixner Acked-by: Miguel Ojeda Signed-off-by: Joerg Roedel --- include/linux/compiler_attributes.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include') diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h index c16d4199bf92..836a50f5917a 100644 --- a/include/linux/compiler_attributes.h +++ b/include/linux/compiler_attributes.h @@ -396,6 +396,17 @@ # define __disable_sanitizer_instrumentation #endif +/* + * Optional: not supported by clang + * + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Attributes.html#index-noipa + */ +#if __has_attribute(noipa) +# define __noipa __attribute__((noipa)) +#else +# define __noipa +#endif + /* * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-weak-function-attribute * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-weak-variable-attribute -- cgit v1.2.3 From 91561e1dc94b8a33857370ef3c5b5523c4461d5b Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Thu, 21 May 2026 13:34:20 -0700 Subject: PCI: Add pci_ats_required() for CXL.cache capable devices Controlled by IOMMU drivers, ATS can be enabled "on demand", when a given PASID on a device is attached to an I/O page table. This is working, even when a device has no translation on its RID (i.e., RID is IOMMU bypassed). However, certain PCIe devices require non-PASID ATS on their RID even when the RID is IOMMU bypassed. Call this "ATS always on" in IOMMU term. For example, CXL spec r4.0 notes in sec 3.2.5.13 Memory Type on CXL.cache: "To source requests on CXL.cache, devices need to get the Host Physical Address (HPA) from the Host by means of an ATS request on CXL.io." In other words, the CXL.cache capability requires ATS; otherwise, it can't access host physical memory. Introduce a new pci_ats_required() helper for the IOMMU driver to scan a PCI device and shift ATS policies between "on demand" and "always on". Add the support for CXL.cache devices first. Pre-CXL devices will be added in quirks.c file. Note that pci_ats_required() validates against pci_ats_supported(), so we ensure that untrusted devices (e.g. external ports) will not be always on. This maintains the existing ATS security policy regarding potential side- channel attacks via ATS. Cc: linux-cxl@vger.kernel.org Suggested-by: Vikram Sethi Suggested-by: Jason Gunthorpe Reviewed-by: Jonathan Cameron Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Tested-by: Nirmoy Das Acked-by: Nirmoy Das Reviewed-by: Dave Jiang Acked-by: Bjorn Helgaas Signed-off-by: Nicolin Chen Reviewed-by: Yi Liu Signed-off-by: Joerg Roedel --- include/linux/pci-ats.h | 3 +++ include/uapi/linux/pci_regs.h | 1 + 2 files changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/pci-ats.h b/include/linux/pci-ats.h index 75c6c86cf09d..f3723b686129 100644 --- a/include/linux/pci-ats.h +++ b/include/linux/pci-ats.h @@ -12,6 +12,7 @@ int pci_prepare_ats(struct pci_dev *dev, int ps); void pci_disable_ats(struct pci_dev *dev); int pci_ats_queue_depth(struct pci_dev *dev); int pci_ats_page_aligned(struct pci_dev *dev); +bool pci_ats_required(struct pci_dev *dev); #else /* CONFIG_PCI_ATS */ static inline bool pci_ats_supported(struct pci_dev *d) { return false; } @@ -24,6 +25,8 @@ static inline int pci_ats_queue_depth(struct pci_dev *d) { return -ENODEV; } static inline int pci_ats_page_aligned(struct pci_dev *dev) { return 0; } +static inline bool pci_ats_required(struct pci_dev *dev) +{ return false; } #endif /* CONFIG_PCI_ATS */ #ifdef CONFIG_PCI_PRI diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h index 14f634ab9350..6ac45be1008b 100644 --- a/include/uapi/linux/pci_regs.h +++ b/include/uapi/linux/pci_regs.h @@ -1349,6 +1349,7 @@ /* CXL r4.0, 8.1.3: PCIe DVSEC for CXL Device */ #define PCI_DVSEC_CXL_DEVICE 0 #define PCI_DVSEC_CXL_CAP 0xA +#define PCI_DVSEC_CXL_CACHE_CAPABLE _BITUL(0) #define PCI_DVSEC_CXL_MEM_CAPABLE _BITUL(2) #define PCI_DVSEC_CXL_HDM_COUNT __GENMASK(5, 4) #define PCI_DVSEC_CXL_CTRL 0xC -- cgit v1.2.3 From 2c5d2d3c3f70cde2565d7b279b544893a2035842 Mon Sep 17 00:00:00 2001 From: Michael Bommarito Date: Wed, 27 May 2026 07:46:04 -0400 Subject: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tb_xdp_handle_request() runs on system_wq and queues xd->state_work via queue_delayed_work() in three request handlers: PROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake), and LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues xd->properties_changed_work when local properties change. Concurrently, tb_xdomain_remove() calls stop_handshake() which does cancel_delayed_work_sync() on both delayed works. Later, tb_xdomain_unregister() calls device_unregister() which eventually frees the xdomain. Since commit 559c1e1e0134 ("thunderbolt: Run tb_xdp_handle_request() in system workqueue") moved the request handler off tb->wq, the handler and the remove path are no longer serialized. If queue_delayed_work() executes after cancel_delayed_work_sync() but before the xdomain is freed, the delayed work fires on a freed object. Add xd->removing that tb_xdomain_remove() sets under xd->lock before calling stop_handshake(). Each external queue site holds the same lock and checks removing before calling queue_delayed_work(). This provides the mutual exclusion needed: either the queue site acquires the lock first and queues work that the subsequent cancel will see, or the remove path acquires the lock first and the queue site observes removing == true and skips the queue. Fixes: 559c1e1e0134 ("thunderbolt: Run tb_xdp_handle_request() in system workqueue") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Signed-off-by: Mika Westerberg --- include/linux/thunderbolt.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index b5659f883517..feb1af175cfd 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -213,6 +213,8 @@ enum tb_link_width { * @link_width: Width of the downstream facing link * @link_usb4: Downstream link is USB4 * @is_unplugged: The XDomain is unplugged + * @removing: Set by tb_xdomain_remove() under @lock to prevent + * concurrent delayed work queueing * @needs_uuid: If the XDomain does not have @remote_uuid it will be * queried first * @service_ids: Used to generate IDs for the services @@ -262,6 +264,7 @@ struct tb_xdomain { enum tb_link_width link_width; bool link_usb4; bool is_unplugged; + bool removing; bool needs_uuid; struct ida service_ids; struct ida in_hopids; -- cgit v1.2.3 From f45c5c4adb27540d43302155e2fbaeca6c3c6d03 Mon Sep 17 00:00:00 2001 From: Marco Elver Date: Fri, 15 May 2026 14:43:31 +0200 Subject: compiler-context-analysis: Bump required Clang version to 23 Clang 23 introduces several major improvements: 1. Support for multiple arguments in the `guarded_by` and `pt_guarded_by` attributes [1]. This allows defining variables protected by multiple context locks, where read access requires holding at least one lock (shared or exclusive), and write access requires holding all of them exclusively. 2. Function pointer support [2]. We can now add attributes to function pointers just like we do on normal functions. 3. A fix to use arrays of locks [3]. Each index is now correctly treated as a separate lock instance. 4. A fix for implicit member access in attributes [4]. This allows to use __guarded_by(&foo->lock) correctly. Overall that makes it worthwhile bumping the compiler version instead of trying to make both Clang 22 and later work while supporting these new features. Signed-off-by: Marco Elver Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Nathan Chancellor Reviewed-by: Bart Van Assche Link: https://github.com/llvm/llvm-project/pull/186838 [1] Link: https://github.com/llvm/llvm-project/pull/191187 [2] Link: https://github.com/llvm/llvm-project/pull/148551 [3] Link: https://github.com/llvm/llvm-project/pull/194457 [4] Link: https://patch.msgid.link/20260515124426.2227783-1-elver@google.com --- include/linux/compiler-context-analysis.h | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/compiler-context-analysis.h b/include/linux/compiler-context-analysis.h index a9317571e6af..8302ebc2ea8c 100644 --- a/include/linux/compiler-context-analysis.h +++ b/include/linux/compiler-context-analysis.h @@ -39,12 +39,14 @@ # define __assumes_shared_ctx_lock(...) __attribute__((assert_shared_capability(__VA_ARGS__))) /** - * __guarded_by - struct member and globals attribute, declares variable - * only accessible within active context + * __guarded_by() - struct member and globals attribute, declares variable + * only accessible within active context + * @...: context lock instance pointer(s) * * Declares that the struct member or global variable is only accessible within - * the context entered by the given context lock. Read operations on the data - * require shared access, while write operations require exclusive access. + * the context entered by the given context lock(s). Read operations on the data + * require shared access to at least one of the context locks, while write + * operations require exclusive access to all listed context locks. * * .. code-block:: c * @@ -52,17 +54,24 @@ * spinlock_t lock; * long counter __guarded_by(&lock); * }; + * + * struct some_state { + * spinlock_t lock1, lock2; + * long counter __guarded_by(&lock1, &lock2); + * }; */ # define __guarded_by(...) __attribute__((guarded_by(__VA_ARGS__))) /** - * __pt_guarded_by - struct member and globals attribute, declares pointed-to - * data only accessible within active context + * __pt_guarded_by() - struct member and globals attribute, declares pointed-to + * data only accessible within active context + * @...: context lock instance pointer(s) * * Declares that the data pointed to by the struct member pointer or global * pointer is only accessible within the context entered by the given context - * lock. Read operations on the data require shared access, while write - * operations require exclusive access. + * lock(s). Read operations on the data require shared access to at least one + * of the context locks, while write operations require exclusive access to all + * listed context locks. * * .. code-block:: c * @@ -70,6 +79,11 @@ * spinlock_t lock; * long *counter __pt_guarded_by(&lock); * }; + * + * struct some_state { + * spinlock_t lock1, lock2; + * long *counter __pt_guarded_by(&lock1, &lock2); + * }; */ # define __pt_guarded_by(...) __attribute__((pt_guarded_by(__VA_ARGS__))) -- cgit v1.2.3 From 88331c4ec23a28c1006ec532fa64763d4c695e90 Mon Sep 17 00:00:00 2001 From: Heiko Carstens Date: Tue, 19 May 2026 13:03:15 +0200 Subject: seqlock: Allow UBSAN_ALIGNMENT to fail optimizing With gcc-15 and gcc-16 with UBSAN_ALIGNMENT enabled the compiler fails to inline and optimize __scoped_seqlock_bug() away on s390: s390x-16.1.0-ld: kernel/sched/build_policy.o: in function `__scoped_seqlock_next': /.../seqlock.h:1286:(.text+0x22030): undefined reference to `__scoped_seqlock_bug' Fix this by adding UBSAN_ALIGNMENT to the list of config options where a not inlined empty __scoped_seqlock_bug() is allowed. Closes: https://lore.kernel.org/r/20260515092057.810542-1-arnd@kernel.org/ Reported-by: Arnd Bergmann Signed-off-by: Heiko Carstens Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260519110315.1385307-1-hca@linux.ibm.com --- include/linux/seqlock.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h index 5a40252b8334..f865491c4f2c 100644 --- a/include/linux/seqlock.h +++ b/include/linux/seqlock.h @@ -1259,14 +1259,15 @@ static __always_inline void __scoped_seqlock_cleanup(struct ss_tmp *sst) extern void __scoped_seqlock_invalid_target(void); -#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || defined(CONFIG_KASAN) +#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || \ + defined(CONFIG_KASAN) || defined(CONFIG_UBSAN_ALIGNMENT) /* * For some reason some GCC-8 architectures (nios2, alpha) have trouble * determining that the ss_done state is impossible in __scoped_seqlock_next() * below. * - * Similarly KASAN is known to confuse compilers enough to break this. But we - * don't care about code quality for KASAN builds anyway. + * Similarly KASAN and UBSAN_ALIGNMENT are known to confuse compilers enough + * to break this. But we don't care about code quality for such builds anyway. */ static inline void __scoped_seqlock_bug(void) { } #else -- cgit v1.2.3 From 98b34f3e8c3492cfc89ff943c9d92b4d52863d1d Mon Sep 17 00:00:00 2001 From: Jamal Hadi Salim Date: Mon, 25 May 2026 08:25:48 -0400 Subject: net: Introduce skb tc depth field to track packet loops Add a 2-bit per-skb tc depth field to track packet loops across the stack. The previous per-CPU loop counters like MIRRED_NEST_LIMIT assume a single call stack and lose state in two cases: 1) When a packet is queued and reprocessed later (e.g., egress->ingress via backlog), the per-cpu state is gone by the time it is dequeued. 2) With XPS/RPS a packet may arrive on one CPU and be processed on another. A per-skb field solves both by travelling with the packet itself. The field fits in existing padding, using 2 bits that were previously a hole: pahole before(-) and after (+) diff looks like: __u8 slow_gro:1; /* 132: 3 1 */ __u8 csum_not_inet:1; /* 132: 4 1 */ __u8 unreadable:1; /* 132: 5 1 */ + __u8 tc_depth:2; /* 132: 6 1 */ - /* XXX 2 bits hole, try to pack */ /* XXX 1 byte hole, try to pack */ __u16 tc_index; /* 134 2 */ There used to be a ttl field which was removed as part of tc_verd in commit aec745e2c520 ("net-tc: remove unused tc_verd fields"). It was already unused by that time, due to remove earlier in commit c19ae86a510c ("tc: remove unused redirect ttl"). The first user of this field is netem, which increments tc_depth on duplicated packets before re-enqueueing them at the root qdisc. On re-entry, netem skips duplication for any skb with tc_depth already set, bounding recursion to a single level regardless of tree topology. The other user is mirred which increments it on each pass and limits to depth to MIRRED_DEFER_LIMIT (3). The new field was called ttl in earlier versions of this patch but renamed to tc_depth to avoid confusion with IP ttl. Note (looking at you Sashiko! Dont ignore me and continue bringing this up): 1. Since both mirred and netem utilize the same 2-bit tc_depth field it is possible when netem and mirred are used together that netem qdisc to skip the duplication step. This is a known trade-off, as a 2-bit field cannot independently track both features' recursion depths and it is not considered sane to have a setup that addresses both features on at the same time. 2. skb_scrub_packet does not clear tc_depth. This means a packet's loop history is preserved even across namespaces. While this might be restrictive for some topologies, it is also design intent to provide robustness against loops across namespaces. Reviewed-by: Stephen Hemminger Signed-off-by: Jamal Hadi Salim Link: https://patch.msgid.link/20260525122556.973584-2-jhs@mojatatu.com Signed-off-by: Paolo Abeni --- include/linux/skbuff.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 2bcf78a4de7b..3f06254ab1b7 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -821,6 +821,7 @@ enum skb_tstamp_type { * @_sk_redir: socket redirection information for skmsg * @_nfct: Associated connection, if any (with nfctinfo bits) * @skb_iif: ifindex of device we arrived on + * @tc_depth: counter for packet duplication * @tc_index: Traffic control index * @hash: the packet hash * @queue_mapping: Queue mapping for multiqueue devices @@ -1030,6 +1031,7 @@ struct sk_buff { __u8 csum_not_inet:1; #endif __u8 unreadable:1; + __u8 tc_depth:2; #if defined(CONFIG_NET_SCHED) || defined(CONFIG_NET_XGRESS) __u16 tc_index; /* traffic control index */ #endif -- cgit v1.2.3 From ec4489c43efe434a132f27ff9298345de1cfacd8 Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Thu, 28 May 2026 00:48:01 +0000 Subject: ASoC: soc-card: add snd_soc_card_set_topology_name() Some drivers want to use topology name, but currently each drivers are setting it by own method. This patch adds new snd_soc_card_set_topology_name() and do it by same method. Almost all driver doesn't set topology name, let's remove fixed name array, and use devm_kasprintf() instead. Signed-off-by: Kuninori Morimoto Reviewed-by: Peter Ujfalusi Link: https://patch.msgid.link/878q942wce.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/soc-card.h | 2 ++ include/sound/soc.h | 3 +-- 2 files changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/sound/soc-card.h b/include/sound/soc-card.h index ecc02e955279..1f1e7d45f553 100644 --- a/include/sound/soc-card.h +++ b/include/sound/soc-card.h @@ -47,6 +47,8 @@ int snd_soc_card_late_probe(struct snd_soc_card *card); void snd_soc_card_fixup_controls(struct snd_soc_card *card); int snd_soc_card_remove(struct snd_soc_card *card); +void snd_soc_card_set_topology_name(struct snd_soc_card *card, const char *preifx); + int snd_soc_card_set_bias_level(struct snd_soc_card *card, struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level); diff --git a/include/sound/soc.h b/include/sound/soc.h index 77a7539ef37f..ed8921835069 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -990,7 +990,7 @@ struct snd_soc_card { bool pci_subsystem_set; #endif /* CONFIG_PCI */ - char topology_shortname[32]; + char *topology_shortname; struct device *dev; struct snd_card *snd_card; @@ -1087,7 +1087,6 @@ struct snd_soc_card { #endif /* bit field */ unsigned int instantiated:1; - unsigned int topology_shortname_created:1; unsigned int fully_routed:1; unsigned int probed:1; unsigned int component_chaining:1; -- cgit v1.2.3 From 20040b2a3cb992f84d3db4c086b909eb9b906b31 Mon Sep 17 00:00:00 2001 From: Ivan Vecera Date: Tue, 26 May 2026 09:45:23 +0200 Subject: dpll: export __dpll_device_change_ntf() for use under dpll_lock Export __dpll_device_change_ntf() so that drivers can send device change notifications from within device callbacks, which are already called under dpll_lock. Using dpll_device_change_ntf() in that context would deadlock. Add lockdep_assert_held() to catch misuse without the lock held. Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20260526074525.1451008-2-ivecera@redhat.com Signed-off-by: Paolo Abeni --- include/linux/dpll.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/dpll.h b/include/linux/dpll.h index f8037f1ab20b..2dbe8567eafc 100644 --- a/include/linux/dpll.h +++ b/include/linux/dpll.h @@ -284,6 +284,7 @@ void dpll_pin_on_pin_unregister(struct dpll_pin *parent, struct dpll_pin *pin, int dpll_pin_ref_sync_pair_add(struct dpll_pin *pin, struct dpll_pin *ref_sync_pin); +int __dpll_device_change_ntf(struct dpll_device *dpll); int dpll_device_change_ntf(struct dpll_device *dpll); int __dpll_pin_change_ntf(struct dpll_pin *pin); -- cgit v1.2.3 From 175db11786bde9061db526bf1ac5107d915f5163 Mon Sep 17 00:00:00 2001 From: Nathan Chancellor Date: Sat, 16 May 2026 04:34:14 +0900 Subject: Disable -Wattribute-alias for clang-23 and newer Clang recently added support for -Wattribute-alias [1], which results in the same warnings that necessitated commit bee20031772a ("disable -Wattribute-alias warning for SYSCALL_DEFINEx()") for GCC. kernel/time/itimer.c:325:1: error: alias and aliasee have different types 'long (unsigned int)' and 'long (typeof (__builtin_choose_expr((__builtin_types_compatible_p(typeof ((unsigned int)0), typeof (0LL)) || __builtin_types_compatible_p(typeof ((unsigned int)0), typeof (0ULL))), 0LL, 0L)))' (aka 'long (long)') [-Werror,-Wattribute-alias] 325 | SYSCALL_DEFINE1(alarm, unsigned int, seconds) | ^ include/linux/syscalls.h:225:36: note: expanded from macro 'SYSCALL_DEFINE1' 225 | #define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__) | ^ include/linux/syscalls.h:236:2: note: expanded from macro 'SYSCALL_DEFINEx' 236 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^ include/linux/syscalls.h:251:18: note: expanded from macro '__SYSCALL_DEFINEx' 251 | __attribute__((alias(__stringify(__se_sys##name)))); \ | ^ kernel/time/itimer.c:325:1: note: aliasee is declared here include/linux/syscalls.h:225:36: note: expanded from macro 'SYSCALL_DEFINE1' 225 | #define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__) | ^ include/linux/syscalls.h:236:2: note: expanded from macro 'SYSCALL_DEFINEx' 236 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^ include/linux/syscalls.h:255:18: note: expanded from macro '__SYSCALL_DEFINEx' 255 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ | ^ :16:1: note: expanded from here 16 | __se_sys_alarm | ^ Disable the warnings in the same way for clang-23 and newer. Disable the warning about unknown warning options to avoid breaking the build for versions of clang-23 that do not have -Wattribute-alias, such as ones deployed by vendors like Android or CI systems or when bisecting LLVM between llvmorg-23-init and release/23.x. Cc: stable@vger.kernel.org Closes: https://github.com/ClangBuiltLinux/linux/issues/2163 Link: https://github.com/llvm/llvm-project/commit/40da6920a0d71d49dfa2392b09153600b0759f5e [1] Link: https://patch.msgid.link/20260515-syscall-disable-attribute-alias-for-clang-v1-1-9a9d95d41df6@kernel.org Signed-off-by: Nathan Chancellor --- include/linux/compat.h | 4 ++++ include/linux/compiler-clang.h | 6 ++++++ include/linux/compiler_types.h | 4 ++++ include/linux/syscalls.h | 4 ++++ 4 files changed, 18 insertions(+) (limited to 'include') diff --git a/include/linux/compat.h b/include/linux/compat.h index 56cebaff0c91..8da0a15c95f4 100644 --- a/include/linux/compat.h +++ b/include/linux/compat.h @@ -72,6 +72,10 @@ __diag_push(); \ __diag_ignore(GCC, 8, "-Wattribute-alias", \ "Type aliasing is used to sanitize syscall arguments");\ + __diag_ignore(clang, 23, "-Wunknown-warning-option", \ + "Avoid breaking versions without -Wattribute-alias"); \ + __diag_ignore(clang, 23, "-Wattribute-alias", \ + "Type aliasing is used to sanitize syscall arguments"); \ asmlinkage long compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ __attribute__((alias(__stringify(__se_compat_sys##name)))); \ ALLOW_ERROR_INJECTION(compat_sys##name, ERRNO); \ diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h index e1123dd28486..527e4e136020 100644 --- a/include/linux/compiler-clang.h +++ b/include/linux/compiler-clang.h @@ -131,6 +131,12 @@ #define __diag_str(s) __diag_str1(s) #define __diag(s) _Pragma(__diag_str(clang diagnostic s)) +#if CONFIG_CLANG_VERSION >= 230000 +#define __diag_clang_23(s) __diag(s) +#else +#define __diag_clang_23(s) +#endif + #define __diag_clang_13(s) __diag(s) #define __diag_ignore_all(option, comment) \ diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h index e8fd77593b68..369966598a2c 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -711,6 +711,10 @@ struct ftrace_likely_data { #define __diag_GCC(version, severity, string) #endif +#ifndef __diag_clang +#define __diag_clang(version, severity, string) +#endif + #define __diag_push() __diag(push) #define __diag_pop() __diag(pop) diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index f5639d5ac331..4fb7291f54b6 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -247,6 +247,10 @@ static inline int is_syscall_trace_event(struct trace_event_call *tp_event) __diag_push(); \ __diag_ignore(GCC, 8, "-Wattribute-alias", \ "Type aliasing is used to sanitize syscall arguments");\ + __diag_ignore(clang, 23, "-Wunknown-warning-option", \ + "Avoid breaking versions without -Wattribute-alias");\ + __diag_ignore(clang, 23, "-Wattribute-alias", \ + "Type aliasing is used to sanitize syscall arguments");\ asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ __attribute__((alias(__stringify(__se_sys##name)))); \ ALLOW_ERROR_INJECTION(sys##name, ERRNO); \ -- cgit v1.2.3 From 353c85082a82fa6d78cbb3821749d5982ffed9f4 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Wed, 27 May 2026 17:06:46 +0200 Subject: block: mark biovec_init_pool static Signed-off-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche Link: https://patch.msgid.link/20260527150646.2349405-1-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/bio.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/bio.h b/include/linux/bio.h index 7597ae4dc52b..e60d2f5bd3dc 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -347,7 +347,6 @@ enum { }; extern int bioset_init(struct bio_set *, unsigned int, unsigned int, int flags); extern void bioset_exit(struct bio_set *); -extern int biovec_init_pool(mempool_t *pool, int pool_entries); struct bio *bio_alloc_bioset(struct block_device *bdev, unsigned short nr_vecs, blk_opf_t opf, gfp_t gfp, struct bio_set *bs); -- cgit v1.2.3 From f6fe52a7b18675d76d7f7dae0c16f412a4e33f9a Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Wed, 27 May 2026 17:10:22 +0200 Subject: bvec: make the bvec_iter helpers inline functions The macros are impossible to follow due to the lack of visual type information and all the braces. Replace them with inline helpers to improve on that. Because the calling conventions are a bit problematic with a lot of passing structures by value, all the helpers are marked as __always_inline so that they are force inlined. Signed-off-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Caleb Sander Mateos Reviewed-by: Ming Lei Reviewed-by: Chaitanya Kulkarni Reviewed-by: Keith Busch Link: https://patch.msgid.link/20260527151043.2349900-4-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/bvec.h | 101 ++++++++++++++++++++++++++++++++------------------- 1 file changed, 64 insertions(+), 37 deletions(-) (limited to 'include') diff --git a/include/linux/bvec.h b/include/linux/bvec.h index d36dd476feda..f4c7ec282ac9 100644 --- a/include/linux/bvec.h +++ b/include/linux/bvec.h @@ -104,51 +104,78 @@ struct bvec_iter_all { unsigned done; }; -/* - * various member access, note that bio_data should of course not be used - * on highmem page vectors - */ -#define __bvec_iter_bvec(bvec, iter) (&(bvec)[(iter).bi_idx]) +static __always_inline const struct bio_vec * +__bvec_iter_bvec(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return bvecs + iter.bi_idx; +} /* multi-page (mp_bvec) helpers */ -#define mp_bvec_iter_page(bvec, iter) \ - (__bvec_iter_bvec((bvec), (iter))->bv_page) +static __always_inline struct page * +mp_bvec_iter_page(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return __bvec_iter_bvec(bvecs, iter)->bv_page; +} -#define mp_bvec_iter_len(bvec, iter) \ - min((iter).bi_size, \ - __bvec_iter_bvec((bvec), (iter))->bv_len - (iter).bi_bvec_done) +static __always_inline unsigned int +mp_bvec_iter_len(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return min(__bvec_iter_bvec(bvecs, iter)->bv_len - iter.bi_bvec_done, + iter.bi_size); +} -#define mp_bvec_iter_offset(bvec, iter) \ - (__bvec_iter_bvec((bvec), (iter))->bv_offset + (iter).bi_bvec_done) +static __always_inline unsigned int +mp_bvec_iter_offset(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return __bvec_iter_bvec(bvecs, iter)->bv_offset + iter.bi_bvec_done; +} -#define mp_bvec_iter_page_idx(bvec, iter) \ - (mp_bvec_iter_offset((bvec), (iter)) / PAGE_SIZE) +static __always_inline unsigned int +mp_bvec_iter_page_idx(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return mp_bvec_iter_offset(bvecs, iter) / PAGE_SIZE; +} -#define mp_bvec_iter_bvec(bvec, iter) \ -((struct bio_vec) { \ - .bv_page = mp_bvec_iter_page((bvec), (iter)), \ - .bv_len = mp_bvec_iter_len((bvec), (iter)), \ - .bv_offset = mp_bvec_iter_offset((bvec), (iter)), \ -}) +static __always_inline struct bio_vec +mp_bvec_iter_bvec(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return (struct bio_vec) { + .bv_page = mp_bvec_iter_page(bvecs, iter), + .bv_len = mp_bvec_iter_len(bvecs, iter), + .bv_offset = mp_bvec_iter_offset(bvecs, iter), + }; +} /* For building single-page bvec in flight */ - #define bvec_iter_offset(bvec, iter) \ - (mp_bvec_iter_offset((bvec), (iter)) % PAGE_SIZE) - -#define bvec_iter_len(bvec, iter) \ - min_t(unsigned, mp_bvec_iter_len((bvec), (iter)), \ - PAGE_SIZE - bvec_iter_offset((bvec), (iter))) - -#define bvec_iter_page(bvec, iter) \ - (mp_bvec_iter_page((bvec), (iter)) + \ - mp_bvec_iter_page_idx((bvec), (iter))) - -#define bvec_iter_bvec(bvec, iter) \ -((struct bio_vec) { \ - .bv_page = bvec_iter_page((bvec), (iter)), \ - .bv_len = bvec_iter_len((bvec), (iter)), \ - .bv_offset = bvec_iter_offset((bvec), (iter)), \ -}) +static __always_inline unsigned int +bvec_iter_offset(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return mp_bvec_iter_offset(bvecs, iter) % PAGE_SIZE; +} + +static __always_inline unsigned int +bvec_iter_len(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return min(mp_bvec_iter_len(bvecs, iter), + PAGE_SIZE - bvec_iter_offset(bvecs, iter)); +} + +static __always_inline struct page * +bvec_iter_page(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return mp_bvec_iter_page(bvecs, iter) + + mp_bvec_iter_page_idx(bvecs, iter); +} + +static __always_inline struct bio_vec +bvec_iter_bvec(const struct bio_vec *bvecs, const struct bvec_iter iter) +{ + return (struct bio_vec) { + .bv_page = bvec_iter_page(bvecs, iter), + .bv_len = bvec_iter_len(bvecs, iter), + .bv_offset = bvec_iter_offset(bvecs, iter), + }; +} static inline bool bvec_iter_advance(const struct bio_vec *bv, struct bvec_iter *iter, unsigned bytes) -- cgit v1.2.3 From a7d8eaee7fafe2e2c58aef9579bdef778c144029 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Thu, 28 May 2026 10:46:13 +0200 Subject: block: add a bio_endio_status helper Add a helper that sets bi_status and call bio_endio() as that is a very common pattern and convert the core block code over to it. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Md Haris Iqbal Reviewed-by: Damien Le Moal Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20260528084632.2505277-1-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/bio.h | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/bio.h b/include/linux/bio.h index e60d2f5bd3dc..97f993d4d914 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -370,16 +370,27 @@ void submit_bio(struct bio *bio); extern void bio_endio(struct bio *); -static inline void bio_io_error(struct bio *bio) +/** + * bio_endio_status - end I/O on a bio with a specific status + * @bio: bio + * @status: status to set + * + * Set @bio->bi_status to @status and call bio_endio(). + **/ +static inline void bio_endio_status(struct bio *bio, blk_status_t status) { - bio->bi_status = BLK_STS_IOERR; + bio->bi_status = status; bio_endio(bio); } +static inline void bio_io_error(struct bio *bio) +{ + bio_endio_status(bio, BLK_STS_IOERR); +} + static inline void bio_wouldblock_error(struct bio *bio) { - bio->bi_status = BLK_STS_AGAIN; - bio_endio(bio); + bio_endio_status(bio, BLK_STS_AGAIN); } /* -- cgit v1.2.3 From 697d6de37650f9c362e02efcf49df2ec774796d6 Mon Sep 17 00:00:00 2001 From: Artur Kowalski Date: Tue, 19 May 2026 12:16:43 +0200 Subject: gpu: host1x: trace: fix string fields in host1x traces Use __assign_str and __get_str as required by tracing subsystem. Fixes string fields being rejected by the verifier and unreadable from userspace. Tested on v6.18.21. Signed-off-by: Artur Kowalski Acked-by: Steven Rostedt Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260519-host1x-tracing-v1-1-55afb8cbd186@gmail.com --- include/trace/events/host1x.h | 50 ++++++++++++++++++++++--------------------- 1 file changed, 26 insertions(+), 24 deletions(-) (limited to 'include') diff --git a/include/trace/events/host1x.h b/include/trace/events/host1x.h index 1ba84b738e46..1b6aeb7b177b 100644 --- a/include/trace/events/host1x.h +++ b/include/trace/events/host1x.h @@ -21,9 +21,11 @@ struct host1x_bo; DECLARE_EVENT_CLASS(host1x, TP_PROTO(const char *name), TP_ARGS(name), - TP_STRUCT__entry(__field(const char *, name)), - TP_fast_assign(__entry->name = name;), - TP_printk("name=%s", __entry->name) + TP_STRUCT__entry(__string(name, name)), + TP_fast_assign( + __assign_str(name); + ), + TP_printk("name=%s", __get_str(name)) ); DEFINE_EVENT(host1x, host1x_channel_open, @@ -52,19 +54,19 @@ TRACE_EVENT(host1x_cdma_push, TP_ARGS(name, op1, op2), TP_STRUCT__entry( - __field(const char *, name) + __string(name, name) __field(u32, op1) __field(u32, op2) ), TP_fast_assign( - __entry->name = name; + __assign_str(name); __entry->op1 = op1; __entry->op2 = op2; ), TP_printk("name=%s, op1=%08x, op2=%08x", - __entry->name, __entry->op1, __entry->op2) + __get_str(name), __entry->op1, __entry->op2) ); TRACE_EVENT(host1x_cdma_push_wide, @@ -73,7 +75,7 @@ TRACE_EVENT(host1x_cdma_push_wide, TP_ARGS(name, op1, op2, op3, op4), TP_STRUCT__entry( - __field(const char *, name) + __string(name, name) __field(u32, op1) __field(u32, op2) __field(u32, op3) @@ -81,7 +83,7 @@ TRACE_EVENT(host1x_cdma_push_wide, ), TP_fast_assign( - __entry->name = name; + __assign_str(name); __entry->op1 = op1; __entry->op2 = op2; __entry->op3 = op3; @@ -89,7 +91,7 @@ TRACE_EVENT(host1x_cdma_push_wide, ), TP_printk("name=%s, op1=%08x, op2=%08x, op3=%08x op4=%08x", - __entry->name, __entry->op1, __entry->op2, __entry->op3, + __get_str(name), __entry->op1, __entry->op2, __entry->op3, __entry->op4) ); @@ -100,7 +102,7 @@ TRACE_EVENT(host1x_cdma_push_gather, TP_ARGS(name, bo, words, offset, cmdbuf), TP_STRUCT__entry( - __field(const char *, name) + __string(name, name) __field(struct host1x_bo *, bo) __field(u32, words) __field(u32, offset) @@ -114,14 +116,14 @@ TRACE_EVENT(host1x_cdma_push_gather, words * sizeof(u32)); } __entry->cmdbuf = cmdbuf; - __entry->name = name; + __assign_str(name); __entry->bo = bo; __entry->words = words; __entry->offset = offset; ), TP_printk("name=%s, bo=%p, words=%u, offset=%d, contents=[%s]", - __entry->name, __entry->bo, + __get_str(name), __entry->bo, __entry->words, __entry->offset, __print_hex(__get_dynamic_array(cmdbuf), __entry->cmdbuf ? __entry->words * 4 : 0)) @@ -134,7 +136,7 @@ TRACE_EVENT(host1x_channel_submit, TP_ARGS(name, cmdbufs, relocs, syncpt_id, syncpt_incrs), TP_STRUCT__entry( - __field(const char *, name) + __string(name, name) __field(u32, cmdbufs) __field(u32, relocs) __field(u32, syncpt_id) @@ -142,7 +144,7 @@ TRACE_EVENT(host1x_channel_submit, ), TP_fast_assign( - __entry->name = name; + __assign_str(name); __entry->cmdbufs = cmdbufs; __entry->relocs = relocs; __entry->syncpt_id = syncpt_id; @@ -151,7 +153,7 @@ TRACE_EVENT(host1x_channel_submit, TP_printk("name=%s, cmdbufs=%u, relocs=%u, syncpt_id=%u, " "syncpt_incrs=%u", - __entry->name, __entry->cmdbufs, __entry->relocs, + __get_str(name), __entry->cmdbufs, __entry->relocs, __entry->syncpt_id, __entry->syncpt_incrs) ); @@ -161,19 +163,19 @@ TRACE_EVENT(host1x_channel_submitted, TP_ARGS(name, syncpt_base, syncpt_max), TP_STRUCT__entry( - __field(const char *, name) + __string(name, name) __field(u32, syncpt_base) __field(u32, syncpt_max) ), TP_fast_assign( - __entry->name = name; + __assign_str(name); __entry->syncpt_base = syncpt_base; __entry->syncpt_max = syncpt_max; ), TP_printk("name=%s, syncpt_base=%d, syncpt_max=%d", - __entry->name, __entry->syncpt_base, __entry->syncpt_max) + __get_str(name), __entry->syncpt_base, __entry->syncpt_max) ); TRACE_EVENT(host1x_channel_submit_complete, @@ -182,19 +184,19 @@ TRACE_EVENT(host1x_channel_submit_complete, TP_ARGS(name, count, thresh), TP_STRUCT__entry( - __field(const char *, name) + __string(name, name) __field(int, count) __field(u32, thresh) ), TP_fast_assign( - __entry->name = name; + __assign_str(name); __entry->count = count; __entry->thresh = thresh; ), TP_printk("name=%s, count=%d, thresh=%d", - __entry->name, __entry->count, __entry->thresh) + __get_str(name), __entry->count, __entry->thresh) ); TRACE_EVENT(host1x_wait_cdma, @@ -203,16 +205,16 @@ TRACE_EVENT(host1x_wait_cdma, TP_ARGS(name, eventid), TP_STRUCT__entry( - __field(const char *, name) + __string(name, name) __field(u32, eventid) ), TP_fast_assign( - __entry->name = name; + __assign_str(name); __entry->eventid = eventid; ), - TP_printk("name=%s, event=%d", __entry->name, __entry->eventid) + TP_printk("name=%s, event=%d", __get_str(name), __entry->eventid) ); TRACE_EVENT(host1x_syncpt_load_min, -- cgit v1.2.3 From 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc Mon Sep 17 00:00:00 2001 From: Mikko Perttunen Date: Fri, 15 May 2026 11:34:51 +0900 Subject: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1x_bo_pin() with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to the underlying host1x_bo (taken in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached, the bo itself could not be freed. However, the only way to remove the cached mapping was through the free path of the buffer object. This meant that if a bo got cached, it could never get freed again. Resolve the circularity by holding a weak reference to the bo from the cache side. This is done by having the .pin callbacks not bump the bo's refcount -- instead the common Host1x bo code does so, except for the cache reference. Also move the remove-cache-mapping-on-free code into a common function inside Host1x code. This is only called from the TegraDRM GEM buffers since those are the only ones that can be cached at the moment. Reported-by: Aaron Kling Fixes: 1f39b1dfa53c ("drm/tegra: Implement buffer object cache") Signed-off-by: Mikko Perttunen Tested-by: Aaron Kling Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260515-host1x-bocache-leak-v1-1-a0375f68aeab@nvidia.com --- include/linux/host1x.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/host1x.h b/include/linux/host1x.h index 1f5f55917d1c..a7a675783136 100644 --- a/include/linux/host1x.h +++ b/include/linux/host1x.h @@ -143,6 +143,12 @@ static inline struct host1x_bo_mapping *to_host1x_bo_mapping(struct kref *ref) return container_of(ref, struct host1x_bo_mapping, ref); } +/** + * struct host1x_bo_ops - operations implemented by a host1x_bo provider + * + * @pin: create a DMA mapping. Implementation must not touch the bo's refcount. + * @unpin: destroy a DMA mapping. Implementation must not touch the bo's refcount. + */ struct host1x_bo_ops { struct host1x_bo *(*get)(struct host1x_bo *bo); void (*put)(struct host1x_bo *bo); @@ -181,6 +187,7 @@ struct host1x_bo_mapping *host1x_bo_pin(struct device *dev, struct host1x_bo *bo enum dma_data_direction dir, struct host1x_bo_cache *cache); void host1x_bo_unpin(struct host1x_bo_mapping *map); +void host1x_bo_clear_cached_mappings(struct host1x_bo *bo); static inline void *host1x_bo_mmap(struct host1x_bo *bo) { -- cgit v1.2.3 From b397cc489ae42c753c608cddd2dd6e9c2b2d86c0 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Mon, 27 Apr 2026 11:44:54 -0700 Subject: drm/tegra: tegra_drm.h: fix all uapi kernel-doc warnings Add 2 struct member descriptions and convert #define macro constants comments to kernel-doc comments to eliminate all kernel-doc warnings: Warning: include/uapi/drm/tegra_drm.h:353 struct member 'cmdbuf' not described in 'drm_tegra_reloc' Warning: include/uapi/drm/tegra_drm.h:353 struct member 'target' not described in 'drm_tegra_reloc' Warning: include/uapi/drm/tegra_drm.h:780 This comment starts with '/**', but isn't a kernel-doc comment. * Specify that bit 39 of the patched-in address should be set to switch Warning: include/uapi/drm/tegra_drm.h:832 This comment starts with '/**', but isn't a kernel-doc comment. * Execute `words` words of Host1x opcodes specified in the `gather_data_ptr` Warning: include/uapi/drm/tegra_drm.h:837 This comment starts with '/**', but isn't a kernel-doc comment. * Wait for a syncpoint to reach a value before continuing with further Warning: include/uapi/drm/tegra_drm.h:842 This comment starts with '/**', but isn't a kernel-doc comment. * Wait for a syncpoint to reach a value before continuing with further Signed-off-by: Randy Dunlap Acked-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260427184454.693794-1-rdunlap@infradead.org --- include/uapi/drm/tegra_drm.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include') diff --git a/include/uapi/drm/tegra_drm.h b/include/uapi/drm/tegra_drm.h index 94cfc306d50a..8f21f3a44832 100644 --- a/include/uapi/drm/tegra_drm.h +++ b/include/uapi/drm/tegra_drm.h @@ -304,6 +304,7 @@ struct drm_tegra_cmdbuf { * struct drm_tegra_reloc - GEM object relocation structure */ struct drm_tegra_reloc { + /** @cmdbuf: cmd information */ struct { /** * @cmdbuf.handle: @@ -321,6 +322,7 @@ struct drm_tegra_reloc { */ __u32 offset; } cmdbuf; + /** @target: relocate target information */ struct { /** * @target.handle: @@ -778,6 +780,9 @@ struct drm_tegra_channel_unmap { /* Submission */ /** + * define DRM_TEGRA_SUBMIT_RELOC_SECTOR_LAYOUT - \ + * Select sector layout swizzling for in-memory buffers. + * * Specify that bit 39 of the patched-in address should be set to switch * swizzling between Tegra and non-Tegra sector layout on systems that store * surfaces in system memory in non-Tegra sector layout. @@ -830,16 +835,27 @@ struct drm_tegra_submit_buf { }; /** + * define DRM_TEGRA_SUBMIT_CMD_GATHER_UPTR - \ + * Execute Host1x opcodes from user pointer. + * * Execute `words` words of Host1x opcodes specified in the `gather_data_ptr` * buffer. Each GATHER_UPTR command uses successive words from the buffer. */ #define DRM_TEGRA_SUBMIT_CMD_GATHER_UPTR 0 + /** + * define DRM_TEGRA_SUBMIT_CMD_WAIT_SYNCPT - \ + * Wait for syncpoint (absolute). + * * Wait for a syncpoint to reach a value before continuing with further * commands. */ #define DRM_TEGRA_SUBMIT_CMD_WAIT_SYNCPT 1 + /** + * define DRM_TEGRA_SUBMIT_CMD_WAIT_SYNCPT_RELATIVE - \ + * Wait for syncpoint (relative). + * * Wait for a syncpoint to reach a value before continuing with further * commands. The threshold is calculated relative to the start of the job. */ -- cgit v1.2.3 From b7f40ab50190e2500c3c297d15e00040dca47feb Mon Sep 17 00:00:00 2001 From: Keith Busch Date: Wed, 27 May 2026 18:00:40 -0700 Subject: block: export passthrough stats enabled A user can enable io accounting for passthrough requests, so export the helper that checks if the request should be tracked. This will enable stacking drivers to to report iostats for passthrough workloads. Since the stacking request_queue may not be the one providing the request, the API has to add a parameter for the caller to specify which one to check. Reviewed-by: Nilay Shroff Reviewed-by: Nitesh Shetty Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/20260528010041.1533124-2-kbusch@meta.com Signed-off-by: Jens Axboe --- include/linux/blk-mq.h | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) (limited to 'include') diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 24b4160aeaad..af878597afb8 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -1252,4 +1252,44 @@ static inline int blk_rq_map_sg(struct request *rq, struct scatterlist *sglist) } void blk_dump_rq_flags(struct request *, char *); +/** + * blk_rq_passthrough_stats - check if this request should account stats + * @rq: request to check + * @q: the queue accumulating the stats + * + * Note, @q does not necessarily need to be the request_queue that provides + * @rq. + * + * Return: true if stats should be accounted. + */ +static inline bool blk_rq_passthrough_stats(struct request *rq, + struct request_queue *q) +{ + struct bio *bio = rq->bio; + + if (!blk_queue_passthrough_stat(q)) + return false; + + /* Requests without a bio do not transfer data. */ + if (!bio) + return false; + + /* + * Stats are accumulated in the bdev, so must have one attached to a + * bio to track stats. Most drivers do not set the bdev for passthrough + * requests, but nvme is one that will set it. + */ + if (!bio->bi_bdev) + return false; + + /* + * We don't know what a passthrough command does, but we know the + * payload size and data direction. Ensuring the size is aligned to the + * block size filters out most commands with payloads that don't + * represent sector access. + */ + if (blk_rq_bytes(rq) & (bdev_logical_block_size(bio->bi_bdev) - 1)) + return false; + return true; +} #endif /* BLK_MQ_H */ -- cgit v1.2.3 From ba220b42c05561761b764089b27a34fd2c6cdc19 Mon Sep 17 00:00:00 2001 From: Yury Norov Date: Tue, 19 May 2026 12:30:56 -0400 Subject: cpumask: switch cpumap_print_to_pagebuf() to using scnprintf() In preparation for removing bitmap_print_to_pagebuf(), switch cpumap_print_to_pagebuf() to using scnprintf("%*pbl"). Signed-off-by: Yury Norov --- include/linux/cpumask.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h index 80211900f373..d3cda0544954 100644 --- a/include/linux/cpumask.h +++ b/include/linux/cpumask.h @@ -13,8 +13,10 @@ #include #include #include +#include #include #include +#include #include @@ -1326,8 +1328,9 @@ static __always_inline bool cpu_dying(unsigned int cpu) static __always_inline ssize_t cpumap_print_to_pagebuf(bool list, char *buf, const struct cpumask *mask) { - return bitmap_print_to_pagebuf(list, buf, cpumask_bits(mask), - nr_cpu_ids); + /* Opencode offset_in_page(buf) to not include linux/mm.h */ + return scnprintf(buf, PAGE_SIZE - ((unsigned long)buf & ~PAGE_MASK), + list ? "%*pbl\n" : "%*pb\n", cpumask_pr_args(mask)); } /** -- cgit v1.2.3 From 87e36d227ec511677ac5a512f7be322bae6c4ae3 Mon Sep 17 00:00:00 2001 From: Yury Norov Date: Tue, 19 May 2026 12:30:57 -0400 Subject: bitmap: drop bitmap_print_to_pagebuf() Now that all users of bitmap_print_to_pagebuf() are switched to the alternatives, drop the function. Signed-off-by: Yury Norov --- include/linux/bitmap-str.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/bitmap-str.h b/include/linux/bitmap-str.h index 53d3e1b32d3d..abe7a69a846f 100644 --- a/include/linux/bitmap-str.h +++ b/include/linux/bitmap-str.h @@ -5,7 +5,6 @@ #include int bitmap_parse_user(const char __user *ubuf, unsigned int ulen, unsigned long *dst, int nbits); -int bitmap_print_to_pagebuf(bool list, char *buf, const unsigned long *maskp, int nmaskbits); int bitmap_print_bitmask_to_buf(char *buf, const unsigned long *maskp, int nmaskbits, loff_t off, size_t count); int bitmap_print_list_to_buf(char *buf, const unsigned long *maskp, int nmaskbits, -- cgit v1.2.3 From 8f4c4562c454c138b8f4db124f03a4ca29750277 Mon Sep 17 00:00:00 2001 From: Yury Norov Date: Thu, 21 May 2026 12:03:45 -0400 Subject: bitmap: fix find helper documentation find_nth_and_bit() and find_nth_and_andnot_bit() may return a value greater than @size when the requested bit does not exist, matching find_nth_bit(). Document that correctly. All current users are safe against the '>=' vs '==' conditions. Also fix the for_each_clear_bitrange_from() parameter descriptions so they describe clear ranges instead of set ranges. Signed-off-by: Yury Norov --- include/linux/find.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/find.h b/include/linux/find.h index 6c2be8ca615d..a129f8205fb6 100644 --- a/include/linux/find.h +++ b/include/linux/find.h @@ -249,7 +249,7 @@ unsigned long find_nth_bit(const unsigned long *addr, unsigned long size, unsign * @n: The number of set bit, which position is needed, counting from 0 * * Returns the bit number of the N'th set bit. - * If no such, returns @size. + * If no such, returns >= @size. */ static __always_inline unsigned long find_nth_and_bit(const unsigned long *addr1, const unsigned long *addr2, @@ -277,7 +277,7 @@ unsigned long find_nth_and_bit(const unsigned long *addr1, const unsigned long * * @n: The number of set bit, which position is needed, counting from 0 * * Returns the bit number of the N'th set bit. - * If no such, returns @size. + * If no such, returns >= @size. */ static __always_inline unsigned long find_nth_and_andnot_bit(const unsigned long *addr1, @@ -655,8 +655,8 @@ unsigned long find_next_bit_le(const void *addr, unsigned /** * for_each_clear_bitrange_from - iterate over all unset bit ranges [b; e) - * @b: bit offset of start of current bitrange (first set bit); must be initialized - * @e: bit offset of end of current bitrange (first unset bit) + * @b: bit offset of start of current bitrange (first unset bit); must be initialized + * @e: bit offset of end of current bitrange (first set bit) * @addr: bitmap address to base the search on * @size: bitmap size in number of bits */ -- cgit v1.2.3 From 83aede8131afa99b26034f81fe77181eba38b0c2 Mon Sep 17 00:00:00 2001 From: Jinjie Ruan Date: Wed, 6 May 2026 13:52:04 -0400 Subject: bitops: Define generic___bitrev8/16/32 for reuse Define generic___bitrev8/16/32 using the implementation in , so they can be reused in , such as RISCV. Reviewed-by: Yury Norov Signed-off-by: Jinjie Ruan Signed-off-by: Yury Norov --- include/asm-generic/bitops/__bitrev.h | 23 +++++++++++++++++++++++ include/linux/bitrev.h | 20 ++++---------------- 2 files changed, 27 insertions(+), 16 deletions(-) create mode 100644 include/asm-generic/bitops/__bitrev.h (limited to 'include') diff --git a/include/asm-generic/bitops/__bitrev.h b/include/asm-generic/bitops/__bitrev.h new file mode 100644 index 000000000000..4addbde14050 --- /dev/null +++ b/include/asm-generic/bitops/__bitrev.h @@ -0,0 +1,23 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _ASM_GENERIC_BITOPS___BITREV_H_ +#define _ASM_GENERIC_BITOPS___BITREV_H_ + +#include + +extern u8 const byte_rev_table[256]; +static __always_inline __attribute_const__ u8 generic___bitrev8(u8 byte) +{ + return byte_rev_table[byte]; +} + +static __always_inline __attribute_const__ u16 generic___bitrev16(u16 x) +{ + return (generic___bitrev8(x & 0xff) << 8) | generic___bitrev8(x >> 8); +} + +static __always_inline __attribute_const__ u32 generic___bitrev32(u32 x) +{ + return (generic___bitrev16(x & 0xffff) << 16) | generic___bitrev16(x >> 16); +} + +#endif /* _ASM_GENERIC_BITOPS___BITREV_H_ */ diff --git a/include/linux/bitrev.h b/include/linux/bitrev.h index d35b8ec1c485..11620a70e776 100644 --- a/include/linux/bitrev.h +++ b/include/linux/bitrev.h @@ -12,22 +12,10 @@ #define __bitrev8 __arch_bitrev8 #else -extern u8 const byte_rev_table[256]; -static inline u8 __bitrev8(u8 byte) -{ - return byte_rev_table[byte]; -} - -static inline u16 __bitrev16(u16 x) -{ - return (__bitrev8(x & 0xff) << 8) | __bitrev8(x >> 8); -} - -static inline u32 __bitrev32(u32 x) -{ - return (__bitrev16(x & 0xffff) << 16) | __bitrev16(x >> 16); -} - +#include +#define __bitrev32 generic___bitrev32 +#define __bitrev16 generic___bitrev16 +#define __bitrev8 generic___bitrev8 #endif /* CONFIG_HAVE_ARCH_BITREVERSE */ #define __bitrev8x4(x) (__bitrev32(swab32(x))) -- cgit v1.2.3 From 31eedfbaa2b8312e89b0fc973c8044dbb7163677 Mon Sep 17 00:00:00 2001 From: Xuan Zhuo Date: Wed, 27 May 2026 20:09:36 +0800 Subject: net: remove SIOCSHWTSTAMP and SIOCGHWTSTAMP from ndo_eth_ioctl comment Since commit 4ee58e1e5680 ("net: promote SIOCSHWTSTAMP and SIOCGHWTSTAMP ioctls to dedicated handlers"), SIOCSHWTSTAMP and SIOCGHWTSTAMP are no longer dispatched through dev_eth_ioctl() / ndo_eth_ioctl(). They are now handled by their own dedicated functions dev_set_hwtstamp() and dev_get_hwtstamp() in the ioctl path. However, the comment describing ndo_eth_ioctl in netdevice.h still lists these two ioctls, which is misleading for driver developers who may incorrectly assume they need to handle hardware timestamping commands in their ndo_eth_ioctl implementation. Remove the stale references from the comment to accurately reflect that ndo_eth_ioctl only handles SIOCGMIIPHY, SIOCGMIIREG and SIOCSMIIREG. Signed-off-by: Xuan Zhuo Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260527120936.24169-1-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index bf3dd9b2c1a7..7309467d7873 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1149,8 +1149,8 @@ struct netdev_net_notifier { * SIOCBONDSLAVEINFOQUERY, and SIOCBONDINFOQUERY * * * int (*ndo_eth_ioctl)(struct net_device *dev, struct ifreq *ifr, int cmd); - * Called for ethernet specific ioctls: SIOCGMIIPHY, SIOCGMIIREG, - * SIOCSMIIREG, SIOCSHWTSTAMP and SIOCGHWTSTAMP. + * Called for ethernet specific ioctls: SIOCGMIIPHY, SIOCGMIIREG and + * SIOCSMIIREG. * * int (*ndo_set_config)(struct net_device *dev, struct ifmap *map); * Used to set network devices bus interface parameters. This interface -- cgit v1.2.3 From f331c7be97cec765c611f95df31ee2a99628a013 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 22 May 2026 00:30:23 -0500 Subject: crypto: hash - Remove support for cloning hash tfms Hash transformation cloning no longer has a user, and there's a good chance no new one will appear because the library API solves the problem in a much simpler and more efficient way. Remove support for it. Note that no tests need to be removed, as this feature had no tests. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Acked-by: Herbert Xu Link: https://patch.msgid.link/20260522053028.91165-2-ebiggers@kernel.org Signed-off-by: Jakub Kicinski --- include/crypto/hash.h | 8 -------- 1 file changed, 8 deletions(-) (limited to 'include') diff --git a/include/crypto/hash.h b/include/crypto/hash.h index 586700332c73..e474f8461ea1 100644 --- a/include/crypto/hash.h +++ b/include/crypto/hash.h @@ -148,7 +148,6 @@ struct ahash_request { * @exit_tfm: Deinitialize the cryptographic transformation object. * This is a counterpart to @init_tfm, used to remove * various changes set in @init_tfm. - * @clone_tfm: Copy transform into new object, may allocate memory. * @halg: see struct hash_alg_common */ struct ahash_alg { @@ -165,7 +164,6 @@ struct ahash_alg { unsigned int keylen); int (*init_tfm)(struct crypto_ahash *tfm); void (*exit_tfm)(struct crypto_ahash *tfm); - int (*clone_tfm)(struct crypto_ahash *dst, struct crypto_ahash *src); struct hash_alg_common halg; }; @@ -239,7 +237,6 @@ struct shash_desc { * @exit_tfm: Deinitialize the cryptographic transformation object. * This is a counterpart to @init_tfm, used to remove * various changes set in @init_tfm. - * @clone_tfm: Copy transform into new object, may allocate memory. * @descsize: Size of the operational state for the message digest. This state * size is the memory size that needs to be allocated for * shash_desc.__ctx @@ -263,7 +260,6 @@ struct shash_alg { unsigned int keylen); int (*init_tfm)(struct crypto_shash *tfm); void (*exit_tfm)(struct crypto_shash *tfm); - int (*clone_tfm)(struct crypto_shash *dst, struct crypto_shash *src); unsigned int descsize; @@ -322,8 +318,6 @@ static inline struct crypto_ahash *__crypto_ahash_cast(struct crypto_tfm *tfm) struct crypto_ahash *crypto_alloc_ahash(const char *alg_name, u32 type, u32 mask); -struct crypto_ahash *crypto_clone_ahash(struct crypto_ahash *tfm); - static inline struct crypto_tfm *crypto_ahash_tfm(struct crypto_ahash *tfm) { return &tfm->base; @@ -759,8 +753,6 @@ static inline void ahash_request_set_virt(struct ahash_request *req, struct crypto_shash *crypto_alloc_shash(const char *alg_name, u32 type, u32 mask); -struct crypto_shash *crypto_clone_shash(struct crypto_shash *tfm); - int crypto_has_shash(const char *alg_name, u32 type, u32 mask); static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm) -- cgit v1.2.3 From cb2e6e86ceb518f792e9c7f404278cfea63c1154 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 22 May 2026 00:30:24 -0500 Subject: crypto: cipher - Remove crypto_clone_cipher() Since the only caller of crypto_clone_cipher() was cmac_clone_tfm() which has been removed, remove crypto_clone_cipher() as well. Note that no tests need to be removed, as this function had no tests. Reviewed-by: Ard Biesheuvel Signed-off-by: Eric Biggers Acked-by: Herbert Xu Link: https://patch.msgid.link/20260522053028.91165-3-ebiggers@kernel.org Signed-off-by: Jakub Kicinski --- include/crypto/internal/cipher.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/crypto/internal/cipher.h b/include/crypto/internal/cipher.h index 5030f6d2df31..a9174ba90250 100644 --- a/include/crypto/internal/cipher.h +++ b/include/crypto/internal/cipher.h @@ -176,8 +176,6 @@ void crypto_cipher_encrypt_one(struct crypto_cipher *tfm, void crypto_cipher_decrypt_one(struct crypto_cipher *tfm, u8 *dst, const u8 *src); -struct crypto_cipher *crypto_clone_cipher(struct crypto_cipher *cipher); - struct crypto_cipher_spawn { struct crypto_spawn base; }; -- cgit v1.2.3 From 3065170bfc7f256f9d1339062dae331f731c6763 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 22 May 2026 00:30:26 -0500 Subject: crypto: api - Remove per-tfm refcount This reverts commit ae131f4970f0 ("crypto: api - Add crypto_tfm_get"). The refcount in struct crypto_tfm was added solely to support crypto_clone_tfm(). Before then it was a simple non-refcounted object. Since crypto_clone_tfm() has been removed, remove the refcount as well. Note that this eliminates an expensive atomic operation from every tfm freeing operation. So this revert doesn't just remove unused code, but it also fixes a performance regression. Signed-off-by: Eric Biggers Acked-by: Herbert Xu Link: https://patch.msgid.link/20260522053028.91165-5-ebiggers@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/crypto.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/crypto.h b/include/linux/crypto.h index a2137e19be7d..b7c97f1c47c9 100644 --- a/include/linux/crypto.h +++ b/include/linux/crypto.h @@ -409,7 +409,6 @@ int crypto_has_alg(const char *name, u32 type, u32 mask); */ struct crypto_tfm { - refcount_t refcnt; u32 crt_flags; -- cgit v1.2.3 From 81a4d039537a89e7619aa94c5b6db051ae0b180c Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Tue, 26 May 2026 08:57:22 -0700 Subject: net: make page_pool_get_stats() void The kdoc for page_pool_get_stats() is missing a Returns: statement. Looking at this function, I have no idea what is the purpose of the bool it returns. My guess was that maybe the static inline stub returns false if CONFIG_PAGE_POOL_STATS=n but such static inline helper doesn't exist at all. All callers pass a pointer to a struct on the stack. Make this function void. Reviewed-by: Nicolai Buchwitz Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20260526155722.2790742-5-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/net/page_pool/helpers.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/page_pool/helpers.h b/include/net/page_pool/helpers.h index 3247026e096a..e2730dd273b2 100644 --- a/include/net/page_pool/helpers.h +++ b/include/net/page_pool/helpers.h @@ -64,7 +64,7 @@ int page_pool_ethtool_stats_get_count(void); u8 *page_pool_ethtool_stats_get_strings(u8 *data); u64 *page_pool_ethtool_stats_get(u64 *data, const void *stats); -bool page_pool_get_stats(const struct page_pool *pool, +void page_pool_get_stats(const struct page_pool *pool, struct page_pool_stats *stats); #else static inline int page_pool_ethtool_stats_get_count(void) -- cgit v1.2.3 From 0c766f0f08ea681396814fd82eddd299da188625 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Thu, 16 Apr 2026 15:48:33 -0700 Subject: spmi: clean up kernel-doc in spmi.h Fix all kernel-doc warnings in spmi.h: Warning: include/linux/spmi.h:114 function parameter 'ctrl' not described in 'spmi_controller_put' Warning: include/linux/spmi.h:144 struct member 'shutdown' not described in 'spmi_driver' Signed-off-by: Randy Dunlap Signed-off-by: Stephen Boyd --- include/linux/spmi.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/spmi.h b/include/linux/spmi.h index 28e8c8bd3944..671ce1b3ee8e 100644 --- a/include/linux/spmi.h +++ b/include/linux/spmi.h @@ -109,7 +109,7 @@ struct spmi_controller *spmi_controller_alloc(struct device *parent, /** * spmi_controller_put() - decrement controller refcount - * @ctrl SPMI controller. + * @ctrl: SPMI controller. */ static inline void spmi_controller_put(struct spmi_controller *ctrl) { @@ -129,6 +129,7 @@ int devm_spmi_controller_add(struct device *parent, struct spmi_controller *ctrl * this structure. * @probe: binds this driver to a SPMI device. * @remove: unbinds this driver from the SPMI device. + * @shutdown: shuts down this driver. * * If PM runtime support is desired for a slave, a device driver can call * pm_runtime_put() from their probe() routine (and a balancing -- cgit v1.2.3 From 3443eec9c55d128064c83225a9111f1a1a37277a Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Thu, 26 Mar 2026 19:41:43 -0700 Subject: spmi: use kzalloc_flex in main allocation Add a flexible array member to avoid indexing past the struct. Signed-off-by: Rosen Penev Signed-off-by: Stephen Boyd --- include/linux/spmi.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/spmi.h b/include/linux/spmi.h index 671ce1b3ee8e..4eb9564a7fb3 100644 --- a/include/linux/spmi.h +++ b/include/linux/spmi.h @@ -76,6 +76,7 @@ void spmi_device_remove(struct spmi_device *sdev); * @cmd: sends a non-data command sequence on the SPMI bus. * @read_cmd: sends a register read command sequence on the SPMI bus. * @write_cmd: sends a register write command sequence on the SPMI bus. + * @priv: array of private data. */ struct spmi_controller { struct device dev; @@ -85,6 +86,7 @@ struct spmi_controller { u8 sid, u16 addr, u8 *buf, size_t len); int (*write_cmd)(struct spmi_controller *ctrl, u8 opcode, u8 sid, u16 addr, const u8 *buf, size_t len); + u8 priv[]; }; static inline struct spmi_controller *to_spmi_controller(struct device *d) -- cgit v1.2.3 From 68413a36f0051bd7ba7ea37ae2167951aeae5bd2 Mon Sep 17 00:00:00 2001 From: "Masami Hiramatsu (Google)" Date: Fri, 22 May 2026 13:09:00 -0400 Subject: ring-buffer: Add persistent ring buffer invalid-page inject test Add a self-corrupting test for the persistent ring buffer. This will inject an erroneous value to some sub-buffer pages (where the index is even or multiples of 5) in the persistent ring buffer when the kernel panics, and checks whether the number of detected invalid pages and the total entry_bytes are the same as the recorded values after reboot. This ensures that the kernel can correctly recover a partially corrupted persistent ring buffer after a reboot or panic. The test only runs on the persistent ring buffer whose name is "ptracingtest". The user has to fill it with events before a kernel panic. To run the test, enable CONFIG_RING_BUFFER_PERSISTENT_INJECT and add the following kernel cmdline: reserve_mem=20M:2M:trace trace_instance=ptracingtest^traceoff@trace panic=1 Run the following commands after the 1st boot: cd /sys/kernel/tracing/instances/ptracingtest echo 1 > tracing_on echo 1 > events/enable sleep 3 echo c > /proc/sysrq-trigger After panic message, the kernel will reboot and run the verification on the persistent ring buffer, e.g. Ring buffer meta [2] invalid buffer page detected Ring buffer meta [2] is from previous boot! (318 pages discarded) Ring buffer testing [2] invalid pages: PASSED (318/318) Ring buffer testing [2] entry_bytes: PASSED (1300476/1300476) Link: https://patch.msgid.link/20260522171051.260140328@kernel.org Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt --- include/linux/ring_buffer.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h index 994f52b34344..0670742b2d60 100644 --- a/include/linux/ring_buffer.h +++ b/include/linux/ring_buffer.h @@ -238,6 +238,7 @@ int ring_buffer_subbuf_size_get(struct trace_buffer *buffer); enum ring_buffer_flags { RB_FL_OVERWRITE = 1 << 0, + RB_FL_TESTING = 1 << 1, }; #ifdef CONFIG_RING_BUFFER -- cgit v1.2.3 From 3c2d42b8ee345b17a4ba56b0f6492d1ff4c1178e Mon Sep 17 00:00:00 2001 From: Wupeng Ma Date: Fri, 22 May 2026 09:03:05 +0800 Subject: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page can trigger a recursive spinlock self-deadlock (AA deadlock) on hugetlb_lock when racing with a concurrent unmap: thread#0 thread#1 -------- -------- madvise(folio, MADV_HWPOISON) -> poisons the folio successfully madvise(folio, MADV_HWPOISON) unmap(folio) try_memory_failure_hugetlb get_huge_page_for_hwpoison spin_lock_irq(&hugetlb_lock) <- held __get_huge_page_for_hwpoison hugetlb_update_hwpoison() -> MF_HUGETLB_FOLIO_PRE_POISONED goto out: folio_put() refcount: 1 -> 0 free_huge_folio() spin_lock_irqsave(&hugetlb_lock) -> AA DEADLOCK! The out: path in __get_huge_page_for_hwpoison() calls folio_put() to drop the GUP reference while the hugetlb_lock is still held by the hugetlb.c wrapper get_huge_page_for_hwpoison(). If concurrent unmap has released the page table mapping reference, folio_put() drops the folio refcount to zero, triggering free_huge_folio() which attempts to re-acquire the non-recursive hugetlb_lock. Fix this by moving hugetlb_lock acquisition from the hugetlb.c wrapper into get_huge_page_for_hwpoison(). Place spin_unlock_irq() before the folio_put() at the out: label so the folio is always released outside the lock. [akpm@linux-foundation.org: fix race, rename label per Miaohe] Link: https://sashiko.dev/#/patchset/20260522010305.4099834-1-mawupeng1@huawei.com Link: https://lore.kernel.org/f39f405e-4b4b-8f79-70fe-a2b5b62114eb@huawei.com Link: https://lore.kernel.org/20260522010305.4099834-1-mawupeng1@huawei.com Fixes: 405ce051236c ("mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb()") Signed-off-by: Wupeng Ma Acked-by: Oscar Salvador (SUSE) Acked-by: Muchun Song Reviewed-by: Kefeng Wang Acked-by: Miaohe Lin Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton --- include/linux/hugetlb.h | 8 -------- include/linux/mm.h | 8 -------- 2 files changed, 16 deletions(-) (limited to 'include') diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 5957bc25efa8..2abaf99321e9 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -153,8 +153,6 @@ long hugetlb_unreserve_pages(struct inode *inode, long start, long end, long freed); bool folio_isolate_hugetlb(struct folio *folio, struct list_head *list); int get_hwpoison_hugetlb_folio(struct folio *folio, bool *hugetlb, bool unpoison); -int get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared); void folio_putback_hugetlb(struct folio *folio); void move_hugetlb_state(struct folio *old_folio, struct folio *new_folio, int reason); void hugetlb_fix_reserve_counts(struct inode *inode); @@ -421,12 +419,6 @@ static inline int get_hwpoison_hugetlb_folio(struct folio *folio, bool *hugetlb, return 0; } -static inline int get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared) -{ - return 0; -} - static inline void folio_putback_hugetlb(struct folio *folio) { } diff --git a/include/linux/mm.h b/include/linux/mm.h index 06bbe9eba636..fc2acedf0b76 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -4975,8 +4975,6 @@ extern int soft_offline_page(unsigned long pfn, int flags); */ extern const struct attribute_group memory_failure_attr_group; extern void memory_failure_queue(unsigned long pfn, int flags); -extern int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared); void num_poisoned_pages_inc(unsigned long pfn); void num_poisoned_pages_sub(unsigned long pfn, long i); #else @@ -4984,12 +4982,6 @@ static inline void memory_failure_queue(unsigned long pfn, int flags) { } -static inline int __get_huge_page_for_hwpoison(unsigned long pfn, int flags, - bool *migratable_cleared) -{ - return 0; -} - static inline void num_poisoned_pages_inc(unsigned long pfn) { } -- cgit v1.2.3 From 8613803cf5d532316aa886f17066c5e5968ea21e Mon Sep 17 00:00:00 2001 From: Chengkaitao Date: Thu, 23 Apr 2026 18:14:41 +0800 Subject: mm: convert vmemmap_p?d_populate() to static functions Since the vmemmap_p?d_populate functions are unused outside the mm subsystem, we can remove their external declarations and convert them to static functions. Link: https://lore.kernel.org/20260423101441.7089-1-kaitao.cheng@linux.dev Signed-off-by: Chengkaitao Acked-by: David Hildenbrand (arm) Acked-by: Mike Rapoport (Microsoft) Acked-by: Oscar Salvador Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes (Oracle) Cc: Michal Hocko Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton --- include/linux/mm.h | 7 ------- 1 file changed, 7 deletions(-) (limited to 'include') diff --git a/include/linux/mm.h b/include/linux/mm.h index 06bbe9eba636..e3b6112a8d79 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -4860,13 +4860,6 @@ unsigned long section_map_size(void); struct page * __populate_section_memmap(unsigned long pfn, unsigned long nr_pages, int nid, struct vmem_altmap *altmap, struct dev_pagemap *pgmap); -pgd_t *vmemmap_pgd_populate(unsigned long addr, int node); -p4d_t *vmemmap_p4d_populate(pgd_t *pgd, unsigned long addr, int node); -pud_t *vmemmap_pud_populate(p4d_t *p4d, unsigned long addr, int node); -pmd_t *vmemmap_pmd_populate(pud_t *pud, unsigned long addr, int node); -pte_t *vmemmap_pte_populate(pmd_t *pmd, unsigned long addr, int node, - struct vmem_altmap *altmap, unsigned long ptpfn, - unsigned long flags); void *vmemmap_alloc_block(unsigned long size, int node); struct vmem_altmap; void *vmemmap_alloc_block_buf(unsigned long size, int node, -- cgit v1.2.3 From 4221aadd720bef7df1268391d6eb1ea1f0476b38 Mon Sep 17 00:00:00 2001 From: Bunyod Suvonov Date: Thu, 23 Apr 2026 18:37:53 +0800 Subject: mm/vmscan: add balance_pgdat begin/end tracepoints Vmscan has six main reclaim entry points: try_to_free_pages() for direct reclaim, try_to_free_mem_cgroup_pages() for memcg reclaim, mem_cgroup_shrink_node() for memcg soft limit reclaim, node_reclaim() for node reclaim, shrink_all_memory() for hibernation reclaim, and balance_pgdat() for kswapd reclaim. All of them, except for shrink_all_memory() and balance_pgdat(), already have begin/end tracepoints. This makes it harder to trace which reclaim path is responsible for memory reclaim activity, because kswapd reclaim cannot be identified as cleanly as other reclaim entry points, even though it is the main background reclaim path under memory pressure. There may be no need to trace shrink_all_memory() as it is primarily used during hibernation. So this patch adds the missing tracepoint pair for balance_pgdat(). The begin tracepoint records the node id, requested reclaim order, and the requested classzone bound (highest_zoneidx). The end tracepoint records the node id, the reclaim order that balance_pgdat() finished with, the requested classzone bound, and nr_reclaimed. Together, they show the requested reclaim order and classzone bound, whether reclaim fell back to a lower order, and how much reclaim work was done. The end tracepoint also records highest_zoneidx even though it does not change within a balance_pgdat() invocation. This keeps the end event self-contained, so users can analyze reclaim results directly from end events without depending on begin/end correlation, which is less convenient when tracing is filtered or records are dropped. It also makes it straightforward to relate nr_reclaimed and the final reclaim order to the requested classzone bound. Link: https://lore.kernel.org/20260424031418.174597-1-b.suvonov@sjtu.edu.cn Link: https://lore.kernel.org/20260423103753.546582-1-b.suvonov@sjtu.edu.cn Signed-off-by: Bunyod Suvonov Acked-by: Shakeel Butt Cc: Axel Rasmussen Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Lorenzo Stoakes Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Qi Zheng Cc: Steven Rostedt Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton --- include/trace/events/vmscan.h | 52 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) (limited to 'include') diff --git a/include/trace/events/vmscan.h b/include/trace/events/vmscan.h index 4445a8d9218d..b4bf7b8def1f 100644 --- a/include/trace/events/vmscan.h +++ b/include/trace/events/vmscan.h @@ -96,6 +96,58 @@ TRACE_EVENT(mm_vmscan_kswapd_wake, __entry->order) ); +TRACE_EVENT(mm_vmscan_balance_pgdat_begin, + + TP_PROTO(int nid, int order, int highest_zoneidx), + + TP_ARGS(nid, order, highest_zoneidx), + + TP_STRUCT__entry( + __field(int, nid) + __field(int, order) + __field(int, highest_zoneidx) + ), + + TP_fast_assign( + __entry->nid = nid; + __entry->order = order; + __entry->highest_zoneidx = highest_zoneidx; + ), + + TP_printk("nid=%d order=%d highest_zoneidx=%-8s", + __entry->nid, + __entry->order, + __print_symbolic(__entry->highest_zoneidx, ZONE_TYPE)) +); + +TRACE_EVENT(mm_vmscan_balance_pgdat_end, + + TP_PROTO(int nid, int order, int highest_zoneidx, + unsigned long nr_reclaimed), + + TP_ARGS(nid, order, highest_zoneidx, nr_reclaimed), + + TP_STRUCT__entry( + __field(int, nid) + __field(int, order) + __field(int, highest_zoneidx) + __field(unsigned long, nr_reclaimed) + ), + + TP_fast_assign( + __entry->nid = nid; + __entry->order = order; + __entry->highest_zoneidx = highest_zoneidx; + __entry->nr_reclaimed = nr_reclaimed; + ), + + TP_printk("nid=%d order=%d highest_zoneidx=%-8s nr_reclaimed=%lu", + __entry->nid, + __entry->order, + __print_symbolic(__entry->highest_zoneidx, ZONE_TYPE), + __entry->nr_reclaimed) +); + TRACE_EVENT(mm_vmscan_wakeup_kswapd, TP_PROTO(int nid, int zid, int order, gfp_t gfp_flags), -- cgit v1.2.3 From 4aa4abf1f14bd6d0748b7d35a803cc2376a8e20b Mon Sep 17 00:00:00 2001 From: Ryan Roberts Date: Wed, 1 Apr 2026 11:16:19 +0100 Subject: mm/page_alloc: optimize free_contig_range() Patch series "mm: Free contiguous order-0 pages efficiently", v6. A recent change to vmalloc caused some performance benchmark regressions (see [1]). I'm attempting to fix that (and at the same time significantly improve beyond the baseline) by freeing a contiguous set of order-0 pages as a batch. At the same time I observed that free_contig_range() was essentially doing the same thing as vfree() so I've fixed it there too. While at it, optimize the __free_contig_frozen_range() as well. Check that the contiguous range falls in the same section. If they aren't enabled, the if conditions get optimized out by the compiler as memdesc_section() returns 0. See num_pages_contiguous() for more details about it. This patch (of 3): Decompose the range of order-0 pages to be freed into the set of largest possible power-of-2 size and aligned chunks and free them to the pcp or buddy. This improves on the previous approach which freed each order-0 page individually in a loop. Testing shows performance to be improved by more than 10x in some cases. Since each page is order-0, we must decrement each page's reference count individually and only consider the page for freeing as part of a high order chunk if the reference count goes to zero. Additionally free_pages_prepare() must be called for each individual order-0 page too, so that the struct page state and global accounting state can be appropriately managed. But once this is done, the resulting high order chunks can be freed as a unit to the pcp or buddy. This significantly speeds up the free operation but also has the side benefit that high order blocks are added to the pcp instead of each page ending up on the pcp order-0 list; memory remains more readily available in high orders. vmalloc will shortly become a user of this new optimized free_contig_range() since it aggressively allocates high order non-compound pages, but then calls split_page() to end up with contiguous order-0 pages. These can now be freed much more efficiently. The execution time of the following function was measured in a server class arm64 machine: static int page_alloc_high_order_test(void) { unsigned int order = HPAGE_PMD_ORDER; struct page *page; int i; for (i = 0; i < 100000; i++) { page = alloc_pages(GFP_KERNEL, order); if (!page) return -1; split_page(page, order); free_contig_range(page_to_pfn(page), 1UL << order); } return 0; } Execution time before: 4097358 usec Execution time after: 729831 usec Perf trace before: 99.63% 0.00% kthreadd [kernel.kallsyms] [.] kthread | ---kthread 0xffffb33c12a26af8 | |--98.13%--0xffffb33c12a26060 | | | |--97.37%--free_contig_range | | | | | |--94.93%--___free_pages | | | | | | | |--55.42%--__free_frozen_pages | | | | | | | | | --43.20%--free_frozen_page_commit | | | | | | | | | --35.37%--_raw_spin_unlock_irqrestore | | | | | | | |--11.53%--_raw_spin_trylock | | | | | | | |--8.19%--__preempt_count_dec_and_test | | | | | | | |--5.64%--_raw_spin_unlock | | | | | | | |--2.37%--__get_pfnblock_flags_mask.isra.0 | | | | | | | --1.07%--free_frozen_page_commit | | | | | --1.54%--__free_frozen_pages | | | --0.77%--___free_pages | --0.98%--0xffffb33c12a26078 alloc_pages_noprof Perf trace after: 8.42% 2.90% kthreadd [kernel.kallsyms] [k] __free_contig_range | |--5.52%--__free_contig_range | | | |--5.00%--free_prepared_contig_range | | | | | |--1.43%--__free_frozen_pages | | | | | | | --0.51%--free_frozen_page_commit | | | | | |--1.08%--_raw_spin_trylock | | | | | --0.89%--_raw_spin_unlock | | | --0.52%--free_pages_prepare | --2.90%--ret_from_fork kthread 0xffffae1c12abeaf8 0xffffae1c12abe7a0 | --2.69%--vfree __free_contig_range Link: https://lore.kernel.org/20260401101634.2868165-1-usama.anjum@arm.com Link: https://lore.kernel.org/20260401101634.2868165-2-usama.anjum@arm.com Link: https://lore.kernel.org/all/66919a28-bc81-49c9-b68f-dd7c73395a0d@arm.com [1] Signed-off-by: Ryan Roberts Co-developed-by: Muhammad Usama Anjum Signed-off-by: Muhammad Usama Anjum Acked-by: David Hildenbrand (Arm) Acked-by: Vlastimil Babka (SUSE) Reviewed-by: Zi Yan Cc: Brendan Jackman Cc: David Sterba Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Nick Terrell Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton --- include/linux/gfp.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/gfp.h b/include/linux/gfp.h index 51ef13ed756e..87259e309dee 100644 --- a/include/linux/gfp.h +++ b/include/linux/gfp.h @@ -467,6 +467,8 @@ void free_contig_frozen_range(unsigned long pfn, unsigned long nr_pages); void free_contig_range(unsigned long pfn, unsigned long nr_pages); #endif +void __free_contig_range(unsigned long pfn, unsigned long nr_pages); + DEFINE_FREE(free_page, void *, free_page((unsigned long)_T)) #endif /* __LINUX_GFP_H */ -- cgit v1.2.3 From 60ced5818f64ac356620d1ad3e0d473c457dbf5b Mon Sep 17 00:00:00 2001 From: Ryan Roberts Date: Wed, 1 Apr 2026 11:16:20 +0100 Subject: vmalloc: optimize vfree with free_pages_bulk() Whenever vmalloc allocates high order pages (e.g. for a huge mapping) it must immediately split_page() to order-0 so that it remains compatible with users that want to access the underlying struct page. Commit a06157804399 ("mm/vmalloc: request large order pages from buddy allocator") recently made it much more likely for vmalloc to allocate high order pages which are subsequently split to order-0. Unfortunately this had the side effect of causing performance regressions for tight vmalloc/vfree loops (e.g. test_vmalloc.ko benchmarks). See Closes: tag. This happens because the high order pages must be gotten from the buddy but then because they are split to order-0, when they are freed they are freed to the order-0 pcp. Previously allocation was for order-0 pages so they were recycled from the pcp. It would be preferable if when vmalloc allocates an (e.g.) order-3 page that it also frees that order-3 page to the order-3 pcp, then the regression could be removed. So let's do exactly that; update stats separately first as coalescing is hard to do correctly without complexity. Use free_pages_bulk() which uses the new __free_contig_range() API to batch-free contiguous ranges of pfns. This not only removes the regression, but significantly improves performance of vfree beyond the baseline. A selection of test_vmalloc benchmarks running on arm64 server class system. mm-new is the baseline. Commit a06157804399 ("mm/vmalloc: request large order pages from buddy allocator") was added in v6.19-rc1 where we see regressions. Then with this change performance is much better. (>0 is faster, <0 is slower, (R)/(I) = statistically significant Regression/Improvement): +-----------------+----------------------------------------------------------+-------------------+--------------------+ | Benchmark | Result Class | mm-new | this series | +=================+==========================================================+===================+====================+ | micromm/vmalloc | fix_align_alloc_test: p:1, h:0, l:500000 (usec) | 1331843.33 | (I) 67.17% | | | fix_size_alloc_test: p:1, h:0, l:500000 (usec) | 415907.33 | -5.14% | | | fix_size_alloc_test: p:4, h:0, l:500000 (usec) | 755448.00 | (I) 53.55% | | | fix_size_alloc_test: p:16, h:0, l:500000 (usec) | 1591331.33 | (I) 57.26% | | | fix_size_alloc_test: p:16, h:1, l:500000 (usec) | 1594345.67 | (I) 68.46% | | | fix_size_alloc_test: p:64, h:0, l:100000 (usec) | 1071826.00 | (I) 79.27% | | | fix_size_alloc_test: p:64, h:1, l:100000 (usec) | 1018385.00 | (I) 84.17% | | | fix_size_alloc_test: p:256, h:0, l:100000 (usec) | 3970899.67 | (I) 77.01% | | | fix_size_alloc_test: p:256, h:1, l:100000 (usec) | 3821788.67 | (I) 89.44% | | | fix_size_alloc_test: p:512, h:0, l:100000 (usec) | 7795968.00 | (I) 82.67% | | | fix_size_alloc_test: p:512, h:1, l:100000 (usec) | 6530169.67 | (I) 118.09% | | | full_fit_alloc_test: p:1, h:0, l:500000 (usec) | 626808.33 | -0.98% | | | kvfree_rcu_1_arg_vmalloc_test: p:1, h:0, l:500000 (usec) | 532145.67 | -1.68% | | | kvfree_rcu_2_arg_vmalloc_test: p:1, h:0, l:500000 (usec) | 537032.67 | -0.96% | | | long_busy_list_alloc_test: p:1, h:0, l:500000 (usec) | 8805069.00 | (I) 74.58% | | | pcpu_alloc_test: p:1, h:0, l:500000 (usec) | 500824.67 | 4.35% | | | random_size_align_alloc_test: p:1, h:0, l:500000 (usec) | 1637554.67 | (I) 76.99% | | | random_size_alloc_test: p:1, h:0, l:500000 (usec) | 4556288.67 | (I) 72.23% | | | vm_map_ram_test: p:1, h:0, l:500000 (usec) | 107371.00 | -0.70% | +-----------------+----------------------------------------------------------+-------------------+--------------------+ Link: https://lore.kernel.org/20260401101634.2868165-3-usama.anjum@arm.com Fixes: a06157804399 ("mm/vmalloc: request large order pages from buddy allocator") Closes: https://lore.kernel.org/all/66919a28-bc81-49c9-b68f-dd7c73395a0d@arm.com/ Signed-off-by: Ryan Roberts Co-developed-by: Muhammad Usama Anjum Signed-off-by: Muhammad Usama Anjum Acked-by: Vlastimil Babka (SUSE) Acked-by: Zi Yan Acked-by: David Hildenbrand (Arm) Reviewed-by: Uladzislau Rezki (Sony) Cc: Brendan Jackman Cc: David Sterba Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Nick Terrell Cc: Suren Baghdasaryan Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton --- include/linux/gfp.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/gfp.h b/include/linux/gfp.h index 87259e309dee..cdf95a9f0b87 100644 --- a/include/linux/gfp.h +++ b/include/linux/gfp.h @@ -239,6 +239,8 @@ unsigned long alloc_pages_bulk_noprof(gfp_t gfp, int preferred_nid, struct page **page_array); #define __alloc_pages_bulk(...) alloc_hooks(alloc_pages_bulk_noprof(__VA_ARGS__)) +void free_pages_bulk(struct page **page_array, unsigned long nr_pages); + unsigned long alloc_pages_bulk_mempolicy_noprof(gfp_t gfp, unsigned long nr_pages, struct page **page_array); -- cgit v1.2.3 From 9138e27a3bc380cd88475546688f23d5eda1ad23 Mon Sep 17 00:00:00 2001 From: Ravi Jonnalagadda Date: Mon, 27 Apr 2026 20:05:20 -0700 Subject: mm/damon: add node_eligible_mem_bp goal metric Background and Motivation ========================= In heterogeneous memory systems, controlling memory distribution across NUMA nodes is essential for performance optimization. This patch enables system-wide page distribution with target-state goals such as "maintain 60% of scheme-eligible memory on DRAM" using PA-mode DAMON schemes. Rather than using absolute thresholds, this metric tracks the ratio of memory that matches each scheme's access pattern filters on a target node, enabling the quota system to automatically adjust migration aggressiveness to maintain the desired distribution. What This Metric Measures ========================= node_eligible_mem_bp: scheme_eligible_bytes_on_node / total_scheme_eligible_bytes * 10000 Two-Scheme Setup for Hot Page Distribution ========================================== For maintaining 60% of hot memory on DRAM (node 0) and 40% on CXL (node 1): PULL scheme: migrate_hot to node 0 goal: node_eligible_mem_bp, nid=0, target=6000 addr filter: node 1 address range (only migrate FROM CXL) "Move hot pages to DRAM if less than 60% of hot data is in DRAM" PUSH scheme: migrate_hot to node 1 goal: node_eligible_mem_bp, nid=1, target=4000 addr filter: node 0 address range (only migrate FROM DRAM) "Move hot pages to CXL if less than 40% of hot data is in CXL" Each scheme independently measures its own eligible memory and adjusts its quota to achieve its target ratio. The schemes work in concert through DAMON's unified monitoring context, with the quota autotuner balancing their relative aggressiveness. Implementation Details ====================== The implementation adds a new quota goal metric type DAMOS_QUOTA_NODE_ELIGIBLE_MEM_BP to the existing DAMOS quota goal framework. When this metric is configured for a scheme: 1. During each quota adjustment cycle, damos_get_node_eligible_mem_bp() is called to calculate the current memory distribution. 2. The function iterates through all regions that match the scheme's access pattern (via __damos_valid_target()) and calculates: - Total eligible bytes across all nodes - Eligible bytes specifically on the target node (goal->nid) 3. For each eligible region, damos_calc_eligible_bytes() walks through the physical address range, using damon_get_folio() to look up each folio and determine its NUMA node via folio_nid(). 4. Large folios are handled by calculating the exact overlap between the region boundaries and folio boundaries, ensuring accurate byte counts even when regions partially span folios. 5. The ratio (node_eligible / total_eligible * 10000) is returned as basis points, which the quota autotuner uses to adjust the scheme's effective quota size (esz). The implementation requires CONFIG_DAMON_PADDR since damon_get_folio() is only available for physical address space monitoring. Testing Results =============== Functionally tested on a two-node heterogeneous memory system with DRAM (node 0) and CXL memory (node 1). A PUSH+PULL scheme configuration using migrate_hot actions was used to reach a target hot memory ratio between the two tiers. With the TEMPORAL tuner, the system converges quickly to the target distribution. The tuner drives esz to maximum when under goal and to zero once the goal is met, forming a simple on/off feedback loop that stabilizes at the desired ratio. With the CONSIST tuner, the scheme still converges but more slowly, as it migrates and then throttles itself based on quota feedback. The time to reach the goal varies depending on workload intensity. Note: This metric works with both TEMPORAL and CONSIST goal tuners. Link: https://lore.kernel.org/20260428030520.701-1-ravis.opensrc@gmail.com Signed-off-by: Ravi Jonnalagadda Suggested-by: SeongJae Park Reviewed-by: SeongJae Park Cc: Honggyu Kim Cc: Jonathan Corbet Cc: Yunjeong Mun Signed-off-by: Andrew Morton --- include/linux/damon.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index f2cdb7c3f5e6..986b8c902585 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -159,6 +159,8 @@ enum damos_action { * @DAMOS_QUOTA_NODE_MEMCG_FREE_BP: MemFree ratio of a node for a cgroup. * @DAMOS_QUOTA_ACTIVE_MEM_BP: Active to total LRU memory ratio. * @DAMOS_QUOTA_INACTIVE_MEM_BP: Inactive to total LRU memory ratio. + * @DAMOS_QUOTA_NODE_ELIGIBLE_MEM_BP: Scheme-eligible memory ratio of a + * node in basis points (0-10000). * @NR_DAMOS_QUOTA_GOAL_METRICS: Number of DAMOS quota goal metrics. * * Metrics equal to larger than @NR_DAMOS_QUOTA_GOAL_METRICS are unsupported. @@ -172,6 +174,7 @@ enum damos_quota_goal_metric { DAMOS_QUOTA_NODE_MEMCG_FREE_BP, DAMOS_QUOTA_ACTIVE_MEM_BP, DAMOS_QUOTA_INACTIVE_MEM_BP, + DAMOS_QUOTA_NODE_ELIGIBLE_MEM_BP, NR_DAMOS_QUOTA_GOAL_METRICS, }; -- cgit v1.2.3 From 4ee4fb3214a8aadf5e8d253f8a34b76baff7f37d Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 27 Apr 2026 18:33:52 -0700 Subject: mm/damon/core: introduce failed region quota charge ratio DAMOS quota is charged to all DAMOS action application attempted memory, regardless of how much of the memory the action was successful and failed. This makes understanding quota behavior without DAMOS stat but only with end level metrics (e.g., increased amount of free memory for DAMOS_PAGEOUT action) difficult. Also, charging action-failed memory same as action-successful memory is somewhat unfair, as successful action application will induce more overhead in most cases. Introduce DAMON core API for setting the charge ratio for such action-failed memory. It allows API callers to specify the ratio in a flexible way, by setting the numerator and the denominator. Link: https://lore.kernel.org/20260428013402.115171-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 986b8c902585..2bb43910e22e 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -236,6 +236,8 @@ enum damos_quota_goal_tuner { * @goals: Head of quota tuning goals (&damos_quota_goal) list. * @goal_tuner: Goal-based @esz tuning algorithm to use. * @esz: Effective size quota in bytes. + * @fail_charge_num: Failed regions charge rate numerator. + * @fail_charge_denom: Failed regions charge rate denominator. * * @weight_sz: Weight of the region's size for prioritization. * @weight_nr_accesses: Weight of the region's nr_accesses for prioritization. @@ -265,6 +267,10 @@ enum damos_quota_goal_tuner { * * The resulting effective size quota in bytes is set to @esz. * + * For DAMOS action applying failed amount of regions, charging those same to + * those that the action has successfully applied may be unfair. For the + * reason, 'the size * @fail_charge_num / @fail_charge_denom' is charged. + * * For selecting regions within the quota, DAMON prioritizes current scheme's * target memory regions using the &struct damon_operations->get_scheme_score. * You could customize the prioritization logic by setting &weight_sz, @@ -279,6 +285,9 @@ struct damos_quota { enum damos_quota_goal_tuner goal_tuner; unsigned long esz; + unsigned int fail_charge_num; + unsigned int fail_charge_denom; + unsigned int weight_sz; unsigned int weight_nr_accesses; unsigned int weight_age; -- cgit v1.2.3 From ffe55393137c01aa01940b528afcea8c5a108ed7 Mon Sep 17 00:00:00 2001 From: Muchun Song Date: Fri, 10 Apr 2026 17:24:19 +0800 Subject: mm/sparse: remove sparse buffer pre-allocation mechanism Commit 9bdac9142407 ("sparsemem: Put mem map for one node together.") introduced a mechanism to pre-allocate a large memory block to hold all memmaps for a NUMA node upfront. However, the original commit message did not clearly state the actual benefits or the necessity of explicitly pre-allocating a single chunk for all memmap areas of a given node. One of the concerns about removing this pre-allocation is that the subsequent per-section memmap allocations could become scattered around, and might turn too many memory blocks/sections into an "un-offlinable" state. However, tests show that even without the explicit node-wide pre-allocation, memblock still allocates memory closely and back-to-back. When tracing vmemmap_set_pmd allocations, the physical chunks allocated by memblock are strictly adjacent to each other in a single contiguous physical range (mapped top-down). Because they are packed tightly together naturally, they will at most consume or pollute the exact same number of memory blocks as the explicit pre-allocation did. Another concern is the boot performance impact of calling memmap_alloc() multiple times compared to one large node-wide allocation. Tests on a 256GB VM showed that memmap allocation time increased from 199,555 ns to 741,292 ns. Even though it is 3.7x slower, on a 1TB machine, the entire memory allocation time would only take a few milliseconds. This boot performance difference is completely negligible. Since no negative impact on memory offlining behavior or noticeable boot performance regression was found, this patch proposes removing the explicit node-wide memmap pre-allocation mechanism to reduce the maintenance burden. Link: https://lore.kernel.org/20260410092419.2446420-1-songmuchun@bytedance.com Signed-off-by: Muchun Song Acked-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand (Arm) Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/mm.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/mm.h b/include/linux/mm.h index e3b6112a8d79..8a0078a4dc78 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -4855,7 +4855,6 @@ static inline void print_vma_addr(char *prefix, unsigned long rip) } #endif -void *sparse_buffer_alloc(unsigned long size); unsigned long section_map_size(void); struct page * __populate_section_memmap(unsigned long pfn, unsigned long nr_pages, int nid, struct vmem_altmap *altmap, -- cgit v1.2.3 From f2a950170f7a78761c2b2e5e535716fb0f8c0813 Mon Sep 17 00:00:00 2001 From: "JP Kobryn (Meta)" Date: Mon, 6 Apr 2026 12:50:14 -0700 Subject: mm/vmpressure: skip socket pressure for costly order reclaim When reclaim is triggered by high order allocations on a fragmented system, vmpressure() can report poor reclaim efficiency even though the system has plenty of free memory. This is because many pages are scanned, but few are found to actually reclaim - the pages are actively in use and don't need to be freed. The resulting scan:reclaim ratio causes vmpressure() to assert socket pressure, throttling TCP throughput unnecessarily. Costly order allocations (above PAGE_ALLOC_COSTLY_ORDER) rely heavily on compaction to succeed, so poor reclaim efficiency at these orders does not necessarily indicate memory pressure. The kernel already treats this order as the boundary where reclaim is no longer expected to succeed and compaction may take over. Make vmpressure() order-aware through an additional parameter sourced from scan_control at existing call sites. Socket pressure is now only asserted when order <= PAGE_ALLOC_COSTLY_ORDER. Memcg reclaim is unaffected since try_to_free_mem_cgroup_pages() always uses order 0, which passes the filter unconditionally. Similarly, vmpressure_prio() now passes order 0 internally when calling vmpressure(), ensuring critical pressure from low reclaim priority is not suppressed by the order filter. The patch was motivated by a case of impacted net throughput in production. On one affected host, the memory state at the time showed ~15GB available, zero cgroup pressure, and the following buddyinfo state: Order FreePages 0: 133,970 1: 29,230 2: 17,351 3: 18,984 7+: 0 Using bpf, it was found that 94% of vmpressure calls on this host were from order-7 kswapd reclaim. TCP minimum recv window is rcv_ssthresh:19712. Before patch: 723 out of 3,843 (19%) TCP connections stuck at minimum recv window After live-patching and ~30min elapsed: 0 out of 3,470 TCP connections stuck at minimum recv window Link: https://lore.kernel.org/20260406195014.112521-1-jp.kobryn@linux.dev Signed-off-by: JP Kobryn (Meta) Reviewed-by: Rik van Riel Acked-by: Johannes Weiner Acked-by: Shakeel Butt Acked-by: Jakub Kicinski Reviewed-by: Barry Song Acked-by: Vlastimil Babka (SUSE) Cc: Axel Rasmussen Cc: David Hildenbrand Cc: Eric Dumazet Cc: Kairui Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Qi Zheng Cc: Suren Baghdasaryan Cc: Wei Xu Cc: Yuanchu Xie Signed-off-by: Andrew Morton --- include/linux/vmpressure.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/vmpressure.h b/include/linux/vmpressure.h index 6a2f51ebbfd3..faecd5522401 100644 --- a/include/linux/vmpressure.h +++ b/include/linux/vmpressure.h @@ -30,8 +30,8 @@ struct vmpressure { struct mem_cgroup; #ifdef CONFIG_MEMCG -extern void vmpressure(gfp_t gfp, struct mem_cgroup *memcg, bool tree, - unsigned long scanned, unsigned long reclaimed); +void vmpressure(gfp_t gfp, int order, struct mem_cgroup *memcg, bool tree, + unsigned long scanned, unsigned long reclaimed); extern void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio); extern void vmpressure_init(struct vmpressure *vmpr); @@ -44,8 +44,9 @@ extern int vmpressure_register_event(struct mem_cgroup *memcg, extern void vmpressure_unregister_event(struct mem_cgroup *memcg, struct eventfd_ctx *eventfd); #else -static inline void vmpressure(gfp_t gfp, struct mem_cgroup *memcg, bool tree, - unsigned long scanned, unsigned long reclaimed) {} +static inline void vmpressure(gfp_t gfp, int order, struct mem_cgroup *memcg, + bool tree, unsigned long scanned, + unsigned long reclaimed) {} static inline void vmpressure_prio(gfp_t gfp, struct mem_cgroup *memcg, int prio) {} #endif /* CONFIG_MEMCG */ -- cgit v1.2.3 From 3bbc54dd1b62f1a4b218c70aafbeceeba7c90c5d Mon Sep 17 00:00:00 2001 From: Muchun Song Date: Tue, 28 Apr 2026 16:18:52 +0800 Subject: mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths Currently, the memory hot-remove call chain -- arch_remove_memory(), __remove_pages(), sparse_remove_section() and section_deactivate() -- does not carry the struct dev_pagemap pointer. This prevents the lower levels from knowing whether the section was originally populated with vmemmap optimizations (e.g., DAX with vmemmap optimization enabled). Without this information, we cannot call vmemmap_can_optimize() to determine if the vmemmap pages were optimized. As a result, the vmemmap page accounting during teardown will mistakenly assume a non-optimized allocation, leading to incorrect memmap statistics. To lay the groundwork for fixing the vmemmap page accounting, we need to pass the @pgmap pointer down to the deactivation location. Plumb the @pgmap argument through the APIs of arch_remove_memory(), __remove_pages() and sparse_remove_section(), mirroring the corresponding *_activate() paths. Link: https://lore.kernel.org/20260428081855.1249045-4-songmuchun@bytedance.com Signed-off-by: Muchun Song Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Oscar Salvador Acked-by: David Hildenbrand (Arm) Acked-by: Liam R. Howlett Cc: "Aneesh Kumar K.V" Cc: Joao Martins Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Nicholas Piggin Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/memory_hotplug.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h index 815e908c4135..7c9d66729c60 100644 --- a/include/linux/memory_hotplug.h +++ b/include/linux/memory_hotplug.h @@ -135,9 +135,10 @@ static inline bool movable_node_is_enabled(void) return movable_node_enabled; } -extern void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap); +extern void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap, + struct dev_pagemap *pgmap); extern void __remove_pages(unsigned long start_pfn, unsigned long nr_pages, - struct vmem_altmap *altmap); + struct vmem_altmap *altmap, struct dev_pagemap *pgmap); /* reasonably generic interface to expand the physical pages */ extern int __add_pages(int nid, unsigned long start_pfn, unsigned long nr_pages, @@ -307,7 +308,8 @@ extern int sparse_add_section(int nid, unsigned long pfn, unsigned long nr_pages, struct vmem_altmap *altmap, struct dev_pagemap *pgmap); extern void sparse_remove_section(unsigned long pfn, unsigned long nr_pages, - struct vmem_altmap *altmap); + struct vmem_altmap *altmap, + struct dev_pagemap *pgmap); extern struct zone *zone_for_pfn_range(enum mmop online_type, int nid, struct memory_group *group, unsigned long start_pfn, unsigned long nr_pages); -- cgit v1.2.3 From 58996503b631adc6a268a42f4624a34513c16199 Mon Sep 17 00:00:00 2001 From: Asier Gutierrez Date: Sun, 26 Apr 2026 16:16:17 -0700 Subject: mm/damon: support MADV_COLLAPSE via DAMOS_COLLAPSE scheme action This patch set introces a new action: DAMOS_COLLAPSE. For DAMOS_HUGEPAGE and DAMOS_NOHUGEPAGE to work, khugepaged should be working, since it relies on hugepage_madvise to add a new slot. This slot should be picked up by khugepaged and eventually collapse (or not, if we are using DAMOS_NOHUGEPAGE) the pages. If THP is not enabled, khugepaged will not be working, and therefore no collapse will happen. DAMOS_COLLAPSE eventually calls madvise_collapse, which will collapse the address range synchronously. In cases where there is a large VMA (databases, for example), DAMOS_COLLAPSE allows us to collapse only the hot region, and not the entire VMA. This new action may be required to support autotuning with hugepage as a goal[1]. ========= Benchmarks: ========= MySQL ===== Tests were performed in an ARM physical server with MariaDB 10.5 and sysbench. Read only benchmark was perform with gaussian row hitting, which follows a normal distribution. T n, D h: THP set to never, DAMON action set to hugepage T m, D h: THP set to madvise, DAMON action set to hugepage T n, D c: THP set to never, DAMON action set to collapse Memory consumption. Lower is better. +------------------+----------+----------+----------+ | | T n, D h | T m, D h | T n, D c | +------------------+----------+----------+----------+ | Total memory use | 2.13 | 2.20 | 2.20 | | Huge pages | 0 | 1.3 | 1.27 | +------------------+----------+----------+----------+ Performance in TPS (Transactions Per Second). Higher is better. T n, D h: 18225.58 T m, D h 18252.93 T n, D c: 18270.21 Performance counter I got the number of L1 D/I TLB accesses and the number a D/I TLB accesses that triggered a page walk. I divided the second by the first to get the percentage of page walkes per TLB access. The lower the better. +---------------+--------------+--------------+--------------+ | | T n, D h | T m, D h | T n, D c | +---------------+--------------+--------------+--------------+ | L1 DTLB | 127248242753 | 125431020479 | 125327001821 | | L1 ITLB | 80332558619 | 79346759071 | 79298139590 | | DTLB walk | 75011087 | 52800418 | 55895794 | | ITLB walk | 71577076 | 71505137 | 67262140 | | DTLB % misses | 0.058948623 | 0.042095183 | 0.044599961 | | ITLB % misses | 0.089100954 | 0.090117275 | 0.084821839 | +---------------+--------------+--------------+--------------+ Masim ===== I used masim with the "demo" configuration, but changing the times to 100 seconds for the initial phase and 50 seconds for the rest of the phases. Memory consumption: +------------------+----------+----------+----------+ | | T n, D h | T m, D h | T n, D c | +------------------+----------+----------+----------+ | Total memory use | 2.38 GB | 2.36 GB | 2.37 GB | | Huge pages | 0 | 190 MB | 188 MB | +------------------+----------+----------+----------+ Performance: THP never, DAMOS_HUGEPAGE initial phase: 40,491 accesses/msec, 100001 msecs run low phase 0: 39,658 accesses/msec, 50002 msecs run high phase 0: 41,678 accesses/msec, 50000 msecs run low phase 1: 39,625 accesses/msec, 50003 msecs run high phase 1: 41,658 accesses/msec, 50002 msecs run low phase 2: 39,642 accesses/msec, 50002 msecs run high phase 2: 41,640 accesses/msec, 50001 msecs run THP madvise, DAMOS_HUGEPAGE initial phase: 51,977 accesses/msec, 100000 msecs run low phase 0: 86,953 accesses/msec, 50000 msecs run high phase 0: 94,812 accesses/msec, 50000 msecs run low phase 1: 101,017 accesses/msec, 50000 msecs run high phase 1: 94,841 accesses/msec, 50000 msecs run low phase 2: 100,993 accesses/msec, 50000 msecs run high phase 2: 94,791 accesses/msec, 50001 msecs run THP never, DAMOS_COLLAPSE initial phase: 93,678 accesses/msec, 100001 msecs run low phase 0: 101,475 accesses/msec, 50000 msecs run high phase 0: 98,589 accesses/msec, 50000 msecs run low phase 1: 101,531 accesses/msec, 50001 msecs run high phase 1: 98,506 accesses/msec, 50001 msecs run low phase 2: 101,458 accesses/msec, 50001 msecs run high phase 2: 98,555 accesses/msec, 50000 msecs run Memory consumption dynamic (how quickly collapses occur): It shows in seconds how many huge pages are allocated. +----+----------+----------+ | | T m, D h | T n, D c | +----+----------+----------+ | 5 | 32 | 188 | | 10 | 48 | 188 | | 15 | 64 | 188 | | 20 | 96 | 188 | | 30 | 112 | 188 | | 35 | 144 | 188 | | 40 | 160 | 188 | | 45 | 190 | 188 | | 50 | 190 | 188 | | 55 | 190 | 188 | | 60 | 190 | 188 | +----+----------+----------+ ========= - We can see that DAMOS "hugepage" action works only when THP is set to madvise. "collapse" action works even when THP is set to never. - Performance for "collapse" action is slightly lower than "hugepage" action and THP madvise. This is due to the fact that collapases occur synchronously. With "hugepage" they may occur during page faults. - Memory consumption is slighly lower for "collapse" than "hugepage" with THP madvise. This is due to the khugepage collapses all VMAs, while "collapse" action only collapses the VMAs in the hot region. - There is an improvement in TLB utilization when collapse through "hugepage" or "collapse" actions are triggered. The amount of TLB misses is lower. - "collapse" action is performance synchronously, which means that page collapses happen earlier and more rapidly. This can be useful or not, depending on the scenario. - "hugepage" action may trigger a VMA split in some scenarios, since it needs to change the flag of the VMA to THP enabled. This may lead to additional overhead. Collapse action just adds a new option to chose the correct system balance. Link: https://lore.kernel.org/20260426231619.107231-5-sj@kernel.org Link: https://lore.kernel.org/damon/20260313000816.79933-1-sj@kernel.org/ [1] Signed-off-by: Asier Gutierrez Signed-off-by: SeongJae Park Reviewed-by: SeongJae Park Cc: Cheng-Han Wu Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Liew Rui Yan Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 2bb43910e22e..d3a231275c23 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -121,6 +121,7 @@ struct damon_target { * @DAMOS_PAGEOUT: Reclaim the region. * @DAMOS_HUGEPAGE: Call ``madvise()`` for the region with MADV_HUGEPAGE. * @DAMOS_NOHUGEPAGE: Call ``madvise()`` for the region with MADV_NOHUGEPAGE. + * @DAMOS_COLLAPSE: Call ``madvise()`` for the region with MADV_COLLAPSE. * @DAMOS_LRU_PRIO: Prioritize the region on its LRU lists. * @DAMOS_LRU_DEPRIO: Deprioritize the region on its LRU lists. * @DAMOS_MIGRATE_HOT: Migrate the regions prioritizing warmer regions. @@ -140,6 +141,7 @@ enum damos_action { DAMOS_PAGEOUT, DAMOS_HUGEPAGE, DAMOS_NOHUGEPAGE, + DAMOS_COLLAPSE, DAMOS_LRU_PRIO, DAMOS_LRU_DEPRIO, DAMOS_MIGRATE_HOT, -- cgit v1.2.3 From 90f01f5d6ba57d93363289b3247314b7fd5e8d49 Mon Sep 17 00:00:00 2001 From: "David Hildenbrand (Arm)" Date: Mon, 27 Apr 2026 13:43:16 +0200 Subject: mm: remove page_mapped() Let's replace the last user of page_mapped() by folio_mapped() so we can get rid of page_mapped(). Replace the remaining occurrences of page_mapped() in rmap documentation by folio_mapped(). Link: https://lore.kernel.org/20260427-page_mapped-v1-3-e89c3592c74c@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Matthew Wilcox (Oracle) Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Eduard Zingerman Cc: Harry Yoo Cc: Jann Horn Cc: Jiri Olsa Cc: John Paul Adrian Glaubitz Cc: Kumar Kartikeya Dwivedi Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Martin KaFai Lau Cc: Michal Hocko Cc: Mike Rapoport Cc: Rich Felker Cc: Rik van Riel Cc: Song Liu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Yonghong Song Cc: Yoshinori Sato Signed-off-by: Andrew Morton --- include/linux/mm.h | 10 ---------- 1 file changed, 10 deletions(-) (limited to 'include') diff --git a/include/linux/mm.h b/include/linux/mm.h index 8a0078a4dc78..9cedc5e75aa9 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1888,16 +1888,6 @@ static inline bool folio_mapped(const struct folio *folio) return folio_mapcount(folio) >= 1; } -/* - * Return true if this page is mapped into pagetables. - * For compound page it returns true if any sub-page of compound page is mapped, - * even if this particular sub-page is not itself mapped by any PTE or PMD. - */ -static inline bool page_mapped(const struct page *page) -{ - return folio_mapped(page_folio(page)); -} - static inline struct page *virt_to_head_page(const void *x) { struct page *page = virt_to_page(x); -- cgit v1.2.3 From 7b32f64bc512b40b268776c5ac4d354b325b3197 Mon Sep 17 00:00:00 2001 From: Frederick Mayle Date: Sun, 26 Apr 2026 20:01:47 -0700 Subject: mm: limit filemap_fault readahead to VMA boundaries When a file mapping covers a strict subset of a file, an access to the mapping can trigger readahead of file pages outside the mapped region. Readahead is meant to prefetch pages likely to be accessed soon, but these pages aren't accessible via the same means, so it fair to say we don't have a good indicator they'll be accessed soon. Take an ELF file for example: an access to the end of a program's read-only segment isn't a sign that nearby file contents will be accessed next (they are likely to be mapped discontiguously, or not at all). The pressure from loading these pages into the cache can evict more useful pages. To improve the behavior, make three changes: * Introduce a new readahead_control field, max_index, as a hard limit on the readahead. The existing file_ra_state->size can't be used as a limit, it is more of a hint and can be increased by various heuristics. * Set readahead_control->max_index to the end of the VMA in all of the readahead paths that can be triggered from a fault on a file mapping (both "sync" and "async" readahead). * Limit the read-around range start to the VMA's start. Note that these changes only affect readahead triggered in the context of a fault, they do not affect readahead triggered by read syscalls. If a user mixes the two types of accesses, the behavior is expected to be the following: if a fault causes readahead and places a PG_readahead marker and then a read(2) syscall hits the PG_readahead marker, the resulting async readahead *will not* be limited to the VMA end. Conversely, if a read(2) syscall places a PG_readahead marker and then a fault hits the marker, the async readahead *will* be limited to the VMA end. There is an edge case that the above motivation glosses over: A single file mapping might be backed by multiple VMAs. For example, a whole file could be mapped RW, then part of the mapping made RO using mprotect. This patch would hurt performance of a sequential faulted read of such a mapping, the degree depending on how fragmented the VMAs are. A usage pattern like that is likely rare and already suffering from sub-optimal performance because, e.g., the fragmented VMAs limit the fault-around, so each VMA boundary in a sequential faulted read would cause a minor fault. Still, this patch would make it worse. See a previous discussion of this topic at [1]. Tested by mapping and reading a small subset of a large file, then using the cachestat syscall to verify the number of cached pages didn't exceed the mapping size. In practical scenarios, the effect depends on the specific file and usage. Sometimes there is no effect at all, but, for some ELF files in Android, we see ~20% fewer pages pulled into the cache. A comprehensive performance evaluation hasn't been done, but, in addition to the anecdontal memory savings mentioned above, a benchmark was run with fio 3.38, showing neutral looking results: /data/local/tmp/fio --version fio --name=mmap_test --ioengine=mmap --rw=read --bs=4k \ --offset=1G --size=1G --filesize=3G --numjobs=1 \ --filename=testfile.bin Before: 4366.6 MiB/s (avg of 3459, 4592, 4613, 4697, 4472) After: 4444.0 MiB/s (avg of 4633, 4655, 4511, 4571, 3850) +1.7% Same, with --ioengine=mmap --rw=randread Before: 445.6 MiB/s (avg of 446, 447, 442, 452, 441) After: 447.0 MiB/s (avg of 447, 446, 446, 451, 445) +0.3% Same, with --ioengine=psync --rw=read Before: 3086.6 MiB/s (avg of 3122, 3094, 3066, 3094, 3057) After: 3084.6 MiB/s (avg of 3039, 3103, 3103, 3084, 3094) -0.06% Same, with --ioengine=psync --rw=randread Before: 2226.4 MiB/s (avg of 2256, 2183, 2207, 2265, 2221) After: 2231.4 MiB/s (avg of 2236, 2241, 2236, 2193, 2251) +0.2% Link: https://lore.kernel.org/20260427030148.653228-1-fmayle@google.com Link: https://lore.kernel.org/all/ivnv2crd3et76p2nx7oszuqhzzah756oecn5yuykzqfkqzoygw@yvnlkhjjssoz/ [1] Signed-off-by: Frederick Mayle Reviewed-by: Jan Kara Reviewed-by: Kalesh Singh Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Matthew Wilcox Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton --- include/linux/pagemap.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h index 31a848485ad9..1f50991b43e3 100644 --- a/include/linux/pagemap.h +++ b/include/linux/pagemap.h @@ -1350,6 +1350,7 @@ struct readahead_control { struct file_ra_state *ra; /* private: use the readahead_* accessors instead */ pgoff_t _index; + pgoff_t _max_index; /* limit readahead to _max_index, inclusive */ unsigned int _nr_pages; unsigned int _batch_count; bool dropbehind; @@ -1363,6 +1364,7 @@ struct readahead_control { .mapping = m, \ .ra = r, \ ._index = i, \ + ._max_index = ULONG_MAX, \ } #define VM_READAHEAD_PAGES (SZ_128K / PAGE_SIZE) -- cgit v1.2.3 From 3b9e3cc0405b422db884054ea2417b7b85220c56 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 27 Apr 2026 08:12:20 -0700 Subject: mm/damon/core: introduce damon_ctx->paused Patch series "mm/damon: let DAMON be paused and resumed", v2. DAMON utilizes a few mechanisms that enhance itself over time. Adaptive regions adjustment, goal-based DAMOS quota auto-tuning and monitoring intervals auto-tuning like self-training mechanisms are such examples. It also adds access frequency stability information (age) to the monitoring results, which makes it enhanced over time. Sometimes users have to stop DAMON. In this case, DAMON internal state that enhanced over the time of the last execution simply goes away. Restarted DAMON have to train itself and enhance its output from the scratch. This makes DAMON less useful in such cases. Introducing three such use cases below. Investigation of DAMON. It is best to do the investigation online, especially when it is a production environment. DAMON therefore provides features for such online investigations, including DAMOS stats, monitoring result snapshot exposure, and multiple tracepoints. When those are insufficient, and there are additional clues that could be interfered by DAMON, users have to temporarily stop DAMON to collect the additional clues. It is not very useful since many of DAMON internal clues are gone when DAMON is stopped. The loss of the monitoring results that improved over time is also problematic, especially in production environments. Monitoring of workloads that have different user-known phases. For example, in Android, applications are known to have very different access patterns and behaviors when they are running on the foreground and the background. It can therefore be useful to separate monitoring of apps based on whether they are running on the foreground and on the background. Having two DAMON threads per application that paused and resumed for the apps foreground/background switches can be useful for the purpose. But such pause/resume of the execution is not supported. Tests of DAMON. A few DAMON selftests are using drgn to dump the internal DAMON status. The tests show if the dumped status is the same as what the test code expected. Because DAMON keeps running and modifying its internal status, there are chances of data races that can cause false test results. Stopping DAMON can avoid the race. But, since the internal state of DAMON is dropped, the test coverage will be limited. Let DAMON execution be paused and resumed without loss of the internal state, to overhaul the limitations. For this, introduce a new DAMON context parameter, namely 'pause'. API callers can update it while the context is running, using the online parameters update functions (damon_commit_ctx() and damon_call()). Once it is set, kdamond_fn() main loop will do only limited works excluding the monitoring and DAMOS works, while sleeping sampling intervals per the work. The limited works include handling of the online parameters update. Hence users can unset the 'pause' parameter again. Once it is unset, kdamond_fn() main loop will do all the work again (resumed). Under the paused state, it also does stop condition checks and handling of it, so that paused DAMON can also be stopped if needed. Expose the feature to the user space via DAMON sysfs interface. Also, update existing drgn-based tests to test and use the feature. Tests ===== I confirmed the feature functionality using real time tracing ('perf trace' or 'trace-cmd stream') of damon:damon_aggregated DAMON tracepoint. By pausing and resuming the DAMON execution, I was able to see the trace stops and continued as expected. Note that the pause feature support is added to DAMON user-space tool (damo) after v3.1.9. Users can use '--pause_ctx' command line option of damo for that, and I actually used it for my test. The extended drgn-based selftests are also testing a part of the functionality. Patches Sequence ================ Patch 1 introduces the new core API for the pause feature. Patch 2 extend DAMON sysfs interface for the new parameter. Patches 3-5 update design, usage and ABI documents for the new sysfs file, respectively. The following five patches are for tests. Patch 6 implements a new kunit test for the pause parameter online commitment. Patches 7 and 8 extend DAMON selftest helpers to support the new feature. Patch 9 extends selftest to test the commitment of the feature. Finally, patch 10 updates existing selftest to be safe from the race condition using the pause/resume feature. This patch (of 10): DAMON supports only start and stop of the execution. When it is stopped, its internal data that it self-trained goes away. It will be useful if the execution can be paused and resumed with the previous self-trained data. Introduce per-context API parameter, 'paused', for the purpose. The parameter can be set and unset while DAMON is running and paused, using the online parameters commit helper functions (damon_commit_ctx() and damon_call()). Once 'paused' is set, the kdamond_fn() main loop does only limited works with sampling interval sleep during the works. The limited works include the handling of the online parameters update, so that users can unset the 'pause' and resume the execution when they want. It also keep checking DAMON stop conditions and handling of it, so that DAMON can be stopped while paused if needed. Link: https://lore.kernel.org/20260427151231.113429-1-sj@kernel.org Link: https://lore.kernel.org/20260427151231.113429-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index d3a231275c23..f2370a3a4a9a 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -801,6 +801,7 @@ struct damon_attrs { * @ops: Set of monitoring operations for given use cases. * @addr_unit: Scale factor for core to ops address conversion. * @min_region_sz: Minimum region size. + * @pause: Pause kdamond main loop. * @adaptive_targets: Head of monitoring targets (&damon_target) list. * @schemes: Head of schemes (&damos) list. */ @@ -854,6 +855,7 @@ struct damon_ctx { struct damon_operations ops; unsigned long addr_unit; unsigned long min_region_sz; + bool pause; struct list_head adaptive_targets; struct list_head schemes; -- cgit v1.2.3 From b56ca146a2b2750172f91f6db960a37a1a546efd Mon Sep 17 00:00:00 2001 From: Muhammad Usama Anjum Date: Wed, 29 Apr 2026 15:57:02 +0530 Subject: vmalloc: add __GFP_SKIP_KASAN support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Patch series "kasan: hw_tags: Disable tagging for stack and page-tables", v4. Stacks and page tables are always accessed with the match-all tag, so assigning a new random tag every time at allocation and setting invalid tag at deallocation time, just adds overhead without improving the detection. With __GFP_SKIP_KASAN the page keeps its poison tag and KASAN_TAG_KERNEL (match-all tag) is stored in the page flags while keeping the poison tag in the hardware. The benefit of it is that 256 tag setting instruction per 4 kB page aren't needed at allocation and deallocation time. Thus match-all pointers still work, while non-match tags (other than poison tag) still fault. __GFP_SKIP_KASAN only skips for KASAN_HW_TAGS mode, so coverage is unchanged. Benchmark: The benchmark has two modes. In thread mode, the child process forks and creates N threads. In pgtable mode, the parent maps and faults a specified memory size and then forks repeatedly with children exiting immediately. Thread benchmark: 2000 iterations, 2000 threads: 2.575 s → 2.229 s (~13.4% faster) The pgtable samples: - 2048 MB, 2000 iters 19.08 s → 17.62 s (~7.6% faster) This patch (of 3): For allocations that will be accessed only with match-all pointers (e.g., kernel stacks), setting tags is wasted work. If the caller already set __GFP_SKIP_KASAN, skip tag setting of vmalloc pages. Before this patch, __GFP_SKIP_KASAN wasn't being used with vmalloc APIs. So it wasn't being checked. Now its being checked and acted upon. Other KASAN modes are unchanged because __GFP_SKIP_KASAN is ignored for them in the page allocator, and in vmalloc too we ignore this flag for them. This is a preparatory patch for optimizing kernel stack allocations. Link: https://lore.kernel.org/20260429102704.680174-1-dev.jain@arm.com Link: https://lore.kernel.org/20260429102704.680174-2-dev.jain@arm.com Signed-off-by: Muhammad Usama Anjum Co-developed-by: Ryan Roberts Signed-off-by: Ryan Roberts Co-developed-by: Dev Jain Signed-off-by: Dev Jain Reviewed-by: Catalin Marinas Cc: Arnd Bergmann Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: K Prateek Nayak Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathieu Desnoyers Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/gfp_types.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/gfp_types.h b/include/linux/gfp_types.h index cd4972a7c97c..54ca0c88bab6 100644 --- a/include/linux/gfp_types.h +++ b/include/linux/gfp_types.h @@ -281,9 +281,9 @@ enum { * * %__GFP_SKIP_KASAN makes KASAN skip unpoisoning on page allocation. * Used for userspace and vmalloc pages; the latter are unpoisoned by - * kasan_unpoison_vmalloc instead. For userspace pages, results in - * poisoning being skipped as well, see should_skip_kasan_poison for - * details. Only effective in HW_TAGS mode. + * kasan_unpoison_vmalloc instead. If passed to vmalloc, kasan_unpoison_vmalloc + * is skipped too. For userspace pages, results in poisoning being skipped as + * well, see should_skip_kasan_poison for details. Only effective in HW_TAGS mode. */ #define __GFP_NOWARN ((__force gfp_t)___GFP_NOWARN) #define __GFP_COMP ((__force gfp_t)___GFP_COMP) -- cgit v1.2.3 From 6ae51adb084a9d87a8b9501d2231e20271dece87 Mon Sep 17 00:00:00 2001 From: Muhammad Usama Anjum Date: Wed, 29 Apr 2026 15:57:03 +0530 Subject: kasan: skip HW tagging for all kernel thread stacks HW-tag KASAN never checks kernel stacks because stack pointers carry the match-all tag, so setting/poisoning tags is pure overhead. - Add __GFP_SKIP_KASAN to THREADINFO_GFP so every stack allocator that uses it skips tagging (fork path plus arch users) - Add __GFP_SKIP_KASAN to GFP_VMAP_STACK for the fork-specific vmap stacks. - When reusing cached vmap stacks, skip kasan_unpoison_range() if HW tags are enabled. Software KASAN is unchanged; this only affects tag-based KASAN. Link: https://lore.kernel.org/20260429102704.680174-3-dev.jain@arm.com Signed-off-by: Muhammad Usama Anjum Signed-off-by: Dev Jain Reviewed-by: Catalin Marinas Cc: Arnd Bergmann Cc: Ben Segall Cc: David Hildenbrand (Arm) Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: K Prateek Nayak Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathieu Desnoyers Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Ryan Roberts Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/thread_info.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h index 051e42902690..307b8390fc67 100644 --- a/include/linux/thread_info.h +++ b/include/linux/thread_info.h @@ -92,7 +92,7 @@ static inline long set_restart_fn(struct restart_block *restart, #define THREAD_ALIGN THREAD_SIZE #endif -#define THREADINFO_GFP (GFP_KERNEL_ACCOUNT | __GFP_ZERO) +#define THREADINFO_GFP (GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_SKIP_KASAN) /* * flag set/clear/test wrappers -- cgit v1.2.3 From d46644af7636c4cb876110c8ff7f1efbbb815bfe Mon Sep 17 00:00:00 2001 From: Muhammad Usama Anjum Date: Wed, 29 Apr 2026 15:57:04 +0530 Subject: mm: skip KASAN tagging for page-allocated page tables Page tables are always accessed via the linear mapping with a match-all tag, so HW-tag KASAN never checks them. For page-allocated tables (PTEs and PGDs etc), avoid the tag setup and poisoning overhead by using __GFP_SKIP_KASAN. SLUB-backed page tables are unchanged for now. (They aren't widely used and require more SLUB related skip logic. Leave it later.) Link: https://lore.kernel.org/20260429102704.680174-4-dev.jain@arm.com Signed-off-by: Muhammad Usama Anjum Signed-off-by: Dev Jain Reviewed-by: Ryan Roberts Reviewed-by: Catalin Marinas Acked-by: David Hildenbrand (Arm) Cc: Arnd Bergmann Cc: Ben Segall Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: K Prateek Nayak Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathieu Desnoyers Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/asm-generic/pgalloc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/asm-generic/pgalloc.h b/include/asm-generic/pgalloc.h index 57137d3ac159..051aa1331051 100644 --- a/include/asm-generic/pgalloc.h +++ b/include/asm-generic/pgalloc.h @@ -4,7 +4,7 @@ #ifdef CONFIG_MMU -#define GFP_PGTABLE_KERNEL (GFP_KERNEL | __GFP_ZERO) +#define GFP_PGTABLE_KERNEL (GFP_KERNEL | __GFP_ZERO | __GFP_SKIP_KASAN) #define GFP_PGTABLE_USER (GFP_PGTABLE_KERNEL | __GFP_ACCOUNT) /** -- cgit v1.2.3 From 70d8797c15d640982365e96e34e93a3aa38e82da Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Tue, 28 Apr 2026 21:12:23 -0700 Subject: mm/damon: introduce damon_set_region_system_rams_default() Patch series "mm/damon/reclaim,lru_sort: monitor all system rams by default". DAMON_RECLAIM and DAMON_LRU_SORT set the biggest 'System RAM' resource of the system as the default monitoring target address range. The main intention behind the design is to minimize the overhead coming from monitoring of non-System RAM areas. This could result in an odd setup when there are multiple discrete System RAMs of considerable sizes. For example, there are System RAMs each having 500 GiB size. In this case, only the first 500 GiB will be set as the monitoring region by default. This is particularly common on NUMA systems. Hence the modules allow users to set the monitoring target address range using the module parameters if the default setup doesn't work for them. In other words, the current design trades ease of setup for lower overhead. However, because DAMON utilizes the sampling based access check and the adaptive regions adjustment mechanisms, the overhead from the monitoring of non-System RAM areas should be negligible in most setups. Meanwhile, the setup complexity is causing real headaches for users who need to run those modules on various types of systems. That is, the current tradeoff is not a good deal. Set the physical address range that can cover all System RAM areas of the system as the default monitoring regions for DAMON_RECLAIM and DAMON_LRU_SORT. Technically speaking, this is changing documented behavior. However, it makes no sense to believe there is a real use case that really depends on the old weird default behavior. If the old default behavior was working for them in the reasonable way, this change will only add a negligible amount of monitoring overhead. If it didn't work, the users may already be using manual monitoring regions setup, and they will not be affected by this change. Patches Sequence ================ Patch 1 introduces a new core function that will be used for the new default monitoring target region setup. Patch 2 and 3 update DAMON_RECLAIM and DAMON_LRU_SORT to use the new function instead of the old one, respectively. Patch 4 removes the old core function that was replaced by the new one, as there is no more user of it. Patch 5 updates DAMON_STAT to use the new one instead of its in-house nearly-duplicate self implementation of the functionality. Finally patches 6 and 7 update the DAMON_RECLAIM and DAMON_LRU_SORT user documentation for the new behaviors, respectively. This patch (of 7): damon_set_region_biggest_system_ram_default() sets the monitoring target region as the caller requested. If the caller didn't specify the region, it finds the biggest System RAM of the system and sets it as the target region. When there are more than one considerable size of System RAM resources in the system, the default target setup makes no sense. Introduce a variant, namely damon_set_region_system_rams_default(). It sets a physical address range that covers all System RAM resources as the default target region. Link: https://lore.kernel.org/20260429041232.90257-1-sj@kernel.org Link: https://lore.kernel.org/20260429041232.90257-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index f2370a3a4a9a..f656908b2d38 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -1010,6 +1010,11 @@ int damon_kdamond_pid(struct damon_ctx *ctx); int damon_call(struct damon_ctx *ctx, struct damon_call_control *control); int damos_walk(struct damon_ctx *ctx, struct damos_walk_control *control); +int damon_set_region_system_rams_default(struct damon_target *t, + unsigned long *start, unsigned long *end, + unsigned long addr_unit, + unsigned long min_region_sz); + int damon_set_region_biggest_system_ram_default(struct damon_target *t, unsigned long *start, unsigned long *end, unsigned long addr_unit, -- cgit v1.2.3 From 3a870b43776c0c9740a087eb0d831cd6cb8016f7 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Tue, 28 Apr 2026 21:12:26 -0700 Subject: mm/damon/core: remove damon_set_region_biggest_system_ram_default() Now nobody is using damon_set_region_biggest_system_ram_default(). Remove it. Link: https://lore.kernel.org/20260429041232.90257-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index f656908b2d38..c7a31572689b 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -1015,11 +1015,6 @@ int damon_set_region_system_rams_default(struct damon_target *t, unsigned long addr_unit, unsigned long min_region_sz); -int damon_set_region_biggest_system_ram_default(struct damon_target *t, - unsigned long *start, unsigned long *end, - unsigned long addr_unit, - unsigned long min_region_sz); - #endif /* CONFIG_DAMON */ #endif /* _DAMON_H */ -- cgit v1.2.3 From 9d5685286aa8c5ef70d8e1a34cef5daf518ae237 Mon Sep 17 00:00:00 2001 From: Zhouyi Zhou Date: Tue, 5 May 2026 02:11:25 +0000 Subject: highmem-internal.h: fix typo in the comment for kunmap_atomic() Replace `PREEMP_RT` with `PREEMPT_RT` in the header comment to match the correct kernel configuration name. Link: https://lore.kernel.org/20260505021125.1941691-1-zhouzhouyi@gmail.com Signed-off-by: Zhouyi Zhou Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Andrew Morton --- include/linux/highmem-internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/highmem-internal.h b/include/linux/highmem-internal.h index 0574c21ca45d..bb71e7dba4f7 100644 --- a/include/linux/highmem-internal.h +++ b/include/linux/highmem-internal.h @@ -262,7 +262,7 @@ static inline bool is_kmap_addr(const void *x) * @__addr: Virtual address to be unmapped * * Unmaps an address previously mapped by kmap_atomic() and re-enables - * pagefaults. Depending on PREEMP_RT configuration, re-enables also + * pagefaults. Depending on PREEMPT_RT configuration, re-enables also * migration and preemption. Users should not count on these side effects. * * Mappings should be unmapped in the reverse order that they were mapped. -- cgit v1.2.3 From cd2464a059d6e88eecda87d71d3dbc87175289f0 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 31 Mar 2026 16:28:38 +0200 Subject: init.h: discard exitcall symbols early Any __exitcall() and built-in module_exit() handler is marked as __used, which leads to the code being included in the object file and later discarded at link time. As far as I can tell, this was originally added at the same time as initcalls were marked the same way, to prevent them from getting dropped with gcc-3.4, but it was never actaully necessary to keep exit functions around. Mark them as __maybe_unused instead, which lets the compiler treat the exitcalls as entirely unused, and make better decisions about dropping specializing static functions called from these. Link: https://lore.kernel.org/all/acruxMNdnUlyRHiy@google.com/ Link: https://lore.kernel.org/20260331142846.3187706-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Acked-by: Nicolas Schier Cc: Andriy Shevchenko Cc: Dmitry Torokhov Cc: Josh Poimboeuf Cc: Kees Cook Cc: Marco Elver Cc: Nathan Chancellor Cc: Peter Zijlstra Cc: Petr Mladek Signed-off-by: Andrew Morton --- include/linux/init.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/init.h b/include/linux/init.h index 40331923b9f4..6326c61e2332 100644 --- a/include/linux/init.h +++ b/include/linux/init.h @@ -47,7 +47,7 @@ #define __initdata __section(".init.data") #define __initconst __section(".init.rodata") #define __exitdata __section(".exit.data") -#define __exit_call __used __section(".exitcall.exit") +#define __exit_call __maybe_unused __section(".exitcall.exit") /* * modpost check for section mismatches during the kernel build. -- cgit v1.2.3 From c02be2ad2b88c67c5d7c06b6aa7083b5b40e1077 Mon Sep 17 00:00:00 2001 From: Yury Norov Date: Fri, 24 Apr 2026 22:08:56 -0400 Subject: uaccess: unify inline vs outline copy_{from,to}_user() selection The kernel allows arches to select between inline and outline implementations of the copy_{from,to}_user() by defining individual INLINE_COPY_FROM_USER and INLINE_COPY_TO_USER, correspondingly. However, all arches enable or disable them always together. Without the real use-case for one helper being inlined while the other outlined, having independent controls is excessive and error prone. Switch the codebase to the single unified INLINE_COPY_USER control. Link: https://lore.kernel.org/20260425020857.356850-3-ynorov@nvidia.com Signed-off-by: Yury Norov Tested-by: Alice Ryhl Cc: Arnd Bergmann Cc: Christophe Leroy (CS GROUP) Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: Randy Dunlap Cc: Viktor Malik Signed-off-by: Andrew Morton --- include/asm-generic/uaccess.h | 3 +-- include/linux/uaccess.h | 12 ++++++------ 2 files changed, 7 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h index b276f783494c..4569045e7139 100644 --- a/include/asm-generic/uaccess.h +++ b/include/asm-generic/uaccess.h @@ -91,8 +91,7 @@ raw_copy_to_user(void __user *to, const void *from, unsigned long n) memcpy((void __force *)to, from, n); return 0; } -#define INLINE_COPY_FROM_USER -#define INLINE_COPY_TO_USER +#define INLINE_COPY_USER #endif /* CONFIG_UACCESS_MEMCPY */ /* diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 56328601218c..6100f1046546 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -84,7 +84,7 @@ * the 6 functions (copy_{to,from}_user(), __copy_{to,from}_user_inatomic()) * that are used instead. Out of those, __... ones are inlined. Plain * copy_{to,from}_user() might or might not be inlined. If you want them - * inlined, have asm/uaccess.h define INLINE_COPY_{TO,FROM}_USER. + * inlined, have asm/uaccess.h define INLINE_COPY_USER. * * NOTE: only copy_from_user() zero-pads the destination in case of short copy. * Neither __copy_from_user() nor __copy_from_user_inatomic() zero anything @@ -157,7 +157,7 @@ __copy_to_user(void __user *to, const void *from, unsigned long n) } /* - * Architectures that #define INLINE_COPY_TO_USER use this function + * Architectures that #define INLINE_COPY_USER use this function * directly in the normal copy_to/from_user(), the other ones go * through an extern _copy_to/from_user(), which expands the same code * here. @@ -190,7 +190,7 @@ fail: memset(to + (n - res), 0, res); return res; } -#ifndef INLINE_COPY_FROM_USER +#ifndef INLINE_COPY_USER extern __must_check unsigned long _copy_from_user(void *, const void __user *, unsigned long); #endif @@ -207,7 +207,7 @@ _inline_copy_to_user(void __user *to, const void *from, unsigned long n) } return n; } -#ifndef INLINE_COPY_TO_USER +#ifndef INLINE_COPY_USER extern __must_check unsigned long _copy_to_user(void __user *, const void *, unsigned long); #endif @@ -217,7 +217,7 @@ copy_from_user(void *to, const void __user *from, unsigned long n) { if (!check_copy_size(to, n, false)) return n; -#ifdef INLINE_COPY_FROM_USER +#ifdef INLINE_COPY_USER return _inline_copy_from_user(to, from, n); #else return _copy_from_user(to, from, n); @@ -230,7 +230,7 @@ copy_to_user(void __user *to, const void *from, unsigned long n) if (!check_copy_size(from, n, true)) return n; -#ifdef INLINE_COPY_TO_USER +#ifdef INLINE_COPY_USER return _inline_copy_to_user(to, from, n); #else return _copy_to_user(to, from, n); -- cgit v1.2.3 From bd99fcfc6219ebe36ae4d0bf5333b5ecc17b53df Mon Sep 17 00:00:00 2001 From: Yury Norov Date: Fri, 24 Apr 2026 22:08:57 -0400 Subject: uaccess: minimize INLINE_COPY_USER-related ifdefery Now that we've got the same config selecting inline vs outline copy_to_user() and copy_from_user(), we can simplify the corresponding logic in the uaccess.h. Link: https://lore.kernel.org/20260425020857.356850-4-ynorov@nvidia.com Fixes: 1f9a8286bc0c ("uaccess: always export _copy_[from|to]_user with CONFIG_RUST") Signed-off-by: Yury Norov Tested-by: Alice Ryhl Cc: Arnd Bergmann Cc: Christophe Leroy (CS GROUP) Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: Randy Dunlap Cc: Viktor Malik Signed-off-by: Andrew Morton --- include/linux/uaccess.h | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) (limited to 'include') diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 6100f1046546..e0c3d6e29301 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -190,10 +190,6 @@ fail: memset(to + (n - res), 0, res); return res; } -#ifndef INLINE_COPY_USER -extern __must_check unsigned long -_copy_from_user(void *, const void __user *, unsigned long); -#endif static inline __must_check unsigned long _inline_copy_to_user(void __user *to, const void *from, unsigned long n) @@ -207,7 +203,13 @@ _inline_copy_to_user(void __user *to, const void *from, unsigned long n) } return n; } -#ifndef INLINE_COPY_USER +#ifdef INLINE_COPY_USER +# define _copy_to_user _inline_copy_to_user +# define _copy_from_user _inline_copy_from_user +#else +extern __must_check unsigned long +_copy_from_user(void *, const void __user *, unsigned long); + extern __must_check unsigned long _copy_to_user(void __user *, const void *, unsigned long); #endif @@ -217,11 +219,7 @@ copy_from_user(void *to, const void __user *from, unsigned long n) { if (!check_copy_size(to, n, false)) return n; -#ifdef INLINE_COPY_USER - return _inline_copy_from_user(to, from, n); -#else return _copy_from_user(to, from, n); -#endif } static __always_inline unsigned long __must_check @@ -229,12 +227,7 @@ copy_to_user(void __user *to, const void *from, unsigned long n) { if (!check_copy_size(from, n, true)) return n; - -#ifdef INLINE_COPY_USER - return _inline_copy_to_user(to, from, n); -#else return _copy_to_user(to, from, n); -#endif } #ifndef copy_mc_to_kernel -- cgit v1.2.3 From 5a13e296a3e32a70db2a520d8611a53d7bde10e8 Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Thu, 30 Apr 2026 16:15:33 +0200 Subject: kcov: refactor common handle ID into kcov_common_handle_id MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Store common handle IDs in "struct kcov_common_handle_id", which consumes no space in non-KCOV builds. This cleanup removes #ifdef boilerplate code from subsystems that integrate with KCOV (in particular in usbip_common.h and skbuff.h, see the diffstat). This should also make it easier to add KCOV remote coverage to more subsystems in the future. Link: https://lore.kernel.org/20260430-kcov-refactor-common-handle-v1-1-23a0c7a0ba38@google.com Signed-off-by: Jann Horn Acked-by: Greg Kroah-Hartman Reviewed-by: Dmitry Vyukov Acked-by: Jakub Kicinski Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Eugenio Pérez Cc: Hongren (Zenithal) Zheng Cc: Jann Horn Cc: Jason Wang Cc: "Michael S. Tsirkin" Cc: Shuah Khan Cc: Valentina Manea Signed-off-by: Andrew Morton --- include/linux/kcov.h | 12 ++++++------ include/linux/skbuff.h | 14 +++----------- include/linux/types.h | 6 ++++++ 3 files changed, 15 insertions(+), 17 deletions(-) (limited to 'include') diff --git a/include/linux/kcov.h b/include/linux/kcov.h index 0143358874b0..cdb72b3859d8 100644 --- a/include/linux/kcov.h +++ b/include/linux/kcov.h @@ -43,11 +43,11 @@ do { \ /* See Documentation/dev-tools/kcov.rst for usage details. */ void kcov_remote_start(u64 handle); void kcov_remote_stop(void); -u64 kcov_common_handle(void); +struct kcov_common_handle_id kcov_common_handle(void); -static inline void kcov_remote_start_common(u64 id) +static inline void kcov_remote_start_common(struct kcov_common_handle_id id) { - kcov_remote_start(kcov_remote_handle(KCOV_SUBSYSTEM_COMMON, id)); + kcov_remote_start(kcov_remote_handle(KCOV_SUBSYSTEM_COMMON, id.val)); } static inline void kcov_remote_start_usb(u64 id) @@ -99,11 +99,11 @@ static inline void kcov_prepare_switch(struct task_struct *t) {} static inline void kcov_finish_switch(struct task_struct *t) {} static inline void kcov_remote_start(u64 handle) {} static inline void kcov_remote_stop(void) {} -static inline u64 kcov_common_handle(void) +static inline struct kcov_common_handle_id kcov_common_handle(void) { - return 0; + return (struct kcov_common_handle_id){}; } -static inline void kcov_remote_start_common(u64 id) {} +static inline void kcov_remote_start_common(struct kcov_common_handle_id id) {} static inline void kcov_remote_start_usb(u64 id) {} static inline void kcov_remote_start_usb_softirq(u64 id) {} static inline void kcov_remote_stop_softirq(void) {} diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 2bcf78a4de7b..a3fe418f7ced 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1082,9 +1082,7 @@ struct sk_buff { __u16 network_header; __u16 mac_header; -#ifdef CONFIG_KCOV - u64 kcov_handle; -#endif + struct kcov_common_handle_id kcov_handle; ); /* end headers group */ @@ -5437,20 +5435,14 @@ static inline void skb_reset_csum_not_inet(struct sk_buff *skb) } static inline void skb_set_kcov_handle(struct sk_buff *skb, - const u64 kcov_handle) + struct kcov_common_handle_id kcov_handle) { -#ifdef CONFIG_KCOV skb->kcov_handle = kcov_handle; -#endif } -static inline u64 skb_get_kcov_handle(struct sk_buff *skb) +static inline struct kcov_common_handle_id skb_get_kcov_handle(struct sk_buff *skb) { -#ifdef CONFIG_KCOV return skb->kcov_handle; -#else - return 0; -#endif } static inline void skb_mark_for_recycle(struct sk_buff *skb) diff --git a/include/linux/types.h b/include/linux/types.h index 608050dbca6a..93166b0b0617 100644 --- a/include/linux/types.h +++ b/include/linux/types.h @@ -224,6 +224,12 @@ struct ustat { char f_fpack[6]; }; +struct kcov_common_handle_id { +#ifdef CONFIG_KCOV + u64 val; +#endif +}; + /** * struct callback_head - callback structure for use with RCU and task_work * @next: next update requests in a list -- cgit v1.2.3 From 25c786a9f7f8b5e882367f569020f1f37ac9fea7 Mon Sep 17 00:00:00 2001 From: Philipp Stanner Date: Thu, 7 May 2026 11:49:19 +0200 Subject: llist: make locking comments consistent llist's locking requirement table has a legend which claims that all operations not needing a lock a marked with '-', whereas in truth for some table entries just a whitespace is used. Add the '-' to all appropriate places. Link: https://lore.kernel.org/20260507094918.23910-2-phasta@kernel.org Signed-off-by: Philipp Stanner Cc: Jens Axboe Cc: "Paul E . McKenney" Cc: Shakeel Butt Cc: Tejun Heo Signed-off-by: Andrew Morton --- include/linux/llist.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/llist.h b/include/linux/llist.h index 607b2360c938..8846b7709669 100644 --- a/include/linux/llist.h +++ b/include/linux/llist.h @@ -26,8 +26,8 @@ * * | add | del_first | del_all * add | - | - | - - * del_first | | L | L - * del_all | | | - + * del_first | - | L | L + * del_all | - | - | - * * Where, a particular row's operation can happen concurrently with a column's * operation, with "-" being no lock needed, while "L" being lock is needed. -- cgit v1.2.3 From 1d9c9493692eccd16b47610f1d21cc7a100199e9 Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Tue, 5 May 2026 11:00:46 +0200 Subject: kcov: allow simultaneous KCOV_ENABLE/KCOV_REMOTE_ENABLE Allow the same userspace thread to simultaneously collect normal coverage in syscall context (KCOV_ENABLE) and remote coverage of asynchronous work created by the thread (KCOV_REMOTE_ENABLE). With this, remote KCOV coverage becomes useful for generic fuzzing and not just fuzzing of specific data injection interfaces. This requires that the task_struct::kcov_* fields are separated into ones that are used by the task that generates coverage, and ones that are used by the task that requested remote coverage. To split this up: - Split task_struct::kcov into kcov and kcov_remote. kcov_task_exit() now has to clean up both separately. - Only use task_struct::kcov_mode on the task that generates coverage. - Only reset task_struct::kcov_handle on the task that requested remote coverage. After this change, fields used by the task that generates coverage are: - kcov_mode - kcov_size - kcov_area - kcov - kcov_sequence - kcov_softirq Fields used by the task that requested remote coverage are: - kcov_remote - kcov_handle [jannh@google.com: remove unused constant KCOV_MODE_REMOTE, per Dmitry] Link: https://lore.kernel.org/20260515-kcov-simultaneous-remote-v2-1-56fde1cfa509@google.com [jannh@google.com: update documentation on remote coverage collection] Link: https://lore.kernel.org/20260519-kcov-docs-v1-1-5bb22f4cb20c@google.com [jannh@google.com: move and reword sentence on simultaneous normal/remote collection Link: https://lore.kernel.org/20260520-kcov-docs-v2-1-819f78778763@google.com Link: https://lore.kernel.org/20260505-kcov-simultaneous-remote-v1-1-a670ba7cefd2@google.com Signed-off-by: Jann Horn Reviewed-by: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Marco Elver Signed-off-by: Andrew Morton --- include/linux/kcov.h | 2 -- include/linux/sched.h | 3 +++ 2 files changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/kcov.h b/include/linux/kcov.h index cdb72b3859d8..895b761b2db1 100644 --- a/include/linux/kcov.h +++ b/include/linux/kcov.h @@ -21,8 +21,6 @@ enum kcov_mode { KCOV_MODE_TRACE_PC = 2, /* Collecting comparison operands mode. */ KCOV_MODE_TRACE_CMP = 3, - /* The process owns a KCOV remote reference. */ - KCOV_MODE_REMOTE = 4, }; #define KCOV_IN_CTXSW (1 << 30) diff --git a/include/linux/sched.h b/include/linux/sched.h index ee06cba5c6f5..d71cec884a5d 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1517,6 +1517,9 @@ struct task_struct { /* KCOV descriptor wired with this task or NULL: */ struct kcov *kcov; + /* KCOV descriptor for remote coverage collection from other tasks: */ + struct kcov *kcov_remote; + /* KCOV common handle for remote coverage collection: */ u64 kcov_handle; -- cgit v1.2.3 From c4697486fc232e821a33191d809d0ac3bb600027 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 07:17:44 +0200 Subject: raid6: turn the userspace test harness into a kunit test Patch series "cleanup the RAID6 P/Q library", v3. This series cleans up the RAID6 P/Q library to match the recent updates to the RAID 5 XOR library and other CRC/crypto libraries. This includes providing properly documented external interfaces, hiding the internals, using static_call instead of indirect calls and turning the user space test suite into an in-kernel kunit test which is also extended to improve coverage. Note that this changes registration so that non-priority algorithms are not registered, which greatly helps with the benchmark time at boot time. I'd like to encourage all architecture maintainers to see if they can further optimized this by registering as few as possible algorithms when there is a clear benefit in optimized or more unrolled implementations. This patch (of 18): Currently the raid6 code can be compiled as userspace code to run the test suite. Convert that to be a kunit case with minimal changes to avoid mutating global state so that we can drop this requirement. Note that this is not a good kunit test case yet and will need a lot more work, but that is deferred until the raid6 code is moved to it's new place, which is easier if the userspace makefile doesn't need adjustments for the new location first. Link: https://lore.kernel.org/20260518051804.462141-1-hch@lst.de Link: https://lore.kernel.org/20260518051804.462141-2-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Ard Biesheuvel Tested-by: Ard Biesheuvel # kunit only on arm64 Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Li Nan Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Song Liu Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton --- include/linux/raid/pq.h | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h index 2467b3be15c9..08c5995ea980 100644 --- a/include/linux/raid/pq.h +++ b/include/linux/raid/pq.h @@ -144,7 +144,6 @@ extern const struct raid6_calls raid6_neonx8; /* Algorithm list */ extern const struct raid6_calls * const raid6_algos[]; extern const struct raid6_recov_calls *const raid6_recov_algos[]; -int raid6_select_algo(void); /* Return values from chk_syndrome */ #define RAID6_OK 0 @@ -165,8 +164,6 @@ extern void (*raid6_2data_recov)(int disks, size_t bytes, int faila, int failb, void **ptrs); extern void (*raid6_datap_recov)(int disks, size_t bytes, int faila, void **ptrs); -void raid6_dual_recov(int disks, size_t bytes, int faila, int failb, - void **ptrs); /* Some definitions to allow code to be compiled for testing in userspace */ #ifndef __KERNEL__ -- cgit v1.2.3 From 3d6beb659ddf0664612bafacb0bd9030ba6ec7e6 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 07:17:45 +0200 Subject: raid6: remove __KERNEL__ ifdefs With the test code ported to kernel space, none of this is required. Link: https://lore.kernel.org/20260518051804.462141-3-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Ard Biesheuvel Tested-by: Ard Biesheuvel # kunit only on arm64 Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Li Nan Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Song Liu Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton --- include/linux/raid/pq.h | 90 ------------------------------------------------- 1 file changed, 90 deletions(-) (limited to 'include') diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h index 08c5995ea980..d26788fada58 100644 --- a/include/linux/raid/pq.h +++ b/include/linux/raid/pq.h @@ -8,8 +8,6 @@ #ifndef LINUX_RAID_RAID6_H #define LINUX_RAID_RAID6_H -#ifdef __KERNEL__ - #include #include @@ -19,59 +17,6 @@ static inline void *raid6_get_zero_page(void) return page_address(ZERO_PAGE(0)); } -#else /* ! __KERNEL__ */ -/* Used for testing in user space */ - -#include -#include -#include -#include -#include -#include -#include - -/* Not standard, but glibc defines it */ -#define BITS_PER_LONG __WORDSIZE - -typedef uint8_t u8; -typedef uint16_t u16; -typedef uint32_t u32; -typedef uint64_t u64; - -#ifndef PAGE_SIZE -# define PAGE_SIZE 4096 -#endif -#ifndef PAGE_SHIFT -# define PAGE_SHIFT 12 -#endif -extern const char raid6_empty_zero_page[PAGE_SIZE]; - -#define __init -#define __exit -#ifndef __attribute_const__ -# define __attribute_const__ __attribute__((const)) -#endif -#define noinline __attribute__((noinline)) - -#define preempt_enable() -#define preempt_disable() -#define cpu_has_feature(x) 1 -#define enable_kernel_altivec() -#define disable_kernel_altivec() - -#undef EXPORT_SYMBOL -#define EXPORT_SYMBOL(sym) -#undef EXPORT_SYMBOL_GPL -#define EXPORT_SYMBOL_GPL(sym) -#define MODULE_LICENSE(licence) -#define MODULE_DESCRIPTION(desc) -#define subsys_initcall(x) -#define module_exit(x) - -#define IS_ENABLED(x) (x) -#define CONFIG_RAID6_PQ_BENCHMARK 1 -#endif /* __KERNEL__ */ - /* Routine choices */ struct raid6_calls { void (*gen_syndrome)(int, size_t, void **); @@ -165,39 +110,4 @@ extern void (*raid6_2data_recov)(int disks, size_t bytes, int faila, int failb, extern void (*raid6_datap_recov)(int disks, size_t bytes, int faila, void **ptrs); -/* Some definitions to allow code to be compiled for testing in userspace */ -#ifndef __KERNEL__ - -# define jiffies raid6_jiffies() -# define printk printf -# define pr_err(format, ...) fprintf(stderr, format, ## __VA_ARGS__) -# define pr_info(format, ...) fprintf(stdout, format, ## __VA_ARGS__) -# define GFP_KERNEL 0 -# define __get_free_pages(x, y) ((unsigned long)mmap(NULL, PAGE_SIZE << (y), \ - PROT_READ|PROT_WRITE, \ - MAP_PRIVATE|MAP_ANONYMOUS,\ - 0, 0)) -# define free_pages(x, y) munmap((void *)(x), PAGE_SIZE << (y)) - -static inline void cpu_relax(void) -{ - /* Nothing */ -} - -#undef HZ -#define HZ 1000 -static inline uint32_t raid6_jiffies(void) -{ - struct timeval tv; - gettimeofday(&tv, NULL); - return tv.tv_sec*1000 + tv.tv_usec/1000; -} - -static inline void *raid6_get_zero_page(void) -{ - return raid6_empty_zero_page; -} - -#endif /* ! __KERNEL__ */ - #endif /* LINUX_RAID_RAID6_H */ -- cgit v1.2.3 From 06d2a66fb7c0b33ce893edb2f695add88291bff2 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 07:17:47 +0200 Subject: raid6: remove unused defines in pq.h These are not used anywhere in the kernel. Link: https://lore.kernel.org/20260518051804.462141-5-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Ard Biesheuvel Tested-by: Ard Biesheuvel # kunit only on arm64 Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Li Nan Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Song Liu Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton --- include/linux/raid/pq.h | 6 ------ 1 file changed, 6 deletions(-) (limited to 'include') diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h index d26788fada58..5e7e743b83f5 100644 --- a/include/linux/raid/pq.h +++ b/include/linux/raid/pq.h @@ -90,12 +90,6 @@ extern const struct raid6_calls raid6_neonx8; extern const struct raid6_calls * const raid6_algos[]; extern const struct raid6_recov_calls *const raid6_recov_algos[]; -/* Return values from chk_syndrome */ -#define RAID6_OK 0 -#define RAID6_P_BAD 1 -#define RAID6_Q_BAD 2 -#define RAID6_PQ_BAD 3 - /* Galois field tables */ extern const u8 raid6_gfmul[256][256] __attribute__((aligned(256))); extern const u8 raid6_vgfmul[256][32] __attribute__((aligned(256))); -- cgit v1.2.3 From 885d314231837a58258edc2757def1ee7fa0138c Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 07:17:48 +0200 Subject: raid6: remove raid6_get_zero_page Just open code it as in other places in the kernel. Link: https://lore.kernel.org/20260518051804.462141-6-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Ard Biesheuvel Tested-by: Ard Biesheuvel # kunit only on arm64 Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Li Nan Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Song Liu Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton --- include/linux/raid/pq.h | 6 ------ 1 file changed, 6 deletions(-) (limited to 'include') diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h index 5e7e743b83f5..f27a866c287f 100644 --- a/include/linux/raid/pq.h +++ b/include/linux/raid/pq.h @@ -11,12 +11,6 @@ #include #include -/* This should be const but the raid6 code is too convoluted for that. */ -static inline void *raid6_get_zero_page(void) -{ - return page_address(ZERO_PAGE(0)); -} - /* Routine choices */ struct raid6_calls { void (*gen_syndrome)(int, size_t, void **); -- cgit v1.2.3 From 35472bc6f31b64e58d1fe560340aa4f1684b8d6d Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 07:17:50 +0200 Subject: raid6: improve the public interface Stop directly calling into function pointers from users of the RAID6 PQ API, and provide exported functions with proper documentation and API guarantees asserts where applicable instead. Link: https://lore.kernel.org/20260518051804.462141-8-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Ard Biesheuvel Tested-by: Ard Biesheuvel # kunit only on arm64 Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Li Nan Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Song Liu Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton --- include/linux/raid/pq.h | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h index f27a866c287f..425a227591c0 100644 --- a/include/linux/raid/pq.h +++ b/include/linux/raid/pq.h @@ -11,6 +11,16 @@ #include #include +void raid6_gen_syndrome(int disks, size_t bytes, void **ptrs); +void raid6_xor_syndrome(int disks, int start, int stop, size_t bytes, + void **ptrs); +bool raid6_can_xor_syndrome(void); + +void raid6_recov_2data(int disks, size_t bytes, int faila, int failb, + void **ptrs); +void raid6_recov_datap(int disks, size_t bytes, int faila, + void **ptrs); + /* Routine choices */ struct raid6_calls { void (*gen_syndrome)(int, size_t, void **); @@ -20,9 +30,6 @@ struct raid6_calls { int priority; /* Relative priority ranking if non-zero */ }; -/* Selected algorithm */ -extern struct raid6_calls raid6_call; - /* Various routine sets */ extern const struct raid6_calls raid6_intx1; extern const struct raid6_calls raid6_intx2; @@ -92,10 +99,4 @@ extern const u8 raid6_gflog[256] __attribute__((aligned(256))); extern const u8 raid6_gfinv[256] __attribute__((aligned(256))); extern const u8 raid6_gfexi[256] __attribute__((aligned(256))); -/* Recovery routines */ -extern void (*raid6_2data_recov)(int disks, size_t bytes, int faila, int failb, - void **ptrs); -extern void (*raid6_datap_recov)(int disks, size_t bytes, int faila, - void **ptrs); - #endif /* LINUX_RAID_RAID6_H */ -- cgit v1.2.3 From 2790045a62eb52a5052eed06ddcc10b03b007a39 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 07:17:51 +0200 Subject: raid6: warn when using less than four devices Quoting H. Peter Anvin who came up with the RAID6 P/Q algorithm, and who wrote the initial implementation, then still part of the md driver: The RAID-6 code has *never* supported only 3 units, and if it ever worked for *any* of the implementations it was purely by accident. Speaking as the original author I should know; this was deliberate as in some cases the degenerate case (3) would have required extra trays in the code to no user benefit. While md never allowed less than 4 devices, btrfs does. This new warning will trigger for such file systems, but given how it already causes havoc that is a good thing. If btrfs wants to fix third, it should switch to transparently use three-way mirroring underneath, which will work as P and Q are copies of the single data device by the definition of the Linux RAID 6 P/Q algorithm. Link: https://lore.kernel.org/20260518051804.462141-9-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Ard Biesheuvel Tested-by: Ard Biesheuvel # kunit only on arm64 Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Li Nan Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Song Liu Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton --- include/linux/raid/pq.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h index 425a227591c0..87e3cb55bf07 100644 --- a/include/linux/raid/pq.h +++ b/include/linux/raid/pq.h @@ -11,6 +11,8 @@ #include #include +#define RAID6_MIN_DISKS 4 + void raid6_gen_syndrome(int disks, size_t bytes, void **ptrs); void raid6_xor_syndrome(int disks, int start, int stop, size_t bytes, void **ptrs); -- cgit v1.2.3 From 769d603fc44f896e7f61de7f0cdb8b78d46bc8c8 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 18 May 2026 07:17:52 +0200 Subject: raid6: hide internals Split out two new headers from the public pq.h: - lib/raid/raid6/algos.h contains the algorithm lists private to lib/raid/raid6 - include/linux/raid/pq_tables.h contains the tables also used by async_tx providers. The public include/linux/pq.h is now limited to the public interface for the consumers of the RAID6 PQ API. [hch@lst.de: remove duplicate ccflags-y line] Link: https://lore.kernel.org/20260527074539.2292913-2-hch@lst.de Link: https://lore.kernel.org/20260518051804.462141-10-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Ard Biesheuvel Tested-by: Ard Biesheuvel # kunit only on arm64 Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Arnd Bergmann Cc: "Borislav Petkov (AMD)" Cc: Catalin Marinas Cc: Chris Mason Cc: Christian Borntraeger Cc: Dan Williams Cc: David Sterba Cc: Heiko Carstens Cc: Herbert Xu Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: Ingo Molnar Cc: Li Nan Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Song Liu Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton --- include/linux/raid/pq.h | 96 ++++-------------------------------------- include/linux/raid/pq_tables.h | 19 +++++++++ 2 files changed, 27 insertions(+), 88 deletions(-) create mode 100644 include/linux/raid/pq_tables.h (limited to 'include') diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h index 87e3cb55bf07..b3bf9339cd86 100644 --- a/include/linux/raid/pq.h +++ b/include/linux/raid/pq.h @@ -1,15 +1,13 @@ /* SPDX-License-Identifier: GPL-2.0-or-later */ -/* -*- linux-c -*- ------------------------------------------------------- * +/* + * Copyright 2003 H. Peter Anvin - All Rights Reserved * - * Copyright 2003 H. Peter Anvin - All Rights Reserved - * - * ----------------------------------------------------------------------- */ - -#ifndef LINUX_RAID_RAID6_H -#define LINUX_RAID_RAID6_H + * Public interface to the RAID6 P/Q calculation and recovery library. + */ +#ifndef LINUX_RAID_PQ_H +#define LINUX_RAID_PQ_H -#include -#include +#include #define RAID6_MIN_DISKS 4 @@ -23,82 +21,4 @@ void raid6_recov_2data(int disks, size_t bytes, int faila, int failb, void raid6_recov_datap(int disks, size_t bytes, int faila, void **ptrs); -/* Routine choices */ -struct raid6_calls { - void (*gen_syndrome)(int, size_t, void **); - void (*xor_syndrome)(int, int, int, size_t, void **); - int (*valid)(void); /* Returns 1 if this routine set is usable */ - const char *name; /* Name of this routine set */ - int priority; /* Relative priority ranking if non-zero */ -}; - -/* Various routine sets */ -extern const struct raid6_calls raid6_intx1; -extern const struct raid6_calls raid6_intx2; -extern const struct raid6_calls raid6_intx4; -extern const struct raid6_calls raid6_intx8; -extern const struct raid6_calls raid6_mmxx1; -extern const struct raid6_calls raid6_mmxx2; -extern const struct raid6_calls raid6_sse1x1; -extern const struct raid6_calls raid6_sse1x2; -extern const struct raid6_calls raid6_sse2x1; -extern const struct raid6_calls raid6_sse2x2; -extern const struct raid6_calls raid6_sse2x4; -extern const struct raid6_calls raid6_altivec1; -extern const struct raid6_calls raid6_altivec2; -extern const struct raid6_calls raid6_altivec4; -extern const struct raid6_calls raid6_altivec8; -extern const struct raid6_calls raid6_avx2x1; -extern const struct raid6_calls raid6_avx2x2; -extern const struct raid6_calls raid6_avx2x4; -extern const struct raid6_calls raid6_avx512x1; -extern const struct raid6_calls raid6_avx512x2; -extern const struct raid6_calls raid6_avx512x4; -extern const struct raid6_calls raid6_s390vx8; -extern const struct raid6_calls raid6_vpermxor1; -extern const struct raid6_calls raid6_vpermxor2; -extern const struct raid6_calls raid6_vpermxor4; -extern const struct raid6_calls raid6_vpermxor8; -extern const struct raid6_calls raid6_lsx; -extern const struct raid6_calls raid6_lasx; -extern const struct raid6_calls raid6_rvvx1; -extern const struct raid6_calls raid6_rvvx2; -extern const struct raid6_calls raid6_rvvx4; -extern const struct raid6_calls raid6_rvvx8; - -struct raid6_recov_calls { - void (*data2)(int, size_t, int, int, void **); - void (*datap)(int, size_t, int, void **); - int (*valid)(void); - const char *name; - int priority; -}; - -extern const struct raid6_recov_calls raid6_recov_intx1; -extern const struct raid6_recov_calls raid6_recov_ssse3; -extern const struct raid6_recov_calls raid6_recov_avx2; -extern const struct raid6_recov_calls raid6_recov_avx512; -extern const struct raid6_recov_calls raid6_recov_s390xc; -extern const struct raid6_recov_calls raid6_recov_neon; -extern const struct raid6_recov_calls raid6_recov_lsx; -extern const struct raid6_recov_calls raid6_recov_lasx; -extern const struct raid6_recov_calls raid6_recov_rvv; - -extern const struct raid6_calls raid6_neonx1; -extern const struct raid6_calls raid6_neonx2; -extern const struct raid6_calls raid6_neonx4; -extern const struct raid6_calls raid6_neonx8; - -/* Algorithm list */ -extern const struct raid6_calls * const raid6_algos[]; -extern const struct raid6_recov_calls *const raid6_recov_algos[]; - -/* Galois field tables */ -extern const u8 raid6_gfmul[256][256] __attribute__((aligned(256))); -extern const u8 raid6_vgfmul[256][32] __attribute__((aligned(256))); -extern const u8 raid6_gfexp[256] __attribute__((aligned(256))); -extern const u8 raid6_gflog[256] __attribute__((aligned(256))); -extern const u8 raid6_gfinv[256] __attribute__((aligned(256))); -extern const u8 raid6_gfexi[256] __attribute__((aligned(256))); - -#endif /* LINUX_RAID_RAID6_H */ +#endif /* LINUX_RAID_PQ_H */ diff --git a/include/linux/raid/pq_tables.h b/include/linux/raid/pq_tables.h new file mode 100644 index 000000000000..7b1ebe675677 --- /dev/null +++ b/include/linux/raid/pq_tables.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* + * Copyright 2003 H. Peter Anvin - All Rights Reserved + * + * Galois field tables for the Linux RAID6 P/Q parity algorithm. + */ +#ifndef _LINUX_RAID_PQ_TABLES_H +#define _LINUX_RAID_PQ_TABLES_H + +#include + +extern const u8 raid6_gfmul[256][256] __attribute__((aligned(256))); +extern const u8 raid6_vgfmul[256][32] __attribute__((aligned(256))); +extern const u8 raid6_gfexp[256] __attribute__((aligned(256))); +extern const u8 raid6_gflog[256] __attribute__((aligned(256))); +extern const u8 raid6_gfinv[256] __attribute__((aligned(256))); +extern const u8 raid6_gfexi[256] __attribute__((aligned(256))); + +#endif /* _LINUX_RAID_PQ_TABLES_H */ -- cgit v1.2.3 From f7ea0d13735ef812f7c777d5c0a79ff6a4b369c3 Mon Sep 17 00:00:00 2001 From: Costa Shulyupin Date: Fri, 15 May 2026 21:34:24 +0300 Subject: include: remove unused cnt32_to_63.h All users have been removed over time as ARM and other architectures switched to generic sched_clock. The last user was microblaze, removed in commit 839396ab88e4 ("microblaze: timer: Use generic sched_clock implementation"). Assisted-by: Claude:claude-opus-4-6 Link: https://lore.kernel.org/20260515183429.1503740-1-costa.shul@redhat.com Signed-off-by: Costa Shulyupin Reviewed-by: Andrew Morton Cc: Nicolas Pitre Cc: Nicolas Pitre Signed-off-by: Andrew Morton --- include/linux/cnt32_to_63.h | 104 -------------------------------------------- 1 file changed, 104 deletions(-) delete mode 100644 include/linux/cnt32_to_63.h (limited to 'include') diff --git a/include/linux/cnt32_to_63.h b/include/linux/cnt32_to_63.h deleted file mode 100644 index 064428479f2d..000000000000 --- a/include/linux/cnt32_to_63.h +++ /dev/null @@ -1,104 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * Extend a 32-bit counter to 63 bits - * - * Author: Nicolas Pitre - * Created: December 3, 2006 - * Copyright: MontaVista Software, Inc. - */ - -#ifndef __LINUX_CNT32_TO_63_H__ -#define __LINUX_CNT32_TO_63_H__ - -#include -#include -#include - -/* this is used only to give gcc a clue about good code generation */ -union cnt32_to_63 { - struct { -#if defined(__LITTLE_ENDIAN) - u32 lo, hi; -#elif defined(__BIG_ENDIAN) - u32 hi, lo; -#endif - }; - u64 val; -}; - - -/** - * cnt32_to_63 - Expand a 32-bit counter to a 63-bit counter - * @cnt_lo: The low part of the counter - * - * Many hardware clock counters are only 32 bits wide and therefore have - * a relatively short period making wrap-arounds rather frequent. This - * is a problem when implementing sched_clock() for example, where a 64-bit - * non-wrapping monotonic value is expected to be returned. - * - * To overcome that limitation, let's extend a 32-bit counter to 63 bits - * in a completely lock free fashion. Bits 0 to 31 of the clock are provided - * by the hardware while bits 32 to 62 are stored in memory. The top bit in - * memory is used to synchronize with the hardware clock half-period. When - * the top bit of both counters (hardware and in memory) differ then the - * memory is updated with a new value, incrementing it when the hardware - * counter wraps around. - * - * Because a word store in memory is atomic then the incremented value will - * always be in synch with the top bit indicating to any potential concurrent - * reader if the value in memory is up to date or not with regards to the - * needed increment. And any race in updating the value in memory is harmless - * as the same value would simply be stored more than once. - * - * The restrictions for the algorithm to work properly are: - * - * 1) this code must be called at least once per each half period of the - * 32-bit counter; - * - * 2) this code must not be preempted for a duration longer than the - * 32-bit counter half period minus the longest period between two - * calls to this code; - * - * Those requirements ensure proper update to the state bit in memory. - * This is usually not a problem in practice, but if it is then a kernel - * timer should be scheduled to manage for this code to be executed often - * enough. - * - * And finally: - * - * 3) the cnt_lo argument must be seen as a globally incrementing value, - * meaning that it should be a direct reference to the counter data which - * can be evaluated according to a specific ordering within the macro, - * and not the result of a previous evaluation stored in a variable. - * - * For example, this is wrong: - * - * u32 partial = get_hw_count(); - * u64 full = cnt32_to_63(partial); - * return full; - * - * This is fine: - * - * u64 full = cnt32_to_63(get_hw_count()); - * return full; - * - * Note that the top bit (bit 63) in the returned value should be considered - * as garbage. It is not cleared here because callers are likely to use a - * multiplier on the returned value which can get rid of the top bit - * implicitly by making the multiplier even, therefore saving on a runtime - * clear-bit instruction. Otherwise caller must remember to clear the top - * bit explicitly. - */ -#define cnt32_to_63(cnt_lo) \ -({ \ - static u32 __m_cnt_hi; \ - union cnt32_to_63 __x; \ - __x.hi = __m_cnt_hi; \ - smp_rmb(); \ - __x.lo = (cnt_lo); \ - if (unlikely((s32)(__x.hi ^ __x.lo) < 0)) \ - __m_cnt_hi = __x.hi = (__x.hi ^ 0x80000000) + (__x.hi >> 31); \ - __x.val; \ -}) - -#endif -- cgit v1.2.3 From e054cdee673181622bc12f2b5049134ecbc2eeb1 Mon Sep 17 00:00:00 2001 From: Zhushuai Yin Date: Mon, 18 May 2026 22:29:51 +0800 Subject: crypto: hisilicon/qm - allow VF devices to query hardware isolation status The problem that the VF device cannot obtain the isolation status and isolation threshold of the device is resolved. The accelerator driver can query the device isolation status and threshold via the VF device using the fault query sysfs interface under uacce. Note that only the PF device supports isolation policy configuration, while the VF device is limited to read-only query operations. Signed-off-by: Zhushuai Yin Signed-off-by: Zongyu Wu Signed-off-by: Herbert Xu --- include/linux/hisi_acc_qm.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h index a6268dc4f7cb..ddecdc2531a2 100644 --- a/include/linux/hisi_acc_qm.h +++ b/include/linux/hisi_acc_qm.h @@ -552,6 +552,7 @@ static inline void hisi_qm_del_list(struct hisi_qm *qm, struct hisi_qm_list *qm_ mutex_unlock(&qm_list->lock); } +int hisi_qm_register_uacce(struct hisi_qm *qm); int hisi_qm_q_num_set(const char *val, const struct kernel_param *kp, unsigned int device); int hisi_qm_init(struct hisi_qm *qm); -- cgit v1.2.3 From 789fc74a220b33bb21257c707467985aac536ecd Mon Sep 17 00:00:00 2001 From: Zhushuai Yin Date: Mon, 18 May 2026 22:29:52 +0800 Subject: crypto: hisilicon/qm - place the interrupt status interface after the PM usage counter To avoid accessing memory of a suspended device, and since the counter interface used by PM involves sleep operations, the counter interface cannot be placed in the interrupt top half. Therefore, the interface for acquiring the interrupt status in the RAS reset flow that resides in the interrupt context needs to be moved to the bottom half for processing. Signed-off-by: Zhushuai Yin Signed-off-by: Zongyu Wu Signed-off-by: Herbert Xu --- include/linux/hisi_acc_qm.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h index ddecdc2531a2..98ff6bcfdebe 100644 --- a/include/linux/hisi_acc_qm.h +++ b/include/linux/hisi_acc_qm.h @@ -158,7 +158,6 @@ enum qm_vf_state { enum qm_misc_ctl_bits { QM_DRIVER_REMOVING = 0x0, - QM_RST_SCHED, QM_RESETTING, QM_MODULE_PARAM, }; -- cgit v1.2.3 From 86cad7009fb4ac2c617077bc1c44a51c60d4ae2e Mon Sep 17 00:00:00 2001 From: Zhushuai Yin Date: Mon, 18 May 2026 22:29:53 +0800 Subject: crypto: hisilicon/qm - support function-level error reset When executing operations on crypto devices, hardware errors are inevitable. For certain errors, a full device reset is required to recover. However, in certain cases, only a specific function may fail, while other functions can still operate normally. A system-wide RAS reset in such cases would unnecessarily impact functioning components. This patch introduces function-level granularity handling, enabling targeted resets of only the error-reporting functions without affecting other operational functions. Signed-off-by: Zhushuai Yin Signed-off-by: Zongyu Wu Signed-off-by: Herbert Xu --- include/linux/hisi_acc_qm.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h index 98ff6bcfdebe..0a2da1029a3f 100644 --- a/include/linux/hisi_acc_qm.h +++ b/include/linux/hisi_acc_qm.h @@ -248,6 +248,7 @@ enum acc_err_result { ACC_ERR_NONE, ACC_ERR_NEED_RESET, ACC_ERR_RECOVERED, + ACC_ERR_NEED_FUNC_RESET, }; struct hisi_qm_err_mask { -- cgit v1.2.3 From cc3b6331ccb06ec481439cef464b38cfa35c2802 Mon Sep 17 00:00:00 2001 From: Zongyu Wu Date: Mon, 18 May 2026 22:29:56 +0800 Subject: crypto: hisilicon/qm - support doorbell enable control The driver notifies the hardware to handle task through doorbell. Currently, doorbell is enabled by default. To prevent the process from sending doorbells during hardware reset scenarios, which could cause the hardware to process doorbells and trigger new errors: For example, when the physical machine is resetting the device, doorbells are still being sent from the virtual machine. Therefore, the driver disables doorbell during hardware unavailability. After hardware initialization is completed, doorbell is enabled, and any task sent during the unavailability period will return errors. The hardware supports the PF to disable doorbells for all functions, while the VF can only disable its own doorbell function. When the PF is reset, it will disable doorbells for all functions. When VF is reset, it only disables its own doorbell and does not affect tasks on other functions. Signed-off-by: Zongyu Wu Signed-off-by: Herbert Xu --- include/linux/hisi_acc_qm.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h index 0a2da1029a3f..f7570a409905 100644 --- a/include/linux/hisi_acc_qm.h +++ b/include/linux/hisi_acc_qm.h @@ -115,10 +115,22 @@ #define QM_ECC_MBIT BIT(2) +/** + * enum qm_stop_reason - Queue manager stop reasons + * @QM_NORMAL: Graceful stop. Used for device unbind, driver removal, + * or runtime power management (runtime_suspend). + * @QM_SOFT_RESET: Error recovery reset. Triggered by unrecoverable hardware + * errors (e.g., PCIe AER, timeout) to recover device state. + * @QM_DOWN: Function Level Reset. Used when the device needs to + * be reset at the function level without resetting the link. + * @QM_SHUTDOWN: System shutdown. Used during system poweroff, reboot, or + * kexec to ensure hardware is in a safe state. + */ enum qm_stop_reason { QM_NORMAL, QM_SOFT_RESET, QM_DOWN, + QM_SHUTDOWN, }; enum qm_state { -- cgit v1.2.3 From fcc77d33a34cf271702e8daafb6c593e4626776d Mon Sep 17 00:00:00 2001 From: Demi Marie Obenour Date: Sat, 23 May 2026 15:43:02 -0400 Subject: net: Remove support for AIO on sockets The only user of msg->msg_iocb was AF_ALG, but that's deprecated. It can be removed entirely at the cost of only supporting synchronous operations. This doesn't break userspace, which will silently block (for a bounded amount of time) in io_submit instead of operating asynchronously. This also makes struct msghdr smaller, helping every other caller of sendmsg(). Signed-off-by: Demi Marie Obenour Acked-by: Jakub Kicinski Signed-off-by: Herbert Xu --- include/crypto/if_alg.h | 5 +---- include/linux/socket.h | 1 - 2 files changed, 1 insertion(+), 5 deletions(-) (limited to 'include') diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h index 0cc8fa749f68..62867daca47d 100644 --- a/include/crypto/if_alg.h +++ b/include/crypto/if_alg.h @@ -80,7 +80,6 @@ struct af_alg_rsgl { /** * struct af_alg_async_req - definition of crypto request - * @iocb: IOCB for AIO operations * @sk: Socket the request is associated with * @first_rsgl: First RX SG * @last_rsgl: Pointer to last RX SG @@ -92,7 +91,6 @@ struct af_alg_rsgl { * @cra_u: Cipher request */ struct af_alg_async_req { - struct kiocb *iocb; struct sock *sk; struct af_alg_rsgl first_rsgl; @@ -138,7 +136,7 @@ struct af_alg_async_req { * @write: True if we are in the middle of a write. * @init: True if metadata has been sent. * @len: Length of memory allocated for this data structure. - * @inflight: Non-zero when AIO requests are in flight. + * @inflight: Non-zero when requests are in flight, for debugging only. */ struct af_alg_ctx { struct list_head tsgl_list; @@ -237,7 +235,6 @@ int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min); int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, unsigned int ivsize); void af_alg_free_resources(struct af_alg_async_req *areq); -void af_alg_async_cb(void *data, int err); __poll_t af_alg_poll(struct file *file, struct socket *sock, poll_table *wait); struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk, diff --git a/include/linux/socket.h b/include/linux/socket.h index ec4a0a025793..3ffdfe184b23 100644 --- a/include/linux/socket.h +++ b/include/linux/socket.h @@ -89,7 +89,6 @@ struct msghdr { bool msg_get_inq : 1;/* return INQ after receive */ unsigned int msg_flags; /* flags on received message */ __kernel_size_t msg_controllen; /* ancillary data buffer length */ - struct kiocb *msg_iocb; /* ptr to iocb for async requests */ struct ubuf_info *msg_ubuf; int (*sg_from_iter)(struct sk_buff *skb, struct iov_iter *from, size_t length); -- cgit v1.2.3 From 7524070f26d8d347c26787dc297fb844baa26abf Mon Sep 17 00:00:00 2001 From: Demi Marie Obenour Date: Sat, 23 May 2026 15:43:03 -0400 Subject: crypto: af_alg - Drop support for off-CPU cryptography AF_ALG is deprecated and exposed to unprivileged userspace. Only use the least buggy algorithm implementations: the pure software ones. This removes one of the main advantages of AF_ALG, which is the ability to use it with off-CPU accelerators. However, using off-CPU accelerators has huge overheads, both in performance and attack surface. I have yet to see real-world, performance-critical workloads where using an accelerator via AF_ALG is actually a win over doing cryptography in userspace. If using an off-CPU accelerator really does turn out to be a win, a new API should be developed that is actually a good fit for it. Signed-off-by: Demi Marie Obenour Signed-off-by: Herbert Xu --- include/crypto/if_alg.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h index 62867daca47d..7643ba954125 100644 --- a/include/crypto/if_alg.h +++ b/include/crypto/if_alg.h @@ -41,7 +41,7 @@ struct af_alg_control { }; struct af_alg_type { - void *(*bind)(const char *name, u32 type, u32 mask); + void *(*bind)(const char *name); void (*release)(void *private); int (*setkey)(void *private, const u8 *key, unsigned int keylen); int (*setentropy)(void *private, sockptr_t entropy, unsigned int len); @@ -243,4 +243,16 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, struct af_alg_async_req *areq, size_t maxsize, size_t *outlen); +/* + * Mask used to disable unsupported algorithm implementations. + * + * This is the same as FSCRYPT_CRYPTOAPI_MASK in fs/crypto/fscrypt_private.h. + * In additions to the motivations there, this API is exposed to userspace + * that might not be fully trusted. + */ +#define AF_ALG_CRYPTOAPI_MASK \ + (CRYPTO_ALG_ASYNC | CRYPTO_ALG_ALLOCATES_MEMORY | \ + CRYPTO_ALG_KERN_DRIVER_ONLY) + + #endif /* _CRYPTO_IF_ALG_H */ -- cgit v1.2.3 From f2f1dddccae50f7a1d088285c53c376e26cedf67 Mon Sep 17 00:00:00 2001 From: Jori Koolstra Date: Thu, 28 May 2026 17:58:46 +0000 Subject: vfs: make LAST_XXX private to fs/namei.c The only user of LAST_XXX outside of fs/namei.c is fs/smb/server/vfs.c; ksmbd_vfs_path_lookup() calls vfs_path_parent_lookup() and expects a LAST_NORM last type (or it will be ENOENT). ksmbd_vfs_rename() also calls vfs_path_parent_lookup() but forgets the LAST_NORM check. It does not really make sense to have vfs_path_parent_lookup() expose the last_type because it is only needed to ensure it is LAST_NORM. So let's do this check in vfs_path_parent_lookup() instead and keep the LAST_XXX internal to fs/namei.c. This changes the ENOENT errno in ksmbd_vfs_path_lookup() to EINVAL, which matches better with how this is handled by callers of filename_parentat(). Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260528175854.57626-1-jkoolstra@xs4all.nl Reviewed-by: Amir Goldstein Reviewed-by: NeilBrown Reviewed-by: Namjae Jeon Signed-off-by: Christian Brauner (Amutable) --- include/linux/namei.h | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/namei.h b/include/linux/namei.h index 2ad6dd9987b9..3941b9f1dec7 100644 --- a/include/linux/namei.h +++ b/include/linux/namei.h @@ -13,11 +13,6 @@ enum { MAX_NESTED_LINKS = 8 }; #define MAXSYMLINKS 40 -/* - * Type of the last component on LOOKUP_PARENT - */ -enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT}; - /* pathwalk mode */ #define LOOKUP_FOLLOW BIT(0) /* follow links at the end */ #define LOOKUP_DIRECTORY BIT(1) /* require a directory */ @@ -67,7 +62,7 @@ static inline void end_removing_path(const struct path *path , struct dentry *de end_creating_path(path, dentry); } int vfs_path_parent_lookup(struct filename *filename, unsigned int flags, - struct path *parent, struct qstr *last, int *type, + struct path *parent, struct qstr *last, const struct path *root); int vfs_path_lookup(struct dentry *, struct vfsmount *, const char *, unsigned int, struct path *); -- cgit v1.2.3 From e7b63427fdb4977621d69085a97272c8856644fe Mon Sep 17 00:00:00 2001 From: Andrea Righi Date: Tue, 26 May 2026 18:42:48 +0200 Subject: sched_ext: Auto-register/unregister dl_server reservations Commit cd959a3562050d ("sched_ext: Add a DL server for sched_ext tasks") introduced an ext_server deadline server to protect sched_ext tasks from fair/RT starvation, mirroring the existing fair_server. Currently, both servers reserve their 50ms/1000ms bandwidth at boot, regardless of whether a BPF scheduler is loaded. Unused bandwidth is still reclaimed at runtime by other classes, but the static reservation prevents the RT class from implicitly using that headroom when one of the two classes is guaranteed to be empty. A sysadmin can work around this by writing /sys/kernel/debug/sched/{fair,ext}_server/cpu*/runtime, but that requires manual action and not all systems expose debugfs. A better approach is to make server bandwidth reservations dynamic: only the scheduling policy that is currently active should register its reservation, while the inactive one should not artificially hold capacity (keeping both reservations only when the BPF scheduler is running in partial mode): +---------------------------------------------+-------------+------------+ | BPF scheduler state | fair server | ext server | +---------------------------------------------+-------------+------------+ | not loaded (default boot) | reserved | none | | loaded full mode (!SCX_OPS_SWITCH_PARTIAL) | none | reserved | | loaded partial mode (SCX_OPS_SWITCH_PARTIAL)| reserved | reserved | +---------------------------------------------+-------------+------------+ To achieve this, introduce an "attached/detached" state for each deadline server, so the kernel can decide whether a server's bandwidth should be accounted in global bandwidth tracking. At boot, the system starts with only the fair server contributing to bandwidth accounting. When a BPF scheduler is enabled, the ext server is attached and may replace or complement the fair server depending on whether full or partial mode is used. When sched_ext is disabled, the system restores the previous deadline bandwidth values and behavior. The transition logic ensures that switching between scheduling modes is consistent and reversible, without losing runtime configuration or requiring manual intervention. Signed-off-by: Andrea Righi Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juri Lelli Link: https://patch.msgid.link/20260526164420.638711-2-arighi@nvidia.com --- include/linux/sched.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index da6a0907a78c..8130d13850fc 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -702,6 +702,11 @@ struct sched_dl_entity { * running, skipping the defer phase. * * @dl_defer_idle tracks idle state + * + * @dl_bw_attached tells if this server's bandwidth currently + * contributes to the root domain's total_bw. Only meaningful for server + * entities (@dl_server == 1). Allows toggling the reservation on/off + * without losing the configured @dl_runtime/@dl_period. */ unsigned int dl_throttled : 1; unsigned int dl_yielded : 1; @@ -713,6 +718,7 @@ struct sched_dl_entity { unsigned int dl_defer_armed : 1; unsigned int dl_defer_running : 1; unsigned int dl_defer_idle : 1; + unsigned int dl_bw_attached : 1; /* * Bandwidth enforcement timer. Each -deadline task has its -- cgit v1.2.3 From ca36c1aaee095d009d73f6623fb5e536ada80032 Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:59:03 +0100 Subject: block: Add bvec_folio() This is a simple helper which replaces page_folio(bvec->bv_page). Minor improvement in readability, but the real motivation is to reduce the number of references to bvec->bv_page so that it can be changed with less work. Signed-off-by: Matthew Wilcox (Oracle) Cc: Leon Romanovsky Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: William Kucharski Link: https://patch.msgid.link/20260528175905.1102280-2-willy@infradead.org Signed-off-by: Jens Axboe --- include/linux/bio.h | 2 +- include/linux/bvec.h | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bio.h b/include/linux/bio.h index 97f993d4d914..26ebfff93a16 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -283,7 +283,7 @@ static inline void bio_first_folio(struct folio_iter *fi, struct bio *bio, return; } - fi->folio = page_folio(bvec->bv_page); + fi->folio = bvec_folio(bvec); fi->offset = bvec->bv_offset + PAGE_SIZE * folio_page_idx(fi->folio, bvec->bv_page); fi->_seg_count = bvec->bv_len; diff --git a/include/linux/bvec.h b/include/linux/bvec.h index f4c7ec282ac9..c939f2b3be87 100644 --- a/include/linux/bvec.h +++ b/include/linux/bvec.h @@ -74,6 +74,21 @@ static inline void bvec_set_virt(struct bio_vec *bv, void *vaddr, bvec_set_page(bv, virt_to_page(vaddr), len, offset_in_page(vaddr)); } +/** + * bvec_folio - Return the first folio referenced by this bvec + * @bv: bvec to access + * + * A bvec can contain non-folio memory, so this should only be called by + * the creator of the bvec; drivers have no business looking at the owner + * of the memory. It may not even be the right interface for the caller + * to use as a bvec can span multiple folios. You may be better off using + * something like bio_for_each_folio_all() which iterates over all folios. + */ +static inline struct folio *bvec_folio(const struct bio_vec *bv) +{ + return page_folio(bv->bv_page); +} + struct bvec_iter { /* * Current device address in 512 byte sectors. Only updated by the bio -- cgit v1.2.3 From 11ff85db51e05cf8cbeea36be1085fdacedeab55 Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:59:04 +0100 Subject: block: Include bvec.h kernel-doc in the htmldocs People have gone to the trouble of writing this kernel-doc; the least we can do is publish it. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Reviewed-by: William Kucharski Link: https://patch.msgid.link/20260528175905.1102280-3-willy@infradead.org Signed-off-by: Jens Axboe --- include/linux/bvec.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/bvec.h b/include/linux/bvec.h index c939f2b3be87..92837e2743f1 100644 --- a/include/linux/bvec.h +++ b/include/linux/bvec.h @@ -289,6 +289,7 @@ static inline void *bvec_kmap_local(struct bio_vec *bvec) /** * memcpy_from_bvec - copy data from a bvec + * @to: Kernel virtual address to copy to. * @bvec: bvec to copy from * * Must be called on single-page bvecs only. @@ -301,6 +302,7 @@ static inline void memcpy_from_bvec(char *to, struct bio_vec *bvec) /** * memcpy_to_bvec - copy data to a bvec * @bvec: bvec to copy to + * @from: Kernel virtual address to copy from. * * Must be called on single-page bvecs only. */ -- cgit v1.2.3 From 9d7a681915245e0e191abfd4b31d010c7037573c Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:27 +0000 Subject: firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members Rename the `dvfs_ops` and `pmic_ops` members of `struct acpm_ops` to `dvfs` and `pmic` respectively. Since these members are housed within the `acpm_ops` structure and utilize the `acpm_*_ops` types, the `_ops` suffix on the variable names creates unnecessary redundancy (e.g., `handle.ops.dvfs_ops`). This cleanup removes the stuttering, leading to cleaner consumer code. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Acked-by: Lee Jones Link: https://lore.kernel.org/linux-samsung-soc/CADrjBPqzKpcd9vuCmNUptCUPyPpPbHcc19-7kN-1c0RpW1e5DQ@mail.gmail.com/T/#mcce154a7e0c6cd1ca6cd5a1e37541ed7a85a84d4 [1] Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-3-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- include/linux/firmware/samsung/exynos-acpm-protocol.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index 13f17dc4443b..62a3eb450067 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -35,8 +35,8 @@ struct acpm_pmic_ops { }; struct acpm_ops { - struct acpm_dvfs_ops dvfs_ops; - struct acpm_pmic_ops pmic_ops; + struct acpm_dvfs_ops dvfs; + struct acpm_pmic_ops pmic; }; /** -- cgit v1.2.3 From 50b400214abaec9122558e3f9c6fdd6295914c3c Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:28 +0000 Subject: firmware: samsung: acpm: Make acpm_ops const and access via pointer Replace the embedded `struct acpm_ops` inside `struct acpm_handle` with a pointer to a `const struct acpm_ops`. Previously, the operations structure was embedded directly within the handle and populated dynamically at runtime via `acpm_setup_ops()`. This resulted in mutable function pointers and unnecessary per-instance memory overhead. By defining `exynos_acpm_driver_ops` statically as a `const` structure, the function pointers are now safely housed in the read-only `.rodata` section. This improves security by preventing function pointer overwrites, saves memory, and slightly reduces initialization overhead in `acpm_probe()`. Consequently, update all consumer drivers (clk, mfd) to access the operations via the new pointer indirection (`->ops->`). Finally, fix the previously empty kernel-doc description for the ops member to reflect its new pointer nature. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-4-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- include/linux/firmware/samsung/exynos-acpm-protocol.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index 62a3eb450067..e13d9ac73ff6 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -41,10 +41,10 @@ struct acpm_ops { /** * struct acpm_handle - Reference to an initialized protocol instance - * @ops: + * @ops: pointer to the constant ACPM protocol operations. */ struct acpm_handle { - struct acpm_ops ops; + const struct acpm_ops *ops; }; struct device; -- cgit v1.2.3 From 4ba23dfc49b4a3cefb4fdaa406172dfb8350098d Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:29 +0000 Subject: firmware: samsung: acpm: Add TMU protocol support The Thermal Management Unit (TMU) on the Google GS101 SoC is managed through a hybrid model shared between the kernel and the Alive Clock and Power Manager (ACPM) firmware. Add the protocol helpers required to communicate with the ACPM for thermal operations, including initialization, threshold configuration, temperature reading, and system suspend/resume handshakes. Signed-off-by: Tudor Ambarus Reviewed-by: Krzysztof Kozlowski Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-5-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- include/linux/firmware/samsung/exynos-acpm-protocol.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'include') diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index e13d9ac73ff6..8511c3c3983b 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -34,9 +34,27 @@ struct acpm_pmic_ops { u8 type, u8 reg, u8 chan, u8 value, u8 mask); }; +struct acpm_tmu_ops { + int (*init)(struct acpm_handle *handle, unsigned int acpm_chan_id); + int (*read_temp)(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz, int *temp); + int (*set_threshold)(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz, + const u8 temperature[8], size_t tlen); + int (*set_interrupt_enable)(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz, u8 inten); + int (*tz_control)(struct acpm_handle *handle, unsigned int acpm_chan_id, + u8 tz, bool enable); + int (*clear_tz_irq)(struct acpm_handle *handle, + unsigned int acpm_chan_id, u8 tz); + int (*suspend)(struct acpm_handle *handle, unsigned int acpm_chan_id); + int (*resume)(struct acpm_handle *handle, unsigned int acpm_chan_id); +}; + struct acpm_ops { struct acpm_dvfs_ops dvfs; struct acpm_pmic_ops pmic; + struct acpm_tmu_ops tmu; }; /** -- cgit v1.2.3 From fc13a4b9b9c8cb0b8e5ba54b21712d00f810496c Mon Sep 17 00:00:00 2001 From: Tudor Ambarus Date: Fri, 15 May 2026 09:32:30 +0000 Subject: firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper Introduce devm_acpm_get_by_phandle() to standardize how consumer drivers acquire a handle to the ACPM IPC interface. Enforce the use of the "samsung,acpm-ipc" property name across the SoC and simplify the boilerplate code in client drivers. The first consumer of this helper is the Exynos ACPM Thermal Management Unit (TMU) driver. The TMU utilizes a hybrid management approach: direct register access from the Application Processor (AP) is restricted to the interrupt pending (INTPEND) registers for event identification. High-level functional tasks, such as sensor initialization, threshold programming, and temperature reads, are delegated to the ACPM firmware via this IPC interface. Signed-off-by: Tudor Ambarus Reviewed-by: Peter Griffin Link: https://patch.msgid.link/20260515-acpm-tmu-helpers-v2-6-8ca011d5a965@linaro.org Signed-off-by: Krzysztof Kozlowski --- include/linux/firmware/samsung/exynos-acpm-protocol.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index 8511c3c3983b..dbf052c4139b 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -70,6 +70,7 @@ struct device; #if IS_ENABLED(CONFIG_EXYNOS_ACPM_PROTOCOL) struct acpm_handle *devm_acpm_get_by_node(struct device *dev, struct device_node *np); +struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev); #else static inline struct acpm_handle *devm_acpm_get_by_node(struct device *dev, @@ -77,6 +78,11 @@ static inline struct acpm_handle *devm_acpm_get_by_node(struct device *dev, { return NULL; } + +static inline struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev) +{ + return ERR_PTR(-ENODEV); +} #endif #endif /* __EXYNOS_ACPM_PROTOCOL_H */ -- cgit v1.2.3 From 7b661285aa7507eab79efff0a418445157db4141 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Fri, 29 May 2026 15:43:31 +0200 Subject: firmware: samsung: acpm: remove compile-testing stubs Sashiko reported an inconsistent use of NULL vs ERR_PTR() returns in the stub helpers in xynos-acpm-protocol.h. Since this only happens on dead code for COMPILE_TEST=y, this is not really a bug though. Having stub functions that return NULL is a common way to define optional interfaces, where callers still work when the feature is disabled, though this clearly does not work for acpm because some callers have a NULL pointer dereference when compile testing. Since CONFIG_EXYNOS_ACPM_PROTOCOL already supports compile-testing itself, and all (both) drivers using it clearly require the support, so this just simplifies the option space without losing any build coverage. Remove the stub functions entirely and adjust the one Kconfig dependency to require EXYNOS_ACPM_PROTOCOL unconditionally. Fixes: 6837c006d4e7 ("firmware: exynos-acpm: add empty method to allow compile test") Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org Link: https://lore.kernel.org/all/a7994860-24a3-4f87-84bf-109ed653dda4@linaro.org/ Reviewed-by: Tudor Ambarus Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20260529134454.2147446-1-arnd@kernel.org [krzk: Rebase on difference in devm_acpm_get_by_node()] Signed-off-by: Krzysztof Kozlowski --- include/linux/firmware/samsung/exynos-acpm-protocol.h | 14 -------------- 1 file changed, 14 deletions(-) (limited to 'include') diff --git a/include/linux/firmware/samsung/exynos-acpm-protocol.h b/include/linux/firmware/samsung/exynos-acpm-protocol.h index dbf052c4139b..c6b35c0ff300 100644 --- a/include/linux/firmware/samsung/exynos-acpm-protocol.h +++ b/include/linux/firmware/samsung/exynos-acpm-protocol.h @@ -67,22 +67,8 @@ struct acpm_handle { struct device; -#if IS_ENABLED(CONFIG_EXYNOS_ACPM_PROTOCOL) struct acpm_handle *devm_acpm_get_by_node(struct device *dev, struct device_node *np); struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev); -#else - -static inline struct acpm_handle *devm_acpm_get_by_node(struct device *dev, - struct device_node *np) -{ - return NULL; -} - -static inline struct acpm_handle *devm_acpm_get_by_phandle(struct device *dev) -{ - return ERR_PTR(-ENODEV); -} -#endif #endif /* __EXYNOS_ACPM_PROTOCOL_H */ -- cgit v1.2.3 From a7b378c949373b6bb4c5a89ffc53085736959dcf Mon Sep 17 00:00:00 2001 From: Rob Clark Date: Tue, 26 May 2026 07:50:47 -0700 Subject: drm/msm: Add PERFCNTR_CONFIG ioctl Add new UABI and implementation of PERFCNTR_CONFIG ioctl. A bit more work is required to configure the pwrup_reglist for the GMU to restore SELect regs on exit of IFPC, before we can stop disabling IFPC while global counter collection. This will follow in a later commit, but will be transparent to userspace. Signed-off-by: Rob Clark Reviewed-by: Anna Maniscalco Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/728217/ Message-ID: <20260526145137.160554-14-robin.clark@oss.qualcomm.com> --- include/uapi/drm/msm_drm.h | 48 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) (limited to 'include') diff --git a/include/uapi/drm/msm_drm.h b/include/uapi/drm/msm_drm.h index b99098792371..7f2e594be4eb 100644 --- a/include/uapi/drm/msm_drm.h +++ b/include/uapi/drm/msm_drm.h @@ -491,6 +491,52 @@ struct drm_msm_submitqueue_query { __u32 pad; }; +#define MSM_PERFCNTR_STREAM 0x00000001 +#define MSM_PERFCNTR_UPDATE 0x00000002 +#define MSM_PERFCNTR_FLAGS ( \ + MSM_PERFCNTR_STREAM | \ + MSM_PERFCNTR_UPDATE | \ + 0) + +struct drm_msm_perfcntr_group { + char group_name[16]; + __u32 nr_countables; + __u32 pad; /* mbz */ + __u64 countables; /* pointer to an array of nr_countables u32 */ +}; + +/* + * Note, for MSM_PERFCNTR_STREAM, the ioctl returns an fd to read recorded + * counters. This only works because the ioctl is DRM_IOW(), if we returned + * a out param in the ioctl struct the copy_to_user() (in drm_ioctl()) + * could fault, causing us to leak the fd. + * + * If the ioctl returns with error E2BIG, that means more counters/countables + * are requested than are currently available. If MSM_PERFCNTR_UPDATE flag + * is set, drm_msm_perfcntr_group::nr_countables will be updated to return + * the actual # of counters available. + * + * The data read from the has the following format for each sampling period: + * + * uint64_t timestamp; // CP_ALWAYS_ON_COUNTER captured at sample time + * uint32_t seqno; // increments by 1 each period, reset to 0 on discontinuity + * uint32_t mbz; // pad out counters to 64b + * struct { + * uint64_t counter[nr_countables]; + * } groups[nr_groups]; + * + * The ordering of groups and counters matches the order in PERFCNTR_CONFIG + * ioctl. + */ +struct drm_msm_perfcntr_config { + __u32 flags; /* bitmask of MSM_PERFCNTR_x */ + __u32 nr_groups; /* # of entries in groups array */ + __u64 groups; /* pointer to array of drm_msm_perfcntr_group */ + __u64 period; /* sampling period in ns */ + __u32 bufsz_shift; /* sample buffer size in bytes is 1< Date: Fri, 3 Apr 2026 13:40:28 +0800 Subject: EDAC/igen6: Fix memory topology parsing for Panther Lake-H SoCs Panther Lake-H SoC memory controller registers for memory topology have been updated, but the current igen6_edac driver still uses old generation ones to incorrectly parse memory topology. Fix the issue by adding memory topology parsing function pointers to the 'struct res_config' and creating a new configuration structure for Panther Lake-H SoCs to enable igen6_edac to parse memory correctly. Fixes: 0be9f1af3902 ("EDAC/igen6: Add Intel Panther Lake-H SoCs support") Fixes: 4c36e6106997 ("EDAC/igen6: Add more Intel Panther Lake-H SoCs support") Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://patch.msgid.link/20260403054029.3950383-3-qiuxu.zhuo@intel.com --- include/linux/edac.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/edac.h b/include/linux/edac.h index deba46b3ee25..e6b4e51130e5 100644 --- a/include/linux/edac.h +++ b/include/linux/edac.h @@ -184,6 +184,7 @@ static inline char *mc_event_error_type(const unsigned int err_type) * @MEM_DDR5: Unbuffered DDR5 RAM * @MEM_RDDR5: Registered DDR5 RAM * @MEM_LRDDR5: Load-Reduced DDR5 memory. + * @MEM_LPDDR5: Low-Power DDR5 memory. * @MEM_NVDIMM: Non-volatile RAM * @MEM_WIO2: Wide I/O 2. * @MEM_HBM2: High bandwidth Memory Gen 2. @@ -216,6 +217,7 @@ enum mem_type { MEM_DDR5, MEM_RDDR5, MEM_LRDDR5, + MEM_LPDDR5, MEM_NVDIMM, MEM_WIO2, MEM_HBM2, @@ -247,6 +249,7 @@ enum mem_type { #define MEM_FLAG_DDR5 BIT(MEM_DDR5) #define MEM_FLAG_RDDR5 BIT(MEM_RDDR5) #define MEM_FLAG_LRDDR5 BIT(MEM_LRDDR5) +#define MEM_FLAG_LPDDR5 BIT(MEM_LPDDR5) #define MEM_FLAG_NVDIMM BIT(MEM_NVDIMM) #define MEM_FLAG_WIO2 BIT(MEM_WIO2) #define MEM_FLAG_HBM2 BIT(MEM_HBM2) -- cgit v1.2.3 From 64d8eae3f89583821f599c0aa398dd2e69b31a89 Mon Sep 17 00:00:00 2001 From: Marco Crivellari Date: Fri, 29 May 2026 15:06:39 +0200 Subject: workqueue: Add warnings and fallback if system_{unbound}_wq is used Currently many users transitioned already to the new introduced workqueue (system_percpu_wq, system_dfl_wq), but there are new users who still use the older system_wq and system_unbound_wq. This change try to push this transition forward, by warning whether the old workqueues are used. Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/ Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo --- include/linux/workqueue.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 6177624539b3..a283766a192a 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -409,6 +409,7 @@ enum wq_flags { __WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */ __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */ __WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */ + __WQ_DEPRECATED = 1 << 19, /* internal: workqueue is deprecated */ /* BH wq only allows the following flags */ __WQ_BH_ALLOWS = WQ_BH | WQ_HIGHPRI | WQ_PERCPU, -- cgit v1.2.3 From af841056860d2dc2754a122fb79abbe92f3752f3 Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:42:57 +0200 Subject: RDMA/umem: Rename ib_umem_get() to ib_umem_get_va() The new umem getter family being introduced in follow-up patches need a fitting name for the central all-source helper that resolves attributes, legacy fillers and a UHW VA fallback. Rename the existing VA-pinning helper ib_umem_get() to ib_umem_get_va() so the name is freed up. The new name is consistent with names of rest of the helpers that are about to be introduced. Link: https://patch.msgid.link/r/20260529134312.2836341-2-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 2ad52cc1d52b..25e90766892e 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -75,8 +75,8 @@ static inline size_t ib_umem_num_pages(struct ib_umem *umem) } #ifdef CONFIG_INFINIBAND_USER_MEM -struct ib_umem *ib_umem_get(struct ib_device *device, unsigned long addr, - size_t size, int access); +struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr, + size_t size, int access); void ib_umem_release(struct ib_umem *umem); int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length); @@ -160,9 +160,9 @@ void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf); #include -static inline struct ib_umem *ib_umem_get(struct ib_device *device, - unsigned long addr, size_t size, - int access) +static inline struct ib_umem *ib_umem_get_va(struct ib_device *device, + unsigned long addr, size_t size, + int access) { return ERR_PTR(-EOPNOTSUPP); } -- cgit v1.2.3 From 3cfdff484d84f04716ae56063a8dac3773bd3f29 Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:42:59 +0200 Subject: RDMA/core: Introduce generic buffer descriptor infrastructure for umem Introduce a per-attribute UVERBS_ATTR_UMEM model so each uverbs command's umem set is explicit in its UAPI definition. Add driver-facing wrapper helpers that pin a umem on demand from an attribute or a VA addr; the driver owns the returned umem and releases it from its destroy/error paths. Link: https://patch.msgid.link/r/20260529134312.2836341-4-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 36 +++++++++++++++++++++++++++++++++ include/rdma/uverbs_ioctl.h | 30 +++++++++++++++++++++++++++ include/uapi/rdma/ib_user_ioctl_verbs.h | 27 +++++++++++++++++++++++++ 3 files changed, 93 insertions(+) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 25e90766892e..0f373679ea81 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -73,10 +73,26 @@ static inline size_t ib_umem_num_pages(struct ib_umem *umem) { return ib_umem_num_dma_blocks(umem, PAGE_SIZE); } + +struct ib_udata; +struct ib_uverbs_buffer_desc; +struct uverbs_attr_bundle; + #ifdef CONFIG_INFINIBAND_USER_MEM +struct ib_umem *ib_umem_get_desc(struct ib_device *device, + const struct ib_uverbs_buffer_desc *desc, + int access); struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr, size_t size, int access); +struct ib_umem *ib_umem_get_attr(struct ib_device *device, + const struct uverbs_attr_bundle *attrs, + u16 attr_id, size_t size, int access); +struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device, + const struct uverbs_attr_bundle *attrs, + u16 attr_id, u64 addr, size_t size, + int access); + void ib_umem_release(struct ib_umem *umem); int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length); @@ -160,12 +176,32 @@ void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf); #include +static inline struct ib_umem * +ib_umem_get_desc(struct ib_device *device, + const struct ib_uverbs_buffer_desc *desc, int access) +{ + return ERR_PTR(-EOPNOTSUPP); +} static inline struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr, size_t size, int access) { return ERR_PTR(-EOPNOTSUPP); } +static inline struct ib_umem * +ib_umem_get_attr(struct ib_device *device, + const struct uverbs_attr_bundle *attrs, u16 attr_id, + size_t size, int access) +{ + return ERR_PTR(-EOPNOTSUPP); +} +static inline struct ib_umem * +ib_umem_get_attr_or_va(struct ib_device *device, + const struct uverbs_attr_bundle *attrs, u16 attr_id, + u64 addr, size_t size, int access) +{ + return ERR_PTR(-EOPNOTSUPP); +} static inline void ib_umem_release(struct ib_umem *umem) { } static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length) { diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h index 9d7575d999e1..24fd36213023 100644 --- a/include/rdma/uverbs_ioctl.h +++ b/include/rdma/uverbs_ioctl.h @@ -590,6 +590,28 @@ struct uapi_definition { UA_OPTIONAL, \ .is_udata = 1) +/* + * Per-attribute UMEM descriptor. The payload is a single + * struct ib_uverbs_buffer_desc identifying a memory region backed by + * dma-buf or user virtual address. _access selects UA_OPTIONAL or + * UA_MANDATORY. Drivers obtain a umem from the attribute via the + * ib_umem_get_*() wrapper helpers. + */ +#define UVERBS_ATTR_UMEM(_attr_id, _access) \ + UVERBS_ATTR_PTR_IN(_attr_id, \ + UVERBS_ATTR_TYPE(struct ib_uverbs_buffer_desc), \ + _access) + +/* + * Bit masks of the @flags / @optional_flags fields of struct + * ib_uverbs_buffer_desc that the kernel understands. @flags is strict: + * any bit outside the known mask makes the call fail with -EINVAL. + * @optional_flags is advisory: bits outside the known mask are silently + * dropped. Both masks are extended as new bits are introduced. + */ +#define IB_UVERBS_BUFFER_DESC_FLAGS_KNOWN_MASK 0U +#define IB_UVERBS_BUFFER_DESC_OPTIONAL_FLAGS_KNOWN_MASK 0U + /* ================================================= * Parsing infrastructure * ================================================= @@ -862,6 +884,8 @@ int uverbs_get_flags32(u32 *to, const struct uverbs_attr_bundle *attrs_bundle, size_t idx, u64 allowed_bits); int uverbs_copy_to(const struct uverbs_attr_bundle *attrs_bundle, size_t idx, const void *from, size_t size); +int uverbs_get_buffer_desc(const struct uverbs_attr_bundle *attrs_bundle, + u16 attr_id, struct ib_uverbs_buffer_desc *desc); __malloc void *_uverbs_alloc(struct uverbs_attr_bundle *bundle, size_t size, gfp_t flags); @@ -920,6 +944,12 @@ static inline int uverbs_copy_to(const struct uverbs_attr_bundle *attrs_bundle, { return -EINVAL; } +static inline int +uverbs_get_buffer_desc(const struct uverbs_attr_bundle *attrs_bundle, + u16 attr_id, struct ib_uverbs_buffer_desc *desc) +{ + return -EINVAL; +} static inline __malloc void *uverbs_alloc(struct uverbs_attr_bundle *bundle, size_t size) { diff --git a/include/uapi/rdma/ib_user_ioctl_verbs.h b/include/uapi/rdma/ib_user_ioctl_verbs.h index 90c5cd8e7753..51030c27d479 100644 --- a/include/uapi/rdma/ib_user_ioctl_verbs.h +++ b/include/uapi/rdma/ib_user_ioctl_verbs.h @@ -273,4 +273,31 @@ struct ib_uverbs_gid_entry { __u32 netdev_ifindex; /* It is 0 if there is no netdev associated with it */ }; +enum ib_uverbs_buffer_type { + IB_UVERBS_BUFFER_TYPE_DMABUF, + IB_UVERBS_BUFFER_TYPE_VA, +}; + +/* + * Describes a single buffer backed by dma-buf or user virtual address. + * Used as the payload of a per-attribute UVERBS_ATTR_UMEM-typed attribute. + * + * @type: buffer type from enum ib_uverbs_buffer_type + * @fd: dma-buf file descriptor (valid for IB_UVERBS_BUFFER_TYPE_DMABUF) + * @flags: required flags; the kernel rejects the call with -EINVAL if any + * bit is not understood. No bits are defined yet. + * @optional_flags: advisory flags; bits the kernel does not understand are + * silently ignored. No bits are defined yet. + * @addr: offset within dma-buf, or user virtual address for VA + * @length: buffer length in bytes + */ +struct ib_uverbs_buffer_desc { + __u32 type; + __s32 fd; + __u32 flags; + __u32 optional_flags; + __aligned_u64 addr; + __aligned_u64 length; +}; + #endif -- cgit v1.2.3 From df67f15c447475b81f77de2eaf22732bc11d6bae Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:43:00 +0200 Subject: RDMA/umem: Route ib_umem_get_va() through ib_umem_get_attr_or_va() ib_umem_get_va() is now redundant: ib_umem_get_attr_or_va() with attrs=NULL and attr_id=0 covers the exact same path. Make it a static inline wrapper instead of a separately exported symbol. Link: https://patch.msgid.link/r/20260529134312.2836341-5-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 0f373679ea81..908eafa52840 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -83,8 +83,6 @@ struct uverbs_attr_bundle; struct ib_umem *ib_umem_get_desc(struct ib_device *device, const struct ib_uverbs_buffer_desc *desc, int access); -struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr, - size_t size, int access); struct ib_umem *ib_umem_get_attr(struct ib_device *device, const struct uverbs_attr_bundle *attrs, u16 attr_id, size_t size, int access); @@ -93,6 +91,13 @@ struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device, u16 attr_id, u64 addr, size_t size, int access); +static inline struct ib_umem *ib_umem_get_va(struct ib_device *device, + unsigned long addr, size_t size, + int access) +{ + return ib_umem_get_attr_or_va(device, NULL, 0, addr, size, access); +} + void ib_umem_release(struct ib_umem *umem); int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length); -- cgit v1.2.3 From 057bb70f531c3e33c18c067716f39f8413b252aa Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:43:01 +0200 Subject: RDMA/uverbs: Push out CQ buffer umem processing into a helper Extract the UVERBS_ATTR_CREATE_CQ_BUFFER_* parser from the CQ create handler into uverbs_create_cq_get_buffer_desc(), and wrap it in ib_umem_get_cq_tmp(), the umem-producing helper the cq_create handler now calls. ib_umem_get_cq_tmp() is temporary; subsequent patches replace it with driver-owned ib_umem_get_cq_buf*() wrappers built on the same parser, and remove it once all CQ drivers have switched. Link: https://patch.msgid.link/r/20260529134312.2836341-6-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 908eafa52840..0d6e90a35f3a 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -90,6 +90,8 @@ struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device, const struct uverbs_attr_bundle *attrs, u16 attr_id, u64 addr, size_t size, int access); +struct ib_umem *ib_umem_get_cq_tmp(struct ib_device *device, + struct uverbs_attr_bundle *attrs); static inline struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr, size_t size, @@ -207,6 +209,11 @@ ib_umem_get_attr_or_va(struct ib_device *device, { return ERR_PTR(-EOPNOTSUPP); } +static inline struct ib_umem * +ib_umem_get_cq_tmp(struct ib_device *device, struct uverbs_attr_bundle *attrs) +{ + return ERR_PTR(-EOPNOTSUPP); +} static inline void ib_umem_release(struct ib_umem *umem) { } static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length) { -- cgit v1.2.3 From f6d2e53ca53ad2e847e5eb64c56c426ee2fd8bdd Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:43:02 +0200 Subject: RDMA/uverbs: Add CQ buffer UMEM attribute and driver helpers Add UVERBS_ATTR_CREATE_CQ_BUF_UMEM and two driver-facing wrappers, ib_umem_get_cq_buf() and ib_umem_get_cq_buf_or_va(), that pin a CQ buffer umem from it. The wrappers reuse the existing legacy CQ buffer-attr filler. Link: https://patch.msgid.link/r/20260529134312.2836341-7-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 20 ++++++++++++++++++++ include/uapi/rdma/ib_user_ioctl_cmds.h | 1 + 2 files changed, 21 insertions(+) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 0d6e90a35f3a..492c8d365730 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -90,6 +90,12 @@ struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device, const struct uverbs_attr_bundle *attrs, u16 attr_id, u64 addr, size_t size, int access); +struct ib_umem *ib_umem_get_cq_buf(struct ib_device *device, + const struct uverbs_attr_bundle *attrs, + size_t size, int access); +struct ib_umem *ib_umem_get_cq_buf_or_va(struct ib_device *device, + const struct uverbs_attr_bundle *attrs, + u64 addr, size_t size, int access); struct ib_umem *ib_umem_get_cq_tmp(struct ib_device *device, struct uverbs_attr_bundle *attrs); @@ -210,6 +216,20 @@ ib_umem_get_attr_or_va(struct ib_device *device, return ERR_PTR(-EOPNOTSUPP); } static inline struct ib_umem * +ib_umem_get_cq_buf(struct ib_device *device, + const struct uverbs_attr_bundle *attrs, size_t size, + int access) +{ + return ERR_PTR(-EOPNOTSUPP); +} +static inline struct ib_umem * +ib_umem_get_cq_buf_or_va(struct ib_device *device, + const struct uverbs_attr_bundle *attrs, u64 addr, + size_t size, int access) +{ + return ERR_PTR(-EOPNOTSUPP); +} +static inline struct ib_umem * ib_umem_get_cq_tmp(struct ib_device *device, struct uverbs_attr_bundle *attrs) { return ERR_PTR(-EOPNOTSUPP); diff --git a/include/uapi/rdma/ib_user_ioctl_cmds.h b/include/uapi/rdma/ib_user_ioctl_cmds.h index 72041c1b0ea5..02835b7fd76d 100644 --- a/include/uapi/rdma/ib_user_ioctl_cmds.h +++ b/include/uapi/rdma/ib_user_ioctl_cmds.h @@ -117,6 +117,7 @@ enum uverbs_attrs_create_cq_cmd_attr_ids { UVERBS_ATTR_CREATE_CQ_BUFFER_LENGTH, UVERBS_ATTR_CREATE_CQ_BUFFER_FD, UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET, + UVERBS_ATTR_CREATE_CQ_BUF_UMEM, }; enum uverbs_attrs_destroy_cq_cmd_attr_ids { -- cgit v1.2.3 From 7c5bbaaf4441558a5b7ab0e4db3f153b18a4ec19 Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:43:07 +0200 Subject: RDMA/uverbs: Remove legacy umem field from struct ib_cq Now that all drivers use helper to get umem and manage the lifetime, legacy umem field in struct ib_cq is no longer needed. Remove it along with ib_umem_get_cq_tmp() helper that populated it and both error and destroy paths. Link: https://patch.msgid.link/r/20260529134312.2836341-12-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 7 ------- include/rdma/ib_verbs.h | 1 - 2 files changed, 8 deletions(-) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 492c8d365730..370d802f0e63 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -96,8 +96,6 @@ struct ib_umem *ib_umem_get_cq_buf(struct ib_device *device, struct ib_umem *ib_umem_get_cq_buf_or_va(struct ib_device *device, const struct uverbs_attr_bundle *attrs, u64 addr, size_t size, int access); -struct ib_umem *ib_umem_get_cq_tmp(struct ib_device *device, - struct uverbs_attr_bundle *attrs); static inline struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr, size_t size, @@ -229,11 +227,6 @@ ib_umem_get_cq_buf_or_va(struct ib_device *device, { return ERR_PTR(-EOPNOTSUPP); } -static inline struct ib_umem * -ib_umem_get_cq_tmp(struct ib_device *device, struct uverbs_attr_bundle *attrs) -{ - return ERR_PTR(-EOPNOTSUPP); -} static inline void ib_umem_release(struct ib_umem *umem) { } static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length) { diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 01e0eea0703f..893cb5b73951 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1738,7 +1738,6 @@ struct ib_cq { u8 interrupt:1; u8 shared:1; unsigned int comp_vector; - struct ib_umem *umem; /* * Implementation details of the RDMA core, don't use in drivers: -- cgit v1.2.3 From cd767d980cb9d808a6811fa043f06480e30e0cd8 Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:43:08 +0200 Subject: RDMA/uverbs: Use UMEM attributes for QP creation Apply the per-attribute UMEM model to the QP create method. Add three optional UMEM attributes that drivers pick from based on how their user ABI lays out the QP rings: - CREATE_QP_BUF_UMEM is a single user buffer that backs both the SQ and RQ of one QP. This is the common case where userspace pins one contiguous WQE region for the QP. - CREATE_QP_SQ_BUF_UMEM and CREATE_QP_RQ_BUF_UMEM are a pair of user buffers backing the SQ and RQ independently, used when the two rings live in physically distinct user allocations and must be pinned and addressed separately. Existing drivers would map their current umems as follows: - mlx5: BUF for normal QPs (one ucmd->buf_addr covers SQ+RQ); for IB_QPT_RAW_PACKET and IB_QP_CREATE_SOURCE_QPN, the RQ side comes from ucmd->buf_addr (RQ-sized) via RQ_BUF and the SQ from ucmd->sq_buf_addr via SQ_BUF. - mlx4: BUF, single ucmd.buf_addr covering SQ+RQ. - hns: BUF, single ucmd.buf_addr covering SQ + ext-SGE + RQ. - erdma: BUF, single ureq.qbuf_va sliced by the kernel into SQ at offset 0 and RQ at rq_offset. - bnxt_re: SQ_BUF (ureq->qpsva) + RQ_BUF (ureq->qprva, the RQ side is skipped when the QP uses an SRQ). - vmw_pvrdma: SQ_BUF (sbuf_addr) + RQ_BUF (rbuf_addr, the RQ side is skipped when the QP uses an SRQ). - qedr: SQ_BUF (sq_addr) + RQ_BUF (rq_addr) for whichever side the QP type actually has (no SQ for XRC_TGT/GSI; no RQ for XRC_INI/XRC_TGT/SRQ). - ionic: SQ_BUF (req.sq.addr) + RQ_BUF (req.rq.addr); both are skipped when the rings are placed in CMB instead of host memory. - mana: raw-packet QP uses SQ_BUF (sq_buf_addr) only; the RC path uses multiple per-queue user buffers (ucmd.queue_buf[]) that do not fit the SQ/RQ pair semantics of these attrs and stays on the legacy UHW path. - efa, irdma, hfi1, ocrdma, mthca, cxgb4 and usnic do not pin a QP WQE buffer via umem; none of these attributes apply. Link: https://patch.msgid.link/r/20260529134312.2836341-13-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/uapi/rdma/ib_user_ioctl_cmds.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/uapi/rdma/ib_user_ioctl_cmds.h b/include/uapi/rdma/ib_user_ioctl_cmds.h index 02835b7fd76d..839835bd4b23 100644 --- a/include/uapi/rdma/ib_user_ioctl_cmds.h +++ b/include/uapi/rdma/ib_user_ioctl_cmds.h @@ -159,6 +159,9 @@ enum uverbs_attrs_create_qp_cmd_attr_ids { UVERBS_ATTR_CREATE_QP_EVENT_FD, UVERBS_ATTR_CREATE_QP_RESP_CAP, UVERBS_ATTR_CREATE_QP_RESP_QP_NUM, + UVERBS_ATTR_CREATE_QP_BUF_UMEM, + UVERBS_ATTR_CREATE_QP_RQ_BUF_UMEM, + UVERBS_ATTR_CREATE_QP_SQ_BUF_UMEM, }; enum uverbs_attrs_destroy_qp_cmd_attr_ids { -- cgit v1.2.3 From 2cc10972f5f4f123e5a7658824db4f7b5abfc410 Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:43:10 +0200 Subject: RDMA/umem: Add ib_umem_is_contiguous() stub for !CONFIG_INFINIBAND_USER_MEM ib_umem_is_contiguous() is defined under #ifdef CONFIG_INFINIBAND_USER_MEM, but the #else branch lacks a stub. Add the missing inline to fix potential broken build. Fixes: c897c2c8b8e8 ("RDMA/core: Add umem "is_contiguous" and "start_dma_addr" helpers") Link: https://patch.msgid.link/r/20260529134312.2836341-15-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 370d802f0e63..bc1e6ed73b3f 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -244,6 +244,10 @@ static inline unsigned long ib_umem_find_best_pgoff(struct ib_umem *umem, { return 0; } +static inline bool ib_umem_is_contiguous(struct ib_umem *umem) +{ + return false; +} static inline struct ib_umem_dmabuf *ib_umem_dmabuf_get(struct ib_device *device, unsigned long offset, -- cgit v1.2.3 From d6ab1d243973acb046aab8f6daea90005041070a Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:43:11 +0200 Subject: RDMA/mlx5: Use UMEM attribute for CQ doorbell record Add an optional mlx5 driver-namespace UMEM attribute on CQ create so userspace can supply the doorbell record buffer explicitly. mlx5_ib_db_map_user() resolves the attribute (or falls back to the legacy UHW VA) into a struct ib_uverbs_buffer_desc and runs a unified lookup-then-pin: VA-typed descriptors share a per-page umem across CQ/QP/SRQ in the same process, FD-typed descriptors are pinned per call. Link: https://patch.msgid.link/r/20260529134312.2836341-16-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/uapi/rdma/mlx5_user_ioctl_cmds.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/rdma/mlx5_user_ioctl_cmds.h b/include/uapi/rdma/mlx5_user_ioctl_cmds.h index 01a2a050e468..b63e75034cda 100644 --- a/include/uapi/rdma/mlx5_user_ioctl_cmds.h +++ b/include/uapi/rdma/mlx5_user_ioctl_cmds.h @@ -274,6 +274,7 @@ enum mlx5_ib_device_query_context_attrs { enum mlx5_ib_create_cq_attrs { MLX5_IB_ATTR_CREATE_CQ_UAR_INDEX = UVERBS_ID_DRIVER_NS_WITH_UHW, + MLX5_IB_ATTR_CREATE_CQ_DBR_BUF_UMEM, }; enum mlx5_ib_reg_dmabuf_mr_attrs { -- cgit v1.2.3 From 93ce776a5b0453314a5d1d6068762c9d646f5754 Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Fri, 29 May 2026 15:43:12 +0200 Subject: RDMA/mlx5: Use UMEM attribute for QP doorbell record Add an optional mlx5 driver-namespace UMEM attribute on QP create so userspace can supply the doorbell record umem explicitly, symmetric to the CQ side. Resolve it inside mlx5_ib_db_map_user() and use it as a private DBR page when present; otherwise take the existing UHW share-or-pin path that preserves per-page DBR sharing across CQ/QP/SRQ in the same process. Add mlx5's first UVERBS_OBJECT_QP UAPI definition chain to attach the new attr. Link: https://patch.msgid.link/r/20260529134312.2836341-17-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/uapi/rdma/mlx5_user_ioctl_cmds.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/uapi/rdma/mlx5_user_ioctl_cmds.h b/include/uapi/rdma/mlx5_user_ioctl_cmds.h index b63e75034cda..ddb898afd813 100644 --- a/include/uapi/rdma/mlx5_user_ioctl_cmds.h +++ b/include/uapi/rdma/mlx5_user_ioctl_cmds.h @@ -277,6 +277,10 @@ enum mlx5_ib_create_cq_attrs { MLX5_IB_ATTR_CREATE_CQ_DBR_BUF_UMEM, }; +enum mlx5_ib_create_qp_attrs { + MLX5_IB_ATTR_CREATE_QP_DBR_BUF_UMEM = UVERBS_ID_DRIVER_NS_WITH_UHW, +}; + enum mlx5_ib_reg_dmabuf_mr_attrs { MLX5_IB_ATTR_REG_DMABUF_MR_ACCESS_FLAGS = (1U << UVERBS_ID_NS_SHIFT), }; -- cgit v1.2.3 From d7a40b519497fbee5644be4bd823b8d710bb8d55 Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Sun, 17 May 2026 16:13:10 +0200 Subject: RDMA/uverbs: Expose CoCo DMA bounce requirement to userspace In CoCo guests, guest memory is encrypted and untrusted (T=0) devices cannot DMA to it directly; such transfers must go through unencrypted bounce buffers. RDMA registers user pages for direct device access, bypassing the DMA layer and thus any bouncing, so registered memory does not work in this configuration. Until trusted (T=1) device detection is available, conservatively flag every device attached to a CoCo guest. Expose the condition to userspace as IB_UVERBS_DEVICE_CC_DMA_BOUNCE in device_cap_flags_ex so applications can avoid memory registration and fall back to copying buffers through send/recv. Link: https://patch.msgid.link/r/20260517141311.2409230-2-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe --- include/rdma/ib_verbs.h | 3 +++ include/uapi/rdma/ib_user_verbs.h | 2 ++ 2 files changed, 5 insertions(+) (limited to 'include') diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 893cb5b73951..0daa5089d539 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -275,6 +275,7 @@ enum ib_device_cap_flags { IB_DEVICE_FLUSH_GLOBAL = IB_UVERBS_DEVICE_FLUSH_GLOBAL, IB_DEVICE_FLUSH_PERSISTENT = IB_UVERBS_DEVICE_FLUSH_PERSISTENT, IB_DEVICE_ATOMIC_WRITE = IB_UVERBS_DEVICE_ATOMIC_WRITE, + IB_DEVICE_CC_DMA_BOUNCE = IB_UVERBS_DEVICE_CC_DMA_BOUNCE, }; enum ib_kernel_cap_flags { @@ -2950,6 +2951,8 @@ struct ib_device { u16 kverbs_provider:1; /* CQ adaptive moderation (RDMA DIM) */ u16 use_cq_dim:1; + /* CoCo guest with DMA bounce buffering required */ + u16 cc_dma_bounce:1; u8 node_type; u32 phys_port_cnt; struct ib_device_attr attrs; diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h index 3b7bd99813e9..d2aeadb6d2f9 100644 --- a/include/uapi/rdma/ib_user_verbs.h +++ b/include/uapi/rdma/ib_user_verbs.h @@ -1368,6 +1368,8 @@ enum ib_uverbs_device_cap_flags { IB_UVERBS_DEVICE_FLUSH_PERSISTENT = 1ULL << 39, /* Atomic write attributes */ IB_UVERBS_DEVICE_ATOMIC_WRITE = 1ULL << 40, + /* CoCo guest with DMA bounce buffering required */ + IB_UVERBS_DEVICE_CC_DMA_BOUNCE = 1ULL << 41, }; enum ib_uverbs_raw_packet_caps { -- cgit v1.2.3 From 1947229f5f2a8d4ecf8c971aca68a1242bb7b37c Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Tue, 5 May 2026 15:37:21 +0200 Subject: amba: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 3cf385713460 ("ARM: 8256/1: driver coamba: add device binding path 'driver_override'") Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260505133935.3772495-2-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/amba/bus.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include') diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h index 9946276aff73..6c54d5c0d21f 100644 --- a/include/linux/amba/bus.h +++ b/include/linux/amba/bus.h @@ -71,11 +71,6 @@ struct amba_device { unsigned int cid; struct amba_cs_uci_id uci; unsigned int irq[AMBA_NR_IRQS]; - /* - * Driver name to force a match. Do not set directly, because core - * frees it. Use driver_set_override() to set or clear it. - */ - const char *driver_override; }; struct amba_driver { -- cgit v1.2.3 From d541aa1897f67f4f14c805785bff894bcc61dca1 Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Tue, 5 May 2026 15:37:22 +0200 Subject: cdx: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 2959ab247061 ("cdx: add the cdx bus driver") Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260505133935.3772495-3-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/cdx/cdx_bus.h | 4 ---- 1 file changed, 4 deletions(-) (limited to 'include') diff --git a/include/linux/cdx/cdx_bus.h b/include/linux/cdx/cdx_bus.h index b1ba97f6c9ad..f54770f110bc 100644 --- a/include/linux/cdx/cdx_bus.h +++ b/include/linux/cdx/cdx_bus.h @@ -137,9 +137,6 @@ struct cdx_controller { * @enabled: is this bus enabled * @msi_dev_id: MSI Device ID associated with CDX device * @num_msi: Number of MSI's supported by the device - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @irqchip_lock: lock to synchronize irq/msi configuration * @msi_write_pending: MSI write pending for this device */ @@ -165,7 +162,6 @@ struct cdx_device { bool enabled; u32 msi_dev_id; u32 num_msi; - const char *driver_override; struct mutex irqchip_lock; bool msi_write_pending; }; -- cgit v1.2.3 From 331d8900121a1d74ecd45cd2db742ddcb5a0a565 Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Tue, 5 May 2026 15:37:23 +0200 Subject: Drivers: hv: vmbus: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Tested-by: Michael Kelley Reviewed-by: Michael Kelley Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: d765edbb301c ("vmbus: add driver_override support") Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260505133935.3772495-4-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/hyperv.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include') diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h index 964f1be8150c..c054d7eff622 100644 --- a/include/linux/hyperv.h +++ b/include/linux/hyperv.h @@ -1272,11 +1272,6 @@ struct hv_device { u16 device_id; struct device device; - /* - * Driver name to force a match. Do not set directly, because core - * frees it. Use driver_set_override() to set or clear it. - */ - const char *driver_override; struct vmbus_channel *channel; struct kset *channels_kset; -- cgit v1.2.3 From 55ced13c42921714e90f8fae94b6ed803330dc6a Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Tue, 5 May 2026 15:37:24 +0200 Subject: rpmsg: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: e95060478244 ("rpmsg: Introduce a driver override mechanism") Reviewed-by: Mathieu Poirier Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260505133935.3772495-5-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/rpmsg.h | 4 ---- 1 file changed, 4 deletions(-) (limited to 'include') diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h index 83266ce14642..2e40eb54155e 100644 --- a/include/linux/rpmsg.h +++ b/include/linux/rpmsg.h @@ -41,9 +41,6 @@ struct rpmsg_channel_info { * rpmsg_device - device that belong to the rpmsg bus * @dev: the device struct * @id: device id (used to match between rpmsg drivers and devices) - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @src: local address * @dst: destination address * @ept: the rpmsg endpoint of this channel @@ -53,7 +50,6 @@ struct rpmsg_channel_info { struct rpmsg_device { struct device dev; struct rpmsg_device_id id; - const char *driver_override; u32 src; u32 dst; struct rpmsg_endpoint *ept; -- cgit v1.2.3 From 46def663dd34da36464ba059f7cfeacf29d98e5e Mon Sep 17 00:00:00 2001 From: Danilo Krummrich Date: Tue, 5 May 2026 15:37:25 +0200 Subject: driver core: remove driver_set_override() All buses have been converted from driver_set_override() to the generic driver_override infrastructure introduced in commit cb3d1049f4ea ("driver core: generalize driver_override in struct device"). Buses now either opt into the generic sysfs callbacks via the bus_type::driver_override flag, or use device_set_driver_override() / __device_set_driver_override() directly. Thus, remove the now-unused driver_set_override() helper. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260505133935.3772495-6-dakr@kernel.org Signed-off-by: Danilo Krummrich --- include/linux/device/driver.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/device/driver.h b/include/linux/device/driver.h index 2fb054868049..38048e74d10a 100644 --- a/include/linux/device/driver.h +++ b/include/linux/device/driver.h @@ -160,8 +160,6 @@ int __must_check driver_create_file(const struct device_driver *driver, void driver_remove_file(const struct device_driver *driver, const struct driver_attribute *attr); -int driver_set_override(struct device *dev, const char **override, - const char *s, size_t len); int __must_check driver_for_each_device(struct device_driver *drv, struct device *start, void *data, device_iter_t fn); struct device *driver_find_device(const struct device_driver *drv, -- cgit v1.2.3 From 72a2a9023c329aca7e7f8d3997c9a26aa317a1fd Mon Sep 17 00:00:00 2001 From: Thierry Reding Date: Tue, 4 Feb 2025 19:45:19 +0100 Subject: soc/tegra: pmc: Remove unused legacy functions All callers of these functions have been replaced by their variants taking a PMC context as an input, so they are no longer used and can be removed. Acked-by: Jon Hunter Signed-off-by: Thierry Reding --- include/soc/tegra/pmc.h | 47 ----------------------------------------------- 1 file changed, 47 deletions(-) (limited to 'include') diff --git a/include/soc/tegra/pmc.h b/include/soc/tegra/pmc.h index 1fd21be02577..8b4bcdea849e 100644 --- a/include/soc/tegra/pmc.h +++ b/include/soc/tegra/pmc.h @@ -164,16 +164,6 @@ int tegra_pmc_io_pad_power_enable(struct tegra_pmc *pmc, enum tegra_io_pad id); int tegra_pmc_io_pad_power_disable(struct tegra_pmc *pmc, enum tegra_io_pad id); /* legacy */ -int tegra_powergate_power_on(unsigned int id); -int tegra_powergate_power_off(unsigned int id); -int tegra_powergate_remove_clamping(unsigned int id); - -int tegra_powergate_sequence_power_up(unsigned int id, struct clk *clk, - struct reset_control *rst); - -int tegra_io_pad_power_enable(enum tegra_io_pad id); -int tegra_io_pad_power_disable(enum tegra_io_pad id); - void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode); void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode); @@ -224,43 +214,6 @@ tegra_pmc_io_pad_power_disable(struct tegra_pmc *pmc, enum tegra_io_pad id) return -ENOSYS; } -static inline int tegra_powergate_power_on(unsigned int id) -{ - return -ENOSYS; -} - -static inline int tegra_powergate_power_off(unsigned int id) -{ - return -ENOSYS; -} - -static inline int tegra_powergate_remove_clamping(unsigned int id) -{ - return -ENOSYS; -} - -static inline int tegra_powergate_sequence_power_up(unsigned int id, - struct clk *clk, - struct reset_control *rst) -{ - return -ENOSYS; -} - -static inline int tegra_io_pad_power_enable(enum tegra_io_pad id) -{ - return -ENOSYS; -} - -static inline int tegra_io_pad_power_disable(enum tegra_io_pad id) -{ - return -ENOSYS; -} - -static inline int tegra_io_pad_get_voltage(enum tegra_io_pad id) -{ - return -ENOSYS; -} - static inline void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode) { } -- cgit v1.2.3 From 8318af5dd29c819d95ec5b878e7dab6090a9ed2b Mon Sep 17 00:00:00 2001 From: Thierry Reding Date: Tue, 4 Feb 2025 19:04:51 +0100 Subject: soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard None of this legacy code is needed on 64-bit ARM devices, so it can be moved behind a corresponding preprocessor guard. This more cleanly separates out the legacy code from code needed on current platforms. Acked-by: Jon Hunter Signed-off-by: Thierry Reding --- include/soc/tegra/pmc.h | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) (limited to 'include') diff --git a/include/soc/tegra/pmc.h b/include/soc/tegra/pmc.h index 8b4bcdea849e..4bcbf19d75ac 100644 --- a/include/soc/tegra/pmc.h +++ b/include/soc/tegra/pmc.h @@ -18,10 +18,6 @@ struct clk; struct reset_control; struct tegra_pmc; -bool tegra_pmc_cpu_is_powered(unsigned int cpuid); -int tegra_pmc_cpu_power_on(unsigned int cpuid); -int tegra_pmc_cpu_remove_clamping(unsigned int cpuid); - /* * powergate and I/O rail APIs */ @@ -163,12 +159,6 @@ int tegra_pmc_powergate_sequence_power_up(struct tegra_pmc *pmc, int tegra_pmc_io_pad_power_enable(struct tegra_pmc *pmc, enum tegra_io_pad id); int tegra_pmc_io_pad_power_disable(struct tegra_pmc *pmc, enum tegra_io_pad id); -/* legacy */ -void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode); -void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode); - -bool tegra_pmc_core_domain_state_synced(void); - #else static inline struct tegra_pmc *devm_tegra_pmc_get(struct device *dev) { @@ -213,28 +203,38 @@ tegra_pmc_io_pad_power_disable(struct tegra_pmc *pmc, enum tegra_io_pad id) { return -ENOSYS; } +#endif /* CONFIG_SOC_TEGRA_PMC */ -static inline void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode) +/* 32-bit ARM platforms only */ +#if defined(CONFIG_ARM) +bool tegra_pmc_cpu_is_powered(unsigned int cpuid); +int tegra_pmc_cpu_power_on(unsigned int cpuid); +int tegra_pmc_cpu_remove_clamping(unsigned int cpuid); +bool tegra_pmc_core_domain_state_synced(void); + +#if defined(CONFIG_SOC_TEGRA_PMC) && defined(CONFIG_PM_SLEEP) +enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void); +void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode); +void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode); +#else +static inline enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void) { + return TEGRA_SUSPEND_NONE; } -static inline void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode) +static inline void tegra_pmc_set_suspend_mode(enum tegra_suspend_mode mode) { } -static inline bool tegra_pmc_core_domain_state_synced(void) +static inline void tegra_pmc_enter_suspend_mode(enum tegra_suspend_mode mode) { - return false; } - -#endif /* CONFIG_SOC_TEGRA_PMC */ - -#if defined(CONFIG_SOC_TEGRA_PMC) && defined(CONFIG_PM_SLEEP) -enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void); +#endif #else -static inline enum tegra_suspend_mode tegra_pmc_get_suspend_mode(void) +/* needed for COMPILE_TEST */ +static inline bool tegra_pmc_core_domain_state_synced(void) { - return TEGRA_SUSPEND_NONE; + return false; } #endif -- cgit v1.2.3 From 129c5499819bee611ea1a05f8307692ff75161ce Mon Sep 17 00:00:00 2001 From: Antoniu Miclaus Date: Mon, 20 Apr 2026 13:12:23 +0300 Subject: iio: backend: add devm_iio_backend_get_by_index() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a new function to get an IIO backend by its index in the io-backends device tree property. This is useful for multi-channel devices that have multiple backends, where looking up by index is more straightforward than using named backends. Extract __devm_iio_backend_fwnode_get_by_index() from the existing __devm_iio_backend_fwnode_get(), taking the index directly as a parameter. The new public API devm_iio_backend_get_by_index() uses the index to find the backend reference in the io-backends property, avoiding the need for io-backend-names. Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron --- include/linux/iio/backend.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/iio/backend.h b/include/linux/iio/backend.h index 4d15c2a9802c..3f95ed1fdf9e 100644 --- a/include/linux/iio/backend.h +++ b/include/linux/iio/backend.h @@ -261,6 +261,7 @@ int iio_backend_extend_chan_spec(struct iio_backend *back, bool iio_backend_has_caps(struct iio_backend *back, u32 caps); void *iio_backend_get_priv(const struct iio_backend *conv); struct iio_backend *devm_iio_backend_get(struct device *dev, const char *name); +struct iio_backend *devm_iio_backend_get_by_index(struct device *dev, unsigned int index); struct iio_backend *devm_iio_backend_fwnode_get(struct device *dev, const char *name, struct fwnode_handle *fwnode); -- cgit v1.2.3 From c0536d61f30417b0aeac7ea8734525ab7a01a93b Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Mon, 27 Apr 2026 20:51:47 +0200 Subject: iio: buffer: Move from int64_t to s64 for timestamp iio_push_to_buffers_with_ts_unaligned() uses int64_t for timestamp. Move it from int64_t to s64 to make consistent with: - iio_push_to_buffers_with_ts() - all current users that supply s64 anyway This will reduce potential of wrong type being chosen when using this API. Signed-off-by: Andy Shevchenko Signed-off-by: Jonathan Cameron --- include/linux/iio/buffer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/iio/buffer.h b/include/linux/iio/buffer.h index 8fd0d57d238f..745c98ef4e04 100644 --- a/include/linux/iio/buffer.h +++ b/include/linux/iio/buffer.h @@ -79,7 +79,7 @@ static inline int iio_push_to_buffers_with_ts(struct iio_dev *indio_dev, int iio_push_to_buffers_with_ts_unaligned(struct iio_dev *indio_dev, const void *data, size_t data_sz, - int64_t timestamp); + s64 timestamp); bool iio_validate_scan_mask_onehot(struct iio_dev *indio_dev, const unsigned long *mask); -- cgit v1.2.3 From 8a2f9c41b9cc3b7570e4b8476220db11bd6a1030 Mon Sep 17 00:00:00 2001 From: Andy Shevchenko Date: Sun, 24 May 2026 20:38:33 -0500 Subject: iio: Convert IIO_CHAN_SOFT_TIMESTAMP() to be compound literal Currently IIO_CHAN_SOFT_TIMESTAMP() can only be used to fill the static data. In some cases it would be convenient to use it as right value in the assignment operation. But it can't be done as is, because compiler has no clue about the data layout. Converting it to be a compound literal allows the above mentioned usage. While at it, tidy up the indentation. We also have to change existing uses of compound literal at the same time to avoid compiler errors. Signed-off-by: Andy Shevchenko Signed-off-by: David Lechner Signed-off-by: Jonathan Cameron --- include/linux/iio/iio.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h index 96b05c86c325..711c00f67371 100644 --- a/include/linux/iio/iio.h +++ b/include/linux/iio/iio.h @@ -353,15 +353,15 @@ static inline bool iio_channel_has_available(const struct iio_chan_spec *chan, (chan->info_mask_shared_by_all_available & BIT(type)); } -#define IIO_CHAN_SOFT_TIMESTAMP(_si) { \ +#define IIO_CHAN_SOFT_TIMESTAMP(_si) (struct iio_chan_spec) { \ .type = IIO_TIMESTAMP, \ .channel = -1, \ .scan_index = _si, \ .scan_type = { \ .sign = 's', \ - .realbits = 64, \ + .realbits = 64, \ .storagebits = 64, \ - }, \ + }, \ } s64 iio_get_time_ns(const struct iio_dev *indio_dev); -- cgit v1.2.3 From 622775dbc56a6349fc98b368041e3224bfeeb9de Mon Sep 17 00:00:00 2001 From: Liviu Stan Date: Mon, 25 May 2026 19:39:34 +0300 Subject: iio: core: Add IIO_COVERAGE channel type Add a new channel type for sensors that report fractional coverage as a percentage. The sysfs attribute is in_coverageY_raw; after applying in_coverageY_scale the value is in percent. The first user is the ADT7604 leak detector, where the value represents the portion of the sensing element that is wetted. Signed-off-by: Liviu Stan Signed-off-by: Jonathan Cameron --- include/uapi/linux/iio/types.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/iio/types.h b/include/uapi/linux/iio/types.h index d7c2bb223651..c9295c707041 100644 --- a/include/uapi/linux/iio/types.h +++ b/include/uapi/linux/iio/types.h @@ -53,6 +53,7 @@ enum iio_chan_type { IIO_CHROMATICITY, IIO_ATTENTION, IIO_ALTCURRENT, + IIO_COVERAGE, }; enum iio_modifier { -- cgit v1.2.3 From 21c4b99b27f3f85b89256e81b3e997dec0a460d0 Mon Sep 17 00:00:00 2001 From: Yuyang Huang Date: Sun, 31 May 2026 15:55:59 +0800 Subject: bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BPF_PROG_QUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpf_attr' structure (e.g. 40 bytes, which was the layout before the addition of 'query.revision'), the kernel performs an out-of-bounds write. Fix this by propagating the user-provided attribute size 'uattr_size' down to the cgroup query handlers, and conditionally skipping writing the revision field to userspace when the provided buffer size is insufficient. query.revision in bpf_mprog_query is structurally identical to the cgroup case: a late tail field, written unconditionally. But the backward-compat hazard is not the same. The min-historical-size test is per command, and bpf_mprog_query only serves attach types that were born with revision in the struct: - tcx_prog_query -> BPF_TCX_INGRESS/EGRESS - netkit_prog_query -> BPF_NETKIT_PRIMARY/PEER tcx, netkit, the revision field, and bpf_mprog_query itself all landed in the same v6.6 merge window (053c8e1f235d added the mprog query API + revision; tcx in e420bed02507, netkit in 35dfaad7188c). There has never been a tcx/netkit BPF_PROG_QUERY userspace that doesn't know about revision. So for these commands the minimum legitimate struct already covers offset 56-64 — no old binary can be broken here. Contrast with cgroup: BPF_PROG_QUERY on cgroup attach types shipped in 2017; revision write-back was bolted on years later (120933984460). That path has a real population of pre-revision callers. Fixes: 120933984460 ("bpf: Implement mprog API on top of existing cgroup progs") Cc: Maciej Żenczykowski Cc: Lorenzo Colitti Signed-off-by: Yuyang Huang Link: https://lore.kernel.org/r/20260531075600.4058207-2-yuyanghuang@google.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf-cgroup.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index b2e79c2b41d5..4d0cc65976a1 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -421,7 +421,7 @@ int cgroup_bpf_prog_detach(const union bpf_attr *attr, enum bpf_prog_type ptype); int cgroup_bpf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog); int cgroup_bpf_prog_query(const union bpf_attr *attr, - union bpf_attr __user *uattr); + union bpf_attr __user *uattr, u32 uattr_size); const struct bpf_func_proto * cgroup_common_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog); @@ -452,7 +452,8 @@ static inline int cgroup_bpf_link_attach(const union bpf_attr *attr, } static inline int cgroup_bpf_prog_query(const union bpf_attr *attr, - union bpf_attr __user *uattr) + union bpf_attr __user *uattr, + u32 uattr_size) { return -EINVAL; } -- cgit v1.2.3 From bf480c6133461a60e8a4486e560550a20e40ac11 Mon Sep 17 00:00:00 2001 From: Michal Clapinski Date: Thu, 23 Apr 2026 14:25:36 +0200 Subject: kho: fix deferred initialization of scratch areas Currently, if CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, kho_release_scratch() will initialize the struct pages and set migratetype of KHO scratch. Unless the whole scratch fits below first_deferred_pfn, some of that will be overwritten either by deferred_init_pages() or memmap_init_reserved_range(). To fix it, make memmap_init_range(), deferred_init_memmap_chunk() and __init_page_from_nid() recognize KHO scratch regions and set migratetype of pageblocks in those regions to MIGRATE_CMA. Co-developed-by: Mike Rapoport (Microsoft) Signed-off-by: Michal Clapinski Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav (Google) Link: https://patch.msgid.link/20260423122538.140993-2-mclapinski@google.com Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/memblock.h | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/memblock.h b/include/linux/memblock.h index b0f750d22a7b..5afcd99aa8c1 100644 --- a/include/linux/memblock.h +++ b/include/linux/memblock.h @@ -613,11 +613,28 @@ static inline void memtest_report_meminfo(struct seq_file *m) { } #ifdef CONFIG_MEMBLOCK_KHO_SCRATCH void memblock_set_kho_scratch_only(void); void memblock_clear_kho_scratch_only(void); -void memmap_init_kho_scratch_pages(void); +bool memblock_is_kho_scratch_memory(phys_addr_t addr); + +static inline enum migratetype kho_scratch_migratetype(unsigned long pfn, + enum migratetype mt) +{ + if (memblock_is_kho_scratch_memory(PFN_PHYS(pfn))) + return MIGRATE_CMA; + return mt; +} #else static inline void memblock_set_kho_scratch_only(void) { } static inline void memblock_clear_kho_scratch_only(void) { } -static inline void memmap_init_kho_scratch_pages(void) {} +static inline bool memblock_is_kho_scratch_memory(phys_addr_t addr) +{ + return false; +} + +static inline enum migratetype kho_scratch_migratetype(unsigned long pfn, + enum migratetype mt) +{ + return mt; +} #endif #endif /* _LINUX_MEMBLOCK_H */ -- cgit v1.2.3 From 4c08a9f38c50c0df7091b5567be7a3bbac92de0b Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 29 Apr 2026 22:21:16 +0100 Subject: liveupdate: add LIVEUPDATE_SESSION_GET_NAME ioctl Userspace when requesting a session via the ioctl specifies a name and gets a FD, but then there is no ioctl to go back the other way and get the name given a LUO session FD. This is problematic especially when there is a userspace orchestrator that wants to check what FDs it is handling for clients without having to do manual string scraping of procfs, or without procfs at all. Add a ioctl to simply get the name from an FD. Signed-off-by: Luca Boccassi Reviewed-by: Pasha Tatashin Reviewed-by: Pratyush Yadav Link: https://lore.kernel.org/r/20260429212221.814107-4-luca.boccassi@gmail.com Signed-off-by: Pasha Tatashin Signed-off-by: Mike Rapoport (Microsoft) --- include/uapi/linux/liveupdate.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/liveupdate.h b/include/uapi/linux/liveupdate.h index 30bc66ee9436..3a9ff53b02e0 100644 --- a/include/uapi/linux/liveupdate.h +++ b/include/uapi/linux/liveupdate.h @@ -59,6 +59,7 @@ enum { LIVEUPDATE_CMD_SESSION_PRESERVE_FD = LIVEUPDATE_CMD_SESSION_BASE, LIVEUPDATE_CMD_SESSION_RETRIEVE_FD = 0x41, LIVEUPDATE_CMD_SESSION_FINISH = 0x42, + LIVEUPDATE_CMD_SESSION_GET_NAME = 0x43, }; /** @@ -213,4 +214,24 @@ struct liveupdate_session_finish { #define LIVEUPDATE_SESSION_FINISH \ _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_SESSION_FINISH) +/** + * struct liveupdate_session_get_name - ioctl(LIVEUPDATE_SESSION_GET_NAME) + * @size: Input; sizeof(struct liveupdate_session_get_name) + * @reserved: Input; Must be zero. Reserved for future use. + * @name: Output; A null-terminated string with the full session name. + * + * Retrieves the full name of the session associated with this file descriptor. + * This is useful because the kernel may truncate the name shown in /proc. + * + * Return: 0 on success, negative error code on failure. + */ +struct liveupdate_session_get_name { + __u32 size; + __u32 reserved; + __u8 name[LIVEUPDATE_SESSION_NAME_LENGTH]; +}; + +#define LIVEUPDATE_SESSION_GET_NAME \ + _IO(LIVEUPDATE_IOCTL_TYPE, LIVEUPDATE_CMD_SESSION_GET_NAME) + #endif /* _UAPI_LIVEUPDATE_H */ -- cgit v1.2.3 From d2850ff2f8c5acda4c1097aa53c006a75b091f2c Mon Sep 17 00:00:00 2001 From: David Matlack Date: Thu, 23 Apr 2026 17:40:28 +0000 Subject: liveupdate: Use refcount_t for FLB reference counts Use refcount_t instead of a raw integer to keep track of references on incoming and outgoing FLBs. Using refcount_t provides protection from overflow, underflow, and other issues. Fixes: cab056f2aae7 ("liveupdate: luo_flb: introduce File-Lifecycle-Bound global state") Signed-off-by: David Matlack Reviewed-by: Samiullah Khawaja Reviewed-by: Pasha Tatashin Link: https://lore.kernel.org/r/20260423174032.3140399-2-dmatlack@google.com Signed-off-by: Pasha Tatashin Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/liveupdate.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/liveupdate.h b/include/linux/liveupdate.h index 30c5a39ff9e9..8d3bbc35c828 100644 --- a/include/linux/liveupdate.h +++ b/include/linux/liveupdate.h @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -175,7 +176,7 @@ struct liveupdate_flb_ops { * @retrieved: True once the FLB's retrieve() callback has run. */ struct luo_flb_private_state { - long count; + refcount_t count; u64 data; void *obj; struct mutex lock; -- cgit v1.2.3 From d8e47bd066d7e626f9f45d416182d585b7e18b9b Mon Sep 17 00:00:00 2001 From: David Matlack Date: Thu, 23 Apr 2026 17:40:29 +0000 Subject: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdate_flb_get_incoming() so that the FLB structure cannot be freed while the caller is actively using it. Add an additional liveupdate_flb_put_incoming() function so the caller can explicitly indicate when it is done using the FLB data. During a Live Update, a subsystem might need to hold onto the incoming File-Lifecycle-Bound (FLB) data for an extended period, such as during device enumeration. Incrementing the reference count guarantees that the data remains valid and accessible until the subsystem releases it, preventing future use-after-free bugs. Fixes: cab056f2aae7 ("liveupdate: luo_flb: introduce File-Lifecycle-Bound global state") Signed-off-by: David Matlack Reviewed-by: Samiullah Khawaja Reviewed-by: Pasha Tatashin Link: https://lore.kernel.org/r/20260423174032.3140399-3-dmatlack@google.com Signed-off-by: Pasha Tatashin Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/liveupdate.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/liveupdate.h b/include/linux/liveupdate.h index 8d3bbc35c828..88722e5caf02 100644 --- a/include/linux/liveupdate.h +++ b/include/linux/liveupdate.h @@ -240,6 +240,8 @@ void liveupdate_unregister_flb(struct liveupdate_file_handler *fh, struct liveupdate_flb *flb); int liveupdate_flb_get_incoming(struct liveupdate_flb *flb, void **objp); +void liveupdate_flb_put_incoming(struct liveupdate_flb *flb); + int liveupdate_flb_get_outgoing(struct liveupdate_flb *flb, void **objp); #else /* CONFIG_LIVEUPDATE */ @@ -280,6 +282,10 @@ static inline int liveupdate_flb_get_incoming(struct liveupdate_flb *flb, return -EOPNOTSUPP; } +static inline void liveupdate_flb_put_incoming(struct liveupdate_flb *flb) +{ +} + static inline int liveupdate_flb_get_outgoing(struct liveupdate_flb *flb, void **objp) { -- cgit v1.2.3 From 42897b76de43e0686c18120e92ac95026ab13940 Mon Sep 17 00:00:00 2001 From: LongWei Date: Sat, 16 May 2026 16:56:53 +0800 Subject: kho: docs: fix typo in ABI documentation Replace "Indentifies" with "Identifies". Signed-off-by: Long Wei Link: https://patch.msgid.link/20260516085653.2193872-1-longwei27@huawei.com Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/kho/abi/kexec_handover.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/kho/abi/kexec_handover.h b/include/linux/kho/abi/kexec_handover.h index db9bda6dd310..fb2d37417ad9 100644 --- a/include/linux/kho/abi/kexec_handover.h +++ b/include/linux/kho/abi/kexec_handover.h @@ -64,7 +64,7 @@ * Root KHO Node (/): * - compatible: "kho-v3" * - * Indentifies the overall KHO ABI version. + * Identifies the overall KHO ABI version. * * - preserved-memory-map: u64 * -- cgit v1.2.3 From 8a2d0b5496850403d1105efbbe54aa8fc68cae6f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= Date: Sun, 31 May 2026 20:41:41 -0300 Subject: ALSA: seq: Use flexible array for device arguments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit snd_seq_device_new() allocates struct snd_seq_device together with a caller-specific argument area. SNDRV_SEQ_DEVICE_ARGPTR() reaches that area by adding sizeof(struct snd_seq_device) to the object pointer. Make the trailing storage explicit with a flexible array and allocate it with kzalloc_flex(). This makes the object layout self-describing and avoids open-coded size arithmetic in the allocation and accessor. Reject negative argsize values before calculating the allocation size. Current in-tree callers pass either zero or sizeof() values, but the function takes an int size argument and should not let a negative value flow into unsigned allocation arithmetic. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260531-alsa-seq-flex-args-v2-1-6e068d4ed9b0@gmail.com Signed-off-by: Takashi Iwai --- include/sound/seq_device.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/sound/seq_device.h b/include/sound/seq_device.h index a72380c202e9..3137d4c5f5a8 100644 --- a/include/sound/seq_device.h +++ b/include/sound/seq_device.h @@ -22,6 +22,7 @@ struct snd_seq_device { void *private_data; /* private data for the caller */ void (*private_free)(struct snd_seq_device *device); struct device dev; + unsigned char args[]; /* driver-specific argument */ }; #define to_seq_dev(_dev) \ @@ -64,7 +65,7 @@ void snd_seq_device_load_drivers(void); int snd_seq_device_new(struct snd_card *card, int device, const char *id, int argsize, struct snd_seq_device **result); -#define SNDRV_SEQ_DEVICE_ARGPTR(dev) (void *)((char *)(dev) + sizeof(struct snd_seq_device)) +#define SNDRV_SEQ_DEVICE_ARGPTR(dev) ((void *)(dev)->args) int __must_check __snd_seq_driver_register(struct snd_seq_driver *drv, struct module *mod); -- cgit v1.2.3 From e9c82f767f0f46ef90eeefccc0a8006cc86aff40 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= Date: Sun, 31 May 2026 22:23:35 -0300 Subject: ALSA: core: Use flexible array for card private data MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit snd_card_new() and snd_devm_card_new() allocate struct snd_card together with optional driver-private storage. The storage is currently described only by open-coded sizeof(*card) + extra_size arithmetic, and snd_card_init() reaches it by manually adding sizeof(struct snd_card) to the card pointer. Make the trailing storage explicit with a flexible array member. Use kzalloc_flex() for the regular allocation path and struct_size() for the devres allocation size. This documents the layout and avoids open-coded variable-size object arithmetic. Align the flexible array to unsigned long long so the driver-private area does not become less aligned than the old sizeof(struct snd_card) tail address on 32-bit ABIs. Signed-off-by: Cássio Gabriel Link: https://patch.msgid.link/20260531-alsa-card-private-flex-array-v2-1-e4ff67f5bd23@gmail.com Signed-off-by: Takashi Iwai --- include/sound/core.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/sound/core.h b/include/sound/core.h index 4093ec82a0a1..4bb76c21c956 100644 --- a/include/sound/core.h +++ b/include/sound/core.h @@ -148,6 +148,8 @@ struct snd_card { struct snd_mixer_oss *mixer_oss; int mixer_oss_change_count; #endif + + unsigned char private_data_area[] __aligned(__alignof__(unsigned long long)); }; #define dev_to_snd_card(p) container_of(p, struct snd_card, card_dev) -- cgit v1.2.3 From 193989cc6d80dd8e0460fb3992e69fa03bf0ff9b Mon Sep 17 00:00:00 2001 From: Julian Anastasov Date: Mon, 25 May 2026 07:07:44 +0300 Subject: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period. Fix it by clearing the ptr early in ip_vs_unbind_scheduler(), before the done_service method schedules any RCU callbacks. Also, if the new scheduler fails to initialize when replacing the old scheduler, try to restore the old scheduler while still returning the error code. Link: https://sashiko.dev/#/patchset/20260519015506.634185-1-rosenp%40gmail.com Fixes: 05f00505a89a ("ipvs: fix crash if scheduler is changed") Signed-off-by: Julian Anastasov Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/net/ip_vs.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h index a02e569813d2..e517eaaa177b 100644 --- a/include/net/ip_vs.h +++ b/include/net/ip_vs.h @@ -1824,8 +1824,7 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler); int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler); int ip_vs_bind_scheduler(struct ip_vs_service *svc, struct ip_vs_scheduler *scheduler); -void ip_vs_unbind_scheduler(struct ip_vs_service *svc, - struct ip_vs_scheduler *sched); +void ip_vs_unbind_scheduler(struct ip_vs_service *svc); struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name); void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler); struct ip_vs_conn * -- cgit v1.2.3 From 55a000fa1d0ebc20b8690ca0d869522712f82c19 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:23 -0400 Subject: sunrpc: rename sunrpc_cache_pipe_upcall() to sunrpc_cache_upcall() Since it will soon also send an upcall via netlink, if configured. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/linux/sunrpc/cache.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h index b1e595c2615b..981af830a003 100644 --- a/include/linux/sunrpc/cache.h +++ b/include/linux/sunrpc/cache.h @@ -189,7 +189,7 @@ sunrpc_cache_update(struct cache_detail *detail, struct cache_head *new, struct cache_head *old, int hash); extern int -sunrpc_cache_pipe_upcall(struct cache_detail *detail, struct cache_head *h); +sunrpc_cache_upcall(struct cache_detail *detail, struct cache_head *h); extern int sunrpc_cache_pipe_upcall_timeout(struct cache_detail *detail, struct cache_head *h); -- cgit v1.2.3 From b2c217ee4f779334cff979a3c11a4ec59162f78b Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:24 -0400 Subject: sunrpc: rename sunrpc_cache_pipe_upcall_timeout() This function doesn't have anything to do with a timeout. The only difference is that it warns if there are no listeners. Rename it to sunrpc_cache_upcall_warn(). Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/linux/sunrpc/cache.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h index 981af830a003..80a3f17731d8 100644 --- a/include/linux/sunrpc/cache.h +++ b/include/linux/sunrpc/cache.h @@ -191,7 +191,7 @@ sunrpc_cache_update(struct cache_detail *detail, extern int sunrpc_cache_upcall(struct cache_detail *detail, struct cache_head *h); extern int -sunrpc_cache_pipe_upcall_timeout(struct cache_detail *detail, +sunrpc_cache_upcall_warn(struct cache_detail *detail, struct cache_head *h); -- cgit v1.2.3 From d52db76f2d3559292b7af7c43ad9a635e017cac8 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:26 -0400 Subject: sunrpc: add a cache_notify callback A later patch will be changing the kernel to send a netlink notification when there is a pending cache_request. Add a new cache_notify operation to struct cache_detail for this purpose. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/linux/sunrpc/cache.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h index 80a3f17731d8..c358151c2395 100644 --- a/include/linux/sunrpc/cache.h +++ b/include/linux/sunrpc/cache.h @@ -80,6 +80,9 @@ struct cache_detail { int (*cache_upcall)(struct cache_detail *, struct cache_head *); + int (*cache_notify)(struct cache_detail *cd, + struct cache_head *h); + void (*cache_request)(struct cache_detail *cd, struct cache_head *ch, char **bpp, int *blen); -- cgit v1.2.3 From c13ecd47648cc98e9f324ce4bcaa3d0654c3c91c Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:27 -0400 Subject: sunrpc: add helpers to count and snapshot pending cache requests Add sunrpc_cache_requests_count() and sunrpc_cache_requests_snapshot() to allow callers to count and snapshot the pending upcall request list without exposing struct cache_request outside of cache.c. Both functions skip entries that no longer have CACHE_PENDING set. The snapshot function takes a cache_get() reference on each item so the caller can safely use them after the queue_lock is released. These will be used by the nfsd generic netlink dumpit handler for svc_export upcall requests. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/linux/sunrpc/cache.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h index c358151c2395..f88dc6bb17c7 100644 --- a/include/linux/sunrpc/cache.h +++ b/include/linux/sunrpc/cache.h @@ -251,6 +251,12 @@ extern int sunrpc_cache_register_pipefs(struct dentry *parent, const char *, extern void sunrpc_cache_unregister_pipefs(struct cache_detail *); extern void sunrpc_cache_unhash(struct cache_detail *, struct cache_head *); +int sunrpc_cache_requests_count(struct cache_detail *cd); +int sunrpc_cache_requests_snapshot(struct cache_detail *cd, + struct cache_head **items, + u64 *seqnos, int max, + u64 min_seqno); + /* Must store cache_detail in seq_file->private if using next three functions */ extern void *cache_seq_start_rcu(struct seq_file *file, loff_t *pos); extern void *cache_seq_next_rcu(struct seq_file *file, void *p, loff_t *pos); -- cgit v1.2.3 From af81cb247ca94e4bcfea31ea862cf3aaf955a503 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:28 -0400 Subject: sunrpc: add a generic netlink family for cache upcalls The auth.unix.ip and auth.unix.gid caches live in the sunrpc module, so they cannot use the nfsd generic netlink family. Create a new "sunrpc" generic netlink family with its own "exportd" multicast group to support cache upcall notifications for sunrpc-resident caches. Define a YAML spec (sunrpc_cache.yaml) with a cache-type enum (ip_map, unix_gid), a cache-notify multicast event, and the corresponding uapi header. Implement sunrpc_cache_notify() in cache.c, which checks for listeners on the exportd multicast group, builds and sends a SUNRPC_CMD_CACHE_NOTIFY message with the cache-type attribute. Register/unregister the sunrpc_nl_family in init_sunrpc() and cleanup_sunrpc(). Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/linux/sunrpc/cache.h | 2 ++ include/uapi/linux/sunrpc_netlink.h | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 include/uapi/linux/sunrpc_netlink.h (limited to 'include') diff --git a/include/linux/sunrpc/cache.h b/include/linux/sunrpc/cache.h index f88dc6bb17c7..2735c332ddb7 100644 --- a/include/linux/sunrpc/cache.h +++ b/include/linux/sunrpc/cache.h @@ -256,6 +256,8 @@ int sunrpc_cache_requests_snapshot(struct cache_detail *cd, struct cache_head **items, u64 *seqnos, int max, u64 min_seqno); +int sunrpc_cache_notify(struct cache_detail *cd, struct cache_head *h, + u32 cache_type); /* Must store cache_detail in seq_file->private if using next three functions */ extern void *cache_seq_start_rcu(struct seq_file *file, loff_t *pos); diff --git a/include/uapi/linux/sunrpc_netlink.h b/include/uapi/linux/sunrpc_netlink.h new file mode 100644 index 000000000000..6135d9b3eef1 --- /dev/null +++ b/include/uapi/linux/sunrpc_netlink.h @@ -0,0 +1,35 @@ +/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */ +/* Do not edit directly, auto-generated from: */ +/* Documentation/netlink/specs/sunrpc_cache.yaml */ +/* YNL-GEN uapi header */ +/* To regenerate run: tools/net/ynl/ynl-regen.sh */ + +#ifndef _UAPI_LINUX_SUNRPC_NETLINK_H +#define _UAPI_LINUX_SUNRPC_NETLINK_H + +#define SUNRPC_FAMILY_NAME "sunrpc" +#define SUNRPC_FAMILY_VERSION 1 + +enum sunrpc_cache_type { + SUNRPC_CACHE_TYPE_IP_MAP = 1, + SUNRPC_CACHE_TYPE_UNIX_GID = 2, +}; + +enum { + SUNRPC_A_CACHE_NOTIFY_CACHE_TYPE = 1, + + __SUNRPC_A_CACHE_NOTIFY_MAX, + SUNRPC_A_CACHE_NOTIFY_MAX = (__SUNRPC_A_CACHE_NOTIFY_MAX - 1) +}; + +enum { + SUNRPC_CMD_CACHE_NOTIFY = 1, + + __SUNRPC_CMD_MAX, + SUNRPC_CMD_MAX = (__SUNRPC_CMD_MAX - 1) +}; + +#define SUNRPC_MCGRP_NONE "none" +#define SUNRPC_MCGRP_EXPORTD "exportd" + +#endif /* _UAPI_LINUX_SUNRPC_NETLINK_H */ -- cgit v1.2.3 From 712bdbb2153bdb99d4a9d0cdcae24b484610147f Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:29 -0400 Subject: sunrpc: add netlink upcall for the auth.unix.ip cache Add netlink-based cache upcall support for the ip_map (auth.unix.ip) cache, using the sunrpc generic netlink family. Add ip-map attribute-set (seqno, class, addr, domain, negative, expiry), ip-map-reqs wrapper, and ip-map-get-reqs / ip-map-set-reqs operations to the sunrpc_cache YAML spec and generated headers. Implement sunrpc_nl_ip_map_get_reqs_dumpit() which snapshots pending ip_map cache requests and sends each entry's seqno, class name, and IP address over netlink. Implement sunrpc_nl_ip_map_set_reqs_doit() which parses ip_map cache responses from userspace (class, addr, expiry, and domain name or negative flag) and updates the cache via __ip_map_lookup() / __ip_map_update(). Wire up ip_map_notify() callback in ip_map_cache_template so cache misses trigger SUNRPC_CMD_CACHE_NOTIFY multicast events with SUNRPC_CACHE_TYPE_IP_MAP. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/uapi/linux/sunrpc_netlink.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/sunrpc_netlink.h b/include/uapi/linux/sunrpc_netlink.h index 6135d9b3eef1..b44befb5a34b 100644 --- a/include/uapi/linux/sunrpc_netlink.h +++ b/include/uapi/linux/sunrpc_netlink.h @@ -22,8 +22,29 @@ enum { SUNRPC_A_CACHE_NOTIFY_MAX = (__SUNRPC_A_CACHE_NOTIFY_MAX - 1) }; +enum { + SUNRPC_A_IP_MAP_SEQNO = 1, + SUNRPC_A_IP_MAP_CLASS, + SUNRPC_A_IP_MAP_ADDR, + SUNRPC_A_IP_MAP_DOMAIN, + SUNRPC_A_IP_MAP_NEGATIVE, + SUNRPC_A_IP_MAP_EXPIRY, + + __SUNRPC_A_IP_MAP_MAX, + SUNRPC_A_IP_MAP_MAX = (__SUNRPC_A_IP_MAP_MAX - 1) +}; + +enum { + SUNRPC_A_IP_MAP_REQS_REQUESTS = 1, + + __SUNRPC_A_IP_MAP_REQS_MAX, + SUNRPC_A_IP_MAP_REQS_MAX = (__SUNRPC_A_IP_MAP_REQS_MAX - 1) +}; + enum { SUNRPC_CMD_CACHE_NOTIFY = 1, + SUNRPC_CMD_IP_MAP_GET_REQS, + SUNRPC_CMD_IP_MAP_SET_REQS, __SUNRPC_CMD_MAX, SUNRPC_CMD_MAX = (__SUNRPC_CMD_MAX - 1) -- cgit v1.2.3 From 0850e8603cd7a3a17e2888391937154a54b93e02 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:30 -0400 Subject: sunrpc: add netlink upcall for the auth.unix.gid cache Add netlink-based cache upcall support for the unix_gid (auth.unix.gid) cache, using the sunrpc generic netlink family. Add unix-gid attribute-set (seqno, uid, gids multi-attr, negative, expiry), unix-gid-reqs wrapper, and unix-gid-get-reqs / unix-gid-set-reqs operations to the sunrpc_cache YAML spec and generated headers. Implement sunrpc_nl_unix_gid_get_reqs_dumpit() which snapshots pending unix_gid cache requests and sends each entry's seqno and uid over netlink. Implement sunrpc_nl_unix_gid_set_reqs_doit() which parses unix_gid cache responses from userspace (uid, expiry, gids as u32 multi-attr or negative flag) and updates the cache via unix_gid_lookup() / sunrpc_cache_update(). Wire up unix_gid_notify() callback in unix_gid_cache_template so cache misses trigger SUNRPC_CMD_CACHE_NOTIFY multicast events with SUNRPC_CACHE_TYPE_UNIX_GID. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/uapi/linux/sunrpc_netlink.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/sunrpc_netlink.h b/include/uapi/linux/sunrpc_netlink.h index b44befb5a34b..d71c623e92ab 100644 --- a/include/uapi/linux/sunrpc_netlink.h +++ b/include/uapi/linux/sunrpc_netlink.h @@ -41,10 +41,30 @@ enum { SUNRPC_A_IP_MAP_REQS_MAX = (__SUNRPC_A_IP_MAP_REQS_MAX - 1) }; +enum { + SUNRPC_A_UNIX_GID_SEQNO = 1, + SUNRPC_A_UNIX_GID_UID, + SUNRPC_A_UNIX_GID_GIDS, + SUNRPC_A_UNIX_GID_NEGATIVE, + SUNRPC_A_UNIX_GID_EXPIRY, + + __SUNRPC_A_UNIX_GID_MAX, + SUNRPC_A_UNIX_GID_MAX = (__SUNRPC_A_UNIX_GID_MAX - 1) +}; + +enum { + SUNRPC_A_UNIX_GID_REQS_REQUESTS = 1, + + __SUNRPC_A_UNIX_GID_REQS_MAX, + SUNRPC_A_UNIX_GID_REQS_MAX = (__SUNRPC_A_UNIX_GID_REQS_MAX - 1) +}; + enum { SUNRPC_CMD_CACHE_NOTIFY = 1, SUNRPC_CMD_IP_MAP_GET_REQS, SUNRPC_CMD_IP_MAP_SET_REQS, + SUNRPC_CMD_UNIX_GID_GET_REQS, + SUNRPC_CMD_UNIX_GID_SET_REQS, __SUNRPC_CMD_MAX, SUNRPC_CMD_MAX = (__SUNRPC_CMD_MAX - 1) -- cgit v1.2.3 From 912fc994b920a24543725d981e9cd082d1376ed7 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:31 -0400 Subject: nfsd: add netlink upcall for the svc_export cache Add netlink-based cache upcall support for the svc_export (nfsd.export) cache to Documentation/netlink/specs/nfsd.yaml and regenerate the resulting files. Implement nfsd_cache_notify() which sends a NFSD_CMD_CACHE_NOTIFY multicast event to the "exportd" group, carrying the cache type so userspace knows which cache has pending requests. Implement nfsd_nl_svc_export_get_reqs_dumpit() which snapshots pending svc_export cache requests and sends each entry's seqno, client name, and path over netlink. Implement nfsd_nl_svc_export_set_reqs_doit() which parses svc_export cache responses from userspace (client, path, expiry, flags, anon uid/gid, fslocations, uuid, secinfo, xprtsec, fsid, or negative flag) and updates the cache via svc_export_lookup() / svc_export_update(). Wire up the svc_export_notify() callback in svc_export_cache_template so cache misses trigger NFSD_CMD_CACHE_NOTIFY multicast events with NFSD_CACHE_TYPE_SVC_EXPORT. Note that the export-flags and xprtsec-mode enums are organized to match their counterparts in include/uapi/linux/nfsd/export.h. The intent is that future export options will only be added to the netlink headers, which should eliminate the need to keep so much in sync. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/uapi/linux/nfsd_netlink.h | 101 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 101 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/nfsd_netlink.h b/include/uapi/linux/nfsd_netlink.h index 97c7447f4d14..32a551b320e0 100644 --- a/include/uapi/linux/nfsd_netlink.h +++ b/include/uapi/linux/nfsd_netlink.h @@ -10,6 +10,52 @@ #define NFSD_FAMILY_NAME "nfsd" #define NFSD_FAMILY_VERSION 1 +enum nfsd_cache_type { + NFSD_CACHE_TYPE_SVC_EXPORT = 1, +}; + +/* + * These flags are ordered to match the NFSEXP_* flags in + * include/linux/nfsd/export.h + */ +enum nfsd_export_flags { + NFSD_EXPORT_FLAGS_READONLY = 1, + NFSD_EXPORT_FLAGS_INSECURE_PORT = 2, + NFSD_EXPORT_FLAGS_ROOTSQUASH = 4, + NFSD_EXPORT_FLAGS_ALLSQUASH = 8, + NFSD_EXPORT_FLAGS_ASYNC = 16, + NFSD_EXPORT_FLAGS_GATHERED_WRITES = 32, + NFSD_EXPORT_FLAGS_NOREADDIRPLUS = 64, + NFSD_EXPORT_FLAGS_SECURITY_LABEL = 128, + NFSD_EXPORT_FLAGS_SIGN_FH = 256, + NFSD_EXPORT_FLAGS_NOHIDE = 512, + NFSD_EXPORT_FLAGS_NOSUBTREECHECK = 1024, + NFSD_EXPORT_FLAGS_NOAUTHNLM = 2048, + NFSD_EXPORT_FLAGS_MSNFS = 4096, + NFSD_EXPORT_FLAGS_FSID = 8192, + NFSD_EXPORT_FLAGS_CROSSMOUNT = 16384, + NFSD_EXPORT_FLAGS_NOACL = 32768, + NFSD_EXPORT_FLAGS_V4ROOT = 65536, + NFSD_EXPORT_FLAGS_PNFS = 131072, +}; + +/* + * These flags are ordered to match the NFSEXP_XPRTSEC_* flags in + * include/linux/nfsd/export.h + */ +enum nfsd_xprtsec_mode { + NFSD_XPRTSEC_MODE_NONE = 1, + NFSD_XPRTSEC_MODE_TLS = 2, + NFSD_XPRTSEC_MODE_MTLS = 4, +}; + +enum { + NFSD_A_CACHE_NOTIFY_CACHE_TYPE = 1, + + __NFSD_A_CACHE_NOTIFY_MAX, + NFSD_A_CACHE_NOTIFY_MAX = (__NFSD_A_CACHE_NOTIFY_MAX - 1) +}; + enum { NFSD_A_RPC_STATUS_XID = 1, NFSD_A_RPC_STATUS_FLAGS, @@ -81,6 +127,55 @@ enum { NFSD_A_POOL_MODE_MAX = (__NFSD_A_POOL_MODE_MAX - 1) }; +enum { + NFSD_A_FSLOCATION_HOST = 1, + NFSD_A_FSLOCATION_PATH, + + __NFSD_A_FSLOCATION_MAX, + NFSD_A_FSLOCATION_MAX = (__NFSD_A_FSLOCATION_MAX - 1) +}; + +enum { + NFSD_A_FSLOCATIONS_LOCATION = 1, + + __NFSD_A_FSLOCATIONS_MAX, + NFSD_A_FSLOCATIONS_MAX = (__NFSD_A_FSLOCATIONS_MAX - 1) +}; + +enum { + NFSD_A_AUTH_FLAVOR_PSEUDOFLAVOR = 1, + NFSD_A_AUTH_FLAVOR_FLAGS, + + __NFSD_A_AUTH_FLAVOR_MAX, + NFSD_A_AUTH_FLAVOR_MAX = (__NFSD_A_AUTH_FLAVOR_MAX - 1) +}; + +enum { + NFSD_A_SVC_EXPORT_SEQNO = 1, + NFSD_A_SVC_EXPORT_CLIENT, + NFSD_A_SVC_EXPORT_PATH, + NFSD_A_SVC_EXPORT_NEGATIVE, + NFSD_A_SVC_EXPORT_EXPIRY, + NFSD_A_SVC_EXPORT_ANON_UID, + NFSD_A_SVC_EXPORT_ANON_GID, + NFSD_A_SVC_EXPORT_FSLOCATIONS, + NFSD_A_SVC_EXPORT_UUID, + NFSD_A_SVC_EXPORT_SECINFO, + NFSD_A_SVC_EXPORT_XPRTSEC, + NFSD_A_SVC_EXPORT_FLAGS, + NFSD_A_SVC_EXPORT_FSID, + + __NFSD_A_SVC_EXPORT_MAX, + NFSD_A_SVC_EXPORT_MAX = (__NFSD_A_SVC_EXPORT_MAX - 1) +}; + +enum { + NFSD_A_SVC_EXPORT_REQS_REQUESTS = 1, + + __NFSD_A_SVC_EXPORT_REQS_MAX, + NFSD_A_SVC_EXPORT_REQS_MAX = (__NFSD_A_SVC_EXPORT_REQS_MAX - 1) +}; + enum { NFSD_CMD_RPC_STATUS_GET = 1, NFSD_CMD_THREADS_SET, @@ -91,9 +186,15 @@ enum { NFSD_CMD_LISTENER_GET, NFSD_CMD_POOL_MODE_SET, NFSD_CMD_POOL_MODE_GET, + NFSD_CMD_CACHE_NOTIFY, + NFSD_CMD_SVC_EXPORT_GET_REQS, + NFSD_CMD_SVC_EXPORT_SET_REQS, __NFSD_CMD_MAX, NFSD_CMD_MAX = (__NFSD_CMD_MAX - 1) }; +#define NFSD_MCGRP_NONE "none" +#define NFSD_MCGRP_EXPORTD "exportd" + #endif /* _UAPI_LINUX_NFSD_NETLINK_H */ -- cgit v1.2.3 From 01c2305795a3b6b164df48e72b12022a68fd60c1 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:32 -0400 Subject: nfsd: add netlink upcall for the nfsd.fh cache Add netlink-based cache upcall support for the expkey (nfsd.fh) cache, following the same pattern as the existing svc_export netlink support. Add expkey to the cache-type enum, a new expkey attribute-set with client, fsidtype, fsid, negative, expiry, and path fields, and the expkey-get-reqs / expkey-set-reqs operations to the nfsd YAML spec and generated headers. Implement nfsd_nl_expkey_get_reqs_dumpit() which snapshots pending expkey cache requests and sends each entry's seqno, client name, fsidtype, and fsid over netlink. Implement nfsd_nl_expkey_set_reqs_doit() which parses expkey cache responses from userspace (client, fsidtype, fsid, expiry, and path or negative flag) and updates the cache via svc_expkey_lookup() / svc_expkey_update(). Wire up the expkey_notify() callback in svc_expkey_cache_template so cache misses trigger NFSD_CMD_CACHE_NOTIFY multicast events with NFSD_CACHE_TYPE_EXPKEY. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/uapi/linux/nfsd_netlink.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/nfsd_netlink.h b/include/uapi/linux/nfsd_netlink.h index 32a551b320e0..fed7533c1533 100644 --- a/include/uapi/linux/nfsd_netlink.h +++ b/include/uapi/linux/nfsd_netlink.h @@ -12,6 +12,7 @@ enum nfsd_cache_type { NFSD_CACHE_TYPE_SVC_EXPORT = 1, + NFSD_CACHE_TYPE_EXPKEY = 2, }; /* @@ -176,6 +177,26 @@ enum { NFSD_A_SVC_EXPORT_REQS_MAX = (__NFSD_A_SVC_EXPORT_REQS_MAX - 1) }; +enum { + NFSD_A_EXPKEY_SEQNO = 1, + NFSD_A_EXPKEY_CLIENT, + NFSD_A_EXPKEY_FSIDTYPE, + NFSD_A_EXPKEY_FSID, + NFSD_A_EXPKEY_NEGATIVE, + NFSD_A_EXPKEY_EXPIRY, + NFSD_A_EXPKEY_PATH, + + __NFSD_A_EXPKEY_MAX, + NFSD_A_EXPKEY_MAX = (__NFSD_A_EXPKEY_MAX - 1) +}; + +enum { + NFSD_A_EXPKEY_REQS_REQUESTS = 1, + + __NFSD_A_EXPKEY_REQS_MAX, + NFSD_A_EXPKEY_REQS_MAX = (__NFSD_A_EXPKEY_REQS_MAX - 1) +}; + enum { NFSD_CMD_RPC_STATUS_GET = 1, NFSD_CMD_THREADS_SET, @@ -189,6 +210,8 @@ enum { NFSD_CMD_CACHE_NOTIFY, NFSD_CMD_SVC_EXPORT_GET_REQS, NFSD_CMD_SVC_EXPORT_SET_REQS, + NFSD_CMD_EXPKEY_GET_REQS, + NFSD_CMD_EXPKEY_SET_REQS, __NFSD_CMD_MAX, NFSD_CMD_MAX = (__NFSD_CMD_MAX - 1) -- cgit v1.2.3 From 565ee23ea2374a0ec42bb70227447baa81fcd196 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:33 -0400 Subject: sunrpc: add SUNRPC_CMD_CACHE_FLUSH netlink command Add a new SUNRPC_CMD_CACHE_FLUSH generic netlink command that allows userspace to flush the sunrpc auth caches (ip_map and unix_gid) without writing to /proc/net/rpc/*/flush. An optional SUNRPC_A_CACHE_FLUSH_MASK u32 attribute selects which caches to flush (bit 1 = ip_map, bit 2 = unix_gid). If the attribute is omitted, all sunrpc caches are flushed. This is used by exportfs to replace its /proc-based cache_flush() with a netlink equivalent, with /proc fallback for older kernels. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/uapi/linux/sunrpc_netlink.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/sunrpc_netlink.h b/include/uapi/linux/sunrpc_netlink.h index d71c623e92ab..34677f0ec2f9 100644 --- a/include/uapi/linux/sunrpc_netlink.h +++ b/include/uapi/linux/sunrpc_netlink.h @@ -59,12 +59,20 @@ enum { SUNRPC_A_UNIX_GID_REQS_MAX = (__SUNRPC_A_UNIX_GID_REQS_MAX - 1) }; +enum { + SUNRPC_A_CACHE_FLUSH_MASK = 1, + + __SUNRPC_A_CACHE_FLUSH_MAX, + SUNRPC_A_CACHE_FLUSH_MAX = (__SUNRPC_A_CACHE_FLUSH_MAX - 1) +}; + enum { SUNRPC_CMD_CACHE_NOTIFY = 1, SUNRPC_CMD_IP_MAP_GET_REQS, SUNRPC_CMD_IP_MAP_SET_REQS, SUNRPC_CMD_UNIX_GID_GET_REQS, SUNRPC_CMD_UNIX_GID_SET_REQS, + SUNRPC_CMD_CACHE_FLUSH, __SUNRPC_CMD_MAX, SUNRPC_CMD_MAX = (__SUNRPC_CMD_MAX - 1) -- cgit v1.2.3 From 70b7e3526c53d9dd7caccdbeff5b0485640d8cf1 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Wed, 25 Mar 2026 10:40:34 -0400 Subject: nfsd: add NFSD_CMD_CACHE_FLUSH netlink command Add a new NFSD_CMD_CACHE_FLUSH generic netlink command that allows userspace to flush the nfsd export caches (svc_export and expkey) without writing to /proc/net/rpc/*/flush. An optional NFSD_A_CACHE_FLUSH_MASK u32 attribute selects which caches to flush (bit 1 = svc_export, bit 2 = expkey). If the attribute is omitted, all nfsd caches are flushed. This is used by exportfs to replace its /proc-based cache_flush() with a netlink equivalent, with /proc fallback for older kernels. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever --- include/uapi/linux/nfsd_netlink.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/nfsd_netlink.h b/include/uapi/linux/nfsd_netlink.h index fed7533c1533..060c43675599 100644 --- a/include/uapi/linux/nfsd_netlink.h +++ b/include/uapi/linux/nfsd_netlink.h @@ -197,6 +197,13 @@ enum { NFSD_A_EXPKEY_REQS_MAX = (__NFSD_A_EXPKEY_REQS_MAX - 1) }; +enum { + NFSD_A_CACHE_FLUSH_MASK = 1, + + __NFSD_A_CACHE_FLUSH_MAX, + NFSD_A_CACHE_FLUSH_MAX = (__NFSD_A_CACHE_FLUSH_MAX - 1) +}; + enum { NFSD_CMD_RPC_STATUS_GET = 1, NFSD_CMD_THREADS_SET, @@ -212,6 +219,7 @@ enum { NFSD_CMD_SVC_EXPORT_SET_REQS, NFSD_CMD_EXPKEY_GET_REQS, NFSD_CMD_EXPKEY_SET_REQS, + NFSD_CMD_CACHE_FLUSH, __NFSD_CMD_MAX, NFSD_CMD_MAX = (__NFSD_CMD_MAX - 1) -- cgit v1.2.3 From 7725c45682abd7a6590676c33c35a7bdfdec6db5 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Fri, 29 May 2026 11:03:10 -0700 Subject: ata: libata: Document when host->eh_mutex should be held Annotate the following functions with __must_hold(&host->eh_mutex): * All ata_port_operations.error_handler() implementations. * ata_eh_reset() and ata_eh_recover() because these functions call ata_eh_release() and ata_eh_acquire(). * All callers of ata_eh_reset() and ata_eh_recover(). Enable Clang's context analysis. This will cause the build to fail if e.g. a locking bug would be introduced in an error path. This patch should not affect the generated assembler code. Signed-off-by: Bart Van Assche [cassel: drop note about clang 23 from commit log] Signed-off-by: Niklas Cassel --- include/linux/libata.h | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/libata.h b/include/linux/libata.h index 127229fbd1a6..7091bc903c05 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h @@ -984,7 +984,8 @@ struct ata_port_operations { void (*thaw)(struct ata_port *ap); struct ata_reset_operations reset; struct ata_reset_operations pmp_reset; - void (*error_handler)(struct ata_port *ap); + void (*error_handler)(struct ata_port *ap) + __must_hold(&ap->host->eh_mutex); void (*lost_interrupt)(struct ata_port *ap); void (*post_internal_cmd)(struct ata_queued_cmd *qc); void (*sched_eh)(struct ata_port *ap); @@ -1419,7 +1420,8 @@ extern void ata_eh_thaw_port(struct ata_port *ap); extern void ata_eh_qc_complete(struct ata_queued_cmd *qc); extern void ata_eh_qc_retry(struct ata_queued_cmd *qc); -extern void ata_std_error_handler(struct ata_port *ap); +extern void ata_std_error_handler(struct ata_port *ap) + __must_hold(&ap->host->eh_mutex); extern void ata_std_sched_eh(struct ata_port *ap); extern void ata_std_end_eh(struct ata_port *ap); extern int ata_link_nr_enabled(struct ata_link *link); @@ -1999,7 +2001,8 @@ extern void ata_timing_merge(const struct ata_timing *, extern const struct ata_port_operations sata_pmp_port_ops; extern int sata_pmp_qc_defer_cmd_switch(struct ata_queued_cmd *qc); -extern void sata_pmp_error_handler(struct ata_port *ap); +extern void sata_pmp_error_handler(struct ata_port *ap) + __must_hold(&ap->host->eh_mutex); #else /* CONFIG_SATA_PMP */ @@ -2063,7 +2066,8 @@ extern int sata_sff_hardreset(struct ata_link *link, unsigned int *class, unsigned long deadline); extern void ata_sff_postreset(struct ata_link *link, unsigned int *classes); extern void ata_sff_drain_fifo(struct ata_queued_cmd *qc); -extern void ata_sff_error_handler(struct ata_port *ap); +extern void ata_sff_error_handler(struct ata_port *ap) + __must_hold(&ap->host->eh_mutex); extern void ata_sff_std_ports(struct ata_ioports *ioaddr); #ifdef CONFIG_PCI extern int ata_pci_sff_init_host(struct ata_host *host); @@ -2093,7 +2097,8 @@ extern enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd * extern unsigned int ata_bmdma_port_intr(struct ata_port *ap, struct ata_queued_cmd *qc); extern irqreturn_t ata_bmdma_interrupt(int irq, void *dev_instance); -extern void ata_bmdma_error_handler(struct ata_port *ap); +extern void ata_bmdma_error_handler(struct ata_port *ap) + __must_hold(&ap->host->eh_mutex); extern void ata_bmdma_post_internal_cmd(struct ata_queued_cmd *qc); extern void ata_bmdma_irq_clear(struct ata_port *ap); extern void ata_bmdma_setup(struct ata_queued_cmd *qc); -- cgit v1.2.3 From 042f5526cf2c44eac17ed2fa57a9a6e8d30d6279 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Thu, 28 May 2026 19:28:59 +0200 Subject: ata: Annotate functions in the issuing path with __must_hold() Annotate the following functions used in the issuing path: ata_qc_issue(), ata_sas_queuecmd(), ata_scsi_qc_issue(), ata_scsi_translate(), __ata_scsi_queuecmd() These functions are all used in the issuing path, so context analysis will be able to verify that the ap lock is held, from it is taken in sas_queuecommand() or ata_scsi_queuecmd() all the way down to ata_qc_issue(). Commenting out the spin_lock_irqsave() successfully results in a compiler error on Clang 23. Signed-off-by: Bart Van Assche Co-developed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Signed-off-by: Niklas Cassel --- include/linux/libata.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/libata.h b/include/linux/libata.h index 7091bc903c05..96e626d6a7ca 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h @@ -1315,7 +1315,8 @@ extern int ata_tport_add(struct device *parent, struct ata_port *ap); extern void ata_tport_delete(struct ata_port *ap); int ata_sas_sdev_configure(struct scsi_device *sdev, struct queue_limits *lim, struct ata_port *ap); -extern int ata_sas_queuecmd(struct scsi_cmnd *cmd, struct ata_port *ap); +extern int ata_sas_queuecmd(struct scsi_cmnd *cmd, struct ata_port *ap) + __must_hold(ap->lock); extern void ata_tf_to_fis(const struct ata_taskfile *tf, u8 pmp, int is_cmd, u8 *fis); extern void ata_tf_from_fis(const u8 *fis, struct ata_taskfile *tf); -- cgit v1.2.3 From 71e1815113f7e37e7e39ed69526cd7d399e5a0c9 Mon Sep 17 00:00:00 2001 From: Sumit Gupta Date: Thu, 28 May 2026 01:16:25 +0530 Subject: ACPI: CPPC: Add support for CPPC v4 CPPC v4 (ACPI 6.6, Section 8.4.6) adds two optional entries to the _CPC package: 1. OSPM Nominal Performance (8.4.6.1.2.6): A write-only register that lets OSPM inform the platform what it considers nominal performance. The platform classifies performance above this level as boost and below as throttle for its power/thermal decisions. 2. Resource Priority (8.4.6.1.2.7): A Package of Resource Priority Register Descriptor sub-packages that allow OSPM to set relative priority among processors for shared resources (boost, throttle, L2/L3 cache, memory bandwidth). Parsing the full structure is not yet supported; such entries are marked as unsupported. Add v4 _CPC table parsing (25 entries) and update REG_OPTIONAL to mark the two new registers as optional. Signed-off-by: Sumit Gupta Reviewed-by: Mario Limonciello (AMD) Reviewed-by: Pierre Gondois Link: https://patch.msgid.link/20260527194626.185286-2-sumitg@nvidia.com Signed-off-by: Rafael J. Wysocki --- include/acpi/cppc_acpi.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/acpi/cppc_acpi.h b/include/acpi/cppc_acpi.h index d1f02ceec4f9..8693890a7275 100644 --- a/include/acpi/cppc_acpi.h +++ b/include/acpi/cppc_acpi.h @@ -17,16 +17,18 @@ #include #include -/* CPPCv2 and CPPCv3 support */ +/* CPPCv2, CPPCv3 and CPPCv4 support */ #define CPPC_V2_REV 2 #define CPPC_V3_REV 3 +#define CPPC_V4_REV 4 #define CPPC_V2_NUM_ENT 21 #define CPPC_V3_NUM_ENT 23 +#define CPPC_V4_NUM_ENT 25 #define PCC_CMD_COMPLETE_MASK (1 << 0) #define PCC_ERROR_MASK (1 << 2) -#define MAX_CPC_REG_ENT 21 +#define MAX_CPC_REG_ENT 23 /* CPPC specific PCC commands. */ #define CMD_READ 0 @@ -109,6 +111,8 @@ enum cppc_regs { REFERENCE_PERF, LOWEST_FREQ, NOMINAL_FREQ, + OSPM_NOMINAL_PERF, + RESOURCE_PRIORITY, }; /* -- cgit v1.2.3 From 5057e1aca011e51ef51498c940ef96f3d3e8a305 Mon Sep 17 00:00:00 2001 From: Jamal Hadi Salim Date: Sun, 31 May 2026 12:08:12 -0400 Subject: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur. Fixes: d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") Suggested-by: Jakub Kicinski Reported-by: Kyle Zeng Tested-by: Victor Nogueira Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Jamal Hadi Salim Tested-by: Kyle Zeng Reviewed-by: Pedro Tammela Reviewed-by: Eric Dumazet Reviewed-by: Victor Nogueira Link: https://patch.msgid.link/20260531160812.68020-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski --- include/net/act_api.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/act_api.h b/include/net/act_api.h index d11b79107930..fd2967ee08f7 100644 --- a/include/net/act_api.h +++ b/include/net/act_api.h @@ -45,6 +45,7 @@ struct tc_action { struct tc_cookie __rcu *user_cookie; struct tcf_chain __rcu *goto_chain; u32 tcfa_flags; + struct rcu_head tcfa_rcu; u8 hw_stats; u8 used_hw_stats; bool used_hw_stats_valid; -- cgit v1.2.3 From 7745f1978a0f34a416c241e94eb812a4c8fcb890 Mon Sep 17 00:00:00 2001 From: Costa Shulyupin Date: Sun, 31 May 2026 16:48:36 +0300 Subject: net: Remove orphaned ax25_ptr references The AX.25 subsystem was removed in commit dd8d4bc28ad7 ("net: remove ax25 and amateur radio (hamradio) subsystem"), which removed the ax25_ptr field from struct net_device but left behind the kdoc comment and documentation. Signed-off-by: Costa Shulyupin Reviewed-by: Randy Dunlap Link: https://patch.msgid.link/20260531134837.4111349-1-costa.shul@redhat.com Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 7309467d7873..74507c006490 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1947,7 +1947,6 @@ enum netdev_reg_state { * @atalk_ptr: AppleTalk link * @ip_ptr: IPv4 specific data * @ip6_ptr: IPv6 specific data - * @ax25_ptr: AX.25 specific data * @ieee80211_ptr: IEEE 802.11 specific data, assign before registering * @ieee802154_ptr: IEEE 802.15.4 low-rate Wireless Personal Area Network * device struct -- cgit v1.2.3 From b5c0a07eb2c23bfd0c42ad6b461e6881b4b0995b Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Thu, 28 May 2026 18:49:25 -0700 Subject: bpf: Unify dynptr handling in the verifier Simplify dynptr checking for helper and kfunc by unifying it. Remember the initialized dynptr (i.e.,g !(arg_type |= MEM_UNINIT)) pass to a dynptr kfunc during process_dynptr_func() so that we can easily retrieve the information for verification later. By saving it in meta->dynptr, there is no need to call dynptr helpers such as dynptr_id(), dynptr_ref_obj_id() and dynptr_type() in check_func_arg(). Remove and open code the helpers in process_dynptr_func() when saving id, ref_obj_id, and type. Besides, since dynptr ref_obj_id information is now pass around in meta->bpf_dynptr_desc, drop the check in helper_multiple_ref_obj_use. Acked-by: Eduard Zingerman Acked-by: Mykyta Yatsenko Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260529014936.2811085-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 5cbad3b64130..3a5c226bf1c3 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -1438,6 +1438,13 @@ struct bpf_map_desc { int uid; }; +/* The last initialized dynptr; Populated by process_dynptr_func() */ +struct bpf_dynptr_desc { + enum bpf_dynptr_type type; + u32 id; + u32 ref_obj_id; +}; + struct bpf_kfunc_call_arg_meta { /* In parameters */ struct btf *btf; @@ -1478,16 +1485,12 @@ struct bpf_kfunc_call_arg_meta { struct { struct btf_field *field; } arg_rbtree_root; - struct { - enum bpf_dynptr_type type; - u32 id; - u32 ref_obj_id; - } initialized_dynptr; struct { u8 spi; u8 frameno; } iter; struct bpf_map_desc map; + struct bpf_dynptr_desc dynptr; u64 mem_size; }; -- cgit v1.2.3 From 308c7a0ae8859b34d9d90a3dff953b2d14242145 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Thu, 28 May 2026 18:49:28 -0700 Subject: bpf: Refactor object relationship tracking and fix dynptr UAF bug Refactor object relationship tracking in the verifier and fix a dynptr use-after-free bug where file/skb dynptrs are not invalidated when the parent referenced object is freed. Add parent_id to bpf_reg_state to precisely track child-parent relationships. A child object's parent_id points to the parent object's id. This replaces the PTR_TO_MEM-specific dynptr_id. Remove ref_obj_id from bpf_reg_state by folding its role into the existing id field. Previously, id tracked pointer identity for null checking while ref_obj_id tracked the owning reference for lifetime management. These are now unified: acquire helpers and kfuncs set id to the acquired reference id, and release paths use id directly. Add reg_is_referenced() which checks if a register is referenced by looking up its id in the reference array. This replaces all former ref_obj_id checks. For release_reference(), invalidating an object now also invalidates all descendants by traversing the object tree. This is done using stack-based DFS to avoid recursive call chains of release_reference() -> unmark_stack_slots_dynptr() -> release_reference(). Referenced objects encountered during tree traversal are reported as leaked references. Add parent_id to bpf_reference_state to enable hierarchical reference tracking. When acquiring a reference, a parent_id can be specified to link the new reference to an existing one (e.g., referenced dynptrs acquire a reference with parent_id linking to the parent object's reference). Pointer casting: For pointer casting helpers (bpf_sk_fullsock, bpf_tcp_sock), instead of propagating ref_obj_id, the cast result reuses the same reference id as the source pointer. Since the cast may return NULL for a non-NULL input, the NULL case is explored as a separate verifier branch. This allows releasing any of the original or cast pointers to invalidate all others. Referenced dynptrs: When constructing a referenced dynptr, acquire a intermediate reference with parent_id linking to the parent referenced object. The dynptr and all clones share the same parent_id (pointing to the intermediate ref) but get unique ids for independent slice tracking. Releasing a referenced dynptr releases the parent reference, which in turn invalidates all clones and their derived slices. Owning to non-owning reference conversion: After converting owning to non-owning by clearing id (e.g., object(id=1) -> object(id=0)), the verifier releases the reference state via release_reference_nomark(). Note that the error message "reference has not been acquired before" in the helper and kfunc release paths is removed. This message was already unreachable. The verifier only calls release_reference() after confirming the reference is valid, so the condition could never trigger in practice. Fixes: 870c28588afa ("bpf: net_sched: Add basic bpf qdisc kfuncs") Signed-off-by: Amery Hung Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20260529014936.2811085-6-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 4 +-- include/linux/bpf_verifier.h | 77 ++++++++++++++++---------------------------- 2 files changed, 30 insertions(+), 51 deletions(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 1c6863ce89e0..d1a17c118316 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1062,7 +1062,7 @@ struct bpf_insn_access_aux { struct { struct btf *btf; u32 btf_id; - u32 ref_obj_id; + u32 ref_id; }; }; struct bpf_verifier_log *log; /* for verbose logs */ @@ -1631,7 +1631,7 @@ struct bpf_ctx_arg_aux { enum bpf_reg_type reg_type; struct btf *btf; u32 btf_id; - u32 ref_obj_id; + u32 ref_id; bool refcounted; }; diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 3a5c226bf1c3..75b287d8d92f 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -66,7 +66,6 @@ struct bpf_reg_state { struct { /* for PTR_TO_MEM | PTR_TO_MEM_OR_NULL */ u32 mem_size; - u32 dynptr_id; /* for dynptr slices */ }; /* For dynptr stack slots */ @@ -148,46 +147,14 @@ struct bpf_reg_state { #define BPF_ADD_CONST32 (1U << 30) #define BPF_ADD_CONST (BPF_ADD_CONST64 | BPF_ADD_CONST32) u32 id; - /* PTR_TO_SOCKET and PTR_TO_TCP_SOCK could be a ptr returned - * from a pointer-cast helper, bpf_sk_fullsock() and - * bpf_tcp_sock(). - * - * Consider the following where "sk" is a reference counted - * pointer returned from "sk = bpf_sk_lookup_tcp();": - * - * 1: sk = bpf_sk_lookup_tcp(); - * 2: if (!sk) { return 0; } - * 3: fullsock = bpf_sk_fullsock(sk); - * 4: if (!fullsock) { bpf_sk_release(sk); return 0; } - * 5: tp = bpf_tcp_sock(fullsock); - * 6: if (!tp) { bpf_sk_release(sk); return 0; } - * 7: bpf_sk_release(sk); - * 8: snd_cwnd = tp->snd_cwnd; // verifier will complain - * - * After bpf_sk_release(sk) at line 7, both "fullsock" ptr and - * "tp" ptr should be invalidated also. In order to do that, - * the reg holding "fullsock" and "sk" need to remember - * the original refcounted ptr id (i.e. sk_reg->id) in ref_obj_id - * such that the verifier can reset all regs which have - * ref_obj_id matching the sk_reg->id. - * - * sk_reg->ref_obj_id is set to sk_reg->id at line 1. - * sk_reg->id will stay as NULL-marking purpose only. - * After NULL-marking is done, sk_reg->id can be reset to 0. - * - * After "fullsock = bpf_sk_fullsock(sk);" at line 3, - * fullsock_reg->ref_obj_id is set to sk_reg->ref_obj_id. - * - * After "tp = bpf_tcp_sock(fullsock);" at line 5, - * tp_reg->ref_obj_id is set to fullsock_reg->ref_obj_id - * which is the same as sk_reg->ref_obj_id. - * - * From the verifier perspective, if sk, fullsock and tp - * are not NULL, they are the same ptr with different - * reg->type. In particular, bpf_sk_release(tp) is also - * allowed and has the same effect as bpf_sk_release(sk). + /* + * Tracks the parent object this register was derived from. + * Used for cascading invalidation: when the parent object is + * released or invalidated, all registers with matching parent_id + * are also invalidated. For example, a slice from bpf_dynptr_data() + * gets parent_id set to the dynptr's id. */ - u32 ref_obj_id; + u32 parent_id; /* Inside the callee two registers can be both PTR_TO_STACK like * R1=fp-8 and R2=fp-8, but one of them points to this function stack * while another to the caller's stack. To differentiate them 'frameno' @@ -364,10 +331,14 @@ struct bpf_reference_state { * is used purely to inform the user of a reference leak. */ int insn_idx; - /* Use to keep track of the source object of a lock, to ensure - * it matches on unlock. - */ - void *ptr; + union { + /* For REF_TYPE_PTR */ + int parent_id; + /* Use to keep track of the source object of a lock, to ensure + * it matches on unlock. + */ + void *ptr; + }; }; struct bpf_retval_range { @@ -585,7 +556,7 @@ bpf_get_spilled_stack_arg(int slot, struct bpf_func_state *frame) iter < frame->out_stack_arg_cnt; \ iter++, reg = bpf_get_spilled_stack_arg(iter, frame)) -#define bpf_for_each_reg_in_vstate_mask(__vst, __state, __reg, __mask, __expr) \ +#define bpf_for_each_reg_in_vstate_mask(__vst, __state, __reg, __stack, __mask, __expr) \ ({ \ struct bpf_verifier_state *___vstate = __vst; \ int ___i, ___j; \ @@ -593,6 +564,7 @@ bpf_get_spilled_stack_arg(int slot, struct bpf_func_state *frame) struct bpf_reg_state *___regs; \ __state = ___vstate->frame[___i]; \ ___regs = __state->regs; \ + __stack = NULL; \ for (___j = 0; ___j < MAX_BPF_REG; ___j++) { \ __reg = &___regs[___j]; \ (void)(__expr); \ @@ -600,8 +572,10 @@ bpf_get_spilled_stack_arg(int slot, struct bpf_func_state *frame) bpf_for_each_spilled_reg(___j, __state, __reg, __mask) { \ if (!__reg) \ continue; \ + __stack = &__state->stack[___j]; \ (void)(__expr); \ } \ + __stack = NULL; \ bpf_for_each_spilled_stack_arg(___j, __state, __reg) { \ if (!__reg) \ continue; \ @@ -611,8 +585,13 @@ bpf_get_spilled_stack_arg(int slot, struct bpf_func_state *frame) }) /* Invoke __expr over regsiters in __vst, setting __state and __reg */ -#define bpf_for_each_reg_in_vstate(__vst, __state, __reg, __expr) \ - bpf_for_each_reg_in_vstate_mask(__vst, __state, __reg, 1 << STACK_SPILL, __expr) +#define bpf_for_each_reg_in_vstate(__vst, __state, __reg, __expr) \ + ({ \ + struct bpf_stack_state * ___stack; \ + (void)___stack; \ + bpf_for_each_reg_in_vstate_mask(__vst, __state, __reg, ___stack,\ + 1 << STACK_SPILL, __expr); \ + }) /* linked list of verifier states used to prune search */ struct bpf_verifier_state_list { @@ -1442,7 +1421,7 @@ struct bpf_map_desc { struct bpf_dynptr_desc { enum bpf_dynptr_type type; u32 id; - u32 ref_obj_id; + u32 parent_id; }; struct bpf_kfunc_call_arg_meta { @@ -1453,7 +1432,7 @@ struct bpf_kfunc_call_arg_meta { const struct btf_type *func_proto; const char *func_name; /* Out parameters */ - u32 ref_obj_id; + u32 id; u8 release_regno; bool r0_rdonly; u32 ret_btf_id; -- cgit v1.2.3 From b7dd2b388657d99689161e82ed13515505838232 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Thu, 28 May 2026 18:49:30 -0700 Subject: bpf: Unify referenced object tracking in verifier Helpers and kfuncs independently tracked referenced object metadata using standalone id fields in their respective arg_meta structs. This led to duplicated logic and inconsistent error handling between the two paths. Introduce struct ref_obj_desc to consolidate id and parent_id along with a count of how many arguments carry a reference. Add update_ref_obj() to populate it from a bpf_reg_state, replacing open-coded assignments in check_func_arg(), check_kfunc_args(), and process_iter_arg(). Add validate_ref_obj() to check for ambiguous ref_obj before using it. For ref_obj releasing helpers and kfuncs, keep checking it before calling update_ref_obj() for now. A later patch will make these functions not depending on ref_obj. For other users of ref_obj, move the checks to the use locations. For helper, this means moving the checks inside helper_multiple_ref_obj_use() to use locations. is_acquire_function() is dropped as ref_obj is never used. Pass ref_obj_desc into process_dynptr_func()/mark_stack_slots_dynptr() instead of a bare parent_id to make it less confusing. Drop the selftest introduced in 7ec899ac90a2 ("selftests/bpf: Negative test case for ref_obj_id in args") since the verifier no longer complains about ambiguous ref_obj if it is not used. Acked-by: Eduard Zingerman Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260529014936.2811085-8-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 75b287d8d92f..b0521ba7787a 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -1424,6 +1424,18 @@ struct bpf_dynptr_desc { u32 parent_id; }; +/* + * The last seen rereferenced object; Updated by update_ref_obj() when a register refers to a + * referenced object. Used when the helper or kfunc is releasing a referenced object, casting + * a referenced object, returning allocated memory derived from referenced object or creating + * a dynptr with a referenced object as parent. + */ +struct ref_obj_desc { + u32 id; + u32 parent_id; + u8 cnt; +}; + struct bpf_kfunc_call_arg_meta { /* In parameters */ struct btf *btf; @@ -1432,7 +1444,6 @@ struct bpf_kfunc_call_arg_meta { const struct btf_type *func_proto; const char *func_name; /* Out parameters */ - u32 id; u8 release_regno; bool r0_rdonly; u32 ret_btf_id; @@ -1470,6 +1481,7 @@ struct bpf_kfunc_call_arg_meta { } iter; struct bpf_map_desc map; struct bpf_dynptr_desc dynptr; + struct ref_obj_desc ref_obj; u64 mem_size; }; -- cgit v1.2.3 From bcfcb15fde94ed39068eb1d6e4b9b37d27111965 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Thu, 28 May 2026 18:49:31 -0700 Subject: bpf: Unify release handling for helpers and kfuncs Introduce release_reg() to consolidate the release logic shared by both helpers and kfuncs: dynptr release, kptr_xchg percpu-to-RCU conversion, regular reference release, and NULL pass-through. NULL pass-through is only allowed if the prototype indicates the argument may be null. Determine release_regno from the function prototype/metadata before argument checking, rather than discovering it dynamically during argument processing. For helpers, scan the arg_type array in check_func_proto() via check_proto_release_reg(). For kfuncs, set release_regno to BPF_REG_1 in bpf_fetch_kfunc_arg_meta() when KF_RELEASE is set. In the future when we start adding decl_tag to kfunc arguments, we can just look at the function prototype instead of a release_regno. Extract ref_convert_alloc_rcu_protected() and invalidate_rcu_protected_refs() to make it more clear what the code is doing. For ref_convert_alloc_rcu_protected(), it pre-converts MEM_ALLOC | MEM_PERCPU registers to MEM_RCU (clearing id so they survive), then calls release_reference() to invalidate the remaining registers and release the reference state. Add KF_RELEASE to bpf_dynptr_file_discard() so its release_regno is set via fetch_kfunc_meta rather than being assigned manually in the dynptr argument processing. Set arg_type to ARG_PTR_TO_DYNPTR for KF_ARG_PTR_TO_DYNPTR so that check_func_arg_reg_off() correctly allows non-zero stack offsets for dynptr release arguments same as helper. Acked-by: Eduard Zingerman Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260529014936.2811085-9-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index b0521ba7787a..3dd2d21230af 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -1426,9 +1426,9 @@ struct bpf_dynptr_desc { /* * The last seen rereferenced object; Updated by update_ref_obj() when a register refers to a - * referenced object. Used when the helper or kfunc is releasing a referenced object, casting - * a referenced object, returning allocated memory derived from referenced object or creating - * a dynptr with a referenced object as parent. + * referenced object. Used when the helper or kfunc is casting a referenced object, returning + * allocated memory derived from referenced object or creating a dynptr with a referenced + * object as parent. */ struct ref_obj_desc { u32 id; -- cgit v1.2.3 From c48c3a7e7d5bed644208ed443d63bb6a6f411676 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Mon, 1 Jun 2026 17:02:43 +0200 Subject: bpf: Drop redundant hash_buf from map_get_hash operation bpf_map_get_info_by_fd() is the only caller of the ->map_get_hash and always invokes it with hash_buf == map->sha and hash_buf_size of SHA256_DIGEST_SIZE. array_map_get_hash() in turn lets sha256() write the digest directly into that buffer (map->sha) and then performs a trailing memcpy(), which evaluates to memcpy(map->sha, map->sha, 32): a redundant self-copy. The hash_buf_size argument was never used at all. Simplify this a bit, no functional change. Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260601150248.394863-3-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index d1a17c118316..c0510d223685 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -111,7 +111,7 @@ struct bpf_map_ops { long (*map_pop_elem)(struct bpf_map *map, void *value); long (*map_peek_elem)(struct bpf_map *map, void *value); void *(*map_lookup_percpu_elem)(struct bpf_map *map, void *key, u32 cpu); - int (*map_get_hash)(struct bpf_map *map, u32 hash_buf_size, void *hash_buf); + int (*map_get_hash)(struct bpf_map *map); /* funcs called by prog_array and perf_event_array map */ void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file, -- cgit v1.2.3 From 0fb6c9ed6493b4af01be8bb0a384574eba7df636 Mon Sep 17 00:00:00 2001 From: KP Singh Date: Mon, 1 Jun 2026 17:02:44 +0200 Subject: libbpf: Reject non-exclusive metadata maps in the signed loader The loader verifies map->sha against the metadata hash in its instructions. map->sha is calculated when BPF_OBJ_GET_INFO_BY_FD is called on the frozen map. While the map is frozen, the /signed loader/ must also ensure the map is exclusive, as, without exclusivity (which a hostile host could just omit when loading the loader), another BPF program with map access can mutate the contents afterwards, so the check passes on stale data. With the extra check as part of the signed loader, it now refuses to move on with map->sha validation if the host set it up wrongly. Fixes: fb2b0e290147 ("libbpf: Update light skeleton for signing") Signed-off-by: KP Singh Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260601150248.394863-4-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index c0510d223685..8599b451dd7a 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -296,6 +296,7 @@ struct bpf_map_owner { struct bpf_map { u8 sha[SHA256_DIGEST_SIZE]; + u32 excl; const struct bpf_map_ops *ops; struct bpf_map *inner_map_meta; #ifdef CONFIG_SECURITY -- cgit v1.2.3 From 37340ac2c7be914ff76fdc6bb505b204a4140268 Mon Sep 17 00:00:00 2001 From: Vicki Pfau Date: Thu, 21 May 2026 18:50:39 -0700 Subject: Input: userio - update maintainer name She's been committing under the name Lyude Paul for a while Signed-off-by: Vicki Pfau Link: https://patch.msgid.link/20260522015040.3953472-1-vi@endrift.com Signed-off-by: Dmitry Torokhov --- include/uapi/linux/userio.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/userio.h b/include/uapi/linux/userio.h index 74c9951d2cd0..98fe7e9089c4 100644 --- a/include/uapi/linux/userio.h +++ b/include/uapi/linux/userio.h @@ -2,7 +2,7 @@ /* * userio: virtual serio device support * Copyright (C) 2015 Red Hat - * Copyright (C) 2015 Lyude (Stephen Chandler Paul) + * Copyright (C) 2015 Lyude Paul * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU Lesser General Public License as published by the -- cgit v1.2.3 From c6f1363abbff69e5bd1cd1fcf060e1510e8d6d31 Mon Sep 17 00:00:00 2001 From: Vicki Pfau Date: Thu, 21 May 2026 18:50:40 -0700 Subject: Input: userio - allow setting other id values Previously, only the type value was settable. The proto value is used internally for choosing the right drivers, so we should expose it. The other values make sense to expose as well. Signed-off-by: Vicki Pfau Link: https://patch.msgid.link/20260522015040.3953472-2-vi@endrift.com Signed-off-by: Dmitry Torokhov --- include/uapi/linux/userio.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/userio.h b/include/uapi/linux/userio.h index 98fe7e9089c4..550c7465af1f 100644 --- a/include/uapi/linux/userio.h +++ b/include/uapi/linux/userio.h @@ -27,7 +27,10 @@ enum userio_cmd_type { USERIO_CMD_REGISTER = 0, USERIO_CMD_SET_PORT_TYPE = 1, - USERIO_CMD_SEND_INTERRUPT = 2 + USERIO_CMD_SEND_INTERRUPT = 2, + USERIO_CMD_SET_PORT_EXTRA = 3, + USERIO_CMD_SET_PORT_ID = 4, + USERIO_CMD_SET_PORT_PROTO = 5, }; /* -- cgit v1.2.3 From 2f20c859a82a291483a8b3f01cbfbb1642782a14 Mon Sep 17 00:00:00 2001 From: Yixun Lan Date: Mon, 11 May 2026 02:59:10 +0000 Subject: clk: spacemit: k3: Fix PCIe clock register offset The offset of PCIe Clock CTRL register for port B and C controller was wrongly swapped, correct it here. Fixes: 091d19cc2401 ("clk: spacemit: k3: extract common header") Acked-by: Conor Dooley Link: https://patch.msgid.link/20260511-06-pci-clk-fix-v2-2-c9a5e563bab3@kernel.org Signed-off-by: Yixun Lan --- include/soc/spacemit/k3-syscon.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/soc/spacemit/k3-syscon.h b/include/soc/spacemit/k3-syscon.h index 0299bea065a0..a68255dd641f 100644 --- a/include/soc/spacemit/k3-syscon.h +++ b/include/soc/spacemit/k3-syscon.h @@ -168,8 +168,8 @@ #define APMU_CPU_C2_CLK_CTRL 0x394 #define APMU_CPU_C3_CLK_CTRL 0x208 #define APMU_PCIE_CLK_RES_CTRL_A 0x1f0 -#define APMU_PCIE_CLK_RES_CTRL_B 0x1c8 -#define APMU_PCIE_CLK_RES_CTRL_C 0x1d0 +#define APMU_PCIE_CLK_RES_CTRL_B 0x1d0 +#define APMU_PCIE_CLK_RES_CTRL_C 0x1c8 #define APMU_PCIE_CLK_RES_CTRL_D 0x1e0 #define APMU_PCIE_CLK_RES_CTRL_E 0x1e8 #define APMU_EMAC0_CLK_RES_CTRL 0x3e4 -- cgit v1.2.3 From 7a2db70a3196717bfb01415b6dde1f90d4291ab1 Mon Sep 17 00:00:00 2001 From: Yixun Lan Date: Mon, 11 May 2026 02:59:11 +0000 Subject: dt-bindings: soc: spacemit: k3: Add PCIe DBI clock IDs Add clock IDs of PCIe DBI (Data Bus Interface) clock. Acked-by: Conor Dooley Link: https://patch.msgid.link/20260511-06-pci-clk-fix-v2-3-c9a5e563bab3@kernel.org Signed-off-by: Yixun Lan --- include/dt-bindings/clock/spacemit,k3-clocks.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/clock/spacemit,k3-clocks.h b/include/dt-bindings/clock/spacemit,k3-clocks.h index b22336f3ae40..dfae52547cda 100644 --- a/include/dt-bindings/clock/spacemit,k3-clocks.h +++ b/include/dt-bindings/clock/spacemit,k3-clocks.h @@ -380,6 +380,11 @@ #define CLK_APMU_ISIM_VCLK1 86 #define CLK_APMU_ISIM_VCLK2 87 #define CLK_APMU_ISIM_VCLK3 88 +#define CLK_APMU_PCIE_PORTA_DBI 89 +#define CLK_APMU_PCIE_PORTB_DBI 90 +#define CLK_APMU_PCIE_PORTC_DBI 91 +#define CLK_APMU_PCIE_PORTD_DBI 92 +#define CLK_APMU_PCIE_PORTE_DBI 93 /* DCIU clocks */ #define CLK_DCIU_HDMA 0 -- cgit v1.2.3 From eba302268a019275fd6ff452d4ff0b94fef11c76 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 21:59:51 +0200 Subject: timekeeping: Provide ktime_get_snapshot_id() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ktime_get_snapshot() provides a snapshot of the underlying clocksource counter value and the corresponding CLOCK_MONOTONIC_RAW, CLOCK_REALTIME and CLOCK_BOOTTIME timestamps. There is no usage of CLOCK_REALTIME and CLOCK_BOOTTIME at the same time and CLOCK_BOOTTIME support was just added for the ARM64 KVM tracing mechanism, which needs CLOCK_BOOTTIME and the underlying clocksource counter value. ktime_get_snapshot() is also not suitable for usage with CLOCK_AUX, but that's a prerequisite to support PTP hardware timestamping for CLOCK_AUX steering. As a first step, rename ktime_get_snapshot() to ktime_get_snapshot_id(), which now takes a clockid argument to select the clock which needs to be captured. The result is stored in system_time_snapshot::systime, which will replace the system_time_snapshot::real/boot members once all usage sites have been converted. ktime_get_snapshot() is a simple wrapper which hands in CLOCK_REALTIME as clockid argument for the conversion period. That means CLOCK_REALTIME is now captured twice, but that redunancy is only temporary. As all usage sites of struct system_time_snapshot has to be updated anyway, rename the 'raw' member to 'monoraw' for clarity. No functional change vs. current users of ktime_get_snapshot() Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Thomas Weißschuh Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260529195556.971591633@kernel.org --- include/linux/timekeeping.h | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h index aee2c1a46e47..161157c8d27e 100644 --- a/include/linux/timekeeping.h +++ b/include/linux/timekeeping.h @@ -276,24 +276,32 @@ static inline bool ktime_get_aux_ts64(clockid_t id, struct timespec64 *kt) { ret #endif /** - * struct system_time_snapshot - simultaneous raw/real time capture with - * counter value - * @cycles: Clocksource counter value to produce the system times - * @real: Realtime system time - * @boot: Boot time - * @raw: Monotonic raw system time - * @cs_id: Clocksource ID + * struct system_time_snapshot - Simultaneous time capture of CLOCK_MONOTONIC_RAW, + * a selected CLOCK_* and the clocksource counter value + * @cycles: Clocksource counter value to produce the system times + * @systime: The system time of the selected CLOCK ID + * @real: Realtime system time + * @boot: Boot time + * @raw: Monotonic raw system time + * @monoraw: Monotonic raw system time + * @cs_id: Clocksource ID * @clock_was_set_seq: The sequence number of clock-was-set events * @cs_was_changed_seq: The sequence number of clocksource change events + * @valid: True if the snapshot is valid */ struct system_time_snapshot { u64 cycles; + ktime_t systime; ktime_t real; ktime_t boot; - ktime_t raw; + union { + ktime_t raw; + ktime_t monoraw; + }; enum clocksource_ids cs_id; unsigned int clock_was_set_seq; u8 cs_was_changed_seq; + u8 valid; }; /** @@ -341,9 +349,15 @@ extern int get_device_system_crosststamp( struct system_device_crosststamp *xtstamp); /* - * Simultaneously snapshot realtime and monotonic raw clocks + * Simultaneously snapshot a given clock with MONOTONIC_RAW and the underlying + * clocksource counter value. */ -extern void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot); +extern void ktime_get_snapshot_id(clockid_t clock_id, struct system_time_snapshot *systime_snapshot); + +static inline void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot) +{ + ktime_get_snapshot_id(CLOCK_REALTIME, systime_snapshot); +} /* * Persistent clock related interfaces -- cgit v1.2.3 From d5becddf8a0f18bcc18129efa086530b5263c6b4 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 22:00:04 +0200 Subject: pps: Convert to ktime_get_snapshot_id() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ktime_get_snapshot() resolves to ktime_get_snapshot_id(CLOCK_REALTIME). Make it obvious in the code and convert the readout to use the snapshot::systime and monoraw fields instead of snapshot::real and raw, which aregoing away. Similar to the PPS generators, avoid the more expensive snapshot when CONFIG_NTP_PPS is disabled. No functional change intended. Signed-off-by: Thomas Gleixner Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Thomas Weißschuh Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260529195557.123410250@kernel.org --- include/linux/pps_kernel.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/pps_kernel.h b/include/linux/pps_kernel.h index aab0aebb529e..9f088c9023b1 100644 --- a/include/linux/pps_kernel.h +++ b/include/linux/pps_kernel.h @@ -99,12 +99,14 @@ static inline void timespec_to_pps_ktime(struct pps_ktime *kt, static inline void pps_get_ts(struct pps_event_time *ts) { +#ifdef CONFIG_NTP_PPS struct system_time_snapshot snap; - ktime_get_snapshot(&snap); - ts->ts_real = ktime_to_timespec64(snap.real); -#ifdef CONFIG_NTP_PPS - ts->ts_raw = ktime_to_timespec64(snap.raw); + ktime_get_snapshot_id(CLOCK_REALTIME, &snap); + ts->ts_real = ktime_to_timespec64(snap.systime); + ts->ts_raw = ktime_to_timespec64(snap.monoraw); +#else + ktime_get_real_ts64(&ts->ts_real); #endif } -- cgit v1.2.3 From f13beb010e4ab0735c9e46802cbcc820a8bd6467 Mon Sep 17 00:00:00 2001 From: John Stultz Date: Tue, 12 May 2026 02:56:15 +0000 Subject: sched: Have try_to_wake_up() handle return-migration for PROXY_WAKING case This patch adds logic so try_to_wake_up() will notice if we are waking a task where blocked_on == PROXY_WAKING, and if necessary dequeue the task so the wakeup will naturally return-migrate the donor task back to a cpu it can run on. This helps performance as we do the dequeue and wakeup under the locks normally taken in the try_to_wake_up() and avoids having to do proxy_force_return() from __schedule(), which has to re-take similar locks and then force a pick again loop. This was split out from the larger proxy patch, and significantly reworked. Credits for the original patch go to: Peter Zijlstra (Intel) Juri Lelli Valentin Schneider Connor O'Brien Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260512025635.2840817-6-jstultz@google.com --- include/linux/sched.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index 8130d13850fc..5dea5b10ac99 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -161,7 +161,7 @@ struct user_event_mm; */ #define is_special_task_state(state) \ ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_PARKED | \ - TASK_DEAD | TASK_FROZEN)) + TASK_DEAD | TASK_WAKING | TASK_FROZEN)) #ifdef CONFIG_DEBUG_ATOMIC_SLEEP # define debug_normal_state_change(state_value) \ -- cgit v1.2.3 From 4c2a20413d7fb3fc3dd7adf233a4f82bb203fb58 Mon Sep 17 00:00:00 2001 From: John Stultz Date: Tue, 12 May 2026 02:56:16 +0000 Subject: sched: Add is_blocked task flag Add a new is_blocked flag to the task struct. This flag is set by try_to_block_task() and cleared by ttwu_do_wakeup() and tracks if the task is blocked. Traditionally this would mirror !p->on_rq, however due things like DELAY_DEQUEUE and PROXY_EXEC, this can diverge, so its useful to manage separately. Additionally with this, we might be able to get rid of the p->se.sched_delayed (ab)use in the core code (eventually). Taken whole cloth from Peter's email: https://lore.kernel.org/lkml/20260501132143.GC1026330@noisy.programming.kicks-ass.net/ With a few additional p->is_blocked = 0 in a few cases where we return current if blocked_on gets zeroed or there is no owner. This may hint that these current special cases might be dropped eventually. This change also helps resolve wait-queue stalls seen with proxy-execution. See previous patch attempts for details: https://lore.kernel.org/lkml/20260430215103.2978955-2-jstultz@google.com/ Reported-by: Vineeth Pillai Suggested-by: Peter Zijlstra Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260512025635.2840817-7-jstultz@google.com --- include/linux/sched.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index 5dea5b10ac99..ec170663f99b 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -852,7 +852,11 @@ struct task_struct { struct alloc_tag *alloc_tag; #endif - int on_cpu; + u8 on_cpu; + u8 on_rq; + u8 is_blocked; + u8 __pad; + struct __call_single_node wake_entry; unsigned int wakee_flips; unsigned long wakee_flip_decay_ts; @@ -867,7 +871,6 @@ struct task_struct { */ int recent_used_cpu; int wake_cpu; - int on_rq; int prio; int static_prio; -- cgit v1.2.3 From 1628b25248d0742b2ce9c7cfa59cd183e35f37e1 Mon Sep 17 00:00:00 2001 From: Peter Zijlstra Date: Tue, 12 May 2026 02:56:17 +0000 Subject: sched: Add blocked_donor link to task for smarter mutex handoffs Add link to the task this task is proxying for, and use it so the mutex owner can do an intelligent hand-off of the mutex to the task that the owner is running on behalf. [jstultz: This patch was split out from larger proxy patch] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Juri Lelli Signed-off-by: Valentin Schneider Signed-off-by: Connor O'Brien Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260512025635.2840817-8-jstultz@google.com --- include/linux/sched.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index ec170663f99b..e2f127a7ca0d 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1250,6 +1250,13 @@ struct task_struct { struct mutex *blocked_on; /* lock we're blocked on */ raw_spinlock_t blocked_lock; + /* + * The task that is boosting this task; a back link for the current + * donor stack. Set in schedule() -> find_proxy_task() and only stable + * under preempt_disable(). + */ + struct task_struct *blocked_donor; + #ifdef CONFIG_DETECT_HUNG_TASK_BLOCKER /* * Encoded lock address causing task block (lower 2 bits = type from -- cgit v1.2.3 From ec9d4f1c424134bbf30965075df78d02a5d021dc Mon Sep 17 00:00:00 2001 From: K Prateek Nayak Date: Tue, 26 May 2026 11:43:02 +0200 Subject: sched/proxy: Remove PROXY_WAKING Now that the proxy path uses ->is_blocked, use the '->is_blocked && !->blocked_on' state instead of PROXY_WAKING. Notably, this is where a blocked_on relation is broken but the donor task might still need a return migration. Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260526113322.596522894%40infradead.org --- include/linux/sched.h | 50 ++------------------------------------------------ 1 file changed, 2 insertions(+), 48 deletions(-) (limited to 'include') diff --git a/include/linux/sched.h b/include/linux/sched.h index e2f127a7ca0d..35e6183ef615 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2205,19 +2205,10 @@ extern int __cond_resched_rwlock_write(rwlock_t *lock) __must_hold(lock); #ifndef CONFIG_PREEMPT_RT -/* - * With proxy exec, if a task has been proxy-migrated, it may be a donor - * on a cpu that it can't actually run on. Thus we need a special state - * to denote that the task is being woken, but that it needs to be - * evaluated for return-migration before it is run. So if the task is - * blocked_on PROXY_WAKING, return migrate it before running it. - */ -#define PROXY_WAKING ((struct mutex *)(-1L)) - static inline struct mutex *__get_task_blocked_on(struct task_struct *p) { lockdep_assert_held_once(&p->blocked_lock); - return p->blocked_on == PROXY_WAKING ? NULL : p->blocked_on; + return p->blocked_on; } static inline void __set_task_blocked_on(struct task_struct *p, struct mutex *m) @@ -2245,7 +2236,7 @@ static inline void __clear_task_blocked_on(struct task_struct *p, struct mutex * * blocked_on relationships, but make sure we are not * clearing the relationship with a different lock. */ - WARN_ON_ONCE(m && p->blocked_on && p->blocked_on != m && p->blocked_on != PROXY_WAKING); + WARN_ON_ONCE(m && p->blocked_on && p->blocked_on != m); p->blocked_on = NULL; } @@ -2254,35 +2245,6 @@ static inline void clear_task_blocked_on(struct task_struct *p, struct mutex *m) guard(raw_spinlock_irqsave)(&p->blocked_lock); __clear_task_blocked_on(p, m); } - -static inline void __set_task_blocked_on_waking(struct task_struct *p, struct mutex *m) -{ - /* Currently we serialize blocked_on under the task::blocked_lock */ - lockdep_assert_held_once(&p->blocked_lock); - - if (!sched_proxy_exec()) { - __clear_task_blocked_on(p, m); - return; - } - - /* Don't set PROXY_WAKING if blocked_on was already cleared */ - if (!p->blocked_on) - return; - /* - * There may be cases where we set PROXY_WAKING on tasks that were - * already set to waking, but make sure we are not changing - * the relationship with a different lock. - */ - WARN_ON_ONCE(m && p->blocked_on != m && p->blocked_on != PROXY_WAKING); - p->blocked_on = PROXY_WAKING; -} - -static inline void set_task_blocked_on_waking(struct task_struct *p, struct mutex *m) -{ - guard(raw_spinlock_irqsave)(&p->blocked_lock); - __set_task_blocked_on_waking(p, m); -} - #else static inline void __clear_task_blocked_on(struct task_struct *p, struct rt_mutex *m) { @@ -2291,14 +2253,6 @@ static inline void __clear_task_blocked_on(struct task_struct *p, struct rt_mute static inline void clear_task_blocked_on(struct task_struct *p, struct rt_mutex *m) { } - -static inline void __set_task_blocked_on_waking(struct task_struct *p, struct rt_mutex *m) -{ -} - -static inline void set_task_blocked_on_waking(struct task_struct *p, struct rt_mutex *m) -{ -} #endif /* !CONFIG_PREEMPT_RT */ static __always_inline bool need_resched(void) -- cgit v1.2.3 From 6d99479799c69c3cb588fcda19c81d8f61d64ecd Mon Sep 17 00:00:00 2001 From: Qing Wang Date: Tue, 2 Jun 2026 11:08:54 +0800 Subject: rseq: Fix using an uninitialized stack variable in rseq_exit_user_update() There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as reported by syzbot: BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline] The local variable: struct rseq_ids ids = { .cpu_id = task_cpu(t), .mm_cid = task_mm_cid(t), .node_id = cpu_to_node(ids.cpu_id), }; According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates `cpu_to_node(ids.cpu_id)` *before* `ids.cpu_id` is initialized with `task_cpu(t)`. This is fixed by moving the assignment of ids.node_id outside the structure initialization. Fixes: 82f572449cfe ("rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode") Closes: https://syzkaller.appspot.com/bug?extid=185a631927096f9da2fc Reported-by: syzbot+185a631927096f9da2fc@syzkaller.appspotmail.com Signed-off-by: Qing Wang Signed-off-by: Peter Zijlstra (Intel) Acked-by: Mark Rutland Link: https://patch.msgid.link/20260602030854.574038-1-wangqing7171@gmail.com --- include/linux/rseq_entry.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/rseq_entry.h b/include/linux/rseq_entry.h index 63bc72086e75..ed9da6e41a2a 100644 --- a/include/linux/rseq_entry.h +++ b/include/linux/rseq_entry.h @@ -635,10 +635,11 @@ static __always_inline bool rseq_exit_user_update(struct pt_regs *regs, struct t return true; } + int cpu = task_cpu(t); struct rseq_ids ids = { - .cpu_id = task_cpu(t), + .cpu_id = cpu, .mm_cid = task_mm_cid(t), - .node_id = cpu_to_node(ids.cpu_id), + .node_id = cpu_to_node(cpu), }; return rseq_update_usr(t, regs, &ids); -- cgit v1.2.3 From 0aae825f1ed7ce3eedfadc54684aa86bbbe188b0 Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Fri, 29 May 2026 17:02:04 +0200 Subject: mm: Make empty_zero_page[] const The empty zero page is used to back any kernel or user space mapping that is supposed to remain cleared, and so the page itself is never supposed to be modified. So mark it as const, which moves it into .rodata rather than .bss: on most architectures, this ensures that both the kernel's mapping of it and any aliases that are accessible via the kernel direct (linear) map are mapped read-only, and cannot be used (inadvertently or maliciously) to corrupt the contents of the zero page. Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Kevin Brodsky Acked-by: David Hildenbrand (Arm) Reviewed-by: Jann Horn Reviewed-by: Feng Tang Signed-off-by: Ard Biesheuvel Signed-off-by: Will Deacon --- include/linux/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h index cdd68ed3ae1a..67aa23814010 100644 --- a/include/linux/pgtable.h +++ b/include/linux/pgtable.h @@ -1993,7 +1993,7 @@ static inline unsigned long zero_pfn(unsigned long addr) return zero_page_pfn; } -extern uint8_t empty_zero_page[PAGE_SIZE]; +extern const uint8_t empty_zero_page[PAGE_SIZE]; extern struct page *__zero_page; static inline struct page *_zero_page(unsigned long addr) -- cgit v1.2.3 From b78dab829760aee9b83f5cf15550a0fe36c6f4b0 Mon Sep 17 00:00:00 2001 From: Lyude Paul Date: Fri, 29 May 2026 14:34:03 -0400 Subject: drm/gem/shmem: Introduce __drm_gem_shmem_free_sgt_locked() One of the complications of trying to use the shmem helpers to create a scatterlist for shmem objects is that we need to be able to provide a guarantee that the driver cannot be unbound for the lifetime of the scatterlist. The easiest way of handling this seems to be just hooking up an unmap operation to devres the first time we create a scatterlist, which allows us to still take advantage of gem shmem facilities without breaking that guarantee. To allow for this, we extract __drm_gem_shmem_free_sgt_locked() - which allows a caller (e.g. the rust bindings) to manually unmap the sgt for a gem object as needed. Signed-off-by: Lyude Paul Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260529183702.677677-6-lyude@redhat.com --- include/drm/drm_gem_shmem_helper.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/drm/drm_gem_shmem_helper.h b/include/drm/drm_gem_shmem_helper.h index 5ccdae21b94a..b2c23af628e1 100644 --- a/include/drm/drm_gem_shmem_helper.h +++ b/include/drm/drm_gem_shmem_helper.h @@ -111,6 +111,7 @@ int drm_gem_shmem_init(struct drm_device *dev, struct drm_gem_shmem_object *shme struct drm_gem_shmem_object *drm_gem_shmem_create(struct drm_device *dev, size_t size); void drm_gem_shmem_release(struct drm_gem_shmem_object *shmem); void drm_gem_shmem_free(struct drm_gem_shmem_object *shmem); +void __drm_gem_shmem_free_sgt_locked(struct drm_gem_shmem_object *shmem); void drm_gem_shmem_put_pages_locked(struct drm_gem_shmem_object *shmem); int drm_gem_shmem_pin(struct drm_gem_shmem_object *shmem); -- cgit v1.2.3 From ec02fe217fa66d79f8a65e8d28be9295c7f85093 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Tue, 2 Jun 2026 11:08:25 +0100 Subject: io_uring/bpf-ops: restrict ctx access to BPF BPF programs should have no need in looking into struct io_ring_ctx, if anything, most of such cases would be anti patterns like looking up ring indices directly via the context. Replace it with a new empty structure, which is just an alias to struct io_ring_ctx. It'll create a new BTF type and fail verification if a BPF program tries to access it (beyond the first byte). It'll also give more flexibility for the future, and otherwise it can be made aligned with io_ring_ctx as before with struct groups if ever needed or extended in a different way. Fixes: d0e437b76bd3c ("io_uring/bpf-ops: implement loop_step with BPF struct_ops") Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/5f6ca3649e9e0bae8667db4357e28dd00cd07901.1780394491.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index 23b8891d5704..aa4d5477f859 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -290,6 +290,8 @@ enum { IO_RING_F_IOWQ_LIMITS_SET = BIT(12), }; +struct iou_ctx {}; + struct io_ring_ctx { /* const or read-mostly hot data */ struct { @@ -366,7 +368,7 @@ struct io_ring_ctx { struct io_alloc_cache rw_cache; struct io_alloc_cache cmd_cache; - int (*loop_step)(struct io_ring_ctx *ctx, + int (*loop_step)(struct iou_ctx *, struct iou_loop_params *); /* -- cgit v1.2.3 From c169a2a5fd9cfdb2ae93cf6d86be4d2a5e3d813c Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Tue, 2 Jun 2026 10:52:04 -0700 Subject: bpf: Silence unused-but-set-variable warning in bpf_for_each_reg_in_vstate_mask The macro requires callers to pass a stack variable, but not all callbacks use it. Add (void)__stack to suppress the clang W=1 warning. Signed-off-by: Amery Hung Link: https://lore.kernel.org/r/20260602175204.624401-1-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index 3dd2d21230af..c248ff41f42a 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -582,6 +582,7 @@ bpf_get_spilled_stack_arg(int slot, struct bpf_func_state *frame) (void)(__expr); \ } \ } \ + (void)__stack; \ }) /* Invoke __expr over regsiters in __vst, setting __state and __reg */ -- cgit v1.2.3 From 080b5c6d95034e46f5ed1abe98c06218a1386aef Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Fri, 8 May 2026 15:16:35 +0200 Subject: sched/cputime: Remove superfluous and error prone kcpustat_field() parameter The first parameter to kcpustat_field() is a pointer to the cpu kcpustat to be fetched from. This parameter is error prone because a copy to a kcpustat could be passed by accident instead of the original one. Also the kcpustat structure can already be retrieved with the help of the mandatory CPU argument. Remove the needless parameter. Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Tested-by: Shrikanth Hegde Reviewed-by: Shrikanth Hegde Link: https://patch.msgid.link/20260508131647.43868-4-frederic@kernel.org --- include/linux/kernel_stat.h | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h index b97ce2df376f..dd020ecaf67b 100644 --- a/include/linux/kernel_stat.h +++ b/include/linux/kernel_stat.h @@ -100,14 +100,12 @@ static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu) } #ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN -extern u64 kcpustat_field(struct kernel_cpustat *kcpustat, - enum cpu_usage_stat usage, int cpu); +extern u64 kcpustat_field(enum cpu_usage_stat usage, int cpu); extern void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu); #else -static inline u64 kcpustat_field(struct kernel_cpustat *kcpustat, - enum cpu_usage_stat usage, int cpu) +static inline u64 kcpustat_field(enum cpu_usage_stat usage, int cpu) { - return kcpustat->cpustat[usage]; + return kcpustat_cpu(cpu).cpustat[usage]; } static inline void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) -- cgit v1.2.3 From 650a59805a9baeff76379ea9309df1395eb15a46 Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Fri, 8 May 2026 15:16:36 +0200 Subject: sched/cputime: Correctly support generic vtime idle time Currently whether generic vtime is running or not, the idle cputime is fetched from the nohz accounting. However generic vtime already does its own idle cputime accounting. Only the kernel stat accessors are not plugged to support it. Read the idle generic vtime cputime when it's running, this will allow to later more clearly split nohz and vtime cputime accounting. Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Tested-by: Shrikanth Hegde Link: https://patch.msgid.link/20260508131647.43868-5-frederic@kernel.org --- include/linux/vtime.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/vtime.h b/include/linux/vtime.h index 29dd5b91dd7d..336875bea767 100644 --- a/include/linux/vtime.h +++ b/include/linux/vtime.h @@ -10,7 +10,6 @@ */ #ifdef CONFIG_VIRT_CPU_ACCOUNTING extern void vtime_account_kernel(struct task_struct *tsk); -extern void vtime_account_idle(struct task_struct *tsk); #endif /* !CONFIG_VIRT_CPU_ACCOUNTING */ #ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN @@ -27,7 +26,13 @@ static inline void vtime_guest_exit(struct task_struct *tsk) { } static inline void vtime_init_idle(struct task_struct *tsk, int cpu) { } #endif +static inline bool vtime_generic_enabled_cpu(int cpu) +{ + return context_tracking_enabled_cpu(cpu); +} + #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE +extern void vtime_account_idle(struct task_struct *tsk); extern void vtime_account_irq(struct task_struct *tsk, unsigned int offset); extern void vtime_account_softirq(struct task_struct *tsk); extern void vtime_account_hardirq(struct task_struct *tsk); @@ -74,7 +79,7 @@ static inline bool vtime_accounting_enabled(void) static inline bool vtime_accounting_enabled_cpu(int cpu) { - return context_tracking_enabled_cpu(cpu); + return vtime_generic_enabled_cpu(cpu); } static inline bool vtime_accounting_enabled_this_cpu(void) -- cgit v1.2.3 From c8ba971cf8567d49eb5f43ee90c4e50424331c18 Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Fri, 8 May 2026 15:16:37 +0200 Subject: powerpc/time: Prepare to stop elapsing in dynticks-idle Currently the tick subsystem stores the idle cputime accounting in private fields, allowing cohabitation with architecture idle vtime accounting. The former is fetched on online CPUs, the latter on offline CPUs. For consolidation purpose, architecture vtime accounting will continue to account the cputime but will make a break when the idle tick is stopped. The dyntick cputime accounting will then be relayed by the tick subsystem so that the idle cputime is still seen advancing coherently even when the tick isn't there to flush the idle vtime. Prepare for that and introduce three new APIs which will be used in subsequent patches: - vtime_dynticks_start() is deemed to be called when idle enters in dyntick mode. The idle cputime that elapsed so far is accumulated. - vtime_dynticks_stop() is deemed to be called when idle exits from dyntick mode. The vtime entry clocks are fast-forward to current time so that idle accounting restarts elapsing from now. - vtime_reset() is deemed to be called from dynticks idle IRQ entry to fast-forward the clock to current time so that the IRQ time is still accounted by vtime while nohz cputime is paused. Also accumulated vtime won't be flushed from dyntick-idle ticks to avoid accounting twice the idle cputime, along with nohz accounting. Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Tested-by: Shrikanth Hegde Reviewed-by: Shrikanth Hegde Link: https://patch.msgid.link/20260508131647.43868-6-frederic@kernel.org --- include/linux/vtime.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/vtime.h b/include/linux/vtime.h index 336875bea767..5516ad549e60 100644 --- a/include/linux/vtime.h +++ b/include/linux/vtime.h @@ -37,11 +37,17 @@ extern void vtime_account_irq(struct task_struct *tsk, unsigned int offset); extern void vtime_account_softirq(struct task_struct *tsk); extern void vtime_account_hardirq(struct task_struct *tsk); extern void vtime_flush(struct task_struct *tsk); +extern void vtime_reset(void); +extern void vtime_dyntick_start(void); +extern void vtime_dyntick_stop(void); #else /* !CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */ static inline void vtime_account_irq(struct task_struct *tsk, unsigned int offset) { } static inline void vtime_account_softirq(struct task_struct *tsk) { } static inline void vtime_account_hardirq(struct task_struct *tsk) { } static inline void vtime_flush(struct task_struct *tsk) { } +static inline void vtime_reset(void) { } +static inline void vtime_dyntick_start(void) { } +static inline void vtime_dyntick_stop(void) { } #endif /* -- cgit v1.2.3 From cf6444c3e1bb7dd5974441bbd74840e9821d36f9 Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Fri, 8 May 2026 15:16:39 +0200 Subject: tick/sched: Unify idle cputime accounting The non-vtime dynticks-idle cputime accounting is a big mess that accumulates within two concurrent statistics, each having their own shortcomings: * The accounting for online CPUs which is based on the delta between tick_nohz_start_idle() and tick_nohz_stop_idle(). Pros: - Works when the tick is off - Has nsecs granularity Cons: - Account idle steal time but doesn't substract it from idle cputime. - Assumes CONFIG_IRQ_TIME_ACCOUNTING by not accounting IRQs but the IRQ time is simply ignored when CONFIG_IRQ_TIME_ACCOUNTING=n - The windows between 1) idle task scheduling and the first call to tick_nohz_start_idle() and 2) idle task between the last tick_nohz_stop_idle() and the rest of the idle time are blindspots wrt. cputime accounting (though mostly insignificant amount) - Relies on private fields outside of kernel stats, with specific accessors. * The accounting for offline CPUs which is based on ticks and the jiffies delta during which the tick was stopped. Pros: - Handles steal time correctly - Handle CONFIG_IRQ_TIME_ACCOUNTING=y and CONFIG_IRQ_TIME_ACCOUNTING=n correctly. - Handles the whole idle task - Accounts directly to kernel stats, without midlayer accumulator. Cons: - Doesn't elapse when the tick is off, which doesn't make it suitable for online CPUs. - Has TICK_NSEC granularity (jiffies) - Needs to track the dyntick-idle ticks that were accounted and substract them from the total jiffies time spent while the tick was stopped. This is an ugly workaround. Having two different accounting for a single context is not the only problem: since those accountings are of different natures, it is possible to observe the global idle time going backward after a CPU goes offline. Clean up the situation with introducing a hybrid approach that stays coherent and works for both online and offline CPUs: * Tick based or native vtime accounting operate before the idle loop is entered and resume once the idle loop prepares to exit. * When the idle loop starts, switch to dynticks-idle accounting as is done currently, except that the statistics accumulate directly to the relevant kernel stat fields. * Private dyntick cputime accounting fields are removed. * Works on both online and offline case. Further improvement will include: * Only switch to dynticks-idle cputime accounting when the tick actually goes in dynticks mode. * Handle CONFIG_IRQ_TIME_ACCOUNTING=n correctly such that the dynticks-idle accounting still elapses while on IRQs. * Correctly substract idle steal cputime from idle time Reported-by: Xin Zhao Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Tested-by: Shrikanth Hegde Link: https://patch.msgid.link/20260508131647.43868-8-frederic@kernel.org --- include/linux/kernel_stat.h | 24 ++++++++++++++++++++---- include/linux/vtime.h | 7 ++++++- 2 files changed, 26 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h index dd020ecaf67b..ba65aad308a1 100644 --- a/include/linux/kernel_stat.h +++ b/include/linux/kernel_stat.h @@ -34,6 +34,9 @@ enum cpu_usage_stat { }; struct kernel_cpustat { +#ifdef CONFIG_NO_HZ_COMMON + int idle_dyntick; +#endif u64 cpustat[NR_STATS]; }; @@ -99,6 +102,20 @@ static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu) return kstat_cpu(cpu).irqs_sum; } +#ifdef CONFIG_NO_HZ_COMMON +extern void kcpustat_dyntick_start(void); +extern void kcpustat_dyntick_stop(void); +static inline bool kcpustat_idle_dyntick(void) +{ + return __this_cpu_read(kernel_cpustat.idle_dyntick); +} +#else +static inline bool kcpustat_idle_dyntick(void) +{ + return false; +} +#endif /* CONFIG_NO_HZ_COMMON */ + #ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN extern u64 kcpustat_field(enum cpu_usage_stat usage, int cpu); extern void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu); @@ -113,7 +130,7 @@ static inline void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) *dst = kcpustat_cpu(cpu); } -#endif +#endif /* !CONFIG_VIRT_CPU_ACCOUNTING_GEN */ extern void account_user_time(struct task_struct *, u64); extern void account_guest_time(struct task_struct *, u64); @@ -127,14 +144,13 @@ extern u64 get_idle_time(struct kernel_cpustat *kcs, int cpu); #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE static inline void account_process_tick(struct task_struct *tsk, int user) { - vtime_flush(tsk); + if (!kcpustat_idle_dyntick()) + vtime_flush(tsk); } #else extern void account_process_tick(struct task_struct *, int user); #endif -extern void account_idle_ticks(unsigned long ticks); - #ifdef CONFIG_SCHED_CORE extern void __account_forceidle_time(struct task_struct *tsk, u64 delta); #endif diff --git a/include/linux/vtime.h b/include/linux/vtime.h index 5516ad549e60..9dc25b04a119 100644 --- a/include/linux/vtime.h +++ b/include/linux/vtime.h @@ -31,6 +31,11 @@ static inline bool vtime_generic_enabled_cpu(int cpu) return context_tracking_enabled_cpu(cpu); } +static inline bool vtime_generic_enabled_this_cpu(void) +{ + return context_tracking_enabled_this_cpu(); +} + #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE extern void vtime_account_idle(struct task_struct *tsk); extern void vtime_account_irq(struct task_struct *tsk, unsigned int offset); @@ -90,7 +95,7 @@ static inline bool vtime_accounting_enabled_cpu(int cpu) static inline bool vtime_accounting_enabled_this_cpu(void) { - return context_tracking_enabled_this_cpu(); + return vtime_generic_enabled_this_cpu(); } extern void vtime_task_switch_generic(struct task_struct *prev); -- cgit v1.2.3 From a5fe724e206ec7ff3ceb15b285d94316c7fe6c41 Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Fri, 8 May 2026 15:16:41 +0200 Subject: tick/sched: Move dyntick-idle cputime accounting to cputime code Although the dynticks-idle cputime accounting is necessarily tied to the tick subsystem, the actual related accounting code has no business residing there and should be part of the scheduler cputime code. Move away the relevant pieces and state machine to where they belong. Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Tested-by: Shrikanth Hegde Link: https://patch.msgid.link/20260508131647.43868-10-frederic@kernel.org --- include/linux/kernel_stat.h | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h index ba65aad308a1..9343353ac7a3 100644 --- a/include/linux/kernel_stat.h +++ b/include/linux/kernel_stat.h @@ -35,9 +35,12 @@ enum cpu_usage_stat { struct kernel_cpustat { #ifdef CONFIG_NO_HZ_COMMON - int idle_dyntick; + bool idle_dyntick; + bool idle_elapse; + seqcount_t idle_sleeptime_seq; + u64 idle_entrytime; #endif - u64 cpustat[NR_STATS]; + u64 cpustat[NR_STATS]; }; struct kernel_stat { @@ -103,8 +106,11 @@ static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu) } #ifdef CONFIG_NO_HZ_COMMON -extern void kcpustat_dyntick_start(void); -extern void kcpustat_dyntick_stop(void); +extern void kcpustat_dyntick_start(u64 now); +extern void kcpustat_dyntick_stop(u64 now); +extern void kcpustat_irq_enter(u64 now); +extern void kcpustat_irq_exit(u64 now); + static inline bool kcpustat_idle_dyntick(void) { return __this_cpu_read(kernel_cpustat.idle_dyntick); -- cgit v1.2.3 From 127b2eb44f36d5d7059f1af425b5800cb27440f9 Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Fri, 8 May 2026 15:16:44 +0200 Subject: tick/sched: Consolidate idle time fetching APIs Fetching the idle cputime is available through a variety of accessors all over the place depending on the different accounting flavours and needs: - idle vtime generic accounting can be accessed by kcpustat_field(), kcpustat_cpu_fetch(), get_idle/iowait_time() and get_cpu_idle/iowait_time_us() - dynticks-idle accounting can only be accessed by get_idle/iowait_time() or get_cpu_idle/iowait_time_us() - CONFIG_NO_HZ_COMMON=n idle accounting can be accessed by kcpustat_field() kcpustat_cpu_fetch(), or get_idle/iowait_time() but not by get_cpu_idle/iowait_time_us() Moreover get_idle/iowait_time() relies on get_cpu_idle/iowait_time_us() with a non-sensical conversion to microseconds and back to nanoseconds on the way. Start consolidating the APIs with removing get_idle/iowait_time() and make kcpustat_field() and kcpustat_cpu_fetch() work for all cases. Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Tested-by: Shrikanth Hegde Link: https://patch.msgid.link/20260508131647.43868-13-frederic@kernel.org --- include/linux/kernel_stat.h | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h index 9343353ac7a3..3680519d7b2c 100644 --- a/include/linux/kernel_stat.h +++ b/include/linux/kernel_stat.h @@ -110,32 +110,59 @@ extern void kcpustat_dyntick_start(u64 now); extern void kcpustat_dyntick_stop(u64 now); extern void kcpustat_irq_enter(u64 now); extern void kcpustat_irq_exit(u64 now); +extern u64 kcpustat_field_idle(int cpu); +extern u64 kcpustat_field_iowait(int cpu); static inline bool kcpustat_idle_dyntick(void) { return __this_cpu_read(kernel_cpustat.idle_dyntick); } #else +static inline u64 kcpustat_field_idle(int cpu) +{ + return kcpustat_cpu(cpu).cpustat[CPUTIME_IDLE]; +} +static inline u64 kcpustat_field_iowait(int cpu) +{ + return kcpustat_cpu(cpu).cpustat[CPUTIME_IOWAIT]; +} + static inline bool kcpustat_idle_dyntick(void) { return false; } #endif /* CONFIG_NO_HZ_COMMON */ +/* Fetch cputime values when vtime is disabled on a CPU */ +static inline u64 kcpustat_field_default(enum cpu_usage_stat usage, int cpu) +{ + if (usage == CPUTIME_IDLE) + return kcpustat_field_idle(cpu); + if (usage == CPUTIME_IOWAIT) + return kcpustat_field_iowait(cpu); + return kcpustat_cpu(cpu).cpustat[usage]; +} + +static inline void kcpustat_cpu_fetch_default(struct kernel_cpustat *dst, int cpu) +{ + *dst = kcpustat_cpu(cpu); + dst->cpustat[CPUTIME_IDLE] = kcpustat_field_idle(cpu); + dst->cpustat[CPUTIME_IOWAIT] = kcpustat_field_iowait(cpu); +} + #ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN extern u64 kcpustat_field(enum cpu_usage_stat usage, int cpu); extern void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu); #else static inline u64 kcpustat_field(enum cpu_usage_stat usage, int cpu) { - return kcpustat_cpu(cpu).cpustat[usage]; + return kcpustat_field_default(usage, cpu); } static inline void kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) { - *dst = kcpustat_cpu(cpu); + kcpustat_cpu_fetch_default(dst, cpu); } - #endif /* !CONFIG_VIRT_CPU_ACCOUNTING_GEN */ extern void account_user_time(struct task_struct *, u64); @@ -145,7 +172,6 @@ extern void account_system_index_time(struct task_struct *, u64, enum cpu_usage_stat); extern void account_steal_time(u64); extern void account_idle_time(u64); -extern u64 get_idle_time(struct kernel_cpustat *kcs, int cpu); #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE static inline void account_process_tick(struct task_struct *tsk, int user) -- cgit v1.2.3 From 3b45b4f188f3a0ebd16ab71efd2ffcc7a16ad861 Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Fri, 8 May 2026 15:16:45 +0200 Subject: sched/cputime: Provide get_cpu_[idle|iowait]_time_us() off-case The last reason why get_cpu_idle/iowait_time_us() may return -1 now is if the config doesn't support nohz. The ad-hoc replacement solution by cpufreq is to compute jiffies minus the whole busy cputime. Although the intention should provide a coherent low resolution estimation of the idle and iowait time, the implementation is buggy because jiffies don't start at 0. Just provide instead a real get_cpu_[idle|iowait]_time_us() offcase. Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Tested-by: Shrikanth Hegde Link: https://patch.msgid.link/20260508131647.43868-14-frederic@kernel.org --- include/linux/kernel_stat.h | 3 +++ include/linux/tick.h | 4 ---- 2 files changed, 3 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h index 3680519d7b2c..512104b0ff49 100644 --- a/include/linux/kernel_stat.h +++ b/include/linux/kernel_stat.h @@ -133,6 +133,9 @@ static inline bool kcpustat_idle_dyntick(void) } #endif /* CONFIG_NO_HZ_COMMON */ +extern u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time); +extern u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time); + /* Fetch cputime values when vtime is disabled on a CPU */ static inline u64 kcpustat_field_default(enum cpu_usage_stat usage, int cpu) { diff --git a/include/linux/tick.h b/include/linux/tick.h index 738007d6f577..1cf4651f09ad 100644 --- a/include/linux/tick.h +++ b/include/linux/tick.h @@ -139,8 +139,6 @@ extern bool tick_nohz_idle_got_tick(void); extern ktime_t tick_nohz_get_next_hrtimer(void); extern ktime_t tick_nohz_get_sleep_length(ktime_t *delta_next); extern unsigned long tick_nohz_get_idle_calls_cpu(int cpu); -extern u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time); -extern u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time); #else /* !CONFIG_NO_HZ_COMMON */ #define tick_nohz_enabled (0) static inline bool tick_nohz_is_active(void) { return false; } @@ -162,8 +160,6 @@ static inline ktime_t tick_nohz_get_sleep_length(ktime_t *delta_next) *delta_next = TICK_NSEC; return *delta_next; } -static inline u64 get_cpu_idle_time_us(int cpu, u64 *unused) { return -1; } -static inline u64 get_cpu_iowait_time_us(int cpu, u64 *unused) { return -1; } #endif /* !CONFIG_NO_HZ_COMMON */ /* -- cgit v1.2.3 From 6199f9999a9b62b2b84a1bf5b52a9fd0bb8de5af Mon Sep 17 00:00:00 2001 From: Frederic Weisbecker Date: Fri, 8 May 2026 15:16:47 +0200 Subject: sched/cputime: Handle dyntick-idle steal time correctly The dyntick-idle steal time is currently accounted when the tick restarts but the stolen idle time is not subtracted from the idle time that was already accounted. This is to avoid observing the idle time going backward as the dyntick-idle cputime accessors can't reliably know in advance the stolen idle time. In order to maintain a forward progressing idle cputime while subtracting idle steal time from it, keep track of the previously accounted idle stolen time and substract it from _later_ idle cputime accounting. Signed-off-by: Frederic Weisbecker Signed-off-by: Thomas Gleixner Tested-by: Shrikanth Hegde Link: https://patch.msgid.link/20260508131647.43868-16-frederic@kernel.org --- include/linux/kernel_stat.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h index 512104b0ff49..fce1392e2140 100644 --- a/include/linux/kernel_stat.h +++ b/include/linux/kernel_stat.h @@ -39,6 +39,7 @@ struct kernel_cpustat { bool idle_elapse; seqcount_t idle_sleeptime_seq; u64 idle_entrytime; + u64 idle_stealtime[2]; #endif u64 cpustat[NR_STATS]; }; -- cgit v1.2.3 From bf8f968a63159661acc20254ccdf0dc3c9f1bac2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Tue, 19 May 2026 08:26:16 +0200 Subject: vdso/vsyscall: Gate update_vsyscall() behind CONFIG_GENERIC_GETTIMEOFDAY MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both the compilation of kernel/time/vsyscall.c, which contains the real definition of update_vsyscall() and the other vDSO definitions in timekeeper_internal.h use CONFIG_GENERIC_GETTIMEOFDAY and not CONFIG_GENERIC_TIME_VSYSCALL. Align the code to use a single Kconfig symbol. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260519-vdso-generic_time_vsyscal-v1-2-5c2a5905d5f5@linutronix.de --- include/linux/timekeeper_internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h index e36d11e33e0c..4486dfd5d0de 100644 --- a/include/linux/timekeeper_internal.h +++ b/include/linux/timekeeper_internal.h @@ -190,7 +190,7 @@ struct timekeeper { s32 tai_offset; }; -#ifdef CONFIG_GENERIC_TIME_VSYSCALL +#ifdef CONFIG_GENERIC_GETTIMEOFDAY extern void update_vsyscall(struct timekeeper *tk); extern void update_vsyscall_tz(void); -- cgit v1.2.3 From 9012c4e647df9a3c5450dcccd766877a3efebc46 Mon Sep 17 00:00:00 2001 From: Jiayuan Chen Date: Fri, 8 May 2026 18:18:15 -0700 Subject: mm/damon: replace damon_rand() with a per-ctx lockless PRNG damon_rand() on the sampling_addr hot path called get_random_u32_below(), which takes a local_lock_irqsave() around a per-CPU batched entropy pool and periodically refills it with ChaCha20. At elevated nr_regions counts (20k+), the lock_acquire / local_lock pair plus __get_random_u32_below() dominate kdamond perf profiles. Replace the helper with a lockless lfsr113 generator (struct rnd_state) held per damon_ctx and seeded from get_random_u64() in damon_new_ctx(). kdamond is the single consumer of a given ctx, so no synchronization is required. Range mapping uses traditional reciprocal multiplication, similar as get_random_u32_below(); for spans larger than U32_MAX (only reachable on 64-bit) the slow path combines two u32 outputs and uses mul_u64_u64_shr() at 64-bit width. On 32-bit the slow path is dead code and gets eliminated by the compiler. The new helper takes a ctx parameter; damon_split_regions_of() and the kunit tests that call it directly are updated accordingly. lfsr113 is a linear PRNG and MUST NOT be used for anything security-sensitive. DAMON's sampling_addr is not exposed to userspace and is only consumed as a probe point for PTE accessed-bit sampling, so a non-cryptographic PRNG is appropriate here. Tested with paddr monitoring and max_nr_regions=20000: kdamond CPU usage reduced from ~72% to ~50% of one core. Link: https://lore.kernel.org/20260505145212.108644-1-jiayuan.chen@linux.dev Link: https://lore.kernel.org/damon/20260426173346.86238-1-sj@kernel.org/T/#m4f1fd74112728f83a41511e394e8c3fef703039c Link: https://lore.kernel.org/20260509011816.85145-1-sj@kernel.org Signed-off-by: Jiayuan Chen Signed-off-by: SeongJae Park Reviewed-by: SeongJae Park Cc: Shu Anzai Cc: Quanmin Yan Signed-off-by: Andrew Morton --- include/linux/damon.h | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index c7a31572689b..4d4f031bcb45 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -8,23 +8,18 @@ #ifndef _DAMON_H_ #define _DAMON_H_ +#include #include #include +#include #include #include -#include /* Minimal region size. Every damon_region is aligned by this. */ #define DAMON_MIN_REGION_SZ PAGE_SIZE /* Max priority score for DAMON-based operation schemes */ #define DAMOS_MAX_SCORE (99) -/* Get a random number in [l, r) */ -static inline unsigned long damon_rand(unsigned long l, unsigned long r) -{ - return l + get_random_u32_below(r - l); -} - /** * struct damon_addr_range - Represents an address region of [@start, @end). * @start: Start address of the region (inclusive). @@ -859,8 +854,27 @@ struct damon_ctx { struct list_head adaptive_targets; struct list_head schemes; + + /* Per-ctx PRNG state for damon_rand(); kdamond is the sole consumer. */ + struct rnd_state rnd_state; }; +/* Get a random number in [@l, @r) using @ctx's lockless PRNG. */ +static inline unsigned long damon_rand(struct damon_ctx *ctx, + unsigned long l, unsigned long r) +{ + unsigned long span = r - l; + u64 rnd; + + if (span <= U32_MAX) { + rnd = prandom_u32_state(&ctx->rnd_state); + return l + (unsigned long)((rnd * span) >> 32); + } + rnd = ((u64)prandom_u32_state(&ctx->rnd_state) << 32) | + prandom_u32_state(&ctx->rnd_state); + return l + mul_u64_u64_shr(rnd, span, 64); +} + static inline struct damon_region *damon_next_region(struct damon_region *r) { return container_of(r->list.next, struct damon_region, list); -- cgit v1.2.3 From cf49b4ebd2ae13554c780eb482e7900447f29ce9 Mon Sep 17 00:00:00 2001 From: "David Hildenbrand (Arm)" Date: Mon, 11 May 2026 16:05:32 +0200 Subject: mm/bootmem_info: remove call to kmemleak_free_part_phys() The call to kmemleak_free_part_phys() was added in 2022 in commit dd0ff4d12dd2 ("bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem"). In 2025, commit b2aad24b5333 ("mm/memmap: prevent double scanning of memmap by kmemleak") started to use MEMBLOCK_ALLOC_NOLEAKTRACE when allocating the memmap to skip the kmemleak_alloc_phys() in the buddy. So remove the call to kmemleak_free_part_phys(). If this would still be required for other purposes, either free_reserved_page() should take care of it, or selected users. Link: https://lore.kernel.org/20260511-bootmem_info_prep-v1-4-3fb0be6fc688@kernel.org Signed-off-by: David Hildenbrand (Arm) Reviewed-by: Oscar Salvador Reviewed-by: Mike Rapoport (Microsoft) Tested-by: Lance Yang Cc: Alexander Gordeev Cc: Andreas Larsson Cc: Christian Borntraeger Cc: David S. Miller Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Nicholas Piggin Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Ritesh Harjani (IBM) Signed-off-by: Andrew Morton --- include/linux/bootmem_info.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/bootmem_info.h b/include/linux/bootmem_info.h index 492ceeb1cdf8..f724340755e5 100644 --- a/include/linux/bootmem_info.h +++ b/include/linux/bootmem_info.h @@ -82,7 +82,6 @@ static inline void get_page_bootmem(unsigned long info, struct page *page, static inline void free_bootmem_page(struct page *page) { - kmemleak_free_part_phys(PFN_PHYS(page_to_pfn(page)), PAGE_SIZE); free_reserved_page(page); } #endif -- cgit v1.2.3 From 9b1b295e9fd354b2263aee80a1ef3605d1eee32e Mon Sep 17 00:00:00 2001 From: Muchun Song Date: Tue, 12 May 2026 15:26:35 +0800 Subject: drivers/base/memory: make memory block get/put explicit Rename the memory block lookup helper to make the acquired reference explicit, add memory_block_put() to wrap put_device(), remove find_memory_block(), and use memory_block_get() as the single block-id based lookup interface. This makes it clearer to callers that a successful lookup holds a reference that must be dropped, reducing the chance of forgetting the matching put and leaking the memory block device reference. Link: https://lore.kernel.org/linux-mm/7887915D-E598-42B3-9AFE-BFFBACE8DE2D@linux.dev/#t Link: https://lore.kernel.org/20260512072635.3969576-1-songmuchun@bytedance.com Signed-off-by: Muchun Song Acked-by: Oscar Salvador Acked-by: David Hildenbrand (Arm) Acked-by: Michal Hocko Tested-by: Donet Tom Reviewed-by: Lorenzo Stoakes Tested-by: Sumanth Korikkar #s390 Cc: Richard Cheng Acked-by: Mike Rapoport (Microsoft) Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Danilo Krummrich Cc: Doug Anderson Cc: Greg Kroah-Hartman Cc: Heiko Carstens Cc: Kees Cook Cc: Liam R. Howlett Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: "Rafael J. Wysocki" Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/memory.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/memory.h b/include/linux/memory.h index 5bb5599c6b2b..463dc02f6cff 100644 --- a/include/linux/memory.h +++ b/include/linux/memory.h @@ -158,7 +158,11 @@ int create_memory_block_devices(unsigned long start, unsigned long size, void remove_memory_block_devices(unsigned long start, unsigned long size); extern void memory_dev_init(void); extern int memory_notify(enum memory_block_state state, void *v); -extern struct memory_block *find_memory_block(unsigned long section_nr); +struct memory_block *memory_block_get(unsigned long block_id); +static inline void memory_block_put(struct memory_block *mem) +{ + put_device(&mem->dev); +} typedef int (*walk_memory_blocks_func_t)(struct memory_block *, void *); extern int walk_memory_blocks(unsigned long start, unsigned long size, void *arg, walk_memory_blocks_func_t func); @@ -171,7 +175,6 @@ struct memory_group *memory_group_find_by_id(int mgid); typedef int (*walk_memory_groups_func_t)(struct memory_group *, void *); int walk_dynamic_memory_groups(int nid, walk_memory_groups_func_t func, struct memory_group *excluded, void *arg); -struct memory_block *find_memory_block_by_id(unsigned long block_id); #define hotplug_memory_notifier(fn, pri) ({ \ static __meminitdata struct notifier_block fn##_mem_nb =\ { .notifier_call = fn, .priority = pri };\ -- cgit v1.2.3 From 80eacd489a50ab2a560bc233b26b94ad9df68410 Mon Sep 17 00:00:00 2001 From: Takahiro Itazuri Date: Wed, 13 May 2026 09:35:46 -0700 Subject: mm/mmu_notifier: fix a begin vs. start typo in the invalidate range comment Fix a goof in the block comment for invalidate_range_{start,end}() where start() is incorrectly referred to as begin(). No functional change intended. [seanjc@google.com: split to separate patch, write changelog] Link: https://lore.kernel.org/20260513163546.1176742-1-seanjc@google.com Signed-off-by: Takahiro Itazuri Signed-off-by: Sean Christopherson Reviewed-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes Reviewed-by: Mike Rapoport (Microsoft) Cc: Liam R. Howlett Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/mmu_notifier.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h index 69c304b467df..a11a44eef521 100644 --- a/include/linux/mmu_notifier.h +++ b/include/linux/mmu_notifier.h @@ -134,8 +134,8 @@ struct mmu_notifier_ops { * Invalidation of multiple concurrent ranges may be * optionally permitted by the driver. Either way the * establishment of sptes is forbidden in the range passed to - * invalidate_range_begin/end for the whole duration of the - * invalidate_range_begin/end critical section. + * invalidate_range_start/end for the whole duration of the + * invalidate_range_start/end critical section. * * invalidate_range_start() is called when all pages in the * range are still mapped and have at least a refcount of one. -- cgit v1.2.3 From 9c860d1d5d69f9cb19eb7c36573ee14065a9c85a Mon Sep 17 00:00:00 2001 From: Brendan Jackman Date: Wed, 13 May 2026 12:35:13 +0000 Subject: mm: introduce for_each_free_list() Patch series "mm: misc cleanups from __GFP_UNMAPPED series". In v2 of the __GFP_UNMAPPED series [0], we realised that some of the patches could potentially be merged as independent cleanups. These are all independent of one another, if you think some are useful cleanups and others are pointless churn, it should be fine to just pick whatever subset you prefer. No functional change intended. This patch (of 4): There are a couple of places that iterate over the freelists with awareness of the data structures' layout. It seems ideally, code outside of mm should not be aware of the page allocator's freelists at all. But, this patch just doesn't hide them completely, it's just a meek incremental step in that direction: provide a macro to iterate over it without needing to be aware of the actual struct fields. Link: https://lore.kernel.org/20260513-page_alloc-unmapped-prep-v1-0-dacdf5402be8@google.com Link: https://lore.kernel.org/20260513-page_alloc-unmapped-prep-v1-1-dacdf5402be8@google.com Link: https://lore.kernel.org/all/20260320-page_alloc-unmapped-v2-0-28bf1bd54f41@google.com/ [0] Signed-off-by: Brendan Jackman Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Vlastimil Babka (SUSE) Cc: Axel Rasmussen Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Len Brown Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: "Rafael J. Wysocki" Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/mmzone.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h index 9adb2ad21da5..1331a7b93f33 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h @@ -177,9 +177,12 @@ static inline bool migratetype_is_mergeable(int mt) return mt < MIGRATE_PCPTYPES; } -#define for_each_migratetype_order(order, type) \ - for (order = 0; order < NR_PAGE_ORDERS; order++) \ - for (type = 0; type < MIGRATE_TYPES; type++) +#define for_each_free_list(list, zone, order) \ + for (order = 0; order < NR_PAGE_ORDERS; order++) \ + for (unsigned int __type = 0; \ + __type < MIGRATE_TYPES && \ + (list = &(zone)->free_area[order].free_list[__type], 1); \ + __type++) extern int page_group_by_mobility_disabled; -- cgit v1.2.3 From 3687c0fd67249cb971990b382a47f02f19ed9f67 Mon Sep 17 00:00:00 2001 From: Brendan Jackman Date: Wed, 13 May 2026 12:35:15 +0000 Subject: mm: rejig pageblock mask definitions - Add a PAGEBLOCK_ prefix to the names to avoid polluting the "global namespace" too much. - This new prefix makes MIGRATETYPE_AND_ISO_MASK look pretty long. Well, that global mask only exists for quite a specific purpose, and is quite a weird thing to have a name for anyway. So drop it and take advantage of the newly-defined PAGEBLOCK_ISO_MASK. Link: https://lore.kernel.org/20260513-page_alloc-unmapped-prep-v1-3-dacdf5402be8@google.com Signed-off-by: Brendan Jackman Reviewed-by: Vlastimil Babka (SUSE) Cc: Axel Rasmussen Cc: Barry Song Cc: David Hildenbrand Cc: Johannes Weiner Cc: Kairui Song Cc: Len Brown Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport (Microsoft) Cc: "Rafael J. Wysocki" Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Wei Xu Cc: Yuanchu Xie Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/pageblock-flags.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/pageblock-flags.h b/include/linux/pageblock-flags.h index e046278a01fa..9a6c3ea17684 100644 --- a/include/linux/pageblock-flags.h +++ b/include/linux/pageblock-flags.h @@ -36,12 +36,12 @@ enum pageblock_bits { #define NR_PAGEBLOCK_BITS (roundup_pow_of_two(__NR_PAGEBLOCK_BITS)) -#define MIGRATETYPE_MASK (BIT(PB_migrate_0)|BIT(PB_migrate_1)|BIT(PB_migrate_2)) +#define PAGEBLOCK_MIGRATETYPE_MASK (BIT(PB_migrate_0)|BIT(PB_migrate_1)|BIT(PB_migrate_2)) #ifdef CONFIG_MEMORY_ISOLATION -#define MIGRATETYPE_AND_ISO_MASK (MIGRATETYPE_MASK | BIT(PB_migrate_isolate)) +#define PAGEBLOCK_ISO_MASK BIT(PB_migrate_isolate) #else -#define MIGRATETYPE_AND_ISO_MASK MIGRATETYPE_MASK +#define PAGEBLOCK_ISO_MASK 0 #endif #if defined(CONFIG_HUGETLB_PAGE) -- cgit v1.2.3 From 1dfbe92e702675964da45847ffe022a41bf4045e Mon Sep 17 00:00:00 2001 From: Kairui Song Date: Sun, 17 May 2026 23:39:42 +0800 Subject: mm/huge_memory: move THP gfp limit helper into header Shmem has some special requirements for THP GFP and has to limit it in certain zones or provide a more lenient fallback. We'll use this helper for generic swap THP allocation, which needs to support shmem. For a typical GFP_HIGHUSER_MOVABLE swap-in, this helper is basically a no-op. But it's necessary for certain shmem users, mostly drivers. No feature change. Link: https://lore.kernel.org/20260517-swap-table-p4-v5-3-88ae43e064c7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Reviewed-by: Zi Yan Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Shakeel Butt Cc: Youngjun Park Signed-off-by: Andrew Morton --- include/linux/huge_mm.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'include') diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 2949e5acff35..58382e97a66d 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -237,6 +237,31 @@ static inline bool thp_vma_suitable_order(struct vm_area_struct *vma, return true; } +/* + * Make sure huge_gfp is always more limited than limit_gfp. + * Some shmem users want THP allocation to be done less aggressively + * and only in certain zone. + */ +static inline gfp_t thp_shmem_limit_gfp_mask(gfp_t huge_gfp, gfp_t limit_gfp) +{ + gfp_t allowflags = __GFP_IO | __GFP_FS | __GFP_RECLAIM; + gfp_t denyflags = __GFP_NOWARN | __GFP_NORETRY; + gfp_t zoneflags = limit_gfp & GFP_ZONEMASK; + gfp_t result = huge_gfp & ~(allowflags | GFP_ZONEMASK); + + /* Allow allocations only from the originally specified zones. */ + result |= zoneflags; + + /* + * Minimize the result gfp by taking the union with the deny flags, + * and the intersection of the allow flags. + */ + result |= (limit_gfp & denyflags); + result |= (huge_gfp & limit_gfp) & allowflags; + + return result; +} + /* * Filter the bitfield of input orders to the ones suitable for use in the vma. * See thp_vma_suitable_order(). @@ -581,6 +606,11 @@ static inline bool thp_vma_suitable_order(struct vm_area_struct *vma, return false; } +static inline gfp_t thp_shmem_limit_gfp_mask(gfp_t huge_gfp, gfp_t limit_gfp) +{ + return huge_gfp; +} + static inline unsigned long thp_vma_suitable_orders(struct vm_area_struct *vma, unsigned long addr, unsigned long orders) { -- cgit v1.2.3 From 945578fee2ec17bebdec067371214d3cbed48822 Mon Sep 17 00:00:00 2001 From: Kairui Song Date: Sun, 17 May 2026 23:39:45 +0800 Subject: mm/memcg, swap: tidy up cgroup v1 memsw swap helpers The cgroup v1 swap helpers always operate on swap cache folios whose swap entry is stable: the folio is locked and in the swap cache. There is no need to pass the swap entry or page count as separate parameters when they can be derived from the folio itself. Simplify the redundant parameters and add sanity checks to document the required preconditions. Also rename memcg1_swapout to __memcg1_swapout to indicate it requires special calling context: the folio must be isolated and dying, and the call must be made with interrupts disabled. No functional change. Link: https://lore.kernel.org/20260517-swap-table-p4-v5-6-88ae43e064c7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Shakeel Butt Cc: Youngjun Park Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/memcontrol.h | 8 ++++---- include/linux/swap.h | 10 ++++------ 2 files changed, 8 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index dc3fa687759b..7d08128de1fd 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -1899,8 +1899,8 @@ static inline void mem_cgroup_exit_user_fault(void) current->in_user_fault = 0; } -void memcg1_swapout(struct folio *folio, swp_entry_t entry); -void memcg1_swapin(swp_entry_t entry, unsigned int nr_pages); +void __memcg1_swapout(struct folio *folio); +void memcg1_swapin(struct folio *folio); #else /* CONFIG_MEMCG_V1 */ static inline @@ -1929,11 +1929,11 @@ static inline void mem_cgroup_exit_user_fault(void) { } -static inline void memcg1_swapout(struct folio *folio, swp_entry_t entry) +static inline void __memcg1_swapout(struct folio *folio) { } -static inline void memcg1_swapin(swp_entry_t entry, unsigned int nr_pages) +static inline void memcg1_swapin(struct folio *folio) { } diff --git a/include/linux/swap.h b/include/linux/swap.h index 7a09df6977a5..f907d3df52d0 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -571,13 +571,12 @@ static inline void folio_throttle_swaprate(struct folio *folio, gfp_t gfp) #endif #if defined(CONFIG_MEMCG) && defined(CONFIG_SWAP) -int __mem_cgroup_try_charge_swap(struct folio *folio, swp_entry_t entry); -static inline int mem_cgroup_try_charge_swap(struct folio *folio, - swp_entry_t entry) +int __mem_cgroup_try_charge_swap(struct folio *folio); +static inline int mem_cgroup_try_charge_swap(struct folio *folio) { if (mem_cgroup_disabled()) return 0; - return __mem_cgroup_try_charge_swap(folio, entry); + return __mem_cgroup_try_charge_swap(folio); } extern void __mem_cgroup_uncharge_swap(swp_entry_t entry, unsigned int nr_pages); @@ -591,8 +590,7 @@ static inline void mem_cgroup_uncharge_swap(swp_entry_t entry, unsigned int nr_p extern long mem_cgroup_get_nr_swap_pages(struct mem_cgroup *memcg); extern bool mem_cgroup_swap_full(struct folio *folio); #else -static inline int mem_cgroup_try_charge_swap(struct folio *folio, - swp_entry_t entry) +static inline int mem_cgroup_try_charge_swap(struct folio *folio) { return 0; } -- cgit v1.2.3 From bc34e87a51d9e51d398ef6d8c2c35cf1a4ff38b9 Mon Sep 17 00:00:00 2001 From: Kairui Song Date: Sun, 17 May 2026 23:39:47 +0800 Subject: mm, swap: delay and unify memcg lookup and charging for swapin Instead of checking the cgroup private ID during page table walk in swap_pte_batch(), move the memcg lookup into __swap_cache_add_check() under the cluster lock. The first pre-alloc check is speculative and skips the memcg check since the post-alloc stable check ensures all slots covered by the folio belong to the same memcg. It is very rare for contiguous and aligned entries across a contiguous region of a page table of the same process or shmem mapping to belong to different memcgs. This also prepares for recording the memcg info in the cluster's table. Also make the order check and fallback more compact. There should be no user-observable behavior change. Link: https://lore.kernel.org/20260517-swap-table-p4-v5-8-88ae43e064c7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Shakeel Butt Cc: Youngjun Park Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/memcontrol.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 7d08128de1fd..a013f37f24aa 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -646,8 +646,8 @@ static inline int mem_cgroup_charge(struct folio *folio, struct mm_struct *mm, int mem_cgroup_charge_hugetlb(struct folio* folio, gfp_t gfp); -int mem_cgroup_swapin_charge_folio(struct folio *folio, struct mm_struct *mm, - gfp_t gfp, swp_entry_t entry); +int mem_cgroup_swapin_charge_folio(struct folio *folio, unsigned short id, + struct mm_struct *mm, gfp_t gfp); void __mem_cgroup_uncharge(struct folio *folio); @@ -1137,7 +1137,7 @@ static inline int mem_cgroup_charge_hugetlb(struct folio* folio, gfp_t gfp) } static inline int mem_cgroup_swapin_charge_folio(struct folio *folio, - struct mm_struct *mm, gfp_t gfp, swp_entry_t entry) + unsigned short id, struct mm_struct *mm, gfp_t gfp) { return 0; } -- cgit v1.2.3 From b197d41462c2076bc88c79fead7f400e48881c19 Mon Sep 17 00:00:00 2001 From: Kairui Song Date: Sun, 17 May 2026 23:39:49 +0800 Subject: mm/memcg, swap: store cgroup id in cluster table directly Drop the usage of the swap_cgroup_ctrl, and use the dynamic cluster table instead. The per-cluster memcg table is 1024 / 512 bytes on most archs, and does not need RCU protection: the cgroup data is only read and written under the cluster lock. That keeps things simple, lets the allocation use plain kmalloc with immediate kfree (no deferred free), and keeps fragmentation acceptable. [akpm@linux-foundation.org: memcgv1: don't compile swap functions when CONFIG_SWAP=n] Link: https://lore.kernel.org/202605281711.bSeZlErK-lkp@intel.com [akpm@linux-foundation.org: fix CONFIG_SWAP=n build] Link: https://lore.kernel.org/20260517-swap-table-p4-v5-10-88ae43e064c7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Shakeel Butt Cc: Youngjun Park Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/memcontrol.h | 19 +++++++++++++------ include/linux/swap.h | 8 ++++---- 2 files changed, 17 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index a013f37f24aa..8f2662db166b 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -29,6 +29,7 @@ struct obj_cgroup; struct page; struct mm_struct; struct kmem_cache; +struct swap_cluster_info; /* Cgroup-specific page state, on top of universal node page state */ enum memcg_stat_item { @@ -1899,9 +1900,6 @@ static inline void mem_cgroup_exit_user_fault(void) current->in_user_fault = 0; } -void __memcg1_swapout(struct folio *folio); -void memcg1_swapin(struct folio *folio); - #else /* CONFIG_MEMCG_V1 */ static inline unsigned long memcg1_soft_limit_reclaim(pg_data_t *pgdat, int order, @@ -1929,14 +1927,23 @@ static inline void mem_cgroup_exit_user_fault(void) { } -static inline void __memcg1_swapout(struct folio *folio) +#endif /* CONFIG_MEMCG_V1 */ + +#if defined(CONFIG_MEMCG_V1) && defined(CONFIG_SWAP) + +void __memcg1_swapout(struct folio *folio, struct swap_cluster_info *ci); +void memcg1_swapin(struct folio *folio); + +#else + +static inline void __memcg1_swapout(struct folio *folio, + struct swap_cluster_info *ci) { } static inline void memcg1_swapin(struct folio *folio) { } - -#endif /* CONFIG_MEMCG_V1 */ +#endif #endif /* _LINUX_MEMCONTROL_H */ diff --git a/include/linux/swap.h b/include/linux/swap.h index f907d3df52d0..200e7c345f26 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -579,12 +579,12 @@ static inline int mem_cgroup_try_charge_swap(struct folio *folio) return __mem_cgroup_try_charge_swap(folio); } -extern void __mem_cgroup_uncharge_swap(swp_entry_t entry, unsigned int nr_pages); -static inline void mem_cgroup_uncharge_swap(swp_entry_t entry, unsigned int nr_pages) +extern void __mem_cgroup_uncharge_swap(unsigned short id, unsigned int nr_pages); +static inline void mem_cgroup_uncharge_swap(unsigned short id, unsigned int nr_pages) { if (mem_cgroup_disabled()) return; - __mem_cgroup_uncharge_swap(entry, nr_pages); + __mem_cgroup_uncharge_swap(id, nr_pages); } extern long mem_cgroup_get_nr_swap_pages(struct mem_cgroup *memcg); @@ -595,7 +595,7 @@ static inline int mem_cgroup_try_charge_swap(struct folio *folio) return 0; } -static inline void mem_cgroup_uncharge_swap(swp_entry_t entry, +static inline void mem_cgroup_uncharge_swap(unsigned short id, unsigned int nr_pages) { } -- cgit v1.2.3 From 4e8e1c498de9f97628207d1ef84506058b06bb51 Mon Sep 17 00:00:00 2001 From: Kairui Song Date: Sun, 17 May 2026 23:39:50 +0800 Subject: mm/memcg: remove no longer used swap cgroup array Now all swap cgroup records are stored in the swap cluster directly, the static array is no longer needed. Link: https://lore.kernel.org/20260517-swap-table-p4-v5-11-88ae43e064c7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Shakeel Butt Cc: Youngjun Park Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/swap_cgroup.h | 47 --------------------------------------------- 1 file changed, 47 deletions(-) delete mode 100644 include/linux/swap_cgroup.h (limited to 'include') diff --git a/include/linux/swap_cgroup.h b/include/linux/swap_cgroup.h deleted file mode 100644 index 91cdf12190a0..000000000000 --- a/include/linux/swap_cgroup.h +++ /dev/null @@ -1,47 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef __LINUX_SWAP_CGROUP_H -#define __LINUX_SWAP_CGROUP_H - -#include - -#if defined(CONFIG_MEMCG) && defined(CONFIG_SWAP) - -extern void swap_cgroup_record(struct folio *folio, unsigned short id, swp_entry_t ent); -extern unsigned short swap_cgroup_clear(swp_entry_t ent, unsigned int nr_ents); -extern unsigned short lookup_swap_cgroup_id(swp_entry_t ent); -extern int swap_cgroup_swapon(int type, unsigned long max_pages); -extern void swap_cgroup_swapoff(int type); - -#else - -static inline -void swap_cgroup_record(struct folio *folio, unsigned short id, swp_entry_t ent) -{ -} - -static inline -unsigned short swap_cgroup_clear(swp_entry_t ent, unsigned int nr_ents) -{ - return 0; -} - -static inline -unsigned short lookup_swap_cgroup_id(swp_entry_t ent) -{ - return 0; -} - -static inline int -swap_cgroup_swapon(int type, unsigned long max_pages) -{ - return 0; -} - -static inline void swap_cgroup_swapoff(int type) -{ - return; -} - -#endif - -#endif /* __LINUX_SWAP_CGROUP_H */ -- cgit v1.2.3 From d9ceded101a142cd56f1e88fc7e893560ee59f4d Mon Sep 17 00:00:00 2001 From: Kairui Song Date: Sun, 17 May 2026 23:39:51 +0800 Subject: mm, swap: merge zeromap into swap table By allocating one additional bit in the swap table entry's flags field alongside the count, we can store the zeromap inline For 64 bit systems, zeromap will store in the swap table, avoiding zeromap allocation. It reduces the allocated memory. That is the happy path. For certain 32-bit archs, there might not be enough bits in the swap table to contain both PFN and flags. Therefore, conditionally let each cluster have a zeromap field at build time, and use that instead. If the swapfile cluster is not fully used, it will still save memory for zeromap. The empty cluster does not allocate a zeromap. In the worst case, all cluster are fully populated. We will use memory similar to the previous zeromap implementation. A few macros were moved to different headers for build time struct definition. [akpm@linux-foundation.org: swap_cluster_alloc_table(): remove unused local `ret] [akpm@linux-foundation.org: fix unused label `err_free'] Link: https://lore.kernel.org/20260517-swap-table-p4-v5-12-88ae43e064c7@tencent.com Signed-off-by: Kairui Song Acked-by: Chris Li Reviewed-by: Youngjun Park Cc: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chengming Zhou Cc: David Hildenbrand Cc: Hugh Dickins Cc: Johannes Weiner Cc: Kemeng Shi Cc: Lorenzo Stoakes Cc: Muchun Song Cc: Nhat Pham Cc: Roman Gushchin Cc: Shakeel Butt Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/swap.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/swap.h b/include/linux/swap.h index 200e7c345f26..8c43bc3055c9 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -252,7 +252,6 @@ struct swap_info_struct { struct plist_node list; /* entry in swap_active_head */ signed char type; /* strange name for an index */ unsigned int max; /* size of this swap device */ - unsigned long *zeromap; /* kvmalloc'ed bitmap to track zero pages */ struct swap_cluster_info *cluster_info; /* cluster info. Only for SSD */ struct list_head free_clusters; /* free clusters list */ struct list_head full_clusters; /* full clusters list */ -- cgit v1.2.3 From 45c49d9fd6089e344663176b8488c97d905ca3ac Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 18 May 2026 16:40:49 -0700 Subject: mm/damon/core: introduce struct damon_probe Patch series "mm/damon: introduce data attributes monitoring". TL; DR ====== Extend DAMON for monitoring general data attributes other than accesses. The short term motivation is lightweight page type (e.g., belonging cgroup) aware monitoring. In long term, this will help extending DAMON for multiple access events capture primitives (e.g., page faults and PMU) and eventually pivotting DAMON to a "Data Attributes Monitoring and Operations eNgine" in long term. Background: High Cost of Page Level Properties Monitoring ========================================================= DAMON is initially introduced as a Data Access MONitor. It has been extended for not only access monitoring but also data access-aware system operations (DAMOS). But still the monitoring part is only for data accesses. Data access patterns is good information, but some users need more holistic views. Particularly, users want to show the access pattern information together with the types of the memory. For example, users who work for making huge pages efficiently want to know how much of DAMON-found hot/cold regions are backed by huge pages. Users who run multiple workloads with different cgroups want to know how much of DAMON-found hot/cold regions belong to specific cgroups. For the user demand, we developed a DAMOS extension for page level properties based monitoring [1], which has landed on 6.14. Using the feature, users can inform the page level data properties that they are interested in, in a flexible format that uses DAMOS filters. Then, DAMON applies the filters to each folio of the entire DAMON region and lets users know how many bytes of memory in each DAMON region passed the given filters. This gives page level detailed and deterministic information to users. But, because the operation is done at page level, the overhead is proportional to the memory size. It was useful for test or debugging purposes on a small number of machines. But it was obviously too heavy to be enabled always on all machines running the real user workloads. For real world workloads, it was recommended to use the feature with user-space controlled sampling approaches. For example, users could do the page level monitoring only once per hour, on randomly selected one percent of machines of their fleet. If the runtime and the size of the fleet is long and big enough, it should provide statistically meaningful data. But users are too busy to implement such controls on their own. Data Attributes Monitoring ========================== Extend DAMON to monitor not only data accesses, but also general data attributes. Do the extension while keeping the main promise of DAMON, the bounded and best-effort minimum overhead. Allow users to specify what data attributes in addition to the data access they want to monitor. Users can install one 'data probe' per data attribute of their interest for this purpose. The 'data probe' should be able to be applied to any memory, and determine if the given memory has the appropriate data attribute. E.g., if memory of physical address 42 belongs to cgroup A. Each 'data probe' is configured with filters that are very similar to the DAMOS filters. When DAMON checks if each sampling address memory of each region is accessed since the last check, it applies data probes if registered. Same to the number of access check-positive samples accounting (nr_accesses), it accounts the number of each data probe-positive samples in another per-region counters array, namely 'probe_hits'. When DAMON resets nr_accesses every aggregation interval, it resets 'probe_hits' together. Users can read 'probe_hits' just before the values are reset. In this way, users can know how many hot/cold memory regions have data attributes of their interest. E.g., 30 percent of this system's hot memory is belonging to cgroup A, and 80 percent of the cgroup A-belonging hot memory is backed by huge pages. Patches Sequence ================ First eight patches implement the core feature, interface and the working support. Patch 1 introduces data probe data structure, namely damon_probe. Patch 2 extends damon_ctx for installing data probes. Patch 3 introduces another data structure for filters of each data probe, namely damon_filter. Patch 4 updates damon_ctx commit function to handle the probes. Patch 5 extends damon_region for the per-region per-probe positive samples counter, namely probe_hits. Patch 6 extends damon_operations for applying probes on the underlying DAMON operations implementation. Patch 7 updates kdamond_fn() to invoke the probes applying callback. Patch 8 finally implements the probes support on paddr ops. Ten changes for user interface (patches 9-18) come next. Patches 9-13 implements sysfs directories and files for setting data probes, namely probes directory, probe directory, filters directory, filter directory and filter directory internal files, respectively. Patch 14 connects the user inputs that are made via the sysfs files to DAMON core. Following three patches (patches 15-17) implement sysfs directories and files for showing the probe_hits to users, namely probes directory, probe directory and hits files, respectively. Patch 18 introduces a new tracepoint for showing the probe_hits via tracefs. Patch 19 adds a selftest for the sysfs files. Patches 20 and 21 documents the design and usage of the new feature, respectively. Seven additional patches (patches 22-28) for monitoring belonging memory cgroup follow. Depending on the feedback, this part might be separated to another series in future. Patch 22 defines the DAMON filter type for the new attribute, namely DAMON_FILTER_TYPE_MEMCG. Patch 23 add the support on paddr ops. Patch 24 updates the sysfs interface for setup of the target memcg. Patch 25 move code for easy reuse of the filter target memcg setup. Patch 26 connects the user input to the core layer. Finally, patches 27 and 28 update the design and usage documents for the memcg attribute monitoring support. Discussion ========== This allows the page properties monitoring with overhead that is low enough to be enabled always on real world workloads. Because the sampling time for access check is reused for data attributes check, the upper-bounded and best-effort minimum overhead of DAMON is kept. Because the sampling memory for access check is reused for data attributes check, additional overhead is minimum. Still DAMOS-based page level properties monitoring should be useful, because it provides a deterministic page level information. When in doubt of the sampling based information, running DAMOS-based one together and comparing the results would be useful, for debugging and tuning. Future Works: Mid Term ======================== This version of implementation is limiting the maximum number of data probes to four. I will try to find a way to remove the limit in future. I personally think it should be enough for common use cases, though, and therefore not giving high priority at the moment. Future Works: Long Term ======================= There are user requests for extending DAMON with detailed access information, for example, per-CPUs/threads/read/writes monitoring. For that, I was working [2] on extending DAMON to use page fault events as another access check primitives, and making the infrastructure flexible for future use of yet another access check primitive. Actually there is another ongoing work [3] for extending DAMON with PMU events. The motivation of the work is reducing the overhead, though. In my work [2], I was introducing a new interface for access sampling primitives control. Now I think this data probe interface can be used for that, too. That is, data access becomes just one type of data attribute. Also, pg_idle-confirmed access, page fault-confirmed access, and PMU event-confirmed access will be different types of data attributes. The regions adjustment mechanism is currently working based on the access information. That's because DAMON is designed for data access monitoring. That is, data access information is the primary interest, and therefore DAMON adjusts regions in a way that can best-present the information. Once data access becomes just one of data attributes, there is no reason to think data access that special. There might be some users not interested in access at all but want to know the location of memory of specific type. Data probes interface will allow doing that. Further, we could extend the interface to let users set any data attribute as the 'primary' attribute. Then, DAMON will split and merge regions in a way that can best-present the 'primary' attributes. DAMOS will also be extended, to specify targets based on not only the data access pattern, but all user-registered data attributes. From this stage, we may be able to call DAMON as a "Data Attributes Monitoring and Operations eNgine". This patch (of 28): Introduce a data structure for data attribute probe. It is just a linked list header at this step. It will be extended in a way that it can determine if a given memory has a specific data attribute. Link: https://lore.kernel.org/20260518234119.97569-1-sj@kernel.org Link: https://lore.kernel.org/20260518234119.97569-2-sj@kernel.org Link: https://lore.kernel.org/20250106193401.109161-1-sj@kernel.org [1] Link: https://lore.kernel.org/20251208062943.68824-1-sj@kernel.org/ [2] Link: https://lore.kernel.org/20260423004211.7037-1-akinobu.mita@gmail.com [3] Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 4d4f031bcb45..4794931fa2ea 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -730,6 +730,15 @@ struct damon_intervals_goal { unsigned long max_sample_us; }; +/** + * struct damon_probe - Data region attribute probe. + * + * @list: Siblings list. + */ +struct damon_probe { + struct list_head list; +}; + /** * struct damon_attrs - Monitoring attributes for accuracy/overhead control. * -- cgit v1.2.3 From 18c777859f28d5e9b65d94c4fdc64f240250df3a Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 18 May 2026 16:40:50 -0700 Subject: mm/damon/core: embed damon_probe objects in damon_ctx Let damon_probe objects be able to be installed on a given damon_ctx, by adding a linked list header for storing the objects. Add initialization and cleanup of the new field with helper functions, too. Link: https://lore.kernel.org/20260518234119.97569-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 4794931fa2ea..43d71eb24ccb 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -857,6 +857,7 @@ struct damon_ctx { /* public: */ struct damon_operations ops; + struct list_head probes; unsigned long addr_unit; unsigned long min_region_sz; bool pause; @@ -909,6 +910,11 @@ static inline unsigned long damon_sz_region(struct damon_region *r) return r->ar.end - r->ar.start; } +#define damon_for_each_probe(p, ctx) \ + list_for_each_entry(p, &(ctx)->probes, list) + +#define damon_for_each_probe_safe(p, next, ctx) \ + list_for_each_entry_safe(p, next, &(ctx)->probes, list) #define damon_for_each_region(r, t) \ list_for_each_entry(r, &t->regions_list, list) @@ -951,6 +957,9 @@ static inline unsigned long damon_sz_region(struct damon_region *r) #ifdef CONFIG_DAMON +struct damon_probe *damon_new_probe(void); +void damon_add_probe(struct damon_ctx *ctx, struct damon_probe *probe); + struct damon_region *damon_new_region(unsigned long start, unsigned long end); /* -- cgit v1.2.3 From f557693dd8ac9cd87d2a1ae1025ee9f568e916e6 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 18 May 2026 16:40:51 -0700 Subject: mm/damon/core: introduce damon_filter Define a data structure for constructing damon_probe's attributes check, namely damon_filter. It is very similar to damos_filter but works only for monitoring purposes. Also embed that into damon_probe, implement essential handling of the link, with fundamental helpers. Link: https://lore.kernel.org/20260518234119.97569-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 43d71eb24ccb..f8b679dd944d 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -730,12 +730,38 @@ struct damon_intervals_goal { unsigned long max_sample_us; }; +/** + * enum damon_filter_type - Type of &struct damon_filter + * + * @DAMON_FILTER_TYPE_ANON: Anonymous pages. + */ +enum damon_filter_type { + DAMON_FILTER_TYPE_ANON, +}; + +/** + * struct damon_filter - DAMON region filter for &struct damon_probe. + * + * @type: Type of the region. + * @matching: Whether this filter is for the type-matching ones. + * @allow: Whether the @type-@matching ones should pass this filter. + * @list: Siblings list. + */ +struct damon_filter { + enum damon_filter_type type; + bool matching; + bool allow; + struct list_head list; +}; + /** * struct damon_probe - Data region attribute probe. * + * @filters: Filters for assessing if a given region is for this probe. * @list: Siblings list. */ struct damon_probe { + struct list_head filters; struct list_head list; }; @@ -910,6 +936,12 @@ static inline unsigned long damon_sz_region(struct damon_region *r) return r->ar.end - r->ar.start; } +#define damon_for_each_filter(f, p) \ + list_for_each_entry(f, &(p)->filters, list) + +#define damon_for_each_filter_safe(f, next, p) \ + list_for_each_entry_safe(f, next, &(p)->filters, list) + #define damon_for_each_probe(p, ctx) \ list_for_each_entry(p, &(ctx)->probes, list) @@ -957,6 +989,10 @@ static inline unsigned long damon_sz_region(struct damon_region *r) #ifdef CONFIG_DAMON +struct damon_filter *damon_new_filter(enum damon_filter_type type, + bool matching, bool allow); +void damon_add_filter(struct damon_probe *probe, struct damon_filter *f); + struct damon_probe *damon_new_probe(void); void damon_add_probe(struct damon_ctx *ctx, struct damon_probe *probe); -- cgit v1.2.3 From 57c6332f2548d94f137f51bd18111e4316fd1ba4 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 18 May 2026 16:40:53 -0700 Subject: mm/damon/core: introduce damon_region->probe_hits Add an array for the per-region per-probe positive samples count. For simple and efficient implementation, add a limit to the number of data probes and set the array to support only the limited number of counters. Link: https://lore.kernel.org/20260518234119.97569-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index f8b679dd944d..3a30af119ac6 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -17,6 +17,8 @@ /* Minimal region size. Every damon_region is aligned by this. */ #define DAMON_MIN_REGION_SZ PAGE_SIZE +/* Maximum number of monitoring probes. */ +#define DAMON_MAX_PROBES (4) /* Max priority score for DAMON-based operation schemes */ #define DAMOS_MAX_SCORE (99) @@ -47,6 +49,7 @@ struct damon_size_range { * @nr_accesses: Access frequency of this region. * @nr_accesses_bp: @nr_accesses in basis point (0.01%) that updated for * each sampling interval. + * @probe_hits: Number of probe-positive region samples. * @list: List head for siblings. * @age: Age of this region. * @@ -75,6 +78,7 @@ struct damon_region { unsigned long sampling_addr; unsigned int nr_accesses; unsigned int nr_accesses_bp; + unsigned char probe_hits[DAMON_MAX_PROBES]; struct list_head list; unsigned int age; -- cgit v1.2.3 From 1a9e847589180359be4198c7d2a3d2ea15b2ddd0 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 18 May 2026 16:40:54 -0700 Subject: mm/damon/core: introduce damon_ops->apply_probes Extend damon_operations struct with a new callback, namely apply_probes. The callback will be invoked for data attributes monitoring. More specifically, the callback will apply damon_probe objects to each region and update the per-region per-probe counters for the number of encountered probe-positive samples. Link: https://lore.kernel.org/20260518234119.97569-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 3a30af119ac6..1fb271a35e98 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -630,6 +630,7 @@ enum damon_ops_id { * @update: Update operations-related data structures. * @prepare_access_checks: Prepare next access check of target regions. * @check_accesses: Check the accesses to target regions. + * @apply_probes: Apply probes for each region. * @get_scheme_score: Get the score of a region for a scheme. * @apply_scheme: Apply a DAMON-based operation scheme. * @target_valid: Determine if the target is valid. @@ -656,6 +657,8 @@ enum damon_ops_id { * last preparation and update the number of observed accesses of each region. * It should also return max number of observed accesses that made as a result * of its update. The value will be used for regions adjustment threshold. + * @apply_probes should apply the data attribute probes to each region and + * accordingly update the probe hits counter of the region. * @get_scheme_score should return the priority score of a region for a scheme * as an integer in [0, &DAMOS_MAX_SCORE]. * @apply_scheme is called from @kdamond when a region for user provided @@ -673,6 +676,7 @@ struct damon_operations { void (*update)(struct damon_ctx *context); void (*prepare_access_checks)(struct damon_ctx *context); unsigned int (*check_accesses)(struct damon_ctx *context); + void (*apply_probes)(struct damon_ctx *context); int (*get_scheme_score)(struct damon_ctx *context, struct damon_region *r, struct damos *scheme); unsigned long (*apply_scheme)(struct damon_ctx *context, -- cgit v1.2.3 From b9b7bad279de29294c4d3314fe90fca345c38ea6 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 18 May 2026 16:41:06 -0700 Subject: mm/damon: trace probe_hits Introduce a new tracepoint for exposing the per-region per-probe positive sample count via tracefs. Link: https://lore.kernel.org/20260518234119.97569-19-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/trace/events/damon.h | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) (limited to 'include') diff --git a/include/trace/events/damon.h b/include/trace/events/damon.h index 7e25f4469b81..78388538acf4 100644 --- a/include/trace/events/damon.h +++ b/include/trace/events/damon.h @@ -130,6 +130,44 @@ TRACE_EVENT(damon_monitor_intervals_tune, TP_printk("sample_us=%lu", __entry->sample_us) ); +TRACE_EVENT_CONDITION(damon_region_aggregated, + + TP_PROTO(unsigned int target_id, struct damon_region *r, + unsigned int nr_regions, unsigned int nr_probes), + + TP_ARGS(target_id, r, nr_regions, nr_probes), + + TP_CONDITION(nr_probes > 0), + + TP_STRUCT__entry( + __field(unsigned long, target_id) + __field(unsigned long, start) + __field(unsigned long, end) + __field(unsigned int, nr_regions) + __field(unsigned int, nr_accesses) + __field(unsigned int, age) + __dynamic_array(unsigned char, probe_hits, nr_probes) + ), + + TP_fast_assign( + __entry->target_id = target_id; + __entry->start = r->ar.start; + __entry->end = r->ar.end; + __entry->nr_regions = nr_regions; + __entry->nr_accesses = r->nr_accesses; + __entry->age = r->age; + memcpy(__get_dynamic_array(probe_hits), r->probe_hits, + sizeof(*r->probe_hits) * nr_probes); + ), + + TP_printk("target_id=%lu nr_regions=%u %lu-%lu: %u %u probe_hits=%s", + __entry->target_id, __entry->nr_regions, + __entry->start, __entry->end, + __entry->nr_accesses, __entry->age, + __print_hex(__get_dynamic_array(probe_hits), + __get_dynamic_array_len(probe_hits))) +); + TRACE_EVENT(damon_aggregated, TP_PROTO(unsigned int target_id, struct damon_region *r, -- cgit v1.2.3 From d9f23f2f822a59771fdc3cab648785d4f651e1b2 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 18 May 2026 16:41:10 -0700 Subject: mm/damon/core: introduce DAMON_FILTER_TYPE_MEMCG Belonging memory cgoup is another data attribute that can be useful to monitor. Introduce a new DAMON filter type, namely DAMON_FILTER_TYPE_MEMCG, for monitoring of this attribute. Link: https://lore.kernel.org/20260518234119.97569-23-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 1fb271a35e98..6a54c601889b 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -742,9 +742,11 @@ struct damon_intervals_goal { * enum damon_filter_type - Type of &struct damon_filter * * @DAMON_FILTER_TYPE_ANON: Anonymous pages. + * @DAMON_FILTER_TYPE_MEMCG: Specific memcg's pages. */ enum damon_filter_type { DAMON_FILTER_TYPE_ANON, + DAMON_FILTER_TYPE_MEMCG, }; /** @@ -753,12 +755,16 @@ enum damon_filter_type { * @type: Type of the region. * @matching: Whether this filter is for the type-matching ones. * @allow: Whether the @type-@matching ones should pass this filter. + * @memcg_id: Memcg id of the question if @type is DAMON_FILTER_MEMCG. * @list: Siblings list. */ struct damon_filter { enum damon_filter_type type; bool matching; bool allow; + union { + u64 memcg_id; + }; struct list_head list; }; -- cgit v1.2.3 From 543ab01db7ace5bb28972ac70f321d55cc4f0214 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Mon, 18 May 2026 16:41:14 -0700 Subject: mm/damon/sysfs: setup damon_filter->memcg_id from path Find and set the memcg_id for damon_filter from the user-passed memory cgroup path when updating the DAMON input parameters. Link: https://lore.kernel.org/20260518234119.97569-27-sj@kernel.org Signed-off-by: SeongJae Park Cc: David Hildenbrand Cc: Jonathan Corbet Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Mike Rapoport Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/damon.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 6a54c601889b..4014fd0d463c 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -1006,6 +1006,7 @@ static inline unsigned long damon_sz_region(struct damon_region *r) struct damon_filter *damon_new_filter(enum damon_filter_type type, bool matching, bool allow); void damon_add_filter(struct damon_probe *probe, struct damon_filter *f); +void damon_destroy_filter(struct damon_filter *f); struct damon_probe *damon_new_probe(void); void damon_add_probe(struct damon_ctx *ctx, struct damon_probe *probe); -- cgit v1.2.3 From 12863b36bfe4ac0aa93e984c72b2bcd8f08402aa Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Fri, 29 May 2026 10:43:43 +0200 Subject: fs: retire sget() sget() and sget_fc() have lived side by side as near-duplicate find-or-create-and-publish helpers for the legacy and fs_context mount APIs. The three remaining in-tree callers (CIFS plus the ext4 extents and mballoc KUnit tests) have all been moved to sget_fc(). Nothing calls sget() anymore. Delete sget() from fs/super.c and the prototype in . Update the two comments that referred to "sget()" or "sget{_fc}()" to just say "sget_fc()". This removes ~60 lines of code that only existed to be kept in lockstep with sget_fc() on every superblock publish-path change. Link: https://patch.msgid.link/20260529-work-sget-v2-4-57bbe08604e4@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner (Amutable) --- include/linux/fs.h | 4 ---- 1 file changed, 4 deletions(-) (limited to 'include') diff --git a/include/linux/fs.h b/include/linux/fs.h index 11559c513dfb..6dbe3218dc1e 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2327,10 +2327,6 @@ void free_anon_bdev(dev_t); struct super_block *sget_fc(struct fs_context *fc, int (*test)(struct super_block *, struct fs_context *), int (*set)(struct super_block *, struct fs_context *)); -struct super_block *sget(struct file_system_type *type, - int (*test)(struct super_block *,void *), - int (*set)(struct super_block *,void *), - int flags, void *data); struct super_block *sget_dev(struct fs_context *fc, dev_t dev); /* Alas, no aliases. Too much hassle with bringing module.h everywhere */ -- cgit v1.2.3 From 876bb45f36939307c1e376243d862ad1b1a5f0cd Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Tue, 26 May 2026 16:08:03 +0200 Subject: thermal/core: Add devm_thermal_cooling_device_register() Introduce a device-managed variant of the non-OF cooling device registration API. This complements devm_thermal_of_cooling_device_register() and allows non-device-tree users to register cooling devices with automatic cleanup tied to the device lifecycle. The helper relies on devm_add_action_or_reset() to release the cooling device via thermal_cooling_device_release() on driver detach or probe failure. This keeps the API consistent across OF and non-OF users and avoids manual cleanup in error paths. Signed-off-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Acked-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260526140802.1059293-14-daniel.lezcano@oss.qualcomm.com --- include/linux/thermal.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/thermal.h b/include/linux/thermal.h index 0ddc77aeeca2..fc3f4a098370 100644 --- a/include/linux/thermal.h +++ b/include/linux/thermal.h @@ -253,8 +253,11 @@ void thermal_zone_device_update(struct thermal_zone_device *, struct thermal_cooling_device *thermal_cooling_device_register(const char *, void *, const struct thermal_cooling_device_ops *); struct thermal_cooling_device * -thermal_of_cooling_device_register(struct device_node *np, const char *, void *, - const struct thermal_cooling_device_ops *); +devm_thermal_cooling_device_register(struct device *dev, const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops); +struct thermal_cooling_device * +thermal_of_cooling_device_register(struct device_node *np, const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops); struct thermal_cooling_device * devm_thermal_of_cooling_device_register(struct device *dev, struct device_node *np, -- cgit v1.2.3 From 27559121b2e3ffbdfdbb77b528ba1015e2617daa Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Tue, 26 May 2026 16:08:06 +0200 Subject: thermal/of: Move cooling device OF helpers out of thermal core The functions: - thermal_of_cooling_device_register() - devm_thermal_of_cooling_device_register() are specific to device tree usage but are currently implemented in thermal_core.c. Move them to thermal_of.c to better reflect the separation between generic thermal core code and OF-specific logic. This change is enabled by the recent split of the cooling device registration into allocation and addition phases, allowing OF-specific handling (such as device node assignment) to be isolated from the core. No functional change intended. Signed-off-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Acked-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260526140802.1059293-17-daniel.lezcano@oss.qualcomm.com --- include/linux/thermal.h | 49 +++++++++++++++++++++++++++++-------------------- 1 file changed, 29 insertions(+), 20 deletions(-) (limited to 'include') diff --git a/include/linux/thermal.h b/include/linux/thermal.h index fc3f4a098370..3e663267a19d 100644 --- a/include/linux/thermal.h +++ b/include/linux/thermal.h @@ -198,6 +198,15 @@ struct thermal_zone_device *devm_thermal_of_zone_register(struct device *dev, in void devm_thermal_of_zone_unregister(struct device *dev, struct thermal_zone_device *tz); +struct thermal_cooling_device * +thermal_of_cooling_device_register(struct device_node *np, const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops); + +struct thermal_cooling_device * +devm_thermal_of_cooling_device_register(struct device *dev, + struct device_node *np, + const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops); #else static inline @@ -211,6 +220,23 @@ static inline void devm_thermal_of_zone_unregister(struct device *dev, struct thermal_zone_device *tz) { } + +static inline struct thermal_cooling_device * +thermal_of_cooling_device_register(struct device_node *np, + const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops) +{ + return ERR_PTR(-ENODEV); +} + +static inline struct thermal_cooling_device * +devm_thermal_of_cooling_device_register(struct device *dev, + struct device_node *np, + const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops) +{ + return ERR_PTR(-ENODEV); +} #endif int for_each_thermal_trip(struct thermal_zone_device *tz, @@ -252,17 +278,11 @@ void thermal_zone_device_update(struct thermal_zone_device *, struct thermal_cooling_device *thermal_cooling_device_register(const char *, void *, const struct thermal_cooling_device_ops *); + struct thermal_cooling_device * devm_thermal_cooling_device_register(struct device *dev, const char *type, void *devdata, const struct thermal_cooling_device_ops *ops); -struct thermal_cooling_device * -thermal_of_cooling_device_register(struct device_node *np, const char *type, void *devdata, - const struct thermal_cooling_device_ops *ops); -struct thermal_cooling_device * -devm_thermal_of_cooling_device_register(struct device *dev, - struct device_node *np, - const char *type, void *devdata, - const struct thermal_cooling_device_ops *ops); + void thermal_cooling_device_update(struct thermal_cooling_device *); void thermal_cooling_device_unregister(struct thermal_cooling_device *); struct thermal_zone_device *thermal_zone_get_zone_by_name(const char *name); @@ -308,18 +328,7 @@ thermal_cooling_device_register(const char *type, void *devdata, const struct thermal_cooling_device_ops *ops) { return ERR_PTR(-ENODEV); } static inline struct thermal_cooling_device * -thermal_of_cooling_device_register(struct device_node *np, - const char *type, void *devdata, - const struct thermal_cooling_device_ops *ops) -{ return ERR_PTR(-ENODEV); } -static inline struct thermal_cooling_device * -devm_thermal_of_cooling_device_register(struct device *dev, - struct device_node *np, - const char *type, void *devdata, - const struct thermal_cooling_device_ops *ops) -{ - return ERR_PTR(-ENODEV); -} + static inline void thermal_cooling_device_unregister( struct thermal_cooling_device *cdev) { } -- cgit v1.2.3 From 5fa8b4225bec1fde0862a2d19964429662841384 Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Tue, 26 May 2026 16:08:05 +0200 Subject: thermal/core: Make cooling device OF node conditional on CONFIG_THERMAL_OF The device node pointer stored in struct thermal_cooling_device is only used by the OF-specific thermal code to associate cooling devices with thermal zones defined in device tree. Now that OF and non-OF registration paths are separated and non-OF users no longer rely on devm_thermal_of_cooling_device_register() with a NULL device node, the np field is no longer required for non-OF configurations. Make this field conditional on CONFIG_THERMAL_OF to reduce memory footprint and better reflect its usage. Signed-off-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Acked-by: Rafael J. Wysocki (Intel) Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20260526140802.1059293-16-daniel.lezcano@oss.qualcomm.com --- include/linux/thermal.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/thermal.h b/include/linux/thermal.h index 3e663267a19d..6d1862ac187f 100644 --- a/include/linux/thermal.h +++ b/include/linux/thermal.h @@ -125,7 +125,6 @@ struct thermal_cooling_device { const char *type; unsigned long max_state; struct device device; - struct device_node *np; void *devdata; void *stats; const struct thermal_cooling_device_ops *ops; @@ -133,6 +132,9 @@ struct thermal_cooling_device { struct mutex lock; /* protect thermal_instances list */ struct list_head thermal_instances; struct list_head node; +#ifdef CONFIG_THERMAL_OF + struct device_node *np; +#endif #ifdef CONFIG_THERMAL_DEBUGFS struct thermal_debugfs *debugfs; #endif -- cgit v1.2.3 From 8e1529e79385608002e126730d32bd91d7427795 Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Tue, 26 May 2026 16:08:07 +0200 Subject: thermal/of: Rename the devm_thermal_of_cooling_device_register() function To clarify that the function operates on child nodes, rename: devm_thermal_of_cooling_device_register() | v devm_thermal_of_child_cooling_device_register() Used the command: find . -type f -name '*.[ch]' -exec \ sed -i 's/devm_thermal_of_cooling_device_register/\ devm_thermal_of_child_cooling_device_register/g' {} \; Did not used clang-format-diff because it does not indent correctly and checkpatch complained. Manually reindented to make checkpatch happy This prepares for upcoming support of cooling devices identified by an ID rather than device tree child nodes. No functional change. Signed-off-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Acked-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260526140802.1059293-18-daniel.lezcano@oss.qualcomm.com --- include/linux/thermal.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/thermal.h b/include/linux/thermal.h index 6d1862ac187f..e6328234a42b 100644 --- a/include/linux/thermal.h +++ b/include/linux/thermal.h @@ -205,10 +205,10 @@ thermal_of_cooling_device_register(struct device_node *np, const char *type, voi const struct thermal_cooling_device_ops *ops); struct thermal_cooling_device * -devm_thermal_of_cooling_device_register(struct device *dev, - struct device_node *np, - const char *type, void *devdata, - const struct thermal_cooling_device_ops *ops); +devm_thermal_of_child_cooling_device_register(struct device *dev, + struct device_node *np, + const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops); #else static inline @@ -232,10 +232,10 @@ thermal_of_cooling_device_register(struct device_node *np, } static inline struct thermal_cooling_device * -devm_thermal_of_cooling_device_register(struct device *dev, - struct device_node *np, - const char *type, void *devdata, - const struct thermal_cooling_device_ops *ops) +devm_thermal_of_child_cooling_device_register(struct device *dev, + struct device_node *np, + const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops) { return ERR_PTR(-ENODEV); } -- cgit v1.2.3 From 37324803f049bee0d2b97941e3fbdf35db9a66b3 Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Tue, 26 May 2026 16:08:08 +0200 Subject: thermal/of: Add cooling device ID support Introduce an identifier (cdev_id) for cooling devices registered from device tree. This prepares support for a new DT binding where cooling devices are identified by a tuple (device node, ID), instead of relying on child nodes. Existing users are updated to pass a default ID of 0, preserving the current behavior. Future changes will extend the cooling map parsing to match cooling devices based on both the device node and the ID. No functional change intended. Signed-off-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Acked-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260526140802.1059293-19-daniel.lezcano@oss.qualcomm.com --- include/linux/thermal.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/thermal.h b/include/linux/thermal.h index e6328234a42b..fb7649439dfa 100644 --- a/include/linux/thermal.h +++ b/include/linux/thermal.h @@ -134,6 +134,7 @@ struct thermal_cooling_device { struct list_head node; #ifdef CONFIG_THERMAL_OF struct device_node *np; + u32 cdev_id; #endif #ifdef CONFIG_THERMAL_DEBUGFS struct thermal_debugfs *debugfs; @@ -201,7 +202,8 @@ struct thermal_zone_device *devm_thermal_of_zone_register(struct device *dev, in void devm_thermal_of_zone_unregister(struct device *dev, struct thermal_zone_device *tz); struct thermal_cooling_device * -thermal_of_cooling_device_register(struct device_node *np, const char *type, void *devdata, +thermal_of_cooling_device_register(struct device_node *np, u32 cdev_id, + const char *type, void *data, const struct thermal_cooling_device_ops *ops); struct thermal_cooling_device * @@ -224,7 +226,7 @@ static inline void devm_thermal_of_zone_unregister(struct device *dev, } static inline struct thermal_cooling_device * -thermal_of_cooling_device_register(struct device_node *np, +thermal_of_cooling_device_register(struct device_node *np, u32 cdev_id, const char *type, void *devdata, const struct thermal_cooling_device_ops *ops) { -- cgit v1.2.3 From 3570cb58e3171c8a65d2cedc0371ed412e0caff6 Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Tue, 26 May 2026 16:08:09 +0200 Subject: thermal/of: Pass cdev_id and introduce devm registration helper Extend the OF cooling device registration to support an explicit cooling device identifier (cdev_id), preparing for upcoming DT bindings where cooling devices are identified by a tuple (device node, id) instead of relying on child nodes. Introduce a new helper: devm_thermal_of_cooling_device_register() which registers a cooling device using the device's of_node and an explicit cdev_id. This complements the existing devm_thermal_of_child_cooling_device_register() helper, which remains dedicated to the legacy child-node based bindings. Internally, factorize the devm registration logic into a common helper to avoid code duplication. Existing users are unaffected, as the child-based helper continues to pass a default cdev_id of 0, preserving current behavior. This change is a preparatory step for supporting indexed cooling devices in thermal OF bindings. Signed-off-by: Daniel Lezcano Signed-off-by: Daniel Lezcano Reviewed-by: Lukasz Luba Acked-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260526140802.1059293-20-daniel.lezcano@oss.qualcomm.com --- include/linux/thermal.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'include') diff --git a/include/linux/thermal.h b/include/linux/thermal.h index fb7649439dfa..81be6e6061b3 100644 --- a/include/linux/thermal.h +++ b/include/linux/thermal.h @@ -206,6 +206,11 @@ thermal_of_cooling_device_register(struct device_node *np, u32 cdev_id, const char *type, void *data, const struct thermal_cooling_device_ops *ops); +struct thermal_cooling_device * +devm_thermal_of_cooling_device_register(struct device *dev, u32 cdev_id, + const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops); + struct thermal_cooling_device * devm_thermal_of_child_cooling_device_register(struct device *dev, struct device_node *np, @@ -233,6 +238,14 @@ thermal_of_cooling_device_register(struct device_node *np, u32 cdev_id, return ERR_PTR(-ENODEV); } +static inline struct thermal_cooling_device * +devm_thermal_of_cooling_device_register(struct device *dev, u32 cdev_id, + const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops) +{ + return ERR_PTR(-ENODEV); +} + static inline struct thermal_cooling_device * devm_thermal_of_child_cooling_device_register(struct device *dev, struct device_node *np, -- cgit v1.2.3 From 995b736ad46a80af84e58596c5e23ce94035bddf Mon Sep 17 00:00:00 2001 From: Daniel Lezcano Date: Mon, 1 Jun 2026 11:01:53 +0200 Subject: thermal/core: Fix missing stub for devm_thermal_cooling_device_register Even it is very unlikely the thermal framework is disabled, the newly added devm_thermal_cooling_device_register() function has not the stub when the thermal framework is optout in the kernel. Add it. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605301554.S9n45bfQ-lkp@intel.com/ Signed-off-by: Daniel Lezcano Acked-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260601090152.1243983-2-daniel.lezcano@kernel.org --- include/linux/thermal.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/thermal.h b/include/linux/thermal.h index 81be6e6061b3..083b4f533933 100644 --- a/include/linux/thermal.h +++ b/include/linux/thermal.h @@ -344,7 +344,11 @@ static inline struct thermal_cooling_device * thermal_cooling_device_register(const char *type, void *devdata, const struct thermal_cooling_device_ops *ops) { return ERR_PTR(-ENODEV); } + static inline struct thermal_cooling_device * +devm_thermal_cooling_device_register(struct device *dev, const char *type, void *devdata, + const struct thermal_cooling_device_ops *ops) +{ return ERR_PTR(-ENODEV); } static inline void thermal_cooling_device_unregister( struct thermal_cooling_device *cdev) -- cgit v1.2.3 From 43a4b19c17d156786adf3515434e7d522664d75d Mon Sep 17 00:00:00 2001 From: Shawn Guo Date: Tue, 14 Apr 2026 11:59:07 +0800 Subject: dt-bindings: power: qcom,rpmhpd: Fix whitespace in RPMHPD defines Some RPMHPD_* defines in the Generic RPMH Power Domain Indexes section were using spaces instead of tabs for alignment. Fix them to be consistent with the rest of the file. Signed-off-by: Shawn Guo Acked-by: Rob Herring (Arm) Signed-off-by: Ulf Hansson --- include/dt-bindings/power/qcom,rpmhpd.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/dt-bindings/power/qcom,rpmhpd.h b/include/dt-bindings/power/qcom,rpmhpd.h index 67e2634fdc99..74e910150956 100644 --- a/include/dt-bindings/power/qcom,rpmhpd.h +++ b/include/dt-bindings/power/qcom,rpmhpd.h @@ -7,7 +7,7 @@ #define _DT_BINDINGS_POWER_QCOM_RPMHPD_H /* Generic RPMH Power Domain Indexes */ -#define RPMHPD_CX 0 +#define RPMHPD_CX 0 #define RPMHPD_CX_AO 1 #define RPMHPD_EBI 2 #define RPMHPD_GFX 3 @@ -19,14 +19,14 @@ #define RPMHPD_MX_AO 9 #define RPMHPD_MXC 10 #define RPMHPD_MXC_AO 11 -#define RPMHPD_MSS 12 +#define RPMHPD_MSS 12 #define RPMHPD_NSP 13 -#define RPMHPD_NSP0 14 -#define RPMHPD_NSP1 15 -#define RPMHPD_QPHY 16 -#define RPMHPD_DDR 17 -#define RPMHPD_XO 18 -#define RPMHPD_NSP2 19 +#define RPMHPD_NSP0 14 +#define RPMHPD_NSP1 15 +#define RPMHPD_QPHY 16 +#define RPMHPD_DDR 17 +#define RPMHPD_XO 18 +#define RPMHPD_NSP2 19 #define RPMHPD_GMXC 20 #define RPMHPD_DCX 21 #define RPMHPD_GBX 22 -- cgit v1.2.3 From 5f0e40827295a4e46da719a399eb72cc2a5a14d6 Mon Sep 17 00:00:00 2001 From: Kamal Wadhwa Date: Tue, 14 Apr 2026 11:59:08 +0800 Subject: dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Nord SoC Document the RPMh power domain for Nord SoC, and add definitions for the new power domains present on Nord SoC. - RPMHPD_NSP3: power domain for the 4th NSP subsystem - RPMHPD_GFX1: power domain for the 2nd GFX subsystem Signed-off-by: Kamal Wadhwa Signed-off-by: Shawn Guo Acked-by: Rob Herring (Arm) Reviewed-by: Konrad Dybcio Signed-off-by: Ulf Hansson --- include/dt-bindings/power/qcom,rpmhpd.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/power/qcom,rpmhpd.h b/include/dt-bindings/power/qcom,rpmhpd.h index 74e910150956..07bd2a7b0150 100644 --- a/include/dt-bindings/power/qcom,rpmhpd.h +++ b/include/dt-bindings/power/qcom,rpmhpd.h @@ -30,6 +30,8 @@ #define RPMHPD_GMXC 20 #define RPMHPD_DCX 21 #define RPMHPD_GBX 22 +#define RPMHPD_NSP3 23 +#define RPMHPD_GFX1 24 /* RPMh Power Domain performance levels */ #define RPMH_REGULATOR_LEVEL_RETENTION 16 -- cgit v1.2.3 From cb19b8a9add2ed3774c1276e0a3906e52e8cf39a Mon Sep 17 00:00:00 2001 From: "WEI-HONG, YE" <1234567weewee457@gmail.com> Date: Mon, 25 May 2026 13:04:50 +0000 Subject: locking/qspinlock: Clarify pending field layout For CONFIG_NR_CPUS < 16K, _Q_PENDING_BITS is 8 and the pending field occupies bits 8-15 of the lock word. The current comment documents bit 8 as pending and bits 9-15 as unused, which describes the pending flag value rather than the field layout. Describe bits 8-15 as the pending byte so the layout description is consistent with the lock byte. Signed-off-by: WEI-HONG, YE <1234567weewee457@gmail.com> Signed-off-by: Peter Zijlstra (Intel) Acked-by: Waiman Long Link: https://patch.msgid.link/20260525130450.723937-1-1234567weewee457@gmail.com --- include/asm-generic/qspinlock_types.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/asm-generic/qspinlock_types.h b/include/asm-generic/qspinlock_types.h index 2fd1fb89ec36..7d17b9bb069c 100644 --- a/include/asm-generic/qspinlock_types.h +++ b/include/asm-generic/qspinlock_types.h @@ -53,8 +53,7 @@ typedef struct qspinlock { * * When NR_CPUS < 16K * 0- 7: locked byte - * 8: pending - * 9-15: not used + * 8-15: pending byte * 16-17: tail index * 18-31: tail cpu (+1) * -- cgit v1.2.3 From 22302af28d3f7c3ca38536978c80db51d2a9e283 Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Tue, 2 Jun 2026 07:12:52 +0000 Subject: cleanup: Annotate guard constructors with nonnull Add __nonnull_args() to unconditional guard constructors so the compiler warns when NULL is statically known to be passed: - DEFINE_GUARD(): re-declare the constructor with __nonnull_args(). - __DEFINE_LOCK_GUARD_1(): annotate the constructor directly. DEFINE_LOCK_GUARD_0() needs no annotation: its constructor takes no pointer arguments (.lock is hardcoded to (void *)1). Define the __nonnull_args() macro in compiler_attributes.h, following the existing convention for attribute wrappers. Deliberately not named '__nonnull', to avoid clashing with glibc's __nonnull() when kernel and userspace headers are combined (User Mode Linux for example). Signed-off-by: Dmitry Ilvokhin Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/85fee12eec20abfcf711443518e8f0caec982a86.1780064327.git.d@ilvokhin.com --- include/linux/cleanup.h | 4 +++- include/linux/compiler_attributes.h | 9 +++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/cleanup.h b/include/linux/cleanup.h index ea95ca4bc11c..4e60d519713c 100644 --- a/include/linux/cleanup.h +++ b/include/linux/cleanup.h @@ -397,6 +397,7 @@ static __maybe_unused const bool class_##_name##_is_conditional = _is_cond __DEFINE_GUARD_LOCK_PTR(_name, _T) #define DEFINE_GUARD(_name, _type, _lock, _unlock) \ + static __always_inline __nonnull_args() _type class_##_name##_constructor(_type _T); \ DEFINE_CLASS(_name, _type, if (_T) { _unlock; }, ({ _lock; _T; }), _type _T); \ DEFINE_CLASS_IS_GUARD(_name) @@ -497,7 +498,8 @@ static __always_inline void class_##_name##_destructor(class_##_name##_t *_T) \ __DEFINE_GUARD_LOCK_PTR(_name, &_T->lock) #define __DEFINE_LOCK_GUARD_1(_name, _type, ...) \ -static __always_inline class_##_name##_t class_##_name##_constructor(_type *l) \ +static __always_inline __nonnull_args() \ +class_##_name##_t class_##_name##_constructor(_type *l) \ __no_context_analysis \ { \ class_##_name##_t _t = { .lock = l }, *_T = &_t; \ diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h index c16d4199bf92..cffe09387ea6 100644 --- a/include/linux/compiler_attributes.h +++ b/include/linux/compiler_attributes.h @@ -230,6 +230,15 @@ */ #define noinline __attribute__((__noinline__)) +/* + * Note: deliberately not named '__nonnull', to avoid clashing with glibc's + * __nonnull() when kernel and userspace headers are combined. + * + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Attributes.html#index-nonnull + * clang: https://clang.llvm.org/docs/AttributeReference.html#nonnull + */ +#define __nonnull_args(x...) __attribute__((__nonnull__(x))) + /* * Optional: only supported since gcc >= 8 * Optional: not supported by clang -- cgit v1.2.3 From a13ab9dd6eb2a89f14b466c3884730ea7969253f Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Tue, 2 Jun 2026 07:12:53 +0000 Subject: cleanup: Remove NULL check from unconditional guards The unconditional guard destructors check whether the lock pointer is NULL before unlocking. This check is dead code because unconditional guards guarantee a non-NULL lock pointer at destructor time. DEFINE_GUARD() runs the lock operation unconditionally in the constructor. If the pointer were NULL, the lock operation (e.g. mutex_lock(NULL)) would crash before the constructor returns. The destructor never runs with a NULL pointer. All DEFINE_GUARD() users dereference the pointer in their lock. Verified by auditing every instance found by: git grep -n -A 1 'DEFINE_GUARD('. The only exception is xe_pm_runtime_release_only, whose constructor is a noop, but it has no callers. __DEFINE_UNLOCK_GUARD() has only a few usages outside of include/linux/cleanup.h: tty_port_tty (NULL-checks in its tty_kref_put() call), irqdesc_lock (fixed earlier) and two guards in kernel/sched/sched.h (dereference the pointer unconditionally in their lock constructors). DEFINE_LOCK_GUARD_1() sets .lock from its argument and runs the lock operation in the constructor. Same reasoning applies. All DEFINE_LOCK_GUARD_1() users dereference the pointer in their lock. Also, verified by auditing every match of: git grep -n 'DEFINE_LOCK_GUARD_1('. DEFINE_LOCK_GUARD_0() hardcodes .lock = (void *)1 in the constructor, so it is never NULL by construction. Conditional (_try) variants: DEFINE_GUARD_COND() and DEFINE_LOCK_GUARD_1_COND() use EXTEND_CLASS_COND(), whose wrapper destructor returns early when the lock was not acquired, before reaching the base destructor since commit 2deccd5c862a ("cleanup: Optimize guards"): if (_cond) return; class_##_name##_destructor(_T); As compiled by GCC-11 with defconfig on top of the locking/core: Total: Before=23889980, After=23834334, chg -0.23% Signed-off-by: Dmitry Ilvokhin Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/0503a089389b2270c478a873e095cf0a4ff26d24.1780064327.git.d@ilvokhin.com --- include/linux/cleanup.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/cleanup.h b/include/linux/cleanup.h index 4e60d519713c..65416938e318 100644 --- a/include/linux/cleanup.h +++ b/include/linux/cleanup.h @@ -398,7 +398,7 @@ static __maybe_unused const bool class_##_name##_is_conditional = _is_cond #define DEFINE_GUARD(_name, _type, _lock, _unlock) \ static __always_inline __nonnull_args() _type class_##_name##_constructor(_type _T); \ - DEFINE_CLASS(_name, _type, if (_T) { _unlock; }, ({ _lock; _T; }), _type _T); \ + DEFINE_CLASS(_name, _type, _unlock, ({ _lock; _T; }), _type _T); \ DEFINE_CLASS_IS_GUARD(_name) #define DEFINE_GUARD_COND_4(_name, _ext, _lock, _cond) \ @@ -492,7 +492,7 @@ typedef struct { \ static __always_inline void class_##_name##_destructor(class_##_name##_t *_T) \ __no_context_analysis \ { \ - if (_T->lock) { _unlock; } \ + _unlock; \ } \ \ __DEFINE_GUARD_LOCK_PTR(_name, &_T->lock) -- cgit v1.2.3 From c06cd66387da92e6cdac44e16c7b5ef9219c53ac Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:21 +0200 Subject: percpu: Sanitize __percpu_qual include hell Slapping __percpu_qual into the next available header is sloppy at best. It's required by __percpu which is defined in compiler_types.h and that is meant to be included without requiring a boatload of other headers so that a struct or function declaration can contain a __percpu qualifier w/o further prerequisites. This implicit dependency on linux/percpu.h makes that impossible and causes a major problem when trying to separate headers. Create asm/percpu_types.h and move it there. Include that from compiler_types.h and the whole recursion problem goes away. Fix up UM so it uses the generic header and includes it in the UM_HOST build, which pulls in compiler_types.h. The USER_CFLAGS fix was suggested by Richard. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260602090535.254874125@kernel.org --- include/asm-generic/Kbuild | 1 + include/asm-generic/percpu_types.h | 19 +++++++++++++++++++ include/linux/compiler_types.h | 3 +++ include/linux/percpu.h | 9 +++++---- 4 files changed, 28 insertions(+), 4 deletions(-) create mode 100644 include/asm-generic/percpu_types.h (limited to 'include') diff --git a/include/asm-generic/Kbuild b/include/asm-generic/Kbuild index 2c53a1e0b760..15df9dcb42a5 100644 --- a/include/asm-generic/Kbuild +++ b/include/asm-generic/Kbuild @@ -44,6 +44,7 @@ mandatory-y += module.lds.h mandatory-y += msi.h mandatory-y += pci.h mandatory-y += percpu.h +mandatory-y += percpu_types.h mandatory-y += pgalloc.h mandatory-y += preempt.h mandatory-y += rqspinlock.h diff --git a/include/asm-generic/percpu_types.h b/include/asm-generic/percpu_types.h new file mode 100644 index 000000000000..a095cea7fa20 --- /dev/null +++ b/include/asm-generic/percpu_types.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _ASM_GENERIC_PERCPU_TYPES_H_ +#define _ASM_GENERIC_PERCPU_TYPES_H_ + +#ifndef __ASSEMBLER__ +/* + * __percpu_qual is the qualifier for the percpu named address space. + * + * Most architectures use generic named address space for percpu variables but + * some architectures define percpu variables in different named address space. + * E.g. on x86, percpu variable may be declared as being relative to the %fs or + * %gs segments using __seg_fs or __seg_gs named address space qualifier. + */ +#ifndef __percpu_qual +# define __percpu_qual +#endif + +#endif /* __ASSEMBLER__ */ +#endif /* _ASM_GENERIC_PERCPU_TYPES_H_ */ diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h index e8fd77593b68..7ad37adda1dd 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -634,6 +634,9 @@ struct ftrace_likely_data { #else #define __unqual_scalar_typeof(x) __typeof_unqual__(x) #endif + +#include + #endif /* !__ASSEMBLY__ */ /* diff --git a/include/linux/percpu.h b/include/linux/percpu.h index 85bf8dd9f087..2f5a889aa50d 100644 --- a/include/linux/percpu.h +++ b/include/linux/percpu.h @@ -3,13 +3,14 @@ #define __LINUX_PERCPU_H #include +#include +#include +#include #include -#include -#include #include -#include -#include +#include #include +#include #include -- cgit v1.2.3 From c1ffc9c6e4f8a13dd68e97920c9a24d095c6e41a Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:25 +0200 Subject: futex: Move futex task related data into a struct MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Having all these members in task_struct along with the required #ifdeffery is annoying, does not allow efficient initializing of the data with memset() and makes extending it tedious. Move it into a data structure and fix up all usage sites. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Reviewed-by: André Almeida Link: https://patch.msgid.link/20260602090535.308220888@kernel.org --- include/linux/futex.h | 12 ++++-------- include/linux/futex_types.h | 36 ++++++++++++++++++++++++++++++++++++ include/linux/sched.h | 16 ++++------------ 3 files changed, 44 insertions(+), 20 deletions(-) create mode 100644 include/linux/futex_types.h (limited to 'include') diff --git a/include/linux/futex.h b/include/linux/futex.h index 9e9750f04980..563e8dd67179 100644 --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -64,14 +64,10 @@ enum { static inline void futex_init_task(struct task_struct *tsk) { - tsk->robust_list = NULL; -#ifdef CONFIG_COMPAT - tsk->compat_robust_list = NULL; -#endif - INIT_LIST_HEAD(&tsk->pi_state_list); - tsk->pi_state_cache = NULL; - tsk->futex_state = FUTEX_STATE_OK; - mutex_init(&tsk->futex_exit_mutex); + memset(&tsk->futex, 0, sizeof(tsk->futex)); + INIT_LIST_HEAD(&tsk->futex.pi_state_list); + tsk->futex.state = FUTEX_STATE_OK; + mutex_init(&tsk->futex.exit_mutex); } void futex_exit_recursive(struct task_struct *tsk); diff --git a/include/linux/futex_types.h b/include/linux/futex_types.h new file mode 100644 index 000000000000..9c6c0dc4148d --- /dev/null +++ b/include/linux/futex_types.h @@ -0,0 +1,36 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_FUTEX_TYPES_H +#define _LINUX_FUTEX_TYPES_H + +#ifdef CONFIG_FUTEX +#include +#include + +struct compat_robust_list_head; +struct futex_pi_state; +struct robust_list_head; + +/** + * struct futex_sched_data - Futex related per task data + * @robust_list: User space registered robust list pointer + * @compat_robust_list: User space registered robust list pointer for compat tasks + * @pi_state_list: List head for Priority Inheritance (PI) state management + * @pi_state_cache: Pointer to cache one PI state object per task + * @exit_mutex: Mutex for serializing exit + * @state: Futex handling state to handle exit races correctly + */ +struct futex_sched_data { + struct robust_list_head __user *robust_list; +#ifdef CONFIG_COMPAT + struct compat_robust_list_head __user *compat_robust_list; +#endif + struct list_head pi_state_list; + struct futex_pi_state *pi_state_cache; + struct mutex exit_mutex; + unsigned int state; +}; +#else +struct futex_sched_data { }; +#endif /* !CONFIG_FUTEX */ + +#endif /* _LINUX_FUTEX_TYPES_H */ diff --git a/include/linux/sched.h b/include/linux/sched.h index 368c7b4d7cb5..c88fc10e9c38 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -16,6 +16,7 @@ #include #include +#include #include #include #include @@ -64,7 +65,6 @@ struct bpf_net_context; struct capture_control; struct cfs_rq; struct fs_struct; -struct futex_pi_state; struct io_context; struct io_uring_task; struct mempolicy; @@ -76,7 +76,6 @@ struct pid_namespace; struct pipe_inode_info; struct rcu_node; struct reclaim_state; -struct robust_list_head; struct root_domain; struct rq; struct sched_attr; @@ -1331,16 +1330,9 @@ struct task_struct { u32 closid; u32 rmid; #endif -#ifdef CONFIG_FUTEX - struct robust_list_head __user *robust_list; -#ifdef CONFIG_COMPAT - struct compat_robust_list_head __user *compat_robust_list; -#endif - struct list_head pi_state_list; - struct futex_pi_state *pi_state_cache; - struct mutex futex_exit_mutex; - unsigned int futex_state; -#endif + + struct futex_sched_data futex; + #ifdef CONFIG_PERF_EVENTS u8 perf_recursion[PERF_NR_CONTEXTS]; struct perf_event_context *perf_event_ctxp; -- cgit v1.2.3 From d7b3f52c861f54ba2fff15696d3798277fb4c19f Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:29 +0200 Subject: futex: Make futex_mm_init() void Nothing fails there. Mop up the leftovers of the early version of this, which did an allocation. While at it clean up the stubs and the #ifdef comments to make the header file readable. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260602090535.356789395@kernel.org --- include/linux/futex.h | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) (limited to 'include') diff --git a/include/linux/futex.h b/include/linux/futex.h index 563e8dd67179..9e6218c2be66 100644 --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -81,22 +81,20 @@ int futex_hash_prctl(unsigned long arg2, unsigned long arg3, unsigned long arg4) #ifdef CONFIG_FUTEX_PRIVATE_HASH int futex_hash_allocate_default(void); void futex_hash_free(struct mm_struct *mm); -int futex_mm_init(struct mm_struct *mm); - -#else /* !CONFIG_FUTEX_PRIVATE_HASH */ +void futex_mm_init(struct mm_struct *mm); +#else /* CONFIG_FUTEX_PRIVATE_HASH */ static inline int futex_hash_allocate_default(void) { return 0; } static inline int futex_hash_free(struct mm_struct *mm) { return 0; } -static inline int futex_mm_init(struct mm_struct *mm) { return 0; } -#endif /* CONFIG_FUTEX_PRIVATE_HASH */ +static inline void futex_mm_init(struct mm_struct *mm) { } +#endif /* !CONFIG_FUTEX_PRIVATE_HASH */ -#else /* !CONFIG_FUTEX */ +#else /* CONFIG_FUTEX */ static inline void futex_init_task(struct task_struct *tsk) { } static inline void futex_exit_recursive(struct task_struct *tsk) { } static inline void futex_exit_release(struct task_struct *tsk) { } static inline void futex_exec_release(struct task_struct *tsk) { } -static inline long do_futex(u32 __user *uaddr, int op, u32 val, - ktime_t *timeout, u32 __user *uaddr2, - u32 val2, u32 val3) +static inline long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, + u32 __user *uaddr2, u32 val2, u32 val3) { return -EINVAL; } @@ -104,13 +102,9 @@ static inline int futex_hash_prctl(unsigned long arg2, unsigned long arg3, unsig { return -EINVAL; } -static inline int futex_hash_allocate_default(void) -{ - return 0; -} +static inline int futex_hash_allocate_default(void) { return 0; } static inline int futex_hash_free(struct mm_struct *mm) { return 0; } -static inline int futex_mm_init(struct mm_struct *mm) { return 0; } - -#endif +static inline void futex_mm_init(struct mm_struct *mm) { } +#endif /* !CONFIG_FUTEX */ -#endif +#endif /* _LINUX_FUTEX_H */ -- cgit v1.2.3 From 1f7f4816b9b05e5110bc1c8a05c3c478e2dae11b Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:34 +0200 Subject: futex: Move futex related mm_struct data into a struct Having all these members in mm_struct along with the required #ifdeffery is annoying, does not allow efficient initializing of the data with memset() and makes extending it tedious. Move it into a data structure and fix up all usage sites. The extra struct for the private hash is intentional to make integration of other conditional mechanisms easier in terms of initialization and separation. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260602090535.407756793@kernel.org --- include/linux/futex_types.h | 36 +++++++++++++++++++++++++++++++++++- include/linux/mm_types.h | 12 ++---------- 2 files changed, 37 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/linux/futex_types.h b/include/linux/futex_types.h index 9c6c0dc4148d..d41557d2790d 100644 --- a/include/linux/futex_types.h +++ b/include/linux/futex_types.h @@ -3,6 +3,7 @@ #define _LINUX_FUTEX_TYPES_H #ifdef CONFIG_FUTEX +#include #include #include @@ -29,8 +30,41 @@ struct futex_sched_data { struct mutex exit_mutex; unsigned int state; }; -#else + +#ifdef CONFIG_FUTEX_PRIVATE_HASH +/** + * struct futex_mm_phash - Futex private hash related per MM data + * @lock: Mutex to protect the private hash operations + * @hash: RCU managed pointer to the private hash + * @hash_new: Pointer to a newly allocated private hash + * @batches: Batch state for RCU synchronization + * @rcu: RCU head for call_rcu() + * @atomic: Aggregate value for @hash_ref + * @ref: Per CPU reference counter for a private hash + */ +struct futex_mm_phash { + struct mutex lock; + struct futex_private_hash __rcu *hash; + struct futex_private_hash *hash_new; + unsigned long batches; + struct rcu_head rcu; + atomic_long_t atomic; + unsigned int __percpu *ref; +}; +#else /* CONFIG_FUTEX_ROBUST_UNLOCK */ +struct futex_mm_phash { }; +#endif /* !CONFIG_FUTEX_ROBUST_UNLOCK */ + +/** + * struct futex_mm_data - Futex related per MM data + * @phash: Futex private hash related data + */ +struct futex_mm_data { + struct futex_mm_phash phash; +}; +#else /* CONFIG_FUTEX */ struct futex_sched_data { }; +struct futex_mm_data { }; #endif /* !CONFIG_FUTEX */ #endif /* _LINUX_FUTEX_TYPES_H */ diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index a308e2c23b82..1d0c8d8875aa 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -20,6 +20,7 @@ #include #include #include +#include #include #include @@ -1270,16 +1271,7 @@ struct mm_struct { */ seqcount_t mm_lock_seq; #endif -#ifdef CONFIG_FUTEX_PRIVATE_HASH - struct mutex futex_hash_lock; - struct futex_private_hash __rcu *futex_phash; - struct futex_private_hash *futex_phash_new; - /* futex-ref */ - unsigned long futex_batches; - struct rcu_head futex_rcu; - atomic_long_t futex_atomic; - unsigned int __percpu *futex_ref; -#endif + struct futex_mm_data futex; unsigned long hiwater_rss; /* High-watermark of RSS usage */ unsigned long hiwater_vm; /* High-water virtual memory usage */ -- cgit v1.2.3 From 2cb5251d3d64d57c172185b9b608f704b3015f26 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:38 +0200 Subject: futex: Provide UABI defines for robust list entry modifiers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The marker for PI futexes in the robust list is a hardcoded 0x1 which lacks any sensible form of documentation. Provide proper defines for the bit and the mask and fix up the usage sites. Thereby convert the boolean pi argument into a modifier argument, which allows new modifier bits to be trivially added and conveyed. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Mathieu Desnoyers Reviewed-by: André Almeida Link: https://patch.msgid.link/20260602090535.458758556@kernel.org --- include/uapi/linux/futex.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/futex.h b/include/uapi/linux/futex.h index 7e2744ec8933..29bf2f65406a 100644 --- a/include/uapi/linux/futex.h +++ b/include/uapi/linux/futex.h @@ -177,6 +177,10 @@ struct robust_list_head { */ #define ROBUST_LIST_LIMIT 2048 +/* Modifiers for robust_list_head::list_op_pending */ +#define FUTEX_ROBUST_MOD_PI (0x1UL) +#define FUTEX_ROBUST_MOD_MASK (FUTEX_ROBUST_MOD_PI) + /* * bitset with all bits set for the FUTEX_xxx_BITSET OPs to request a * match of any bit. -- cgit v1.2.3 From 6149fc36c09b91050b62e8e68a91027df8df7345 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:42 +0200 Subject: uaccess: Provide unsafe_atomic_store_release_user() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The upcoming support for unlocking robust futexes in the kernel requires store release semantics. Syscalls do not imply memory ordering on all architectures so the unlock operation requires a barrier. This barrier can be avoided when stores imply release like on x86. Provide a generic version with a smp_mb() before the unsafe_put_user(), which can be overridden by architectures. Provide also a ARCH_MEMORY_ORDER_TSO Kconfig option, which can be selected by architectures with Total Store Order (TSO), where store implies release, so that the smp_mb() in the generic implementation can be avoided. If that is set a barrier() is used instead of smp_mb(), which is not required for the use case at hand, but makes it future proof for other usage to prevent the compiler from reordering. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: André Almeida Link: https://patch.msgid.link/20260602090535.513181528@kernel.org --- include/linux/uaccess.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include') diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 56328601218c..c6bd20065a5d 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -649,6 +649,17 @@ static inline void user_access_restore(unsigned long flags) { } #define user_read_access_end user_access_end #endif +#ifndef unsafe_atomic_store_release_user +# define unsafe_atomic_store_release_user(val, uptr, elbl) \ + do { \ + if (!IS_ENABLED(CONFIG_ARCH_MEMORY_ORDER_TSO)) \ + smp_mb(); \ + else \ + barrier(); \ + unsafe_put_user(val, uptr, elbl); \ + } while (0) +#endif + /* Define RW variant so the below _mode macro expansion works */ #define masked_user_rw_access_begin(u) masked_user_access_begin(u) #define user_rw_access_begin(u, s) user_access_begin(u, s) -- cgit v1.2.3 From 1fd053d26f0333485cdbaa9d6e7b8cb53f54de95 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:51 +0200 Subject: futex: Cleanup UAPI defines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Make the operand defines tabular for readability sake. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: André Almeida Link: https://patch.msgid.link/20260602090535.615600933@kernel.org --- include/uapi/linux/futex.h | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/futex.h b/include/uapi/linux/futex.h index 29bf2f65406a..75df1eaff75d 100644 --- a/include/uapi/linux/futex.h +++ b/include/uapi/linux/futex.h @@ -25,23 +25,22 @@ #define FUTEX_PRIVATE_FLAG 128 #define FUTEX_CLOCK_REALTIME 256 -#define FUTEX_CMD_MASK ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) - -#define FUTEX_WAIT_PRIVATE (FUTEX_WAIT | FUTEX_PRIVATE_FLAG) -#define FUTEX_WAKE_PRIVATE (FUTEX_WAKE | FUTEX_PRIVATE_FLAG) -#define FUTEX_REQUEUE_PRIVATE (FUTEX_REQUEUE | FUTEX_PRIVATE_FLAG) -#define FUTEX_CMP_REQUEUE_PRIVATE (FUTEX_CMP_REQUEUE | FUTEX_PRIVATE_FLAG) -#define FUTEX_WAKE_OP_PRIVATE (FUTEX_WAKE_OP | FUTEX_PRIVATE_FLAG) -#define FUTEX_LOCK_PI_PRIVATE (FUTEX_LOCK_PI | FUTEX_PRIVATE_FLAG) -#define FUTEX_LOCK_PI2_PRIVATE (FUTEX_LOCK_PI2 | FUTEX_PRIVATE_FLAG) -#define FUTEX_UNLOCK_PI_PRIVATE (FUTEX_UNLOCK_PI | FUTEX_PRIVATE_FLAG) -#define FUTEX_TRYLOCK_PI_PRIVATE (FUTEX_TRYLOCK_PI | FUTEX_PRIVATE_FLAG) + +#define FUTEX_CMD_MASK ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) + +#define FUTEX_WAIT_PRIVATE (FUTEX_WAIT | FUTEX_PRIVATE_FLAG) +#define FUTEX_WAKE_PRIVATE (FUTEX_WAKE | FUTEX_PRIVATE_FLAG) +#define FUTEX_REQUEUE_PRIVATE (FUTEX_REQUEUE | FUTEX_PRIVATE_FLAG) +#define FUTEX_CMP_REQUEUE_PRIVATE (FUTEX_CMP_REQUEUE | FUTEX_PRIVATE_FLAG) +#define FUTEX_WAKE_OP_PRIVATE (FUTEX_WAKE_OP | FUTEX_PRIVATE_FLAG) +#define FUTEX_LOCK_PI_PRIVATE (FUTEX_LOCK_PI | FUTEX_PRIVATE_FLAG) +#define FUTEX_LOCK_PI2_PRIVATE (FUTEX_LOCK_PI2 | FUTEX_PRIVATE_FLAG) +#define FUTEX_UNLOCK_PI_PRIVATE (FUTEX_UNLOCK_PI | FUTEX_PRIVATE_FLAG) +#define FUTEX_TRYLOCK_PI_PRIVATE (FUTEX_TRYLOCK_PI | FUTEX_PRIVATE_FLAG) #define FUTEX_WAIT_BITSET_PRIVATE (FUTEX_WAIT_BITSET | FUTEX_PRIVATE_FLAG) #define FUTEX_WAKE_BITSET_PRIVATE (FUTEX_WAKE_BITSET | FUTEX_PRIVATE_FLAG) -#define FUTEX_WAIT_REQUEUE_PI_PRIVATE (FUTEX_WAIT_REQUEUE_PI | \ - FUTEX_PRIVATE_FLAG) -#define FUTEX_CMP_REQUEUE_PI_PRIVATE (FUTEX_CMP_REQUEUE_PI | \ - FUTEX_PRIVATE_FLAG) +#define FUTEX_WAIT_REQUEUE_PI_PRIVATE (FUTEX_WAIT_REQUEUE_PI | FUTEX_PRIVATE_FLAG) +#define FUTEX_CMP_REQUEUE_PI_PRIVATE (FUTEX_CMP_REQUEUE_PI | FUTEX_PRIVATE_FLAG) /* * Flags for futex2 syscalls. -- cgit v1.2.3 From 3ca9595d9fb6cce6633a5b03d98c2aecb5499838 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:55 +0200 Subject: futex: Add support for unlocking robust futexes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Unlocking robust non-PI futexes happens in user space with the following sequence: 1) robust_list_set_op_pending(mutex); 2) robust_list_remove(mutex); lval = 0; 3) lval = atomic_xchg(lock, lval); 4) if (lval & WAITERS) 5) sys_futex(WAKE,....); 6) robust_list_clear_op_pending(); That opens a window between #3 and #6 where the mutex could be acquired by some other task which observes that it is the last user and: A) unmaps the mutex memory B) maps a different file, which ends up covering the same address When the original task exits before reaching #6 then the kernel robust list handling observes the pending op entry and tries to fix up user space. In case that the newly mapped data contains the TID of the exiting thread at the address of the mutex/futex the kernel will set the owner died bit in that memory and therefore corrupting unrelated data. PI futexes have a similar problem both for the non-contented user space unlock and the in kernel unlock: 1) robust_list_set_op_pending(mutex); 2) robust_list_remove(mutex); lval = gettid(); 3) if (!atomic_try_cmpxchg(lock, lval, 0)) 4) sys_futex(UNLOCK_PI,....); 5) robust_list_clear_op_pending(); Address the first part of the problem where the futexes have waiters and need to enter the kernel anyway. Add a new FUTEX_ROBUST_UNLOCK flag, which is valid for the sys_futex() FUTEX_UNLOCK_PI, FUTEX_WAKE, FUTEX_WAKE_BITSET operations. This deliberately omits FUTEX_WAKE_OP from this treatment as it's unclear whether this is needed and there is no usage of it in glibc either to investigate. For the futex2 syscall family this needs to be implemented with a new syscall. The sys_futex() case [ab]uses the @uaddr2 argument to hand the pointer to robust_list_head::list_pending_op into the kernel. This argument is only evaluated when the FUTEX_ROBUST_UNLOCK bit is set and is therefore backward compatible. This is an explicit argument to avoid the lookup of the robust list pointer and retrieving the pending op pointer from there. User space has the pointer already available so it can just put it into the @uaddr2 argument. Aside of that this allows the usage of multiple robust lists in the future without any changes to the internal functions as they just operate on the provided pointer. This requires a second flag FUTEX_ROBUST_LIST32 which indicates that the robust list pointer points to an u32 and not to an u64. This is required for two reasons: 1) sys_futex() has no compat variant 2) The gaming emulators use both both 64-bit and compat 32-bit robust lists in the same 64-bit application As a consequence 32-bit applications have to set this flag unconditionally so they can run on a 64-bit kernel in compat mode unmodified. 32-bit kernels return an error code when the flag is not set. 64-bit kernels will happily clear the full 64 bits if user space fails to set it. In case of FUTEX_UNLOCK_PI this clears the robust list pending op when the unlock succeeded. In case of errors, the user space value is still locked by the caller and therefore the above cannot happen. In case of FUTEX_WAKE* this does the unlock of the futex in the kernel and clears the robust list pending op when the unlock was successful. If not, the user space value is still locked and user space has to deal with the returned error. That means that the unlocking of non-PI robust futexes has to use the same try_cmpxchg() unlock scheme as PI futexes. If the clearing of the pending list op fails (fault) then the kernel clears the registered robust list pointer if it matches to prevent that exit() will try to handle invalid data. That's a valid paranoid decision because the robust list head sits usually in the TLS and if the TLS is not longer accessible then the chance for fixing up the resulting mess is very close to zero. The problem of non-contended unlocks still exists and will be addressed separately. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: André Almeida Link: https://patch.msgid.link/20260602090535.670514505@kernel.org --- include/uapi/linux/futex.h | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/futex.h b/include/uapi/linux/futex.h index 75df1eaff75d..10a36c551675 100644 --- a/include/uapi/linux/futex.h +++ b/include/uapi/linux/futex.h @@ -25,8 +25,11 @@ #define FUTEX_PRIVATE_FLAG 128 #define FUTEX_CLOCK_REALTIME 256 +#define FUTEX_ROBUST_UNLOCK 512 +#define FUTEX_ROBUST_LIST32 1024 -#define FUTEX_CMD_MASK ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME) +#define FUTEX_CMD_MASK ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME | \ + FUTEX_ROBUST_UNLOCK | FUTEX_ROBUST_LIST32) #define FUTEX_WAIT_PRIVATE (FUTEX_WAIT | FUTEX_PRIVATE_FLAG) #define FUTEX_WAKE_PRIVATE (FUTEX_WAKE | FUTEX_PRIVATE_FLAG) @@ -42,6 +45,30 @@ #define FUTEX_WAIT_REQUEUE_PI_PRIVATE (FUTEX_WAIT_REQUEUE_PI | FUTEX_PRIVATE_FLAG) #define FUTEX_CMP_REQUEUE_PI_PRIVATE (FUTEX_CMP_REQUEUE_PI | FUTEX_PRIVATE_FLAG) +/* + * Operations to unlock a futex, clear the robust list pending op pointer and + * wake waiters. + */ +#define FUTEX_UNLOCK_PI_LIST64 (FUTEX_UNLOCK_PI | FUTEX_ROBUST_UNLOCK) +#define FUTEX_UNLOCK_PI_LIST64_PRIVATE (FUTEX_UNLOCK_PI_LIST64 | FUTEX_PRIVATE_FLAG) +#define FUTEX_UNLOCK_PI_LIST32 (FUTEX_UNLOCK_PI | FUTEX_ROBUST_UNLOCK | \ + FUTEX_ROBUST_LIST32) +#define FUTEX_UNLOCK_PI_LIST32_PRIVATE (FUTEX_UNLOCK_PI_LIST32 | FUTEX_PRIVATE_FLAG) + +#define FUTEX_UNLOCK_WAKE_LIST64 (FUTEX_WAKE | FUTEX_ROBUST_UNLOCK) +#define FUTEX_UNLOCK_WAKE_LIST64_PRIVATE (FUTEX_UNLOCK_WAKE_LIST64 | FUTEX_PRIVATE_FLAG) + +#define FUTEX_UNLOCK_WAKE_LIST32 (FUTEX_WAKE | FUTEX_ROBUST_UNLOCK | \ + FUTEX_ROBUST_LIST32) +#define FUTEX_UNLOCK_WAKE_LIST32_PRIVATE (FUTEX_UNLOCK_WAKE_LIST32 | FUTEX_PRIVATE_FLAG) + +#define FUTEX_UNLOCK_BITSET_LIST64 (FUTEX_WAKE_BITSET | FUTEX_ROBUST_UNLOCK) +#define FUTEX_UNLOCK_BITSET_LIST64_PRIVATE (FUTEX_UNLOCK_BITSET_LIST64 | FUTEX_PRIVATE_FLAG) + +#define FUTEX_UNLOCK_BITSET_LIST32 (FUTEX_WAKE_BITSET | FUTEX_ROBUST_UNLOCK | \ + FUTEX_ROBUST_LIST32) +#define FUTEX_UNLOCK_BITSET_LIST32_PRIVATE (FUTEX_UNLOCK_BITSET_LIST32 | FUTEX_PRIVATE_FLAG) + /* * Flags for futex2 syscalls. * -- cgit v1.2.3 From 042df0c1d48609a85580dcbaff498c95ced20a5f Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:09:59 +0200 Subject: futex: Add robust futex unlock IP range MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There will be a VDSO function to unlock robust futexes in user space. The unlock sequence is racy vs. clearing the list_pending_op pointer in the tasks robust list head. To plug this race the kernel needs to know the instruction window. As the VDSO is per MM the addresses are stored in mm_struct::futex. Architectures which implement support for this have to update these addresses when the VDSO is (re)mapped and indicate the pending op pointer size which is matching the IP. Arguably this could be resolved by chasing mm->context->vdso->image, but that's architecture specific and requires to touch quite some cache lines. Having it in mm::futex reduces the cache line impact and avoids having yet another set of architecture specific functionality. To support multi size robust list applications (gaming) this provides two ranges when COMPAT is enabled. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: André Almeida Link: https://patch.msgid.link/20260602090535.718926819@kernel.org --- include/linux/futex.h | 21 ++++++++++++++++++--- include/linux/futex_types.h | 28 ++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/futex.h b/include/linux/futex.h index 9e6218c2be66..cb2a182547dd 100644 --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -81,11 +81,9 @@ int futex_hash_prctl(unsigned long arg2, unsigned long arg3, unsigned long arg4) #ifdef CONFIG_FUTEX_PRIVATE_HASH int futex_hash_allocate_default(void); void futex_hash_free(struct mm_struct *mm); -void futex_mm_init(struct mm_struct *mm); #else /* CONFIG_FUTEX_PRIVATE_HASH */ static inline int futex_hash_allocate_default(void) { return 0; } static inline int futex_hash_free(struct mm_struct *mm) { return 0; } -static inline void futex_mm_init(struct mm_struct *mm) { } #endif /* !CONFIG_FUTEX_PRIVATE_HASH */ #else /* CONFIG_FUTEX */ @@ -104,7 +102,24 @@ static inline int futex_hash_prctl(unsigned long arg2, unsigned long arg3, unsig } static inline int futex_hash_allocate_default(void) { return 0; } static inline int futex_hash_free(struct mm_struct *mm) { return 0; } -static inline void futex_mm_init(struct mm_struct *mm) { } #endif /* !CONFIG_FUTEX */ +#ifdef CONFIG_FUTEX_ROBUST_UNLOCK +void futex_reset_cs_ranges(struct futex_mm_data *fd); + +static inline void futex_set_vdso_cs_range(struct futex_mm_data *fd, unsigned int idx, + unsigned long start, unsigned long end, bool sz32) +{ + fd->unlock.cs_ranges[idx].start_ip = start; + fd->unlock.cs_ranges[idx].len = end - start; + fd->unlock.cs_ranges[idx].pop_size32 = sz32; +} +#endif /* CONFIG_FUTEX_ROBUST_UNLOCK */ + +#if defined(CONFIG_FUTEX_PRIVATE_HASH) || defined(CONFIG_FUTEX_ROBUST_UNLOCK) +void futex_mm_init(struct mm_struct *mm); +#else +static inline void futex_mm_init(struct mm_struct *mm) { } +#endif + #endif /* _LINUX_FUTEX_H */ diff --git a/include/linux/futex_types.h b/include/linux/futex_types.h index d41557d2790d..d320c0571f0c 100644 --- a/include/linux/futex_types.h +++ b/include/linux/futex_types.h @@ -55,12 +55,40 @@ struct futex_mm_phash { struct futex_mm_phash { }; #endif /* !CONFIG_FUTEX_ROBUST_UNLOCK */ +#ifdef CONFIG_FUTEX_ROBUST_UNLOCK +/** + * struct futex_unlock_cs_range - Range for the VDSO unlock critical section + * @start_ip: The start IP of the robust futex unlock critical section (inclusive) + * @len: The length of the robust futex unlock critical section + * @pop_size32: Pending OP pointer size indicator. 0 == 64-bit, 1 == 32-bit + */ +struct futex_unlock_cs_range { + unsigned long start_ip; + unsigned int len; + unsigned int pop_size32; +}; + +#define FUTEX_ROBUST_MAX_CS_RANGES (1 + IS_ENABLED(CONFIG_COMPAT)) + +/** + * struct futex_unlock_cs_ranges - Futex unlock VSDO critical sections + * @cs_ranges: Array of critical section ranges + */ +struct futex_unlock_cs_ranges { + struct futex_unlock_cs_range cs_ranges[FUTEX_ROBUST_MAX_CS_RANGES]; +}; +#else /* CONFIG_FUTEX_ROBUST_UNLOCK */ +struct futex_unlock_cs_ranges { }; +#endif /* !CONFIG_FUTEX_ROBUST_UNLOCK */ + /** * struct futex_mm_data - Futex related per MM data * @phash: Futex private hash related data + * @unlock: Futex unlock VDSO critical sections */ struct futex_mm_data { struct futex_mm_phash phash; + struct futex_unlock_cs_ranges unlock; }; #else /* CONFIG_FUTEX */ struct futex_sched_data { }; -- cgit v1.2.3 From 7010c39d8fc5063af69ee63f905e592e046f8e5d Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Tue, 2 Jun 2026 11:10:04 +0200 Subject: futex: Provide infrastructure to plug the non contended robust futex unlock race MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the FUTEX_ROBUST_UNLOCK mechanism is used for unlocking (PI-)futexes, then the unlock sequence in user space looks like this: 1) robust_list_set_op_pending(mutex); 2) robust_list_remove(mutex); lval = gettid(); 3) if (atomic_try_cmpxchg(&mutex->lock, lval, 0)) 4) robust_list_clear_op_pending(); else 5) sys_futex(OP | FUTEX_ROBUST_UNLOCK, ....); That still leaves a minimal race window between #3 and #4 where the mutex could be acquired by some other task, which observes that it is the last user and: 1) unmaps the mutex memory 2) maps a different file, which ends up covering the same address When then the original task exits before reaching #5 then the kernel robust list handling observes the pending op entry and tries to fix up user space. In case that the newly mapped data contains the TID of the exiting thread at the address of the mutex/futex the kernel will set the owner died bit in that memory and therefore corrupt unrelated data. On X86 this boils down to this simplified assembly sequence: mov %esi,%eax // Load TID into EAX xor %ecx,%ecx // Set ECX to 0 #3 lock cmpxchg %ecx,(%rdi) // Try the TID -> 0 transition .Lstart: jnz .Lend #4 movq %rcx,(%rdx) // Clear list_op_pending .Lend: If the cmpxchg() succeeds and the task is interrupted before it can clear list_op_pending in the robust list head (#4) and the task crashes in a signal handler or gets killed then it ends up in do_exit() and subsequently in the robust list handling, which then might run into the unmap/map issue described above. This is only relevant when user space was interrupted and a signal is pending. The fix-up has to be done before signal delivery is attempted because: 1) The signal might be fatal so get_signal() ends up in do_exit() 2) The signal handler might crash or the task is killed before returning from the handler. At that point the instruction pointer in pt_regs is not longer the instruction pointer of the initially interrupted unlock sequence. The right place to handle this is in __exit_to_user_mode_loop() before invoking arch_do_signal_or_restart() as this covers obviously both scenarios. As this is only relevant when the task was interrupted in user space, this is tied to RSEQ and the generic entry code as RSEQ keeps track of user space interrupts unconditionally even if the task does not have a RSEQ region installed. That makes the decision very lightweight: if (current->rseq.user_irq && within(regs, csr->unlock_ip_range)) futex_fixup_robust_unlock(regs, csr); futex_fixup_robust_unlock() then invokes a architecture specific function to return the pending op pointer or NULL. The function evaluates the register content to decide whether the pending ops pointer in the robust list head needs to be cleared. Assuming the above unlock sequence, then on x86 this decision is the trivial evaluation of the zero flag: return regs->eflags & X86_EFLAGS_ZF ? regs->dx : NULL; Other architectures might need to do more complex evaluations due to LLSC, but the approach is valid in general. The size of the pointer is determined from the matching range struct, which covers both 32-bit and 64-bit builds including COMPAT. The unlock sequence is going to be placed in the VDSO so that the kernel can keep everything synchronized, especially the register usage. The resulting code sequence for user space is: if (__vdso_futex_robust_list$SZ_try_unlock(lock, tid, &pending_op) != tid) err = sys_futex($OP | FUTEX_ROBUST_UNLOCK,....); Both the VDSO unlock and the kernel side unlock ensure that the pending_op pointer is always cleared when the lock becomes unlocked. Signed-off-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: André Almeida Link: https://patch.msgid.link/20260602090535.773669210@kernel.org --- include/linux/futex.h | 39 +++++++++++++++++++++++++++++++++++++- include/vdso/futex.h | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+), 1 deletion(-) create mode 100644 include/vdso/futex.h (limited to 'include') diff --git a/include/linux/futex.h b/include/linux/futex.h index cb2a182547dd..51f4ccdc9092 100644 --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -105,7 +105,41 @@ static inline int futex_hash_free(struct mm_struct *mm) { return 0; } #endif /* !CONFIG_FUTEX */ #ifdef CONFIG_FUTEX_ROBUST_UNLOCK +#include + void futex_reset_cs_ranges(struct futex_mm_data *fd); +void __futex_fixup_robust_unlock(struct pt_regs *regs, struct futex_unlock_cs_range *csr); + +static inline bool futex_within_robust_unlock(struct pt_regs *regs, + struct futex_unlock_cs_range *csr) +{ + unsigned long ip = instruction_pointer(regs); + + return ip >= csr->start_ip && ip < csr->start_ip + csr->len; +} + +static inline void futex_fixup_robust_unlock(struct pt_regs *regs) +{ + struct futex_unlock_cs_range *csr; + + /* + * Avoid dereferencing current->mm if not returning from interrupt. + * current->rseq.event is going to be used subsequently, so bringing the + * cache line in is not a big deal. + */ + if (!current->rseq.event.user_irq) + return; + + csr = current->mm->futex.unlock.cs_ranges; + + /* The loop is optimized out for !COMPAT */ + for (int r = 0; r < FUTEX_ROBUST_MAX_CS_RANGES; r++, csr++) { + if (unlikely(futex_within_robust_unlock(regs, csr))) { + __futex_fixup_robust_unlock(regs, csr); + return; + } + } +} static inline void futex_set_vdso_cs_range(struct futex_mm_data *fd, unsigned int idx, unsigned long start, unsigned long end, bool sz32) @@ -114,7 +148,10 @@ static inline void futex_set_vdso_cs_range(struct futex_mm_data *fd, unsigned in fd->unlock.cs_ranges[idx].len = end - start; fd->unlock.cs_ranges[idx].pop_size32 = sz32; } -#endif /* CONFIG_FUTEX_ROBUST_UNLOCK */ +#else /* CONFIG_FUTEX_ROBUST_UNLOCK */ +static inline void futex_fixup_robust_unlock(struct pt_regs *regs) { } +#endif /* !CONFIG_FUTEX_ROBUST_UNLOCK */ + #if defined(CONFIG_FUTEX_PRIVATE_HASH) || defined(CONFIG_FUTEX_ROBUST_UNLOCK) void futex_mm_init(struct mm_struct *mm); diff --git a/include/vdso/futex.h b/include/vdso/futex.h new file mode 100644 index 000000000000..3cd175eefe64 --- /dev/null +++ b/include/vdso/futex.h @@ -0,0 +1,52 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _VDSO_FUTEX_H +#define _VDSO_FUTEX_H + +#include + +/** + * __vdso_futex_robust_list64_try_unlock - Try to unlock an uncontended robust futex + * with a 64-bit pending op pointer + * @lock: Pointer to the futex lock object + * @tid: The TID of the calling task + * @pop: Pointer to the task's robust_list_head::list_pending_op + * + * Return: The content of *@lock. On success this is the same as @tid. + * + * The function implements: + * if (atomic_try_cmpxchg(lock, &tid, 0)) + * *op = NULL; + * return tid; + * + * There is a race between a successful unlock and clearing the pending op + * pointer in the robust list head. If the calling task is interrupted in the + * race window and has to handle a (fatal) signal on return to user space then + * the kernel handles the clearing of @pending_op before attempting to deliver + * the signal. That ensures that a task cannot exit with a potentially invalid + * pending op pointer. + * + * User space uses it in the following way: + * + * if (__vdso_futex_robust_list64_try_unlock(lock, tid, &pending_op) != tid) + * err = sys_futex($OP | FUTEX_ROBUST_UNLOCK,....); + * + * If the unlock attempt fails due to the FUTEX_WAITERS bit set in the lock, + * then the syscall does the unlock, clears the pending op pointer and wakes the + * requested number of waiters. + */ +__u32 __vdso_futex_robust_list64_try_unlock(__u32 *lock, __u32 tid, __u64 *pop); + +/** + * __vdso_futex_robust_list32_try_unlock - Try to unlock an uncontended robust futex + * with a 32-bit pending op pointer + * @lock: Pointer to the futex lock object + * @tid: The TID of the calling task + * @pop: Pointer to the task's robust_list_head::list_pending_op + * + * Return: The content of *@lock. On success this is the same as @tid. + * + * Same as __vdso_futex_robust_list64_try_unlock() just with a 32-bit @pop pointer. + */ +__u32 __vdso_futex_robust_list32_try_unlock(__u32 *lock, __u32 tid, __u32 *pop); + +#endif -- cgit v1.2.3 From e32d7f404d7d9dac307c1cd9a1fe132fa62ab6d6 Mon Sep 17 00:00:00 2001 From: Gabriele Monaco Date: Mon, 1 Jun 2026 17:38:29 +0200 Subject: rv: Reset per-task DA monitors before releasing the slot Per-task monitors use task_mon_slot to determine which slot in the array to use for the monitor. During destruction, this slot is returned but this is done before resetting the monitor. As a result, the monitor's reset is in fact resetting a slot that is outside of the array (RV_PER_TASK_MONITOR_INIT). Release the slot only after the reset to avoid out-of-bound memory access. Fixes: f5587d1b6ec93 ("rv: Add Hybrid Automata monitor type") Cc: stable@vger.kernel.org Suggested-by: Wen Yang Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-3-gmonaco@redhat.com Signed-off-by: Gabriele Monaco --- include/rv/da_monitor.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h index 39765ff6f098..1459fb3dfee6 100644 --- a/include/rv/da_monitor.h +++ b/include/rv/da_monitor.h @@ -309,10 +309,11 @@ static inline void da_monitor_destroy(void) WARN_ONCE(1, "Disabling a disabled monitor: " __stringify(MONITOR_NAME)); return; } - rv_put_task_monitor_slot(task_mon_slot); - task_mon_slot = RV_PER_TASK_MONITOR_INIT; da_monitor_reset_all(); + + rv_put_task_monitor_slot(task_mon_slot); + task_mon_slot = RV_PER_TASK_MONITOR_INIT; } #elif RV_MON_TYPE == RV_MON_PER_OBJ -- cgit v1.2.3 From c3d016ea823a9941ab8cbcef01a500821ff0cf16 Mon Sep 17 00:00:00 2001 From: Gabriele Monaco Date: Mon, 1 Jun 2026 17:38:30 +0200 Subject: rv: Prevent in-flight per-task handlers from using invalid slots Per-task monitors use a slot in the task_struct->rv[] array and store that locally (e.g. task_mon_slot), this slot is returned during the destruction process but currently hanlers can be running while that slot is returning and this race may lead to accessing an invalid slot. Synchronise with all in-flight tracepoint handlers using tracepoint_synchronize_unregister() before returning the slot. Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Fixes: a9769a5b9878 ("rv: Add support for LTL monitors") Suggested-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-4-gmonaco@redhat.com Signed-off-by: Gabriele Monaco --- include/rv/da_monitor.h | 4 ++++ include/rv/ltl_monitor.h | 1 + 2 files changed, 5 insertions(+) (limited to 'include') diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h index 1459fb3dfee6..cc97cc5dfbfd 100644 --- a/include/rv/da_monitor.h +++ b/include/rv/da_monitor.h @@ -302,6 +302,9 @@ static int da_monitor_init(void) /* * da_monitor_destroy - return the allocated slot + * + * Wait for all in-flight handlers before returning the slot to avoid + * out-of-bound accesses. */ static inline void da_monitor_destroy(void) { @@ -310,6 +313,7 @@ static inline void da_monitor_destroy(void) return; } + tracepoint_synchronize_unregister(); da_monitor_reset_all(); rv_put_task_monitor_slot(task_mon_slot); diff --git a/include/rv/ltl_monitor.h b/include/rv/ltl_monitor.h index eff60cd61106..38e792401f76 100644 --- a/include/rv/ltl_monitor.h +++ b/include/rv/ltl_monitor.h @@ -77,6 +77,7 @@ static void ltl_monitor_destroy(void) { rv_detach_trace_probe(name, task_newtask, handle_task_newtask); + tracepoint_synchronize_unregister(); rv_put_task_monitor_slot(ltl_monitor_slot); ltl_monitor_slot = RV_PER_TASK_MONITOR_INIT; } -- cgit v1.2.3 From 32171d828ab964dc1f05f2056a81477522a3361b Mon Sep 17 00:00:00 2001 From: Gabriele Monaco Date: Mon, 1 Jun 2026 17:38:31 +0200 Subject: rv: Ensure all pending probes terminate on per-obj monitor destroy The monitor disable/destroy sequence detaches all probes and resets the monitor's data, however it doesn't wait for pending probes. This is an issue with per-object monitors, which free the monitor storage. Call tracepoint_synchronize_unregister() to make sure to wait for all pending probes before destroying the monitor storage. Fixes: 4a24127bd6cb ("rv: Add support for per-object monitors in DA/HA") Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-5-gmonaco@redhat.com Signed-off-by: Gabriele Monaco --- include/rv/da_monitor.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h index cc97cc5dfbfd..a7e103654406 100644 --- a/include/rv/da_monitor.h +++ b/include/rv/da_monitor.h @@ -511,9 +511,10 @@ static inline void da_monitor_destroy(void) struct hlist_node *tmp; int bkt; + tracepoint_synchronize_unregister(); /* - * This function is called after all probes are disabled, we need only - * worry about concurrency against old events. + * This function is called after all probes are disabled and no longer + * pending, we can safely assume no concurrent user. */ synchronize_rcu(); hash_for_each_safe(da_monitor_ht, bkt, tmp, mon_storage, node) { -- cgit v1.2.3 From 2b9a8c27417eeef01967c6297def426a44776c04 Mon Sep 17 00:00:00 2001 From: Wen Yang Date: Mon, 1 Jun 2026 17:38:32 +0200 Subject: rv: Fix monitor start ordering and memory ordering for monitoring flag da_monitor_start() set monitoring=1 before calling da_monitor_init_hook(), may racing with the sched_switch handler: da_monitor_start() sched_switch handler ------------------------- --------------------------------- da_mon->monitoring = 1; if (da_monitoring(da_mon)) /* true */ ha_start_timer_ns(...); /* hrtimer->base == NULL, crash */ da_monitor_init_hook(da_mon); /* hrtimer_setup() sets base */ Fix the ordering and pair with release/acquire semantics: da_monitor_init_hook(da_mon); smp_store_release(&da_mon->monitoring, 1); /* da_monitor_start() */ return smp_load_acquire(&da_mon->monitoring); /* da_monitoring() */ On ARM64 a plain STR + LDR does not form a release-acquire pair, so the load can observe monitoring=1 while hrtimer->base is still NULL. The plain accesses are also data races under KCSAN. Use WRITE_ONCE for the monitoring=0 store in da_monitor_reset() to cover the reset path. Fixes: 792575348ff7 ("rv/include: Add deterministic automata monitor definition via C macros") Signed-off-by: Wen Yang Reviewed-by: Gabriele Monaco Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-6-gmonaco@redhat.com Signed-off-by: Gabriele Monaco --- include/rv/da_monitor.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h index a7e103654406..60dc39f2620a 100644 --- a/include/rv/da_monitor.h +++ b/include/rv/da_monitor.h @@ -82,7 +82,7 @@ static void react(enum states curr_state, enum events event) static inline void da_monitor_reset(struct da_monitor *da_mon) { da_monitor_reset_hook(da_mon); - da_mon->monitoring = 0; + WRITE_ONCE(da_mon->monitoring, 0); da_mon->curr_state = model_get_initial_state(); } @@ -95,8 +95,9 @@ static inline void da_monitor_reset(struct da_monitor *da_mon) static inline void da_monitor_start(struct da_monitor *da_mon) { da_mon->curr_state = model_get_initial_state(); - da_mon->monitoring = 1; da_monitor_init_hook(da_mon); + /* Pairs with smp_load_acquire in da_monitoring(). */ + smp_store_release(&da_mon->monitoring, 1); } /* @@ -104,7 +105,8 @@ static inline void da_monitor_start(struct da_monitor *da_mon) */ static inline bool da_monitoring(struct da_monitor *da_mon) { - return da_mon->monitoring; + /* Pairs with smp_store_release in da_monitor_start(). */ + return smp_load_acquire(&da_mon->monitoring); } /* -- cgit v1.2.3 From 713c9e1ea7623846f8e0bb657f1b9d211d1a61e6 Mon Sep 17 00:00:00 2001 From: Gabriele Monaco Date: Mon, 1 Jun 2026 17:38:33 +0200 Subject: rv: Do not rely on clean monitor when initialising HA Hybrid Automata monitors hook into the DA implementation when doing da_monitor_reset(). This function is called both on initialisation and teardown, HA monitors try to cancel a timer only when it's initialised relying on the da_mon->monitoring flag. This flag could however be corrupted during initialisation. This happens for instance on per-task monitors that share the same storage with different type of monitors like LTL or in case of races during a previous teardown. Stop relying on the monitoring flag during initialisation, assume that can have any value, so use a separate da_reset_state() skiping timer cancellation. New monitors (e.g. new tasks) are always zero-initialised so it is safe to rely on the monitoring flag for those. Reported-by: Wen Yang Closes: https://lore.kernel.org/lkml/d02c656aada7d071f083460a5c9a454363669b61.1778522945.git.wen.yang@linux.dev Suggested-by: Nam Cao Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-7-gmonaco@redhat.com Signed-off-by: Gabriele Monaco --- include/rv/da_monitor.h | 91 ++++++++++++++++++++++++++++++++++++++++--------- include/rv/ha_monitor.h | 2 +- 2 files changed, 76 insertions(+), 17 deletions(-) (limited to 'include') diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h index 60dc39f2620a..ec9bc88bd4c4 100644 --- a/include/rv/da_monitor.h +++ b/include/rv/da_monitor.h @@ -76,14 +76,22 @@ static void react(enum states curr_state, enum events event) model_get_state_name(curr_state)); } +/* + * da_monitor_reset_state - reset a monitor and setting it to init state + */ +static inline void da_monitor_reset_state(struct da_monitor *da_mon) +{ + WRITE_ONCE(da_mon->monitoring, 0); + da_mon->curr_state = model_get_initial_state(); +} + /* * da_monitor_reset - reset a monitor and setting it to init state */ static inline void da_monitor_reset(struct da_monitor *da_mon) { da_monitor_reset_hook(da_mon); - WRITE_ONCE(da_mon->monitoring, 0); - da_mon->curr_state = model_get_initial_state(); + da_monitor_reset_state(da_mon); } /* @@ -158,12 +166,28 @@ static struct da_monitor *da_get_monitor(void) return &DA_MON_NAME; } +/* + * __da_monitor_reset_all - reset the single monitor + */ +static void __da_monitor_reset_all(void (*reset)(struct da_monitor *)) +{ + reset(da_get_monitor()); +} + /* * da_monitor_reset_all - reset the single monitor */ static void da_monitor_reset_all(void) { - da_monitor_reset(da_get_monitor()); + __da_monitor_reset_all(da_monitor_reset); +} + +/* + * da_monitor_reset_state_all - reset the single monitor + */ +static inline void da_monitor_reset_state_all(void) +{ + __da_monitor_reset_all(da_monitor_reset_state); } /* @@ -171,7 +195,7 @@ static void da_monitor_reset_all(void) */ static inline int da_monitor_init(void) { - da_monitor_reset_all(); + da_monitor_reset_state_all(); return 0; } @@ -202,25 +226,41 @@ static struct da_monitor *da_get_monitor(void) } /* - * da_monitor_reset_all - reset all CPUs' monitor + * __da_monitor_reset_all - reset all CPUs' monitor */ -static void da_monitor_reset_all(void) +static void __da_monitor_reset_all(void (*reset)(struct da_monitor *)) { struct da_monitor *da_mon; int cpu; for_each_cpu(cpu, cpu_online_mask) { da_mon = per_cpu_ptr(&DA_MON_NAME, cpu); - da_monitor_reset(da_mon); + reset(da_mon); } } +/* + * da_monitor_reset_all - reset all CPUs' monitor + */ +static void da_monitor_reset_all(void) +{ + __da_monitor_reset_all(da_monitor_reset); +} + +/* + * da_monitor_reset_state_all - reset all CPUs' monitor + */ +static inline void da_monitor_reset_state_all(void) +{ + __da_monitor_reset_all(da_monitor_reset_state); +} + /* * da_monitor_init - initialize all CPUs' monitor */ static inline int da_monitor_init(void) { - da_monitor_reset_all(); + da_monitor_reset_state_all(); return 0; } @@ -269,19 +309,29 @@ static inline da_id_type da_get_id(struct da_monitor *da_mon) return da_get_target(da_mon)->pid; } -static void da_monitor_reset_all(void) +static void __da_monitor_reset_all(void (*reset)(struct da_monitor *)) { struct task_struct *g, *p; int cpu; read_lock(&tasklist_lock); for_each_process_thread(g, p) - da_monitor_reset(da_get_monitor(p)); + reset(da_get_monitor(p)); for_each_present_cpu(cpu) - da_monitor_reset(da_get_monitor(idle_task(cpu))); + reset(da_get_monitor(idle_task(cpu))); read_unlock(&tasklist_lock); } +static void da_monitor_reset_all(void) +{ + __da_monitor_reset_all(da_monitor_reset); +} + +static inline void da_monitor_reset_state_all(void) +{ + __da_monitor_reset_all(da_monitor_reset_state); +} + /* * da_monitor_init - initialize the per-task monitor * @@ -298,7 +348,7 @@ static int da_monitor_init(void) task_mon_slot = slot; - da_monitor_reset_all(); + da_monitor_reset_state_all(); return 0; } @@ -490,15 +540,24 @@ static inline void da_destroy_storage(da_id_type id) kfree_rcu(mon_storage, rcu); } -static void da_monitor_reset_all(void) +static void __da_monitor_reset_all(void (*reset)(struct da_monitor *)) { struct da_monitor_storage *mon_storage; int bkt; - rcu_read_lock(); + guard(rcu)(); hash_for_each_rcu(da_monitor_ht, bkt, mon_storage, node) - da_monitor_reset(&mon_storage->rv.da_mon); - rcu_read_unlock(); + reset(&mon_storage->rv.da_mon); +} + +static void da_monitor_reset_all(void) +{ + __da_monitor_reset_all(da_monitor_reset); +} + +static inline void da_monitor_reset_state_all(void) +{ + __da_monitor_reset_all(da_monitor_reset_state); } static inline int da_monitor_init(void) diff --git a/include/rv/ha_monitor.h b/include/rv/ha_monitor.h index d59507e8cb30..bd87055567cc 100644 --- a/include/rv/ha_monitor.h +++ b/include/rv/ha_monitor.h @@ -153,12 +153,12 @@ static inline void ha_monitor_init_env(struct da_monitor *da_mon) * Called from a hook in the DA reset functions, it supplies the da_mon * corresponding to the current ha_mon. * Not all hybrid automata require the timer, still clear it for simplicity. + * Monitors that never started have their timer uninitialized, do not stop those. */ static inline void ha_monitor_reset_env(struct da_monitor *da_mon) { struct ha_monitor *ha_mon = to_ha_monitor(da_mon); - /* Initialisation resets the monitor before initialising the timer */ if (likely(da_monitoring(da_mon))) ha_cancel_timer(ha_mon); } -- cgit v1.2.3 From 700782ec8f6589c5792b323efd6e004dd183328b Mon Sep 17 00:00:00 2001 From: Gabriele Monaco Date: Mon, 1 Jun 2026 17:38:34 +0200 Subject: rv: Add automatic cleanup handlers for per-task HA monitors Hybrid automata monitors may start timers, depending on the model, these may remain active on an exiting task and cause false positives or even access freed memory. Add an enable/disable hook in the HA code, currently only populated by the per-task handler for registration and deregistration. This hooks to the sched_process_exit event and ensures the timer is stopped for every exiting task. The handler is enabled automatically but may be disabled, for instance if the monitor uses the event for another purpose (but should still manually ensure timers are stopped). Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-8-gmonaco@redhat.com Signed-off-by: Gabriele Monaco --- include/rv/ha_monitor.h | 60 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) (limited to 'include') diff --git a/include/rv/ha_monitor.h b/include/rv/ha_monitor.h index bd87055567cc..4002b5247c46 100644 --- a/include/rv/ha_monitor.h +++ b/include/rv/ha_monitor.h @@ -28,6 +28,7 @@ static inline void ha_monitor_init_env(struct da_monitor *da_mon); static inline void ha_monitor_reset_env(struct da_monitor *da_mon); static inline void ha_setup_timer(struct ha_monitor *ha_mon); static inline bool ha_cancel_timer(struct ha_monitor *ha_mon); +static inline void ha_cancel_timer_sync(struct ha_monitor *ha_mon); static bool ha_monitor_handle_constraint(struct da_monitor *da_mon, enum states curr_state, enum events event, @@ -37,6 +38,26 @@ static bool ha_monitor_handle_constraint(struct da_monitor *da_mon, #define da_monitor_init_hook ha_monitor_init_env #define da_monitor_reset_hook ha_monitor_reset_env +#if !defined(HA_SKIP_AUTO_CLEANUP) && RV_MON_TYPE == RV_MON_PER_TASK +/* + * Automatic cleanup handlers for per-task HA monitors, only skip if you know + * what you are doing (e.g. you want to implement cleanup manually in another + * handler doing more things). + */ +static void ha_handle_sched_process_exit(void *data, struct task_struct *p, + bool group_dead); + +#define ha_monitor_enable_hook() \ + rv_attach_trace_probe(__stringify(MONITOR_NAME), sched_process_exit, \ + ha_handle_sched_process_exit) +#define ha_monitor_disable_hook() \ + rv_detach_trace_probe(__stringify(MONITOR_NAME), sched_process_exit, \ + ha_handle_sched_process_exit) +#else +#define ha_monitor_enable_hook() ((void)0) +#define ha_monitor_disable_hook() ((void)0) +#endif + #include #include @@ -115,6 +136,22 @@ static enum hrtimer_restart ha_monitor_timer_callback(struct hrtimer *hrtimer); #define ha_get_ns() 0 #endif /* HA_CLK_NS */ +static int ha_monitor_init(void) +{ + int ret; + + ret = da_monitor_init(); + if (ret == 0) + ha_monitor_enable_hook(); + return ret; +} + +static void ha_monitor_destroy(void) +{ + ha_monitor_disable_hook(); + da_monitor_destroy(); +} + /* Should be supplied by the monitor */ static u64 ha_get_env(struct ha_monitor *ha_mon, enum envs env, u64 time_ns); static bool ha_verify_constraint(struct ha_monitor *ha_mon, @@ -200,6 +237,20 @@ static inline void ha_trace_error_env(struct ha_monitor *ha_mon, { CONCATENATE(trace_error_env_, MONITOR_NAME)(id, curr_state, event, env); } + +#if !defined(HA_SKIP_AUTO_CLEANUP) && RV_MON_TYPE == RV_MON_PER_TASK +static void ha_handle_sched_process_exit(void *data, struct task_struct *p, + bool group_dead) +{ + struct da_monitor *da_mon = da_get_monitor(p); + + if (likely(da_monitoring(da_mon))) { + da_monitor_reset(da_mon); + ha_cancel_timer_sync(to_ha_monitor(da_mon)); + } +} +#endif + #endif /* RV_MON_TYPE */ /* @@ -412,6 +463,10 @@ static inline bool ha_cancel_timer(struct ha_monitor *ha_mon) { return timer_delete(&ha_mon->timer); } +static inline void ha_cancel_timer_sync(struct ha_monitor *ha_mon) +{ + timer_delete_sync(&ha_mon->timer); +} #elif HA_TIMER_TYPE == HA_TIMER_HRTIMER /* * Helper functions to handle the monitor timer. @@ -463,6 +518,10 @@ static inline bool ha_cancel_timer(struct ha_monitor *ha_mon) { return hrtimer_try_to_cancel(&ha_mon->hrtimer) == 1; } +static inline void ha_cancel_timer_sync(struct ha_monitor *ha_mon) +{ + hrtimer_cancel(&ha_mon->hrtimer); +} #else /* HA_TIMER_NONE */ /* * Start function is intentionally not defined, monitors using timers must @@ -473,6 +532,7 @@ static inline bool ha_cancel_timer(struct ha_monitor *ha_mon) { return false; } +static inline void ha_cancel_timer_sync(struct ha_monitor *ha_mon) { } #endif #endif -- cgit v1.2.3 From 74e17bd6fc8ed7e30363bb78d4c50b38cfd71efe Mon Sep 17 00:00:00 2001 From: Gabriele Monaco Date: Mon, 1 Jun 2026 17:38:35 +0200 Subject: rv: Ensure synchronous cleanup for HA monitors HA monitors may start timers, all cleanup functions currently stop the timers asynchronously to avoid sleeping in the wrong context. Nothing makes sure running callbacks terminate on cleanup. Run the entire HA timer callback in an RCU read-side critical section, this way we can simply synchronize_rcu() with any pending timer and are sure any cleanup using kfree_rcu() runs after callbacks terminated. Additionally make sure any unlikely callback running late won't run any code if the monitor is marked as disabled or if destruction started. Use memory barriers to serialise with racing resets. Fixes: f5587d1b6ec9 ("rv: Add Hybrid Automata monitor type") Fixes: 4a24127bd6cb ("rv: Add support for per-object monitors in DA/HA") Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-9-gmonaco@redhat.com Signed-off-by: Gabriele Monaco --- include/rv/da_monitor.h | 19 ++++++++++++++++--- include/rv/ha_monitor.h | 29 ++++++++++++++++++++++++++--- 2 files changed, 42 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h index ec9bc88bd4c4..1f440c7818e6 100644 --- a/include/rv/da_monitor.h +++ b/include/rv/da_monitor.h @@ -57,6 +57,15 @@ static struct rv_monitor rv_this; #define da_monitor_reset_hook(da_mon) #endif +/* + * Hook to allow the implementation of hybrid automata: define it with a + * function that waits for the termination of all monitors background + * activities (e.g. all timers). This hook can sleep. + */ +#ifndef da_monitor_sync_hook +#define da_monitor_sync_hook() +#endif + /* * Type for the target id, default to int but can be overridden. * A long type can work as hash table key (PER_OBJ) but will be downgraded to @@ -82,7 +91,8 @@ static void react(enum states curr_state, enum events event) static inline void da_monitor_reset_state(struct da_monitor *da_mon) { WRITE_ONCE(da_mon->monitoring, 0); - da_mon->curr_state = model_get_initial_state(); + /* Pair with load in __ha_monitor_timer_callback */ + smp_store_release(&da_mon->curr_state, model_get_initial_state()); } /* @@ -205,6 +215,7 @@ static inline int da_monitor_init(void) static inline void da_monitor_destroy(void) { da_monitor_reset_all(); + da_monitor_sync_hook(); } #elif RV_MON_TYPE == RV_MON_PER_CPU @@ -270,6 +281,7 @@ static inline int da_monitor_init(void) static inline void da_monitor_destroy(void) { da_monitor_reset_all(); + da_monitor_sync_hook(); } #elif RV_MON_TYPE == RV_MON_PER_TASK @@ -367,6 +379,7 @@ static inline void da_monitor_destroy(void) tracepoint_synchronize_unregister(); da_monitor_reset_all(); + da_monitor_sync_hook(); rv_put_task_monitor_slot(task_mon_slot); task_mon_slot = RV_PER_TASK_MONITOR_INIT; @@ -573,13 +586,13 @@ static inline void da_monitor_destroy(void) int bkt; tracepoint_synchronize_unregister(); + da_monitor_reset_all(); + da_monitor_sync_hook(); /* * This function is called after all probes are disabled and no longer * pending, we can safely assume no concurrent user. */ - synchronize_rcu(); hash_for_each_safe(da_monitor_ht, bkt, tmp, mon_storage, node) { - da_monitor_reset_hook(&mon_storage->rv.da_mon); hash_del_rcu(&mon_storage->node); kfree(mon_storage); } diff --git a/include/rv/ha_monitor.h b/include/rv/ha_monitor.h index 4002b5247c46..28d3c74cabfc 100644 --- a/include/rv/ha_monitor.h +++ b/include/rv/ha_monitor.h @@ -37,6 +37,7 @@ static bool ha_monitor_handle_constraint(struct da_monitor *da_mon, #define da_monitor_event_hook ha_monitor_handle_constraint #define da_monitor_init_hook ha_monitor_init_env #define da_monitor_reset_hook ha_monitor_reset_env +#define da_monitor_sync_hook() synchronize_rcu() #if !defined(HA_SKIP_AUTO_CLEANUP) && RV_MON_TYPE == RV_MON_PER_TASK /* @@ -136,10 +137,13 @@ static enum hrtimer_restart ha_monitor_timer_callback(struct hrtimer *hrtimer); #define ha_get_ns() 0 #endif /* HA_CLK_NS */ +static bool ha_mon_destroying; + static int ha_monitor_init(void) { int ret; + WRITE_ONCE(ha_mon_destroying, false); ret = da_monitor_init(); if (ret == 0) ha_monitor_enable_hook(); @@ -148,6 +152,7 @@ static int ha_monitor_init(void) static void ha_monitor_destroy(void) { + WRITE_ONCE(ha_mon_destroying, true); ha_monitor_disable_hook(); da_monitor_destroy(); } @@ -288,12 +293,30 @@ static bool ha_monitor_handle_constraint(struct da_monitor *da_mon, return false; } +/* + * __ha_monitor_timer_callback - generic callback representation + * + * This callback runs in an RCU read-side critical section to allow the + * destruction sequence to easily synchronize_rcu() with all pending timers + * after asynchronously disabling them. The ha_mon_destroying check ensures + * any callback entering the RCU section after synchronize_rcu() completes + * will see the flag and bail out immediately. + */ static inline void __ha_monitor_timer_callback(struct ha_monitor *ha_mon) { - enum states curr_state = READ_ONCE(ha_mon->da_mon.curr_state); DECLARE_SEQ_BUF(env_string, ENV_BUFFER_SIZE); - u64 time_ns = ha_get_ns(); - + enum states curr_state; + u64 time_ns; + + guard(rcu)(); + if (unlikely(READ_ONCE(ha_mon_destroying))) + return; + /* Ensure consistent curr_state if we race with da_monitor_reset */ + curr_state = smp_load_acquire(&ha_mon->da_mon.curr_state); + if (unlikely(!da_monitor_handling_event(&ha_mon->da_mon))) + return; + + time_ns = ha_get_ns(); ha_get_env_string(&env_string, ha_mon, time_ns); ha_react(curr_state, EVENT_NONE, env_string.buffer); ha_trace_error_env(ha_mon, model_get_state_name(curr_state), -- cgit v1.2.3 From 7c147fae71f3b3542ba3292d2099ef7237cfc0da Mon Sep 17 00:00:00 2001 From: Gabriele Monaco Date: Mon, 1 Jun 2026 17:38:36 +0200 Subject: rv: Prevent task migration while handling per-CPU events Tracepoint handlers are fully preemptible after a46023d5616 ("tracing: Guard __DECLARE_TRACE() use of __DO_TRACE_CALL() with SRCU-fast"). When a per-CPU monitor handles an event, it retrieves the monitor state using a per-CPU pointer. If the event itself doesn't disable preemption, the task can migrate to a different CPU and we risk updating the wrong monitor. Mitigate this by explicitly disabling task migration before acquiring the monitor pointer. This cannot guarantee the monitor runs on the correct CPU but reduces the race condition window and prevents warnings. Reviewed-by: Wen Yang Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20260601153840.124372-10-gmonaco@redhat.com Signed-off-by: Gabriele Monaco --- include/rv/da_monitor.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include') diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h index 1f440c7818e6..34b8fba9ecd4 100644 --- a/include/rv/da_monitor.h +++ b/include/rv/da_monitor.h @@ -218,6 +218,10 @@ static inline void da_monitor_destroy(void) da_monitor_sync_hook(); } +#ifndef da_implicit_guard +#define da_implicit_guard() +#endif + #elif RV_MON_TYPE == RV_MON_PER_CPU /* * Functions to define, init and get a per-cpu monitor. @@ -284,6 +288,10 @@ static inline void da_monitor_destroy(void) da_monitor_sync_hook(); } +#ifndef da_implicit_guard +#define da_implicit_guard() guard(migrate)() +#endif + #elif RV_MON_TYPE == RV_MON_PER_TASK /* * Functions to define, init and get a per-task monitor. @@ -756,6 +764,7 @@ static inline bool __da_handle_start_run_event(struct da_monitor *da_mon, */ static inline void da_handle_event(enum events event) { + da_implicit_guard(); __da_handle_event(da_get_monitor(), event, 0); } @@ -771,6 +780,7 @@ static inline void da_handle_event(enum events event) */ static inline bool da_handle_start_event(enum events event) { + da_implicit_guard(); return __da_handle_start_event(da_get_monitor(), event, 0); } @@ -782,6 +792,7 @@ static inline bool da_handle_start_event(enum events event) */ static inline bool da_handle_start_run_event(enum events event) { + da_implicit_guard(); return __da_handle_start_run_event(da_get_monitor(), event, 0); } -- cgit v1.2.3 From 1a15bf9708ba3bf80410065e113aa17cd6a18dcf Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 29 May 2026 08:40:27 +0200 Subject: wifi: cfg80211: remove 5/10 MHz channel support Remove WIPHY_FLAG_SUPPORTS_5_10_MHZ and 5/10 MHz channel width support. We contemplated this back in early 2023 and didn't do it yet, but nobody stepped up to maintain it. It's already _mostly_ dead code since it can really only be used for AP and maybe IBSS and monitor, but not on a client since there's no way to scan (and hasn't been in a very long time, if ever), so the only thing that ever could really happen with it was run syzbot and trip over assumptions in the code. Signed-off-by: Johannes Berg Reviewed-by: Lachlan Hodges Link: https://patch.msgid.link/20260529084502.080c5885f0b7.I77cc94485b523c3c006005b9233db13cd4e077b3@changeid Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 69dc9a978861..f91a71c7f4db 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -5676,7 +5676,6 @@ struct cfg80211_ops { * responds to probe-requests in hardware. * @WIPHY_FLAG_OFFCHAN_TX: Device supports direct off-channel TX. * @WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL: Device supports remain-on-channel call. - * @WIPHY_FLAG_SUPPORTS_5_10_MHZ: Device supports 5 MHz and 10 MHz channels. * @WIPHY_FLAG_HAS_CHANNEL_SWITCH: Device supports channel switch in * beaconing mode (AP, IBSS, Mesh, ...). * @WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK: The device supports bigger kek and kck keys @@ -5716,7 +5715,6 @@ enum wiphy_flags { WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD = BIT(19), WIPHY_FLAG_OFFCHAN_TX = BIT(20), WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL = BIT(21), - WIPHY_FLAG_SUPPORTS_5_10_MHZ = BIT(22), WIPHY_FLAG_HAS_CHANNEL_SWITCH = BIT(23), WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER = BIT(24), WIPHY_FLAG_CHANNEL_CHANGE_ON_BEACON = BIT(25), -- cgit v1.2.3 From 4ac20bd40b7db8568aea5ba1d390241842e41ed8 Mon Sep 17 00:00:00 2001 From: Masashi Honma Date: Sat, 30 May 2026 08:09:43 +0900 Subject: wifi: mac80211: Use struct instead of macro for PREQ frame The existing PREQ_IE_* macros access HWMP PREQ frame fields via hardcoded byte offsets. When the AE (Address Extension) flag is set, an additional 6 bytes appear mid-frame, and the macros handle this with conditional arithmetic (e.g., AE_F_SET(x) ? x + N+6 : x + N). This approach obscures the frame layout and is prone to miscalculation. Introduce typed packed C structs to represent the PREQ frame layout: - ieee80211_mesh_hwmp_preq_top: fixed fields before the optional AE address - ieee80211_mesh_hwmp_preq_bottom: fields after the optional AE address - ieee80211_mesh_hwmp_preq_target: per-target fields Add ieee80211_mesh_hwmp_preq_get_bottom() to locate the bottom struct correctly based on whether the AE flag is set. This preparatory refactoring is needed to fix a 2-byte overread of target_addr in hwmp_preq_frame_process() when AE is enabled, which is addressed in a subsequent patch. Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-1-masashi.honma@gmail.com Signed-off-by: Johannes Berg --- include/linux/ieee80211-mesh.h | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) (limited to 'include') diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h index 4b829bcb38b6..bf4a544aed00 100644 --- a/include/linux/ieee80211-mesh.h +++ b/include/linux/ieee80211-mesh.h @@ -28,12 +28,40 @@ struct ieee80211s_hdr { u8 eaddr2[ETH_ALEN]; } __packed __aligned(2); +struct ieee80211_mesh_hwmp_preq_target { + u8 flags; + u8 addr[ETH_ALEN]; + __le32 sn; +} __packed; + +struct ieee80211_mesh_hwmp_preq_top { + u8 flags; + u8 hopcount; + u8 ttl; + __le32 preq_id; + u8 orig_addr[ETH_ALEN]; + __le32 orig_sn; + + /* optional AE, lifetime, metric, target */ + u8 variable[]; +} __packed; + +struct ieee80211_mesh_hwmp_preq_bottom { + __le32 lifetime; + __le32 metric; + u8 target_count; + struct ieee80211_mesh_hwmp_preq_target targets[]; +} __packed; + /* Mesh flags */ #define MESH_FLAGS_AE_A4 0x1 #define MESH_FLAGS_AE_A5_A6 0x2 #define MESH_FLAGS_AE 0x3 #define MESH_FLAGS_PS_DEEP 0x4 +/* HWMP IE processing macros */ +#define AE_F (1<<6) + /** * enum ieee80211_preq_flags - mesh PREQ element flags * @@ -227,4 +255,18 @@ enum ieee80211_root_mode_identifier { IEEE80211_PROACTIVE_RANN = 4, }; +static inline bool ieee80211_mesh_preq_prep_ae_enabled(const u8 *ie) +{ + return ie[0] & AE_F; +} + +static inline struct ieee80211_mesh_hwmp_preq_bottom * +ieee80211_mesh_hwmp_preq_get_bottom(const u8 *ie) +{ + struct ieee80211_mesh_hwmp_preq_top *top = (void *)ie; + + return (void *)&top->variable[ + ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0]; +} + #endif /* LINUX_IEEE80211_MESH_H */ -- cgit v1.2.3 From a91c65cb99d1e03c8d8f0244258cbdd2d60faa86 Mon Sep 17 00:00:00 2001 From: Masashi Honma Date: Sat, 30 May 2026 08:09:44 +0900 Subject: wifi: mac80211: Use struct instead of macro for PREP frame The existing PREP_IE_* macros access HWMP PREP frame fields via hardcoded byte offsets. When the AE (Address Extension) flag is set, an additional 6 bytes appear mid-frame, making the offset arithmetic error-prone. Introduce typed packed C structs to represent the PREP frame layout: - ieee80211_mesh_hwmp_prep_top: fixed fields before the optional AE address - ieee80211_mesh_hwmp_prep_bottom: fields after the optional AE address Add ieee80211_mesh_hwmp_prep_get_bottom() to locate the bottom struct correctly based on whether the AE flag is set. This preparatory refactoring is needed to fix a 2-byte overread of orig_addr in hwmp_prep_frame_process() when AE is enabled, which is addressed in a subsequent patch. Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-2-masashi.honma@gmail.com Signed-off-by: Johannes Berg --- include/linux/ieee80211-mesh.h | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'include') diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h index bf4a544aed00..4ce4e47d6d01 100644 --- a/include/linux/ieee80211-mesh.h +++ b/include/linux/ieee80211-mesh.h @@ -53,6 +53,24 @@ struct ieee80211_mesh_hwmp_preq_bottom { struct ieee80211_mesh_hwmp_preq_target targets[]; } __packed; +struct ieee80211_mesh_hwmp_prep_top { + u8 flags; + u8 hopcount; + u8 ttl; + u8 target_addr[ETH_ALEN]; + __le32 target_sn; + + /* optional Target External Address */ + u8 variable[]; +} __packed; + +struct ieee80211_mesh_hwmp_prep_bottom { + __le32 lifetime; + __le32 metric; + u8 orig_addr[ETH_ALEN]; + __le32 orig_sn; +} __packed; + /* Mesh flags */ #define MESH_FLAGS_AE_A4 0x1 #define MESH_FLAGS_AE_A5_A6 0x2 @@ -269,4 +287,13 @@ ieee80211_mesh_hwmp_preq_get_bottom(const u8 *ie) ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0]; } +static inline struct ieee80211_mesh_hwmp_prep_bottom * +ieee80211_mesh_hwmp_prep_get_bottom(const u8 *ie) +{ + struct ieee80211_mesh_hwmp_prep_top *top = (void *)ie; + + return (void *)&top->variable[ + ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0]; +} + #endif /* LINUX_IEEE80211_MESH_H */ -- cgit v1.2.3 From 68511e16320b19387a8593c578a7ebe307c05166 Mon Sep 17 00:00:00 2001 From: Masashi Honma Date: Sat, 30 May 2026 08:09:45 +0900 Subject: wifi: mac80211: Use struct instead of macro for PERR frame The existing PERR_IE_* macros access HWMP PERR frame fields via hardcoded byte offsets. Each PERR destination entry contains an optional 6-byte AE (Address Extension) address followed by a reason code, making offset-based access error-prone. Introduce typed packed C structs to represent the PERR frame layout: - ieee80211_mesh_hwmp_perr: top-level frame containing TTL and destination count - ieee80211_mesh_hwmp_perr_dst: per-destination entry with optional AE address and variable-position reason code Add ieee80211_mesh_hwmp_perr_get_rcode() to locate the reason code in each destination entry depending on whether the AE flag is set. This refactoring makes the PERR processing code consistent with the struct-based approach adopted for PREQ and PREP in preceding patches. Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-3-masashi.honma@gmail.com Signed-off-by: Johannes Berg --- include/linux/ieee80211-mesh.h | 62 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) (limited to 'include') diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h index 4ce4e47d6d01..f709263c310b 100644 --- a/include/linux/ieee80211-mesh.h +++ b/include/linux/ieee80211-mesh.h @@ -71,6 +71,21 @@ struct ieee80211_mesh_hwmp_prep_bottom { __le32 orig_sn; } __packed; +struct ieee80211_mesh_hwmp_perr_dst { + u8 flags; + u8 addr[ETH_ALEN]; + __le32 sn; + /* optional Destination External Address */ + u8 variable[]; +} __packed; + +struct ieee80211_mesh_hwmp_perr { + u8 ttl; + u8 number_of_dst; + /* Destinations */ + u8 variable[]; +} __packed; + /* Mesh flags */ #define MESH_FLAGS_AE_A4 0x1 #define MESH_FLAGS_AE_A5_A6 0x2 @@ -296,4 +311,51 @@ ieee80211_mesh_hwmp_prep_get_bottom(const u8 *ie) ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0]; } +static inline struct ieee80211_mesh_hwmp_perr_dst * +ieee80211_mesh_hwmp_perr_get_dst(const u8 *ie, u8 dst_idx) +{ + struct ieee80211_mesh_hwmp_perr *perr_ie = (void *)ie; + struct ieee80211_mesh_hwmp_perr_dst *dst; + u8 *pos = perr_ie->variable; + int i; + + for (i = 0; i < dst_idx + 1; i++) { + dst = (void *)pos; + pos += sizeof(struct ieee80211_mesh_hwmp_perr_dst) + + ((dst->flags & AE_F) ? ETH_ALEN : 0) + /* Destination External Address */ + + 2 /* Reason Code */; + } + + return dst; +} + +static inline u8 * +ieee80211_mesh_hwmp_perr_get_addr(const u8 *ie, u8 dst_idx) +{ + struct ieee80211_mesh_hwmp_perr_dst *dst = + ieee80211_mesh_hwmp_perr_get_dst(ie, dst_idx); + + return dst->addr; +} + +static inline u32 +ieee80211_mesh_hwmp_perr_get_sn(const u8 *ie, u8 dst_idx) +{ + struct ieee80211_mesh_hwmp_perr_dst *dst = + ieee80211_mesh_hwmp_perr_get_dst(ie, dst_idx); + + return le32_to_cpu(dst->sn); +} + +static inline u16 +ieee80211_mesh_hwmp_perr_get_rcode(const u8 *ie, u8 dst_idx) +{ + struct ieee80211_mesh_hwmp_perr_dst *dst = + ieee80211_mesh_hwmp_perr_get_dst(ie, dst_idx); + + return get_unaligned_le16(&dst->variable[ + (dst->flags & AE_F) ? ETH_ALEN : 0]); +} + #endif /* LINUX_IEEE80211_MESH_H */ -- cgit v1.2.3 From 8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae Mon Sep 17 00:00:00 2001 From: Masashi Honma Date: Sat, 30 May 2026 08:09:46 +0900 Subject: wifi: mac80211: Fix overread in PREQ frame processing When the AF flag is enabled, hwmp_preq_frame_process() overreads target_addr by 2 bytes. Since this occurs within the socket buffer, it does not read across memory boundaries and therefore poses no security risk; however, we will fix it as a precaution. In this fix, a new function mesh_path_parse_request_frame() is established to separate the implementation of frame format validation and the check for unsupported features. This is intended to facilitate future work when implementing the currently unsupported parts. Assisted-by: Claude:Sonnet 4.6 Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-4-masashi.honma@gmail.com Signed-off-by: Johannes Berg --- include/linux/ieee80211-mesh.h | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'include') diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h index f709263c310b..8fbd31d9538d 100644 --- a/include/linux/ieee80211-mesh.h +++ b/include/linux/ieee80211-mesh.h @@ -358,4 +358,33 @@ ieee80211_mesh_hwmp_perr_get_rcode(const u8 *ie, u8 dst_idx) (dst->flags & AE_F) ? ETH_ALEN : 0]); } +/* IEEE Std 802.11-2016 9.4.2.113 PREQ element */ +static inline bool ieee80211_mesh_preq_size_ok(const u8 *pos, u8 elen) +{ + struct ieee80211_mesh_hwmp_preq_bottom *preq_elem_bottom = + ieee80211_mesh_hwmp_preq_get_bottom(pos); + u8 target_count; + int needed; + + /* Check if the element contains flags */ + needed = sizeof(struct ieee80211_mesh_hwmp_preq_top); + if (elen < needed) + return false; + + /* Check if the element contains target_count */ + needed += (ieee80211_mesh_preq_prep_ae_enabled(pos) ? ETH_ALEN : 0) + /* Originator External Address */ + + sizeof(struct ieee80211_mesh_hwmp_preq_bottom); + if (elen < needed) + return false; + + target_count = preq_elem_bottom->target_count; + /* IEEE Std 802.11-2016 Table 14-10 to 14-16 */ + if (target_count < 1) + return false; + + needed += target_count * sizeof(struct ieee80211_mesh_hwmp_preq_target); + return elen == needed; +} + #endif /* LINUX_IEEE80211_MESH_H */ -- cgit v1.2.3 From d158e54476ea9667c33dfa2c8d87c7cc32b40f1b Mon Sep 17 00:00:00 2001 From: Masashi Honma Date: Sat, 30 May 2026 08:09:47 +0900 Subject: wifi: mac80211: Fix overread in PREP frame processing When the AF flag is enabled, hwmp_prep_frame_process() overreads orig_addr by 2 bytes. Since this occurs within the socket buffer, it does not read across memory boundaries and therefore poses no security risk; however, we will fix it as a precaution. In this fix, a new function mesh_path_parse_reply_frame() is established to separate the implementation of frame format validation and the check for unsupported features. This is intended to facilitate future work when implementing the currently unsupported parts. Assisted-by: Claude:Sonnet 4.6 Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-5-masashi.honma@gmail.com Signed-off-by: Johannes Berg --- include/linux/ieee80211-mesh.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include') diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h index 8fbd31d9538d..482ac0c6d759 100644 --- a/include/linux/ieee80211-mesh.h +++ b/include/linux/ieee80211-mesh.h @@ -387,4 +387,20 @@ static inline bool ieee80211_mesh_preq_size_ok(const u8 *pos, u8 elen) return elen == needed; } +/* IEEE Std 802.11-2016 9.4.2.114 PREP element */ +static inline bool ieee80211_mesh_prep_size_ok(const u8 *pos, u8 elen) +{ + u8 needed; + + /* Check if the element contains flags */ + needed = sizeof(struct ieee80211_mesh_hwmp_prep_top); + if (elen < needed) + return false; + + needed += (ieee80211_mesh_preq_prep_ae_enabled(pos) ? ETH_ALEN : 0) + /* Target External Address */ + + sizeof(struct ieee80211_mesh_hwmp_prep_bottom); + return elen == needed; +} + #endif /* LINUX_IEEE80211_MESH_H */ -- cgit v1.2.3 From 4ec9ea8a58859c260ae32e097aa643975572e58b Mon Sep 17 00:00:00 2001 From: Masashi Honma Date: Sat, 30 May 2026 08:09:48 +0900 Subject: wifi: mac80211: Fix PERR frame processing There are no issues with the PERR processing itself; however, to maintain consistency with the previous PREQ/PREP code modifications, I will create a new mesh_path_parse_error_frame() function to separately implement the frame format validation and the "not supported" check. Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-6-masashi.honma@gmail.com Signed-off-by: Johannes Berg --- include/linux/ieee80211-mesh.h | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) (limited to 'include') diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h index 482ac0c6d759..7eb15834531c 100644 --- a/include/linux/ieee80211-mesh.h +++ b/include/linux/ieee80211-mesh.h @@ -403,4 +403,40 @@ static inline bool ieee80211_mesh_prep_size_ok(const u8 *pos, u8 elen) return elen == needed; } +/* IEEE Std 802.11-2016 9.4.2.115 PERR element */ +static inline bool ieee80211_mesh_perr_size_ok(const u8 *pos, u8 elen) +{ + struct ieee80211_mesh_hwmp_perr *perr_elem = (void *)pos; + const u8 *start = pos; + u8 number_of_dst; + int needed; + int i; + + needed = sizeof(struct ieee80211_mesh_hwmp_perr); + + /* Check if the element contains number of dst */ + if (elen < needed) + return false; + + pos += sizeof(struct ieee80211_mesh_hwmp_perr); + number_of_dst = perr_elem->number_of_dst; + + for (i = 0; i < number_of_dst; i++) { + struct ieee80211_mesh_hwmp_perr_dst *dst = (void *)pos; + u8 dst_len = sizeof(struct ieee80211_mesh_hwmp_perr_dst); + + /* Check if the element contains flags */ + if (elen < pos - start + dst_len) + return false; + + dst_len += ((dst->flags & AE_F) ? ETH_ALEN : 0) + /* Destination External Address */ + + 2 /* Reason Code */; + needed += dst_len; + pos += dst_len; + } + + return elen == needed; +} + #endif /* LINUX_IEEE80211_MESH_H */ -- cgit v1.2.3 From b3d519330554b0b9e662cefebba854e0a7c1a592 Mon Sep 17 00:00:00 2001 From: Lachlan Hodges Date: Tue, 2 Jun 2026 16:22:24 +1000 Subject: wifi: mac80211: basic S1G rx rate reporting support Introduce basic rate encoding/decoding for S1G stas such that the usermode rx reporting is relevant as it currently uses VHT calculations which are obviously wildy different to S1G. Sample iw output (with the associated iw patches applied): Connected to 0c:bf:74:00:21:c4 (on wlan0) SSID: wifi_halow freq: 923.500 RX: 7325230 bytes (4756 packets) TX: 190044 bytes (2238 packets) signal: -38 dBm rx bitrate: 43.3 MBit/s S1G-MCS 9 8MHz short GI S1G-NSS 1 tx bitrate: 43.3 MBit/s S1G-MCS 9 8MHz short GI S1G-NSS 1 bss flags: dtim period: 1 beacon int: 100 Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20260602062224.1792985-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg --- include/net/mac80211.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/mac80211.h b/include/net/mac80211.h index 4fb579805e0f..7dd558f4025b 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -1704,6 +1704,7 @@ enum mac80211_rx_encoding { RX_ENC_HE, RX_ENC_EHT, RX_ENC_UHR, + RX_ENC_S1G, }; /** -- cgit v1.2.3 From 50aa66ac0162aac818285a4a5d7c2c553b6bfb65 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 29 May 2026 10:24:54 +0200 Subject: wifi: ieee80211: define some UHR link reconfiguration frame types Define some values needed for UHR link reconfiguration frames, in particular to prepare for UHR mode change request/handling. Link: https://patch.msgid.link/20260529102644.03029bae6447.If22b0c1e10d9db712dca408a420469b3d385b4ea@changeid Signed-off-by: Johannes Berg --- include/linux/ieee80211-uhr.h | 51 +++++++++++++++++++++++++++++++++++++++++++ include/linux/ieee80211.h | 17 +++++++++++++++ 2 files changed, 68 insertions(+) (limited to 'include') diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h index f4f4bd8256df..71faf4a6825e 100644 --- a/include/linux/ieee80211-uhr.h +++ b/include/linux/ieee80211-uhr.h @@ -8,6 +8,7 @@ #define LINUX_IEEE80211_UHR_H #include +#include #include #define IEEE80211_UHR_OPER_PARAMS_DPS_ENA 0x0001 @@ -463,4 +464,54 @@ struct ieee80211_smd_info { __le16 timeout; } __packed; +enum ieee80211_protected_uhr_action { + IEEE80211_PROTECTED_UHR_ACTION_LINK_RECONFIG_REQUEST = 0, + IEEE80211_PROTECTED_UHR_ACTION_LINK_RECONFIG_RESPONSE = 1, + IEEE80211_PROTECTED_UHR_ACTION_LINK_RECONFIG_NOTIFY = 2, +}; + +enum ieee80211_uhr_link_reconfig_request_type { + IEEE80211_UHR_LINK_RECONFIG_REQUEST_ST_PREP = 0, + IEEE80211_UHR_LINK_RECONFIG_REQUEST_ST_EXEC = 1, + IEEE80211_UHR_LINK_RECONFIG_REQUEST_OMP_REQUEST = 3, +}; + +enum ieee80211_uhr_link_reconfig_response_type { + IEEE80211_UHR_LINK_RECONFIG_RESPONSE_ST_PREP = 0, + IEEE80211_UHR_LINK_RECONFIG_RESPONSE_ST_EXEC = 1, +}; + +enum ieee80211_uhr_link_reconfig_notify_type { + IEEE80211_UHR_LINK_RECONFIG_NOTIFY_DL_DRAINED = 2, + IEEE80211_UHR_LINK_RECONFIG_NOTIFY_OMP_RESPONSE = 3, +}; + +enum ieee80211_uhr_mode_change_control { + IEEE80211_UHR_MODE_CHANGE_CONTROL_MODE_ID = 0x003f, + IEEE80211_UHR_MODE_CHANGE_CONTROL_MODE_ENABLE = 0x0040, + IEEE80211_UHR_MODE_CHANGE_CONTROL_MODE_UPDATE = 0x0080, + IEEE80211_UHR_MODE_CHANGE_CONTROL_MODE_LENGTH = 0x0f00, + IEEE80211_UHR_MODE_CHANGE_CONTROL_MODE_SPECIFIC = 0xf000, +}; + +enum ieee80211_uhr_mode_change_mode_id { + IEEE80211_UHR_MODE_CHANGE_MODE_ID_DPS = 0, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_NPCA = 1, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_DUO = 2, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_DSO = 3, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_P_EDCA = 4, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_ELR_RX = 5, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_AOM = 6, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_LLI = 7, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_CO_BF = 8, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_CO_SR = 9, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_EMLSR = 10, + IEEE80211_UHR_MODE_CHANGE_MODE_ID_DBE = 11, +}; + +struct ieee80211_uhr_mode_change_tuple { + __le16 control; + u8 variable[]; +} __packed; + #endif /* LINUX_IEEE80211_UHR_H */ diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index 11106589acc6..d40484451e9a 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -1174,6 +1174,22 @@ struct ieee80211_mgmt { u8 control; u8 variable[]; } __packed eml_omn; + struct { + u8 dialog_token; + u8 type; + u8 variable[]; + } __packed uhr_link_reconf_req; + struct { + u8 dialog_token; + u8 type; + u8 count; + u8 variable[]; + } __packed uhr_link_reconf_resp; + struct { + u8 dialog_token; + u8 type; + u8 variable[]; + } __packed uhr_link_reconf_notif; }; } __packed action; DECLARE_FLEX_ARRAY(u8, body); /* Generic frame body */ @@ -1837,6 +1853,7 @@ enum ieee80211_category { WLAN_CATEGORY_VHT = 21, WLAN_CATEGORY_S1G = 22, WLAN_CATEGORY_PROTECTED_EHT = 37, + WLAN_CATEGORY_PROTECTED_UHR = 43, WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126, WLAN_CATEGORY_VENDOR_SPECIFIC = 127, }; -- cgit v1.2.3 From 7ad8731738d7511c92f9ffc8c69fa8681986dd5d Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 29 May 2026 10:25:04 +0200 Subject: wifi: Update UHR PHY capabilities to D1.4 There are new capabilities in D1.4, and some reserved bits. Update the code accordingly. Link: https://patch.msgid.link/20260529102644.f146932b21e2.I12bad84157bf809fbe285b79420143b3c456d9d2@changeid Signed-off-by: Johannes Berg --- include/linux/ieee80211-uhr.h | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h index 71faf4a6825e..be51d91f5e03 100644 --- a/include/linux/ieee80211-uhr.h +++ b/include/linux/ieee80211-uhr.h @@ -401,17 +401,39 @@ struct ieee80211_uhr_cap_mac { u8 mac_cap[5]; } __packed; -#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 0x01 -#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_LE80 0x02 -#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_160 0x04 -#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_160 0x08 -#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_320 0x10 -#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_320 0x20 -#define IEEE80211_UHR_PHY_CAP_ELR_RX 0x40 -#define IEEE80211_UHR_PHY_CAP_ELR_TX 0x80 +#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 0x00000001 +#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_LE80 0x00000002 +#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_160 0x00000004 +#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_160 0x00000008 +#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_320 0x00000010 +#define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_DL_MU_320 0x00000020 +#define IEEE80211_UHR_PHY_CAP_ELR_TX 0x00000040 +#define IEEE80211_UHR_PHY_CAP_ELR_RX 0x00000080 +#define IEEE80211_UHR_PHY_CAP_PART_BW_DL_MUMIMO 0x00000100 +#define IEEE80211_UHR_PHY_CAP_PART_BW_UL_MUMIMO 0x00000200 +#define IEEE80211_UHR_PHY_CAP_MCS15 0x00000400 +#define IEEE80211_UHR_PHY_CAP_2XLDPC_TX 0x00000800 +#define IEEE80211_UHR_PHY_CAP_2XLDPC_RX 0x00001000 +#define IEEE80211_UHR_PHY_CAP_UEQM_TX_MAX_NSS 0x00006000 +#define IEEE80211_UHR_PHY_CAP_UEQM_RX_MAX_NSS 0x00018000 +#define IEEE80211_UHR_PHY_CAP_CO_BF_JOINT_SOUNDING 0x00040000 +#define IEEE80211_UHR_PHY_CAP_IM_TX 0x00080000 +#define IEEE80211_UHR_PHY_CAP_IM_RX 0x00100000 +#define IEEE80211_UHR_PHY_CAP_CO_SR_MODE_1 0x00200000 +#define IEEE80211_UHR_PHY_CAP_CO_SR_MODE_2 0x00400000 +#define IEEE80211_UHR_PHY_CAP_DRU_DBW_20_IN_PBW_20 0x00800000 +#define IEEE80211_UHR_PHY_CAP_DRU_DBW_40_IN_PBW_40 0x01000000 +#define IEEE80211_UHR_PHY_CAP_DRU_DBW_80_IN_PBW_80 0x02000000 +#define IEEE80211_UHR_PHY_CAP_DRU_DBW_80_IN_PBW_160 0x04000000 +#define IEEE80211_UHR_PHY_CAP_DRU_DBW_80_IN_PBW_320 0x08000000 +#define IEEE80211_UHR_PHY_CAP_DRU_DBW_20_IN_PBW_GE80 0x10000000 +#define IEEE80211_UHR_PHY_CAP_DRU_DBW_40_IN_PBW_GE80 0x20000000 +#define IEEE80211_UHR_PHY_CAP_DRU_DBW_60_IN_PBW_GE80 0x40000000 +#define IEEE80211_UHR_PHY_CAP_DRU_RRU_HYBRID_MODE 0x80000000 struct ieee80211_uhr_cap_phy { - u8 cap; + __le32 cap; + u8 reserved; } __packed; struct ieee80211_uhr_cap { -- cgit v1.2.3 From f576db12f1f0adafd8fd1c395e377b7b37a77b7b Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 29 May 2026 10:25:05 +0200 Subject: wifi: Update UHR MAC capabilities to D1.4 There are now 8 more reserved bits in D1.4, update the code accordingly. Link: https://patch.msgid.link/20260529102644.6e27c54cfceb.Id395c07ffde286011494fc75190dc6060117436e@changeid Signed-off-by: Johannes Berg --- include/linux/ieee80211-uhr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h index be51d91f5e03..c8dde0fbd896 100644 --- a/include/linux/ieee80211-uhr.h +++ b/include/linux/ieee80211-uhr.h @@ -398,7 +398,7 @@ enum ieee80211_uhr_dbe_max_supported_bw { }; struct ieee80211_uhr_cap_mac { - u8 mac_cap[5]; + u8 mac_cap[6]; } __packed; #define IEEE80211_UHR_PHY_CAP_MAX_NSS_RX_SND_NDP_LE80 0x00000001 -- cgit v1.2.3 From d3ea22270d7c02fe08606f609545cbe583e53060 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 29 May 2026 10:25:07 +0200 Subject: wifi: mac80211: parse and apply UHR DBE channel When a UHR AP has DBE enabled, parse the channel and apply it to the chandef. Apply for TX only after the OMP response (or timeout) so that the AP doesn't receive frames with DBE width before the station completed transition to DBE. Link: https://patch.msgid.link/20260529102644.cb810f212128.Ife37c2673251346e84e4250b242b31f0895520ab@changeid Signed-off-by: Johannes Berg --- include/linux/ieee80211-eht.h | 18 +++++---- include/linux/ieee80211-uhr.h | 92 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 103 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index 87d92fb86fab..73e97fe30724 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -1038,13 +1038,17 @@ ieee80211_mle_basic_sta_prof_bss_param_ch_cnt(const struct ieee80211_mle_per_sta #define IEEE80211_MLE_STA_RECONF_CONTROL_COMPLETE_PROFILE 0x0010 #define IEEE80211_MLE_STA_RECONF_CONTROL_STA_MAC_ADDR_PRESENT 0x0020 #define IEEE80211_MLE_STA_RECONF_CONTROL_AP_REM_TIMER_PRESENT 0x0040 -#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE 0x0780 -#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_AP_REM 0 -#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_OP_PARAM_UPDATE 1 -#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_ADD_LINK 2 -#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_DEL_LINK 3 -#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_NSTR_STATUS 4 -#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_PARAMS_PRESENT 0x0800 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE 0x0780 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_AP_REM 0 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_OP_PARAM_UPDATE 1 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_ADD_LINK 2 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_DEL_LINK 3 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_NSTR_STATUS 4 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_TYPE_UHR_OMP_UPD 5 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_PARAMS_PRESENT 0x0800 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_NSTR_BMAP_SIZE 0x1000 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_NSTR_IND_BMAP_PRES 0x2000 +#define IEEE80211_MLE_STA_RECONF_CONTROL_OPERATION_DSO_INFO_PRESENT 0x4000 /** * ieee80211_mle_reconf_sta_prof_size_ok - validate reconfiguration multi-link diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h index c8dde0fbd896..1dd53c5f2954 100644 --- a/include/linux/ieee80211-uhr.h +++ b/include/linux/ieee80211-uhr.h @@ -10,11 +10,13 @@ #include #include #include +#include "ieee80211-eht.h" #define IEEE80211_UHR_OPER_PARAMS_DPS_ENA 0x0001 #define IEEE80211_UHR_OPER_PARAMS_NPCA_ENA 0x0002 #define IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA 0x0004 #define IEEE80211_UHR_OPER_PARAMS_DBE_ENA 0x0008 +#define IEEE80211_UHR_OPER_PARAMS_DBE_BW 0x0070 struct ieee80211_uhr_operation { __le16 params; @@ -177,6 +179,29 @@ enum ieee80211_uhr_dbe_oper_bw { IEEE80211_UHR_DBE_OPER_BW_320_2 = 5, }; +/** + * ieee80211_uhr_dbe_bw_mhz - get bandwidth in MHz from UHR DBE bandwidth + * @bw: UHR DBE bandwidth + * + * Return: the bandwidth in MHz, or -1 for invalid values + */ +static inline int ieee80211_uhr_dbe_bw_mhz(enum ieee80211_uhr_dbe_oper_bw bw) +{ + switch (bw) { + case IEEE80211_UHR_DBE_OPER_BW_40: + return 40; + case IEEE80211_UHR_DBE_OPER_BW_80: + return 80; + case IEEE80211_UHR_DBE_OPER_BW_160: + return 160; + case IEEE80211_UHR_DBE_OPER_BW_320_1: + case IEEE80211_UHR_DBE_OPER_BW_320_2: + return 320; + default: + return -1; + } +} + /** * struct ieee80211_uhr_dbe_info - DBE operation information * @@ -335,6 +360,35 @@ ieee80211_uhr_npca_dis_subch_bitmap(const struct ieee80211_uhr_operation *oper) return npca->dis_subch_bmap; } +/* + * Note: cannot call this on the element coming from a beacon, + * must ensure ieee80211_uhr_oper_size_ok(..., false) first + */ +static inline const struct ieee80211_uhr_dbe_info * +ieee80211_uhr_oper_dbe_info(const struct ieee80211_uhr_operation *oper) +{ + const u8 *pos = oper->variable; + + if (!(oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_ENA))) + return NULL; + + if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA)) + pos += sizeof(struct ieee80211_uhr_dps_info); + + if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)) { + const struct ieee80211_uhr_npca_info *npca = (const void *)pos; + + pos += sizeof(*npca); + if (npca->params & cpu_to_le32(IEEE80211_UHR_NPCA_PARAMS_DIS_SUBCH_BMAP_PRES)) + pos += sizeof(npca->dis_subch_bmap[0]); + } + + if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA)) + pos += sizeof(struct ieee80211_uhr_p_edca_info); + + return (const void *)pos; +} + #define IEEE80211_UHR_MAC_CAP0_DPS_SUPP 0x01 #define IEEE80211_UHR_MAC_CAP0_DPS_ASSIST_SUPP 0x02 #define IEEE80211_UHR_MAC_CAP0_DPS_AP_STATIC_HCM_SUPP 0x04 @@ -475,6 +529,44 @@ static inline bool ieee80211_uhr_capa_size_ok(const u8 *data, u8 len, return len >= needed; } +#define IEEE80211_UHR_OM_PU_TO_128TU 11 + +/** + * ieee80211_uhr_capa_get_om_pu_to_us - get OM parameter update timeout in usec + * @cap: the UHR capability element, size must be validated + * + * Return: the OM parameter update timeout in usec, or -1 if it's not valid + */ +static inline int +ieee80211_uhr_capa_get_om_pu_to_us(const struct ieee80211_uhr_cap *cap) +{ + u8 timeout; + + timeout = u8_get_bits(cap->mac.mac_cap[3], + IEEE80211_UHR_MAC_CAP3_UHR_OM_PU_TO_HIGH); + timeout <<= 2; + timeout |= u8_get_bits(cap->mac.mac_cap[2], + IEEE80211_UHR_MAC_CAP2_UHR_OM_PU_TO_LOW); + + if (timeout > IEEE80211_UHR_OM_PU_TO_128TU) + return -1; + + if (!timeout) + return 0; + + return 128 << (timeout - 1); +} + +/* only valid from AP, must check ieee80211_uhr_capa_size_ok(..., true) */ +static inline const struct ieee80211_uhr_cap_dbe * +ieee80211_uhr_dbe_cap(const struct ieee80211_uhr_cap *cap) +{ + if (!(cap->mac.mac_cap[1] & IEEE80211_UHR_MAC_CAP1_DBE_SUPP)) + return NULL; + + return (const void *)cap->variable; +} + #define IEEE80211_SMD_INFO_CAPA_DL_DATA_FWD 0x01 #define IEEE80211_SMD_INFO_CAPA_MAX_NUM_PREP 0x0E #define IEEE80211_SMD_INFO_CAPA_TYPE 0x10 -- cgit v1.2.3 From 14b1a85518a17c01a8d52a8d3332596b68b4f201 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 29 May 2026 10:25:08 +0200 Subject: wifi: mac80211: AP: handle DBE for clients In AP mode, track the BSS non-DBE bandwidth and apply that to all non-DBE clients, then track OMP updates from the clients and enable/disable DBE accordingly. For now don't send a response, clients need to have a timer anyway (it's up to the driver to set the right timeout in UHR capabilities.) Link: https://patch.msgid.link/20260529102644.be84f2b055cc.I4d2c067dfe54c47621d5a872ca07a0e754d6c20f@changeid Signed-off-by: Johannes Berg --- include/linux/ieee80211-eht.h | 16 +++++++++++++--- include/linux/ieee80211-uhr.h | 16 ++++++++++++++++ 2 files changed, 29 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/ieee80211-eht.h b/include/linux/ieee80211-eht.h index 73e97fe30724..18f9c662cf4c 100644 --- a/include/linux/ieee80211-eht.h +++ b/include/linux/ieee80211-eht.h @@ -393,14 +393,24 @@ ieee80211_eht_oper_size_ok(const u8 *data, u8 len) return len >= needed; } +/* must validate ieee80211_eht_oper_size_ok() first */ +static inline const struct ieee80211_eht_operation_info * +ieee80211_eht_oper_info(const struct ieee80211_eht_operation *eht_oper) +{ + if (!(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) + return NULL; + + return (const void *)eht_oper->optional; +} + /* must validate ieee80211_eht_oper_size_ok() first */ static inline u16 ieee80211_eht_oper_dis_subchan_bitmap(const struct ieee80211_eht_operation *eht_oper) { - const struct ieee80211_eht_operation_info *info = - (const void *)eht_oper->optional; + const struct ieee80211_eht_operation_info *info; - if (!(eht_oper->params & IEEE80211_EHT_OPER_INFO_PRESENT)) + info = ieee80211_eht_oper_info(eht_oper); + if (!info) return 0; if (!(eht_oper->params & IEEE80211_EHT_OPER_DISABLED_SUBCHANNEL_BITMAP_PRESENT)) diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h index 1dd53c5f2954..597c9e559261 100644 --- a/include/linux/ieee80211-uhr.h +++ b/include/linux/ieee80211-uhr.h @@ -628,4 +628,20 @@ struct ieee80211_uhr_mode_change_tuple { u8 variable[]; } __packed; +static inline int +ieee80211_uhr_mode_change_tuple_size(const struct ieee80211_uhr_mode_change_tuple *tuple) +{ + return sizeof(*tuple) + + le16_get_bits(tuple->control, + IEEE80211_UHR_MODE_CHANGE_CONTROL_MODE_LENGTH); +} + +#define for_each_uhr_mode_change_tuple(data, len, tuple) \ + for (tuple = (const void *)(data); \ + (len) - ((const u8 *)tuple - (data)) >= sizeof(*tuple) && \ + (len) - ((const u8 *)tuple - (data)) >= \ + ieee80211_uhr_mode_change_tuple_size(tuple); \ + tuple = (const void *)((const u8 *)tuple + \ + ieee80211_uhr_mode_change_tuple_size(tuple))) + #endif /* LINUX_IEEE80211_UHR_H */ -- cgit v1.2.3 From d2f6e83bbbef31169ea363af4277f5c09c914eda Mon Sep 17 00:00:00 2001 From: Li Chen Date: Fri, 15 May 2026 17:18:26 +0800 Subject: ext4: fast commit: add lock_updates tracepoint Commit-time fast commit snapshots run under jbd2_journal_lock_updates(), so it is useful to quantify the time spent with updates locked and to understand why snapshotting can fail. Add a new tracepoint, ext4_fc_lock_updates, reporting the time spent in the updates-locked window along with the number of snapshotted inodes and ranges. Record the first snapshot failure reason in a stable snap_err field for tooling. Signed-off-by: Li Chen Reviewed-by: Steven Rostedt (Google) Link: https://patch.msgid.link/20260515091829.194810-7-me@linux.beauty Signed-off-by: Theodore Ts'o --- include/trace/events/ext4.h | 61 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) (limited to 'include') diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h index f493642cf121..7028a28316fa 100644 --- a/include/trace/events/ext4.h +++ b/include/trace/events/ext4.h @@ -107,6 +107,26 @@ TRACE_DEFINE_ENUM(EXT4_FC_REASON_VERITY); TRACE_DEFINE_ENUM(EXT4_FC_REASON_MOVE_EXT); TRACE_DEFINE_ENUM(EXT4_FC_REASON_MAX); +#undef EM +#undef EMe +#define EM(a) TRACE_DEFINE_ENUM(EXT4_FC_SNAP_ERR_##a); +#define EMe(a) TRACE_DEFINE_ENUM(EXT4_FC_SNAP_ERR_##a); + +#define TRACE_SNAP_ERR \ + EM(NONE) \ + EM(ES_MISS) \ + EM(ES_DELAYED) \ + EM(ES_OTHER) \ + EM(INODES_CAP) \ + EM(RANGES_CAP) \ + EM(NOMEM) \ + EMe(INODE_LOC) + +TRACE_SNAP_ERR + +#undef EM +#undef EMe + #define show_fc_reason(reason) \ __print_symbolic(reason, \ { EXT4_FC_REASON_XATTR, "XATTR"}, \ @@ -2818,6 +2838,47 @@ TRACE_EVENT(ext4_fc_commit_stop, __entry->num_fc_ineligible, __entry->nblks_agg, __entry->tid) ); +#define EM(a) { EXT4_FC_SNAP_ERR_##a, #a }, +#define EMe(a) { EXT4_FC_SNAP_ERR_##a, #a } + +TRACE_EVENT(ext4_fc_lock_updates, + TP_PROTO(struct super_block *sb, tid_t commit_tid, u64 locked_ns, + unsigned int nr_inodes, unsigned int nr_ranges, int err, + int snap_err), + + TP_ARGS(sb, commit_tid, locked_ns, nr_inodes, nr_ranges, err, snap_err), + + TP_STRUCT__entry(/* entry */ + __field(dev_t, dev) + __field(tid_t, tid) + __field(u64, locked_ns) + __field(unsigned int, nr_inodes) + __field(unsigned int, nr_ranges) + __field(int, err) + __field(int, snap_err) + ), + + TP_fast_assign(/* assign */ + __entry->dev = sb->s_dev; + __entry->tid = commit_tid; + __entry->locked_ns = locked_ns; + __entry->nr_inodes = nr_inodes; + __entry->nr_ranges = nr_ranges; + __entry->err = err; + __entry->snap_err = snap_err; + ), + + TP_printk("dev %d,%d tid %u locked_ns %llu nr_inodes %u nr_ranges %u err %d snap_err %s", + MAJOR(__entry->dev), MINOR(__entry->dev), __entry->tid, + __entry->locked_ns, __entry->nr_inodes, __entry->nr_ranges, + __entry->err, __print_symbolic(__entry->snap_err, + TRACE_SNAP_ERR)) +); + +#undef EM +#undef EMe +#undef TRACE_SNAP_ERR + #define FC_REASON_NAME_STAT(reason) \ show_fc_reason(reason), \ __entry->fc_ineligible_rc[reason] -- cgit v1.2.3 From dd214733544427587a95f66dbf3adff072568990 Mon Sep 17 00:00:00 2001 From: Michael Bommarito Date: Thu, 21 May 2026 10:45:17 -0400 Subject: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer within radio range can send a fixed-channel CID 0x0001 packet that is larger than MTUsig and contains many L2CAP_ECHO_REQ commands before pairing. In a real-radio stock-kernel run, one 681-byte signaling packet containing 168 zero-length ECHO_REQ commands made the target transmit 168 ECHO_RSP frames over about 220 ms. Impact: a Bluetooth BR/EDR peer within radio range, before pairing, can force 168 ECHO_RSP frames from one 681-byte fixed-channel signaling packet containing packed ECHO_REQ commands. Define Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes and reject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP carrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched. The Bluetooth Core spec wording for MTUExceeded says the reject identifier shall match the first request command in the packet, and that packets containing only responses shall be silently discarded. Linux intentionally deviates from that prescription: silently discarding desynchronizes the peer because the remote stack never learns its responses were dropped, and locating the first request command requires walking command headers past MTUsig, i.e. processing bytes from a packet we have already decided is too large to process. We therefore always emit one reject and use the identifier from the first command header, a single fixed-offset byte read. The unrestricted BR/EDR signaling parser and ECHO_REQ response path both trace to the initial git import; no later introducing commit is available for a Fixes tag. Cc: stable@vger.kernel.org Suggested-by: Luiz Augusto von Dentz Link: https://lore.kernel.org/r/20260518002800.1361430-1-michael.bommarito@gmail.com Link: https://lore.kernel.org/r/20260520135034.1060859-1-michael.bommarito@gmail.com Link: https://lore.kernel.org/r/20260521000555.3712030-1-michael.bommarito@gmail.com Assisted-by: Claude:claude-opus-4-7 Assisted-by: Codex:gpt-5-5-xhigh Signed-off-by: Michael Bommarito Signed-off-by: Luiz Augusto von Dentz --- include/net/bluetooth/l2cap.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h index 5172afee5494..e0a1f2293679 100644 --- a/include/net/bluetooth/l2cap.h +++ b/include/net/bluetooth/l2cap.h @@ -33,6 +33,7 @@ /* L2CAP defaults */ #define L2CAP_DEFAULT_MTU 672 #define L2CAP_DEFAULT_MIN_MTU 48 +#define L2CAP_SIG_MTU 48 /* BR/EDR signaling MTU */ #define L2CAP_DEFAULT_FLUSH_TO 0xFFFF #define L2CAP_EFS_DEFAULT_FLUSH_TO 0xFFFFFFFF #define L2CAP_DEFAULT_TX_WINDOW 63 -- cgit v1.2.3 From 6bb0009862c5f0e89a6e4afc09b499a02576c7da Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Thu, 28 May 2026 11:34:32 +0200 Subject: mm/slab: improve kmem_cache_alloc_bulk The kmem_cache_alloc_bulk return value is weird. It returns the number of allocated objects, but that must always be 0 or the requested number based on the implementations and the handling in the callers, but that assumption is not actually documented anywhere, which confuses automated review tools. Fix this by returning a bool if the allocation succeeded and adding a kerneldoc comment explaining the API. [rob.clark@oss.qualcomm.com: fixups in msm_iommu_pagetable_prealloc_allocate() ] Signed-off-by: Christoph Hellwig Reviewed-by: Alexander Lobakin # skbuff Link: https://patch.msgid.link/20260528093437.2519248-2-hch@lst.de Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/slab.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/slab.h b/include/linux/slab.h index 15a60b501b95..24b244e63ba9 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -815,8 +815,10 @@ kmem_buckets *kmem_buckets_create(const char *name, slab_flags_t flags, */ void kmem_cache_free_bulk(struct kmem_cache *s, size_t size, void **p); -int kmem_cache_alloc_bulk_noprof(struct kmem_cache *s, gfp_t flags, size_t size, void **p); -#define kmem_cache_alloc_bulk(...) alloc_hooks(kmem_cache_alloc_bulk_noprof(__VA_ARGS__)) +bool kmem_cache_alloc_bulk_noprof(struct kmem_cache *s, gfp_t flags, + size_t size, void **p); +#define kmem_cache_alloc_bulk(...) \ + alloc_hooks(kmem_cache_alloc_bulk_noprof(__VA_ARGS__)) static __always_inline void kfree_bulk(size_t size, void **p) { -- cgit v1.2.3 From be6e0a533d4f42f87e5fe1190d742478e4184f86 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Tue, 2 Jun 2026 18:00:38 +0200 Subject: mm: simplify the mempool_alloc_bulk API The mempool_alloc_bulk was modelled after the alloc_pages_bulk API, including some misunderstanding of it. Remove checking for NULL slots in the array, as alloc_pages_bulk and kmem_cache_alloc_bulk always fill the array from the beginning and thus we know the offset of the first failing allocation. This removes support for working well with alloc_pages_bulk used to refill page arrays that might have an entry removed from in the middle, but that is only used by sunrpc and hopefully on it's way out. Also remove the allocated parameter as it is redundant because the caller can simply specific and offset into the entries array. Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260602160038.3976341-1-hch@lst.de Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/mempool.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/mempool.h b/include/linux/mempool.h index e8e440e04a06..a0fa6d43e0dc 100644 --- a/include/linux/mempool.h +++ b/include/linux/mempool.h @@ -66,7 +66,7 @@ void *mempool_alloc_noprof(struct mempool *pool, gfp_t gfp_mask) __malloc; #define mempool_alloc(...) \ alloc_hooks(mempool_alloc_noprof(__VA_ARGS__)) int mempool_alloc_bulk_noprof(struct mempool *pool, void **elem, - unsigned int count, unsigned int allocated); + unsigned int count); #define mempool_alloc_bulk(...) \ alloc_hooks(mempool_alloc_bulk_noprof(__VA_ARGS__)) -- cgit v1.2.3 From d376e4b55c9a0adb3e701c7eaff21d9ba655a1c6 Mon Sep 17 00:00:00 2001 From: Pasha Tatashin Date: Wed, 3 Jun 2026 15:43:52 +0000 Subject: liveupdate: centralize state management into struct luo_ser Transition the LUO to ABI v2, which centralizes state management into a single struct luo_ser header. Previously, LUO state was spread across multiple FDT properties and subnodes. ABI v2 simplifies this by placing all core state, including the liveupdate number and physical addresses for sessions and FLB headers into a centralized struct luo_ser. Note that this change introduces a semantic difference: the sessions and FLB serialization formats are no longer completely independent of the core LUO. Their metadata (such as physical addresses for sessions and FLB headers) is now coupled to and managed via the centralized struct luo_ser. Reviewed-by: Pratyush Yadav (Google) Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Pasha Tatashin Link: https://patch.msgid.link/20260603154402.468928-4-pasha.tatashin@soleen.com Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/kho/abi/luo.h | 91 +++++++++++++++------------------------------ 1 file changed, 31 insertions(+), 60 deletions(-) (limited to 'include') diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h index 46750a0ddf88..1b2f865a771a 100644 --- a/include/linux/kho/abi/luo.h +++ b/include/linux/kho/abi/luo.h @@ -30,52 +30,25 @@ * .. code-block:: none * * / { - * compatible = "luo-v1"; - * liveupdate-number = <...>; - * - * luo-session { - * compatible = "luo-session-v1"; - * luo-session-header = ; - * }; - * - * luo-flb { - * compatible = "luo-flb-v1"; - * luo-flb-header = ; - * }; + * compatible = "luo-v2"; + * luo-abi-header = ; * }; * * Main LUO Node (/): * - * - compatible: "luo-v1" + * - compatible: "luo-v2" * Identifies the overall LUO ABI version. - * - liveupdate-number: u64 - * A counter tracking the number of successful live updates performed. - * - * Session Node (luo-session): - * This node describes all preserved user-space sessions. - * - * - compatible: "luo-session-v1" - * Identifies the session ABI version. - * - luo-session-header: u64 - * The physical address of a `struct luo_session_header_ser`. This structure - * is the header for a contiguous block of memory containing an array of - * `struct luo_session_ser`, one for each preserved session. - * - * File-Lifecycle-Bound Node (luo-flb): - * This node describes all preserved global objects whose lifecycle is bound - * to that of the preserved files (e.g., shared IOMMU state). - * - * - compatible: "luo-flb-v1" - * Identifies the FLB ABI version. - * - luo-flb-header: u64 - * The physical address of a `struct luo_flb_header_ser`. This structure is - * the header for a contiguous block of memory containing an array of - * `struct luo_flb_ser`, one for each preserved global object. + * - luo-abi-header: u64 + * The physical address of `struct luo_ser`. * * Serialization Structures: * The FDT properties point to memory regions containing arrays of simple, * `__packed` structures. These structures contain the actual preserved state. * + * - struct luo_ser: + * The central ABI structure that contains the overall state of the LUO. + * It includes the liveupdate-number and pointers to sessions and FLBs. + * * - struct luo_session_header_ser: * Header for the session array. Contains the total page count of the * preserved memory block and the number of `struct luo_session_ser` @@ -109,13 +82,26 @@ /* * The LUO FDT hooks all LUO state for sessions, fds, etc. - * In the root it also carries "liveupdate-number" 64-bit property that - * corresponds to the number of live-updates performed on this machine. */ #define LUO_FDT_SIZE PAGE_SIZE #define LUO_FDT_KHO_ENTRY_NAME "LUO" -#define LUO_FDT_COMPATIBLE "luo-v1" -#define LUO_FDT_LIVEUPDATE_NUM "liveupdate-number" +#define LUO_FDT_COMPATIBLE "luo-v2" +#define LUO_FDT_ABI_HEADER "luo-abi-header" + +/** + * struct luo_ser - Centralized LUO ABI header. + * @liveupdate_num: A counter tracking the number of successful live updates. + * @sessions_pa: Physical address of the first session block header. + * @flbs_pa: Physical address of the FLB header. + * + * This structure is the root of all preserved LUO state. It is pointed to by + * the "luo-abi-header" property in the LUO FDT. + */ +struct luo_ser { + u64 liveupdate_num; + u64 sessions_pa; + u64 flbs_pa; +} __packed; #define LIVEUPDATE_HNDL_COMPAT_LENGTH 48 @@ -147,15 +133,6 @@ struct luo_file_set_ser { u64 count; } __packed; -/* - * LUO FDT session node - * LUO_FDT_SESSION_HEADER: is a u64 physical address of struct - * luo_session_header_ser - */ -#define LUO_FDT_SESSION_NODE_NAME "luo-session" -#define LUO_FDT_SESSION_COMPATIBLE "luo-session-v2" -#define LUO_FDT_SESSION_HEADER "luo-session-header" - /** * struct luo_session_header_ser - Header for the serialized session data block. * @count: The number of `struct luo_session_ser` entries that immediately @@ -165,7 +142,7 @@ struct luo_file_set_ser { * physical memory preserved across the kexec. It provides the necessary * metadata to interpret the array of session entries that follow. * - * If this structure is modified, `LUO_FDT_SESSION_COMPATIBLE` must be updated. + * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated. */ struct luo_session_header_ser { u64 count; @@ -182,7 +159,7 @@ struct luo_session_header_ser { * session) is created and passed to the new kernel, allowing it to reconstruct * the session context. * - * If this structure is modified, `LUO_FDT_SESSION_COMPATIBLE` must be updated. + * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated. */ struct luo_session_ser { char name[LIVEUPDATE_SESSION_NAME_LENGTH]; @@ -192,10 +169,6 @@ struct luo_session_ser { /* The max size is set so it can be reliably used during in serialization */ #define LIVEUPDATE_FLB_COMPAT_LENGTH 48 -#define LUO_FDT_FLB_NODE_NAME "luo-flb" -#define LUO_FDT_FLB_COMPATIBLE "luo-flb-v1" -#define LUO_FDT_FLB_HEADER "luo-flb-header" - /** * struct luo_flb_header_ser - Header for the serialized FLB data block. * @pgcnt: The total number of pages occupied by the entire preserved memory @@ -205,11 +178,9 @@ struct luo_session_ser { * in the memory block. * * This structure is located at the physical address specified by the - * `LUO_FDT_FLB_HEADER` FDT property. It provides the new kernel with the - * necessary information to find and iterate over the array of preserved - * File-Lifecycle-Bound objects and to manage the underlying memory. + * flbs_pa in luo_ser. * - * If this structure is modified, LUO_FDT_FLB_COMPATIBLE must be updated. + * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated. */ struct luo_flb_header_ser { u64 pgcnt; @@ -231,7 +202,7 @@ struct luo_flb_header_ser { * passed to the new kernel. Each entry allows the LUO core to restore one * global, shared object. * - * If this structure is modified, LUO_FDT_FLB_COMPATIBLE must be updated. + * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated. */ struct luo_flb_ser { char name[LIVEUPDATE_FLB_COMPAT_LENGTH]; -- cgit v1.2.3 From cf071b3536df76a2a75b83ca1fe8c043824352c3 Mon Sep 17 00:00:00 2001 From: Pasha Tatashin Date: Wed, 3 Jun 2026 15:43:53 +0000 Subject: liveupdate: register luo_ser as KHO subtree Entirely remove the LUO FDT wrapper since the FDT only carries the compatible string and the pointer to the centralized struct luo_ser. Instead, register the struct luo_ser via the KHO raw subtree API, placing the compatibility string inside the structure itself. Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav (Google) Signed-off-by: Pasha Tatashin Link: https://patch.msgid.link/20260603154402.468928-5-pasha.tatashin@soleen.com Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/kho/abi/luo.h | 57 +++++++++++++++++---------------------------- 1 file changed, 21 insertions(+), 36 deletions(-) (limited to 'include') diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h index 1b2f865a771a..9a4fe491812b 100644 --- a/include/linux/kho/abi/luo.h +++ b/include/linux/kho/abi/luo.h @@ -10,11 +10,11 @@ * * Live Update Orchestrator uses the stable Application Binary Interface * defined below to pass state from a pre-update kernel to a post-update - * kernel. The ABI is built upon the Kexec HandOver framework and uses a - * Flattened Device Tree to describe the preserved data. + * kernel. The ABI is built upon the Kexec HandOver framework and registers + * the central `struct luo_ser` via the KHO raw subtree API. * - * This interface is a contract. Any modification to the FDT structure, node - * properties, compatible strings, or the layout of the `__packed` serialization + * This interface is a contract. Any modification to the structure fields, + * compatible strings, or the layout of the `__packed` serialization * structures defined here constitutes a breaking change. Such changes require * incrementing the version number in the relevant `_COMPATIBLE` string to * prevent a new kernel from misinterpreting data from an old kernel. @@ -23,31 +23,15 @@ * however, backward/forward compatibility is only guaranteed for kernels * supporting the same ABI version. * - * FDT Structure Overview: + * KHO Structure Overview: * The entire LUO state is encapsulated within a single KHO entry named "LUO". - * This entry contains an FDT with the following layout: - * - * .. code-block:: none - * - * / { - * compatible = "luo-v2"; - * luo-abi-header = ; - * }; - * - * Main LUO Node (/): - * - * - compatible: "luo-v2" - * Identifies the overall LUO ABI version. - * - luo-abi-header: u64 - * The physical address of `struct luo_ser`. + * This entry contains the `struct luo_ser` structure. * * Serialization Structures: - * The FDT properties point to memory regions containing arrays of simple, - * `__packed` structures. These structures contain the actual preserved state. - * * - struct luo_ser: * The central ABI structure that contains the overall state of the LUO. - * It includes the liveupdate-number and pointers to sessions and FLBs. + * It includes the compatibility string, the liveupdate-number, and pointers + * to sessions and FLBs. * * - struct luo_session_header_ser: * Header for the session array. Contains the total page count of the @@ -78,26 +62,27 @@ #ifndef _LINUX_KHO_ABI_LUO_H #define _LINUX_KHO_ABI_LUO_H +#include #include /* - * The LUO FDT hooks all LUO state for sessions, fds, etc. + * The LUO state is registered under this KHO entry name. */ -#define LUO_FDT_SIZE PAGE_SIZE -#define LUO_FDT_KHO_ENTRY_NAME "LUO" -#define LUO_FDT_COMPATIBLE "luo-v2" -#define LUO_FDT_ABI_HEADER "luo-abi-header" +#define LUO_KHO_ENTRY_NAME "LUO" +#define LUO_ABI_COMPATIBLE "luo-v3" +#define LUO_ABI_COMPAT_LEN ALIGN(sizeof(LUO_ABI_COMPATIBLE), 8) /** * struct luo_ser - Centralized LUO ABI header. + * @compatible: Compatibility string identifying the LUO ABI version. * @liveupdate_num: A counter tracking the number of successful live updates. * @sessions_pa: Physical address of the first session block header. * @flbs_pa: Physical address of the FLB header. * - * This structure is the root of all preserved LUO state. It is pointed to by - * the "luo-abi-header" property in the LUO FDT. + * This structure is the root of all preserved LUO state. */ struct luo_ser { + char compatible[LUO_ABI_COMPAT_LEN]; u64 liveupdate_num; u64 sessions_pa; u64 flbs_pa; @@ -111,7 +96,7 @@ struct luo_ser { * @data: Private data * @token: User provided token for this file * - * If this structure is modified, LUO_SESSION_COMPATIBLE must be updated. + * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated. */ struct luo_file_ser { char compatible[LIVEUPDATE_HNDL_COMPAT_LENGTH]; @@ -142,7 +127,7 @@ struct luo_file_set_ser { * physical memory preserved across the kexec. It provides the necessary * metadata to interpret the array of session entries that follow. * - * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated. + * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated. */ struct luo_session_header_ser { u64 count; @@ -159,7 +144,7 @@ struct luo_session_header_ser { * session) is created and passed to the new kernel, allowing it to reconstruct * the session context. * - * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated. + * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated. */ struct luo_session_ser { char name[LIVEUPDATE_SESSION_NAME_LENGTH]; @@ -180,7 +165,7 @@ struct luo_session_ser { * This structure is located at the physical address specified by the * flbs_pa in luo_ser. * - * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated. + * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated. */ struct luo_flb_header_ser { u64 pgcnt; @@ -202,7 +187,7 @@ struct luo_flb_header_ser { * passed to the new kernel. Each entry allows the LUO core to restore one * global, shared object. * - * If this structure is modified, `LUO_FDT_COMPATIBLE` must be updated. + * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated. */ struct luo_flb_ser { char name[LIVEUPDATE_FLB_COMPAT_LENGTH]; -- cgit v1.2.3 From 0349ff2887059112ce06831ab29aec47a2a7285a Mon Sep 17 00:00:00 2001 From: Pasha Tatashin Date: Wed, 3 Jun 2026 15:43:56 +0000 Subject: kho: add support for linked-block serialization Introduce a linked-block serialization mechanism for state handover. Previously, LUO used contiguous memory blocks for serializing sessions and files, which imposed limits on the total number of items that could be preserved across a live update. This commit adds the infrastructure for a more flexible, block-based approach where serialized data is stored in a chain of linked blocks. This is a generic KHO serialization block infrastructure that can be used by multiple subsystems. Signed-off-by: Pasha Tatashin Link: https://patch.msgid.link/20260603154402.468928-8-pasha.tatashin@soleen.com Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/kho/abi/block.h | 54 +++++++++++++++++ include/linux/kho/abi/kexec_handover.h | 2 +- include/linux/kho_block.h | 106 +++++++++++++++++++++++++++++++++ 3 files changed, 161 insertions(+), 1 deletion(-) create mode 100644 include/linux/kho/abi/block.h create mode 100644 include/linux/kho_block.h (limited to 'include') diff --git a/include/linux/kho/abi/block.h b/include/linux/kho/abi/block.h new file mode 100644 index 000000000000..d06d64b963be --- /dev/null +++ b/include/linux/kho/abi/block.h @@ -0,0 +1,54 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2026, Google LLC. + * Pasha Tatashin + */ + +/** + * DOC: KHO Serialization Blocks ABI + * + * Subsystems using the KHO Serialization Blocks framework rely on the stable + * Application Binary Interface defined below to pass serialized state from a + * pre-update kernel to a post-update kernel. + * + * This interface is a contract. Any modification to the structure fields, + * compatible strings, or the layout of the `__packed` serialization + * structures defined here constitutes a breaking change. Such changes require + * incrementing the version number in the `KHO_FDT_COMPATIBLE` string to + * prevent a new kernel from misinterpreting data from an old kernel. + * + * Changes are allowed provided the compatibility version is incremented; + * however, backward/forward compatibility is only guaranteed for kernels + * supporting the same ABI version. + */ + +#ifndef _LINUX_KHO_ABI_BLOCK_H +#define _LINUX_KHO_ABI_BLOCK_H + +#include +#include + +/** + * KHO_BLOCK_SIZE - The size of each serialization block. + * + * This is defined as PAGE_SIZE. PAGE_SIZE is ABI compliant because live + * update between kernels with different page sizes is not supported by KHO. + */ +#define KHO_BLOCK_SIZE PAGE_SIZE + +/** + * struct kho_block_header_ser - Header for the serialized data block. + * @next: Physical address of the next struct kho_block_header_ser. + * @count: The number of entries that immediately follow this header in the + * memory block. + * + * This structure is located at the beginning of a block of physical memory + * preserved across a kexec. It provides the necessary metadata to interpret + * the array of entries that follow. + */ +struct kho_block_header_ser { + u64 next; + u64 count; +} __packed; + +#endif /* _LINUX_KHO_ABI_BLOCK_H */ diff --git a/include/linux/kho/abi/kexec_handover.h b/include/linux/kho/abi/kexec_handover.h index fb2d37417ad9..5e2eb8519bda 100644 --- a/include/linux/kho/abi/kexec_handover.h +++ b/include/linux/kho/abi/kexec_handover.h @@ -90,7 +90,7 @@ */ /* The compatible string for the KHO FDT root node. */ -#define KHO_FDT_COMPATIBLE "kho-v3" +#define KHO_FDT_COMPATIBLE "kho-v4" /* The FDT property for the preserved memory map. */ #define KHO_FDT_MEMORY_MAP_PROP_NAME "preserved-memory-map" diff --git a/include/linux/kho_block.h b/include/linux/kho_block.h new file mode 100644 index 000000000000..93a7cc2be5f5 --- /dev/null +++ b/include/linux/kho_block.h @@ -0,0 +1,106 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (c) 2026, Google LLC. + * Pasha Tatashin + */ + +#ifndef _LINUX_KHO_BLOCK_H +#define _LINUX_KHO_BLOCK_H + +#include +#include +#include + +/** + * struct kho_block - Internal representation of a serialization block. + * @list: List head for linking blocks in memory. + * @ser: Pointer to the serialized header in preserved memory. + */ +struct kho_block { + struct list_head list; + struct kho_block_header_ser *ser; +}; + +/** + * struct kho_block_set - A set of blocks containing serialized entries of the same type. + * @blocks: The list of serialization blocks (struct kho_block). + * @nblocks: The number of allocated serialization blocks. + * @head_pa: Physical address of the first block header. + * @entry_size: The size of each entry in the blocks. + * @count_per_block: The maximum number of entries each block can hold. + * @incoming: True if this block set was restored from the previous kernel. + * + * Note: Synchronization and locking are the responsibility of the caller. + * The block set structure itself is not internally synchronized. + */ +struct kho_block_set { + struct list_head blocks; + long nblocks; + u64 head_pa; + size_t entry_size; + u64 count_per_block; + bool incoming; +}; + +/** + * struct kho_block_set_it - Iterator for serializing entries into blocks. + * @bs: The block set being iterated. + * @block: The current block. + * @i: The current entry index within @block. + */ +struct kho_block_set_it { + struct kho_block_set *bs; + struct kho_block *block; + u64 i; +}; + +/** + * KHO_BLOCK_SET_INIT - Initialize a static kho_block_set. + * @_name: Name of the kho_block_set variable. + * @_entry_size: The size of each entry in the block set. + */ +#define KHO_BLOCK_SET_INIT(_name, _entry_size) { \ + .blocks = LIST_HEAD_INIT((_name).blocks), \ + .entry_size = _entry_size, \ + .count_per_block = (KHO_BLOCK_SIZE - \ + sizeof(struct kho_block_header_ser)) / \ + (_entry_size), \ +} + +void kho_block_set_init(struct kho_block_set *bs, size_t entry_size); + +int kho_block_set_grow(struct kho_block_set *bs, u64 count); +void kho_block_set_shrink(struct kho_block_set *bs, u64 count); + +int kho_block_set_restore(struct kho_block_set *bs, u64 head_pa); +void kho_block_set_destroy(struct kho_block_set *bs); +void kho_block_set_clear(struct kho_block_set *bs); + +/** + * kho_block_set_head_pa - Get the physical address of the first block header. + * @bs: The block set. + * + * Return: The physical address of the first block header, or 0 if empty. + */ +static inline u64 kho_block_set_head_pa(struct kho_block_set *bs) +{ + return bs->head_pa; +} + +/** + * kho_block_set_is_empty - Check if the block set has no allocated blocks. + * @bs: The block set. + * + * Return: True if there are no blocks in the set, false otherwise. + */ +static inline bool kho_block_set_is_empty(struct kho_block_set *bs) +{ + return list_empty(&bs->blocks); +} + +void kho_block_set_it_init(struct kho_block_set_it *it, struct kho_block_set *bs); +void *kho_block_set_it_reserve_entry(struct kho_block_set_it *it); +void *kho_block_set_it_read_entry(struct kho_block_set_it *it); +void *kho_block_set_it_prev(struct kho_block_set_it *it); + +#endif /* _LINUX_KHO_BLOCK_H */ -- cgit v1.2.3 From 2a441a14c2c03b39d1c89438dd28cef9d8fa57d5 Mon Sep 17 00:00:00 2001 From: Pasha Tatashin Date: Wed, 3 Jun 2026 15:43:58 +0000 Subject: liveupdate: Remove limit on the number of sessions Currently, the number of LUO sessions is limited by a fixed number of pre-allocated pages for serialization (16 pages, allowing for ~819 sessions). This limitation is problematic if LUO is used to support things such as systemd file descriptor store, and would be used not just as VM memory but to save other states on the machine. Remove this limit by transitioning to a linked-block approach for session metadata serialization. Instead of a single contiguous block, session metadata is now stored in a chain of 16-page blocks. Each block starts with a header containing the physical address of the next block and the number of session entries in the current block. Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav (Google) Signed-off-by: Pasha Tatashin Link: https://patch.msgid.link/20260603154402.468928-10-pasha.tatashin@soleen.com Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/kho/abi/luo.h | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-) (limited to 'include') diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h index 9a4fe491812b..03d940d0f9bb 100644 --- a/include/linux/kho/abi/luo.h +++ b/include/linux/kho/abi/luo.h @@ -33,11 +33,6 @@ * It includes the compatibility string, the liveupdate-number, and pointers * to sessions and FLBs. * - * - struct luo_session_header_ser: - * Header for the session array. Contains the total page count of the - * preserved memory block and the number of `struct luo_session_ser` - * entries that follow. - * * - struct luo_session_ser: * Metadata for a single session, including its name and a physical pointer * to another preserved memory block containing an array of @@ -63,13 +58,14 @@ #define _LINUX_KHO_ABI_LUO_H #include +#include #include /* * The LUO state is registered under this KHO entry name. */ #define LUO_KHO_ENTRY_NAME "LUO" -#define LUO_ABI_COMPATIBLE "luo-v3" +#define LUO_ABI_COMPATIBLE "luo-v4" #define LUO_ABI_COMPAT_LEN ALIGN(sizeof(LUO_ABI_COMPATIBLE), 8) /** @@ -118,21 +114,6 @@ struct luo_file_set_ser { u64 count; } __packed; -/** - * struct luo_session_header_ser - Header for the serialized session data block. - * @count: The number of `struct luo_session_ser` entries that immediately - * follow this header in the memory block. - * - * This structure is located at the beginning of a contiguous block of - * physical memory preserved across the kexec. It provides the necessary - * metadata to interpret the array of session entries that follow. - * - * If this structure is modified, `LUO_ABI_COMPATIBLE` must be updated. - */ -struct luo_session_header_ser { - u64 count; -} __packed; - /** * struct luo_session_ser - Represents the serialized metadata for a LUO session. * @name: The unique name of the session, provided by the userspace at -- cgit v1.2.3 From 1d1153097f4dd417e2ea00404edec9fbd1d88f28 Mon Sep 17 00:00:00 2001 From: Pasha Tatashin Date: Wed, 3 Jun 2026 15:43:59 +0000 Subject: liveupdate: Remove limit on the number of files per session To remove the fixed limit on the number of preserved files per session, transition the file metadata serialization from a single contiguous memory block to a chain of linked blocks. Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Pratyush Yadav (Google) Signed-off-by: Pasha Tatashin Link: https://patch.msgid.link/20260603154402.468928-11-pasha.tatashin@soleen.com Signed-off-by: Mike Rapoport (Microsoft) --- include/linux/kho/abi/luo.h | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/kho/abi/luo.h b/include/linux/kho/abi/luo.h index 03d940d0f9bb..288076de6d4a 100644 --- a/include/linux/kho/abi/luo.h +++ b/include/linux/kho/abi/luo.h @@ -35,8 +35,8 @@ * * - struct luo_session_ser: * Metadata for a single session, including its name and a physical pointer - * to another preserved memory block containing an array of - * `struct luo_file_ser` for all files in that session. + * to the first `struct kho_block_header_ser` for all files in that session. + * Multiple blocks are linked via the `next` field in the header. * * - struct luo_file_ser: * Metadata for a single preserved file. Contains the `compatible` string to @@ -65,7 +65,7 @@ * The LUO state is registered under this KHO entry name. */ #define LUO_KHO_ENTRY_NAME "LUO" -#define LUO_ABI_COMPATIBLE "luo-v4" +#define LUO_ABI_COMPATIBLE "luo-v5" #define LUO_ABI_COMPAT_LEN ALIGN(sizeof(LUO_ABI_COMPATIBLE), 8) /** @@ -102,9 +102,10 @@ struct luo_file_ser { /** * struct luo_file_set_ser - Represents the serialized metadata for file set - * @files: The physical address of a contiguous memory block that holds - * the serialized state of files (array of luo_file_ser) in this file - * set. + * @files: The physical address of the first `struct kho_block_header_ser`. + * This structure is the header for a block of memory containing + * an array of `struct luo_file_ser` entries. Multiple blocks are + * linked via the `next` field in the header. * @count: The total number of files that were part of this session during * serialization. Used for iteration and validation during * restoration. -- cgit v1.2.3 From d0c54c6f9dab20f93185df7722ed133097aaccb3 Mon Sep 17 00:00:00 2001 From: Vincent Cloutier Date: Mon, 6 Apr 2026 16:57:54 -0400 Subject: power: supply: max17042_battery: Remove unused platform-data plumbing No in-tree user still provides `max17042_platform_data` or `max17042_reg_data`. Move the simple runtime fields into `struct max17042_chip`, populate them directly from DT or the default hardware state, and drop the unused public platform-data interface. While here, write the MAX17047/MAX17050 default `FullSOCThr` value directly in probe instead of carrying it through an `init_data` table. Signed-off-by: Vincent Cloutier Link: https://patch.msgid.link/20260406205759.493288-7-vincent.cloutier@icloud.com Signed-off-by: Sebastian Reichel --- include/linux/power/max17042_battery.h | 29 ----------------------------- 1 file changed, 29 deletions(-) (limited to 'include') diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h index d5b08313cf11..25dccf908d20 100644 --- a/include/linux/power/max17042_battery.h +++ b/include/linux/power/max17042_battery.h @@ -198,16 +198,6 @@ enum max170xx_chip_type { MAXIM_DEVICE_TYPE_NUM }; -/* - * used for setting a register to a desired value - * addr : address for a register - * data : setting value for the register - */ -struct max17042_reg_data { - u8 addr; - u16 data; -}; - struct max17042_config_data { /* External current sense resistor value in milli-ohms */ u32 cur_sense_val; @@ -265,23 +255,4 @@ struct max17042_config_data { u16 cell_char_tbl[MAX17042_CHARACTERIZATION_DATA_SIZE]; } __packed; -struct max17042_platform_data { - struct max17042_reg_data *init_data; - struct max17042_config_data *config_data; - int num_init_data; /* Number of enties in init_data array */ - bool enable_current_sense; - bool enable_por_init; /* Use POR init from Maxim appnote */ - - /* - * R_sns in micro-ohms. - * default 10000 (if r_sns = 0) as it is the recommended value by - * the datasheet although it can be changed by board designers. - */ - unsigned int r_sns; - int vmin; /* in millivolts */ - int vmax; /* in millivolts */ - int temp_min; /* in tenths of degree Celsius */ - int temp_max; /* in tenths of degree Celsius */ -}; - #endif /* __MAX17042_BATTERY_H_ */ -- cgit v1.2.3 From b26bc0b97d8d1b7454b7f7ab64f1bda8d1cd4002 Mon Sep 17 00:00:00 2001 From: Sebastian Krzyszkowiak Date: Mon, 6 Apr 2026 16:57:55 -0400 Subject: power: supply: max17042_battery: use ModelCfg refresh on max17055 Unlike other models, max17055 doesn't require cell characterization data and operates on a smaller set of input variables (`DesignCap`, `VEmpty`, `IChgTerm`, and `ModelCfg`). Those values can be filled in through `max17042_override_por_values()`, but the refresh bit has to be set afterward in order to make them apply. Signed-off-by: Sebastian Krzyszkowiak Signed-off-by: Vincent Cloutier Link: https://patch.msgid.link/20260406205759.493288-8-vincent.cloutier@icloud.com Signed-off-by: Sebastian Reichel --- include/linux/power/max17042_battery.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h index 25dccf908d20..13aeab1597c6 100644 --- a/include/linux/power/max17042_battery.h +++ b/include/linux/power/max17042_battery.h @@ -24,6 +24,8 @@ #define MAX17042_CHARACTERIZATION_DATA_SIZE 48 +#define MAX17055_MODELCFG_REFRESH_BIT BIT(15) + enum max17042_register { MAX17042_STATUS = 0x00, MAX17042_VALRT_Th = 0x01, @@ -219,6 +221,7 @@ struct max17042_config_data { u16 full_soc_thresh; /* 0x13 */ u16 design_cap; /* 0x18 */ u16 ichgt_term; /* 0x1E */ + u16 model_cfg; /* 0xDB */ /* MG3 config */ u16 at_rate; /* 0x04 */ -- cgit v1.2.3 From 0549c4c01338abe343a4ffaa4733475d0a85d38a Mon Sep 17 00:00:00 2001 From: Costa Shulyupin Date: Fri, 15 May 2026 21:50:41 +0300 Subject: power: supply: Remove unused jz4740-battery.h The last user was removed in commit aea12071d6fc ("power/supply: Drop obsolete JZ4740 driver") and replaced by a self-contained IIO-based driver. No file includes this header. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Costa Shulyupin Link: https://patch.msgid.link/20260515185043.1523363-1-costa.shul@redhat.com Signed-off-by: Sebastian Reichel --- include/linux/power/jz4740-battery.h | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 include/linux/power/jz4740-battery.h (limited to 'include') diff --git a/include/linux/power/jz4740-battery.h b/include/linux/power/jz4740-battery.h deleted file mode 100644 index 10da211678c8..000000000000 --- a/include/linux/power/jz4740-battery.h +++ /dev/null @@ -1,15 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* - * Copyright (C) 2009, Jiejing Zhang - */ - -#ifndef __JZ4740_BATTERY_H -#define __JZ4740_BATTERY_H - -struct jz_battery_platform_data { - struct power_supply_info info; - int gpio_charge; /* GPIO port of Charger state */ - int gpio_charge_active_low; -}; - -#endif -- cgit v1.2.3 From afabbb56a7262979a75259e2710019aa8ced3e8a Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Tue, 2 Jun 2026 19:03:45 +0000 Subject: geneve: Introduce IFLA_GENEVE_LOCAL and IFLA_GENEVE_LOCAL6. By default, a GENEVE device bind()s its underlying UDP socket(s) to the IPv4 or IPv6 wildcard address because there is no way to specify a specific local IP address to bind() to. This prevents deploying multiple GENEVE devices on a multi-homed host where each device should be isolated and bound to a different local IP address on the same UDP port. Let's introduce new options, IFLA_GENEVE_LOCAL and IFLA_GENEVE_LOCAL6, to allow specifying a local IPv4/IPv6 address for the backend UDP socket. By default, when collect metadata mode (IFLA_GENEVE_COLLECT_METADATA) is enabled, both IPv4 and IPv6 sockets are created. However, if a source address is specified via the new attributes, only a single socket corresponding to that specific address family is created. Accordingly, geneve_find_sock() and geneve_find_dev() are updated to take the source address into account, ensuring that multiple devices and sockets configured with different source addresses can coexist without conflict. In addition, the source address is validated in geneve_xmit_skb() and geneve6_xmit_skb(), so the BPF prog must set it in bpf_tunnel_key. With this change, multiple GENEVE devices can be successfully created and bound to their respective local IP addresses: (*) "local" is the keyword for IFLA_GENEVE_LOCAL / IFLA_GENEVE_LOCAL6 # for i in $(seq 1 2); do ip link add geneve4_${i} type geneve local 192.168.0.${i} external ip addr add 192.168.0.${i}/24 dev geneve4_${i} ip link set geneve4_${i} up ip link add geneve6_${i} type geneve local 2001:9292::${i} external ip addr add 2001:9292::${i}/64 dev geneve6_${i} nodad ip link set geneve6_${i} up done # ip -d l | grep geneve 9: geneve4_1: ... geneve external id 0 local 192.168.0.1 ... 10: geneve6_1: ... geneve external id 0 local 2001:9292::1 ... 11: geneve4_2: ... geneve external id 0 local 192.168.0.2 ... 12: geneve6_2: ... geneve external id 0 local 2001:9292::2 ... # ss -ua | grep geneve UNCONN 0 0 192.168.0.2:geneve 0.0.0.0:* UNCONN 0 0 192.168.0.1:geneve 0.0.0.0:* UNCONN 0 0 [2001:9292::2]:geneve *:* UNCONN 0 0 [2001:9292::1]:geneve *:* Note that even if the local address is explicitly configured with the wildcard address, kernel does not dump it except for devices with IFLA_GENEVE_COLLECT_METADATA. This is consistent with the behaviour of is_tnl_info_zero(), which treats the wildcard remote address as not configured. ## ynl example. # ./tools/net/ynl/pyynl/cli.py \ --spec ./Documentation/netlink/specs/rt-link.yaml \ --do newlink --create \ --json '{"ifname": "geneve0", "linkinfo": {"kind":"geneve", "data": {"local": "0.0.0.0", "collect-metadata": true}}}' # ./tools/net/ynl/pyynl/cli.py \ --spec ./Documentation/netlink/specs/rt-link.yaml \ --do getlink \ --json '{"ifname": "geneve0"}' --output-json | \ jq .linkinfo.data.local "0.0.0.0" Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260602190436.139591-6-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/uapi/linux/if_link.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 46413392b402..363526549a01 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -1506,6 +1506,8 @@ enum { IFLA_GENEVE_INNER_PROTO_INHERIT, IFLA_GENEVE_PORT_RANGE, IFLA_GENEVE_GRO_HINT, + IFLA_GENEVE_LOCAL, + IFLA_GENEVE_LOCAL6, __IFLA_GENEVE_MAX }; #define IFLA_GENEVE_MAX (__IFLA_GENEVE_MAX - 1) -- cgit v1.2.3 From 5e939544f9d2b4d5c052a07cfcde97de44263946 Mon Sep 17 00:00:00 2001 From: Paolo Abeni Date: Tue, 2 Jun 2026 22:14:17 +1000 Subject: mptcp: fix uninit-value in mptcp_established_options syzbot reported the following uninit splat: BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542 [inline] BUG: KMSAN: uninit-value in mptcp_established_options_dss net/mptcp/options.c:590 [inline] BUG: KMSAN: uninit-value in mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874 mptcp_write_data_fin net/mptcp/options.c:542 [inline] mptcp_established_options_dss net/mptcp/options.c:590 [inline] mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874 tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192 __tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505 mptcp_subflow_shutdown+0x164/0x690 net/mptcp/protocol.c:3137 mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218 __mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline] __mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313 mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367 inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442 __sock_release net/socket.c:722 [inline] sock_close+0xd6/0x2f0 net/socket.c:1514 __fput+0x60e/0x1010 fs/file_table.c:510 ____fput+0x25/0x30 fs/file_table.c:538 task_work_run+0x208/0x2b0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0x306/0x1b60 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] __do_fast_syscall_32+0x2c7/0x460 arch/x86/entry/syscall_32.c:310 do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Local variable opts created at: __tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536 __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499 The output path currently omits initializing the mptcp extension `use_map` flag in a few corner cases. Address the issue always zeroing all the extensions flags before eventually initializing the individual bits. To that extent, introduce and use a struct_group to avoid multiple bitwise operations. Fixes: cfcceb7a39fc ("tcp: shrink per-packet memset in __tcp_transmit_skb()") Cc: stable@vger.kernel.org Reported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ff020673c5e3d94d9478 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-10-856831229976@kernel.org Signed-off-by: Jakub Kicinski --- include/net/mptcp.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/mptcp.h b/include/net/mptcp.h index f7263fe2a2e4..ee70f597a4de 100644 --- a/include/net/mptcp.h +++ b/include/net/mptcp.h @@ -27,7 +27,9 @@ struct mptcp_ext { u32 subflow_seq; u16 data_len; __sum16 csum; - u8 use_map:1, + + struct_group(flags, + u8 use_map:1, dsn64:1, data_fin:1, use_ack:1, @@ -35,9 +37,10 @@ struct mptcp_ext { mpc_map:1, frozen:1, reset_transient:1; - u8 reset_reason:4, + u8 reset_reason:4, csum_reqd:1, infinite_map:1; + ); /* end of flags group */ }; #define MPTCPOPT_HMAC_LEN 20 -- cgit v1.2.3 From a02a765bd5c2ae7705144829b2911c96c29db6ba Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 2 Jun 2026 12:51:38 +0000 Subject: mptcp: change mptcp_established_options() to return opt_size Instead of passing opt_size address to mptcp_established_options(), change this function to return it by value. This removes the need for an expensive stack canary in tcp_established_options() when CONFIG_STACKPROTECTOR_STRONG=y. $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 0/3 up/down: 0/-92 (-92) Function old new delta tcp_options_write.isra 1423 1407 -16 mptcp_established_options 2746 2720 -26 tcp_established_options 553 503 -50 Total: Before=22110750, After=22110658, chg -0.00% Signed-off-by: Eric Dumazet Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20260602125138.2317015-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/net/mptcp.h | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/net/mptcp.h b/include/net/mptcp.h index f7263fe2a2e4..27225c68a388 100644 --- a/include/net/mptcp.h +++ b/include/net/mptcp.h @@ -149,9 +149,9 @@ bool mptcp_syn_options(struct sock *sk, const struct sk_buff *skb, unsigned int *size, struct mptcp_out_options *opts); bool mptcp_synack_options(const struct request_sock *req, unsigned int *size, struct mptcp_out_options *opts); -bool mptcp_established_options(struct sock *sk, struct sk_buff *skb, - unsigned int *size, unsigned int remaining, - struct mptcp_out_options *opts); +int mptcp_established_options(struct sock *sk, struct sk_buff *skb, + unsigned int remaining, + struct mptcp_out_options *opts); bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb); void mptcp_write_options(struct tcphdr *th, __be32 *ptr, struct tcp_sock *tp, @@ -266,13 +266,12 @@ static inline bool mptcp_synack_options(const struct request_sock *req, return false; } -static inline bool mptcp_established_options(struct sock *sk, - struct sk_buff *skb, - unsigned int *size, - unsigned int remaining, - struct mptcp_out_options *opts) +static inline int mptcp_established_options(struct sock *sk, + struct sk_buff *skb, + unsigned int remaining, + struct mptcp_out_options *opts) { - return false; + return -1; } static inline bool mptcp_incoming_options(struct sock *sk, -- cgit v1.2.3 From 88d6f128d06d492b6d178c8e8c53db8c82305ae1 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Mon, 11 May 2026 07:58:28 -0400 Subject: mm: track DONTCACHE dirty pages per bdi_writeback Add a per-wb WB_DONTCACHE_DIRTY counter that tracks the number of dirty pages with the dropbehind flag set (i.e., pages dirtied via RWF_DONTCACHE writes). Increment the counter alongside WB_RECLAIMABLE in folio_account_dirtied() when the folio has the dropbehind flag set, and decrement it in folio_clear_dirty_for_io() and folio_account_cleaned(). Also decrement it when a non-DONTCACHE lookup atomically clears the dropbehind flag on a dirty folio in __filemap_get_folio_mpol(), using folio_test_clear_dropbehind() to prevent concurrent lookups from double-decrementing the counter, and guarding the decrement with mapping_can_writeback() to match the increment path. Transfer the counter alongside WB_RECLAIMABLE in inode_do_switch_wbs() so that the stat is properly migrated when an inode switches cgroup writeback domains. The counter will be used by the writeback flusher to determine how many pages to write back when expediting writeback for IOCB_DONTCACHE writes, without flushing the entire BDI's dirty pages. Suggested-by: Jan Kara Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260511-dontcache-v7-2-2848ddce8090@kernel.org Reviewed-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Christian Brauner (Amutable) --- include/linux/backing-dev-defs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h index a06b93446d10..cb660dd37286 100644 --- a/include/linux/backing-dev-defs.h +++ b/include/linux/backing-dev-defs.h @@ -33,6 +33,7 @@ enum wb_stat_item { WB_WRITEBACK, WB_DIRTIED, WB_WRITTEN, + WB_DONTCACHE_DIRTY, NR_WB_STAT_ITEMS }; -- cgit v1.2.3 From e1bf79628453e6afac81ffa57f4f40f28e5512ff Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Mon, 11 May 2026 07:58:29 -0400 Subject: mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The IOCB_DONTCACHE writeback path in generic_write_sync() calls filemap_flush_range() on every write, submitting writeback inline in the writer's context. Perf lock contention profiling shows the performance problem is not lock contention but the writeback submission work itself — walking the page tree and submitting I/O blocks the writer for milliseconds, inflating p99.9 latency from 23ms (buffered) to 93ms (dontcache). Replace the inline filemap_flush_range() call with a flusher kick that drains dirty pages in the background. This moves writeback submission completely off the writer's hot path. To avoid flushing unrelated buffered dirty data, add a dedicated WB_start_dontcache bit and wb_check_start_dontcache() handler that uses the per-wb WB_DONTCACHE_DIRTY counter to determine how many pages to write back. The flusher writes back that many pages from the oldest dirty inodes (not restricted to dontcache-specific inodes). This helps preserve I/O batching while limiting the scope of expedited writeback. Like WB_start_all, the WB_start_dontcache bit coalesces multiple DONTCACHE writes into a single flusher wakeup without per-write allocations. Use test_and_clear_bit to atomically consume the kick request before reading the dirty counter and starting writeback, so that concurrent DONTCACHE writes during writeback can re-set the bit and schedule a follow-up flusher run. Read the dirty counter with wb_stat_sum() (aggregating per-CPU batches) rather than wb_stat() (which reads only the global counter) to ensure small writes below the percpu batch threshold are visible to the flusher. In filemap_dontcache_kick_writeback(), set the WB_start_dontcache bit inside the unlocked_inode_to_wb_begin/end section for correct cgroup writeback domain targeting, but defer the wb_wakeup() call until after the section ends, since wb_wakeup() uses spin_unlock_irq() which would unconditionally re-enable interrupts while the i_pages xa_lock may still be held under irqsave during a cgroup writeback switch. Pin the wb with wb_get() inside the RCU critical section before calling wb_wakeup() outside it, since cgroup bdi_writeback structures are RCU-freed and the wb pointer could become invalid after unlocked_inode_to_wb_end() drops the RCU read lock. Also add WB_REASON_DONTCACHE as a new writeback reason for tracing visibility. dontcache-bench results (same host, T6F_SKL_1920GBF, 251 GiB RAM, xfs on NVMe, fio io_uring): Buffered and direct I/O paths are unaffected by this patchset. All improvements are confined to the dontcache path: Single-stream throughput (MB/s): Before After Change seq-write/dontcache 298 897 +201% rand-write/dontcache 131 236 +80% Tail latency improvements (seq-write/dontcache): p99: 135,266 us -> 23,986 us (-82%) p99.9: 8,925,479 us -> 28,443 us (-99.7%) Multi-writer (4 jobs, sequential write): Before After Change dontcache aggregate (MB/s) 2,529 4,532 +79% dontcache p99 (us) 8,553 1,002 -88% dontcache p99.9 (us) 109,314 1,057 -99% Dontcache multi-writer throughput now matches buffered (4,532 vs 4,616 MB/s). 32-file write (Axboe test): Before After Change dontcache aggregate (MB/s) 1,548 3,499 +126% dontcache p99 (us) 10,170 602 -94% Peak dirty pages (MB) 1,837 213 -88% Dontcache now reaches 81% of buffered throughput (was 35%). Competing writers (dontcache vs buffered, separate files): Before After buffered writer 868 433 MB/s dontcache writer 415 433 MB/s Aggregate 1,284 866 MB/s Previously the buffered writer starved the dontcache writer 2:1. With per-bdi_writeback tracking, both writers now receive equal bandwidth. The aggregate matches the buffered-vs-buffered baseline (863 MB/s), indicating fair sharing regardless of I/O mode. The dontcache writer's p99.9 latency collapsed from 119 ms to 33 ms (-73%), eliminating the severe periodic stalls seen in the baseline. Both writers now share identical latency profiles, matching the buffered-vs-buffered pattern. The per-bdi_writeback dirty tracking dramatically reduces peak dirty pages in dontcache workloads, with the 32-file test dropping from 1.8 GB to 213 MB. Dontcache sequential write throughput triples and multi-writer throughput reaches parity with buffered I/O, with tail latencies collapsing by 1-2 orders of magnitude. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260511-dontcache-v7-3-2848ddce8090@kernel.org Reviewed-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Christian Brauner (Amutable) --- include/linux/backing-dev-defs.h | 2 ++ include/linux/fs.h | 6 ++---- include/trace/events/writeback.h | 3 ++- 3 files changed, 6 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h index cb660dd37286..4f1084937315 100644 --- a/include/linux/backing-dev-defs.h +++ b/include/linux/backing-dev-defs.h @@ -26,6 +26,7 @@ enum wb_state { WB_writeback_running, /* Writeback is in progress */ WB_has_dirty_io, /* Dirty inodes on ->b_{dirty|io|more_io} */ WB_start_all, /* nr_pages == 0 (all) work pending */ + WB_start_dontcache, /* dontcache writeback pending */ }; enum wb_stat_item { @@ -56,6 +57,7 @@ enum wb_reason { */ WB_REASON_FORKER_THREAD, WB_REASON_FOREIGN_FLUSH, + WB_REASON_DONTCACHE, WB_REASON_MAX, }; diff --git a/include/linux/fs.h b/include/linux/fs.h index 11559c513dfb..df72b42a9e9b 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2624,6 +2624,7 @@ extern int __must_check file_write_and_wait_range(struct file *file, loff_t start, loff_t end); int filemap_flush_range(struct address_space *mapping, loff_t start, loff_t end); +void filemap_dontcache_kick_writeback(struct address_space *mapping); static inline int file_write_and_wait(struct file *file) { @@ -2657,10 +2658,7 @@ static inline ssize_t generic_write_sync(struct kiocb *iocb, ssize_t count) if (ret) return ret; } else if (iocb->ki_flags & IOCB_DONTCACHE) { - struct address_space *mapping = iocb->ki_filp->f_mapping; - - filemap_flush_range(mapping, iocb->ki_pos - count, - iocb->ki_pos - 1); + filemap_dontcache_kick_writeback(iocb->ki_filp->f_mapping); } return count; diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h index bdac0d685a98..13ee076ccd16 100644 --- a/include/trace/events/writeback.h +++ b/include/trace/events/writeback.h @@ -44,7 +44,8 @@ EM( WB_REASON_PERIODIC, "periodic") \ EM( WB_REASON_FS_FREE_SPACE, "fs_free_space") \ EM( WB_REASON_FORKER_THREAD, "forker_thread") \ - EMe(WB_REASON_FOREIGN_FLUSH, "foreign_flush") + EM( WB_REASON_FOREIGN_FLUSH, "foreign_flush") \ + EMe(WB_REASON_DONTCACHE, "dontcache") WB_WORK_REASON -- cgit v1.2.3 From c6c6f0aec6fb4cbcc547bb265315fd76f18be731 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= Date: Thu, 4 Jun 2026 01:48:13 -0300 Subject: ALSA: core: Add scoped cleanup helper for card references MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Several ALSA paths acquire temporary card references with snd_card_ref() and release them manually with snd_card_unref(). control_led.c already defines a local cleanup helper for this pattern, while other core paths still open-code the release. Move the helper to the common ALSA core header and use it in control-layer card-reference paths. This makes the ownership rule explicit and avoids future missing-unref mistakes when adding early exits. No functional change is intended. Signed-off-by: Cássio Gabriel Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260604-alsa-scoped-cleanups-v1-2-10c43152a728@gmail.com --- include/sound/core.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/sound/core.h b/include/sound/core.h index 4bb76c21c956..8b2ca95d13f7 100644 --- a/include/sound/core.h +++ b/include/sound/core.h @@ -319,6 +319,8 @@ static inline void snd_card_unref(struct snd_card *card) put_device(&card->card_dev); } +DEFINE_FREE(snd_card_unref, struct snd_card *, if (_T) snd_card_unref(_T)) + #define snd_card_set_dev(card, devptr) ((card)->dev = (devptr)) /* device.c */ -- cgit v1.2.3 From 4b7381326424809577eb43bf635ea1d43a095d89 Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:31:15 +0100 Subject: buffer: Add bh_submit() bh_submit() takes a bio_end_io allowing users to avoid the indirect function call through bh->b_end_io, and eventually allowing us to remove bh->b_end_io. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20260528173150.1093780-3-willy@infradead.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner (Amutable) --- include/linux/buffer_head.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h index e4939e33b4b5..d59980e4adda 100644 --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -240,6 +240,7 @@ int sync_dirty_buffer(struct buffer_head *bh); int __sync_dirty_buffer(struct buffer_head *bh, blk_opf_t op_flags); void write_dirty_buffer(struct buffer_head *bh, blk_opf_t op_flags); void submit_bh(blk_opf_t, struct buffer_head *); +void bh_submit(struct buffer_head *, blk_opf_t, bio_end_io_t); void write_boundary_block(struct block_device *bdev, sector_t bblock, unsigned blocksize); int bh_uptodate_or_lock(struct buffer_head *bh); -- cgit v1.2.3 From 86ecf5704ed3c731284b9c60e46dcc5d115ebe7c Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:31:17 +0100 Subject: buffer: Add bh_end_read(), bh_end_write() and bh_end_async_write() These are the bio_end_io_t versions of end_buffer_read_sync(), end_buffer_write_sync() and end_buffer_async_write(). They do not contain a put_bh() call as it is no longer necessary. Also add the helper function bio_endio_bh(). Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20260528173150.1093780-5-willy@infradead.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner (Amutable) --- include/linux/buffer_head.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h index d59980e4adda..b0a31a90fa79 100644 --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -204,6 +204,12 @@ struct buffer_head *create_empty_buffers(struct folio *folio, unsigned long blocksize, unsigned long b_state); void end_buffer_read_sync(struct buffer_head *bh, int uptodate); void end_buffer_write_sync(struct buffer_head *bh, int uptodate); +bool bio_endio_bh(struct bio *bio, struct buffer_head **bhp); + +/* Completion routines suitable for passing to bh_submit() */ +void bh_end_read(struct bio *bio); +void bh_end_write(struct bio *bio); +void bh_end_async_write(struct bio *bio); /* Things to do with metadata buffers list */ void mmb_mark_buffer_dirty(struct buffer_head *bh, struct mapping_metadata_bhs *mmb); -- cgit v1.2.3 From e6eff926482d0f6ebe038a15348158682f5711a0 Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:31:39 +0100 Subject: buffer: Remove mark_buffer_async_write() There are no more callers of this function, so delete it. end_buffer_async_write() then has only one caller left, so inline it into bh_end_async_write(). Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20260528173150.1093780-27-willy@infradead.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner (Amutable) --- include/linux/buffer_head.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h index b0a31a90fa79..f0a9f3f05ac1 100644 --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -224,7 +224,6 @@ static inline void clean_bdev_bh_alias(struct buffer_head *bh) clean_bdev_aliases(bh->b_bdev, bh->b_blocknr, 1); } -void mark_buffer_async_write(struct buffer_head *bh); void __wait_on_buffer(struct buffer_head *); wait_queue_head_t *bh_waitq_head(struct buffer_head *bh); struct buffer_head *__find_get_block(struct block_device *bdev, sector_t block, -- cgit v1.2.3 From 2911b935825523a71a71eecfe908902d181c041e Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:31:44 +0100 Subject: buffer: Remove submit_bh() No users are left; remove this API. Also remove/fix comments mentioning it, and end_bio_bh_io_sync() as it's now unused. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20260528173150.1093780-32-willy@infradead.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner (Amutable) --- include/linux/buffer_head.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h index f0a9f3f05ac1..7629130d42c4 100644 --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -55,7 +55,7 @@ typedef void (bh_end_io_t)(struct buffer_head *bh, int uptodate); * is the bio, and buffer_heads are used for extracting block * mappings (via a get_block_t call), for tracking state within * a folio (via a folio_mapping) and for wrapping bio submission - * for backward compatibility reasons (e.g. submit_bh). + * for backward compatibility reasons (e.g. bh_submit). */ struct buffer_head { unsigned long b_state; /* buffer state bitmap (see above) */ @@ -244,7 +244,6 @@ void __lock_buffer(struct buffer_head *bh); int sync_dirty_buffer(struct buffer_head *bh); int __sync_dirty_buffer(struct buffer_head *bh, blk_opf_t op_flags); void write_dirty_buffer(struct buffer_head *bh, blk_opf_t op_flags); -void submit_bh(blk_opf_t, struct buffer_head *); void bh_submit(struct buffer_head *, blk_opf_t, bio_end_io_t); void write_boundary_block(struct block_device *bdev, sector_t bblock, unsigned blocksize); -- cgit v1.2.3 From ac75b922bb67cc8edb52006c9346dc0ca91d04c8 Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:31:45 +0100 Subject: buffer: Remove b_end_io This shrinks buffer_head by 8 bytes, letting us pack more buffer heads per slab. With a Debian config, it shrinks from 104 bytes to 96 bytes which is 42 objects per 4KiB page rather than 39, a 7% reduction in the amount of memory used. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20260528173150.1093780-33-willy@infradead.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner (Amutable) --- include/linux/buffer_head.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h index 7629130d42c4..1ee56c9f2327 100644 --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -46,7 +46,6 @@ enum bh_state_bits { struct page; struct buffer_head; struct address_space; -typedef void (bh_end_io_t)(struct buffer_head *bh, int uptodate); /* * Historically, a buffer_head was used to map a single block @@ -70,8 +69,7 @@ struct buffer_head { char *b_data; /* pointer to data within the page */ struct block_device *b_bdev; - bh_end_io_t *b_end_io; /* I/O completion */ - void *b_private; /* reserved for b_end_io */ + void *b_private; /* reserved for bio_end_io */ struct list_head b_assoc_buffers; /* associated with another mapping */ struct mapping_metadata_bhs *b_mmb; /* head of the list of metadata bhs * this buffer is associated with */ -- cgit v1.2.3 From b20f15420f786a029be09b1d9b81695581d1a122 Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:31:47 +0100 Subject: buffer: Remove end_buffer_write_sync() It has no callers left, so delete it. Inline __end_buffer_write_sync() into bh_end_write(). Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20260528173150.1093780-35-willy@infradead.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner (Amutable) --- include/linux/buffer_head.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h index 1ee56c9f2327..8b23bc9a244c 100644 --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -201,7 +201,6 @@ struct buffer_head *alloc_page_buffers(struct page *page, unsigned long size); struct buffer_head *create_empty_buffers(struct folio *folio, unsigned long blocksize, unsigned long b_state); void end_buffer_read_sync(struct buffer_head *bh, int uptodate); -void end_buffer_write_sync(struct buffer_head *bh, int uptodate); bool bio_endio_bh(struct bio *bio, struct buffer_head **bhp); /* Completion routines suitable for passing to bh_submit() */ -- cgit v1.2.3 From 9c91efd1d63e995bb0577fc1c5e909613dfe671d Mon Sep 17 00:00:00 2001 From: Reinette Chatre Date: Wed, 3 Jun 2026 20:38:47 -0700 Subject: cpu: Add lockdep_is_cpus_held()/lockdep_is_cpus_write_held() stubs for !CONFIG_HOTPLUG_CPU lockdep_is_cpus_held() and lockdep_is_cpus_write_held() are undefined when !CONFIG_HOTPLUG_CPU. This is ok because their few callers protect the calls with a "if (IS_ENABLED(CONFIG_HOTPLUG_CPU) ..." check. It is error prone to require callers to protect lockdep_is_cpus_held() and lockdep_is_cpus_write_held() with an IS_ENABLED(CONFIG_HOTPLUG_CPU) check while the custom for equivalent functions, for example the more prevalent lockdep_is_held(), is to not require similar protection. It is also inconsistent with CPU hotplug lockdep code self since related call lockdep_assert_cpus_held() does not require protection. Create stubs for lockdep_is_cpus_held() and lockdep_is_cpus_write_held() that returns 1 (LOCK_STATE_UNKNOWN/LOCK_STATE_HELD) when !CONFIG_HOTPLUG_CPU. This makes the CPU hotplug lockdep checks consistent while following existing lockdep custom. Drop the "extern" from the function declaration as part of the move to match kernel coding style. Keep the IS_ENABLED(CONFIG_HOTPLUG_CPU) checks in existing users since removing them would change the logic of these expressions. Reported-by: Sashiko Signed-off-by: Reinette Chatre Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/7484f0b58fd86153d445819cc4e172adba16cff9.1780543665.git.reinette.chatre@intel.com Closes: https://sashiko.dev/#/patchset/cover.1780456704.git.reinette.chatre%40intel.com?part=1 --- include/linux/cpuhplock.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/cpuhplock.h b/include/linux/cpuhplock.h index 286b3ab92e15..42f6a095ba5b 100644 --- a/include/linux/cpuhplock.h +++ b/include/linux/cpuhplock.h @@ -12,9 +12,6 @@ struct device; -extern int lockdep_is_cpus_held(void); -extern int lockdep_is_cpus_write_held(void); - #ifdef CONFIG_HOTPLUG_CPU void cpus_write_lock(void); void cpus_write_unlock(void); @@ -22,6 +19,8 @@ void cpus_read_lock(void); void cpus_read_unlock(void); int cpus_read_trylock(void); void lockdep_assert_cpus_held(void); +int lockdep_is_cpus_held(void); +int lockdep_is_cpus_write_held(void); void cpu_hotplug_disable_offlining(void); void cpu_hotplug_disable(void); void cpu_hotplug_enable(void); @@ -38,6 +37,8 @@ static inline void cpus_read_lock(void) { } static inline void cpus_read_unlock(void) { } static inline int cpus_read_trylock(void) { return true; } static inline void lockdep_assert_cpus_held(void) { } +static inline int lockdep_is_cpus_held(void) { return 1; } +static inline int lockdep_is_cpus_write_held(void) { return 1; } static inline void cpu_hotplug_disable_offlining(void) { } static inline void cpu_hotplug_disable(void) { } static inline void cpu_hotplug_enable(void) { } -- cgit v1.2.3 From 0652a3daa78723f955b1ebeb621665ce72bec53e Mon Sep 17 00:00:00 2001 From: Eva Kurchatova Date: Wed, 3 Jun 2026 18:31:42 +0300 Subject: tracing: Fix CFI violation in probestub being called by tprobes The probestub is a function to allow tprobes to hook to a tracepoint to gain access to its parameters. The function itself is only referenced by the tracepoint structure which lives in the __tracepoint section. objtool explicitly ignores that section and when processing functions in the kernel, if it detects one that has no references it will seal it to have its ENDBR stripped on boot up. This means when a tprobe is attached to the sched_wakeup tracepoint, when it is triggered it will call __probestub_sched_wakeup and due to the missing ENDBR on a CFI-enabled machine it will take a #CP exception. Fix this by adding CFI_NOSEAL annotation to probestub declaration. Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu (Google) Link: https://patch.msgid.link/20260603153147.573589-1-eva.kurchatova@virtuozzo.com Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks") Signed-off-by: Eva Kurchatova [ Updated change log ] Signed-off-by: Steven Rostedt --- include/linux/tracepoint.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h index 763eea4d80d8..2d2b9f8cdda4 100644 --- a/include/linux/tracepoint.h +++ b/include/linux/tracepoint.h @@ -20,6 +20,7 @@ #include #include #include +#include struct module; struct tracepoint; @@ -389,6 +390,13 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p) void __probestub_##_name(void *__data, proto) \ { \ } \ + /* \ + * Annotate the probestub 'CFI_NOSEAL' to stop objtool from \ + * requesting the kernel remove the ENDBR, because the only \ + * references to the function are in the __tracepoint section, \ + * that objtool doesn't scan. \ + */ \ + CFI_NOSEAL(__probestub_##_name); \ DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name); \ DEFINE_RUST_DO_TRACE(_name, TP_PROTO(proto), TP_ARGS(args)) -- cgit v1.2.3 From 705e1068071f82b6c66b9e28124fbb7123b04c1d Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 22:00:20 +0200 Subject: timekeeping: Remove system_time_snapshot::real/boot/raw MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All users are converted over to ktime_get_snapshot_id() and system_time_snapshot::systime and ::monoraw. Remove the leftovers. Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Thomas Weißschuh Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260529195557.330029635@kernel.org --- include/linux/timekeeping.h | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) (limited to 'include') diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h index 161157c8d27e..eb64c90c4127 100644 --- a/include/linux/timekeeping.h +++ b/include/linux/timekeeping.h @@ -280,9 +280,6 @@ static inline bool ktime_get_aux_ts64(clockid_t id, struct timespec64 *kt) { ret * a selected CLOCK_* and the clocksource counter value * @cycles: Clocksource counter value to produce the system times * @systime: The system time of the selected CLOCK ID - * @real: Realtime system time - * @boot: Boot time - * @raw: Monotonic raw system time * @monoraw: Monotonic raw system time * @cs_id: Clocksource ID * @clock_was_set_seq: The sequence number of clock-was-set events @@ -292,12 +289,7 @@ static inline bool ktime_get_aux_ts64(clockid_t id, struct timespec64 *kt) { ret struct system_time_snapshot { u64 cycles; ktime_t systime; - ktime_t real; - ktime_t boot; - union { - ktime_t raw; - ktime_t monoraw; - }; + ktime_t monoraw; enum clocksource_ids cs_id; unsigned int clock_was_set_seq; u8 cs_was_changed_seq; -- cgit v1.2.3 From 6c14771816435a7ecf52d981a341e2de21463268 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 22:00:28 +0200 Subject: timekeeping: Add system_counterval_t to struct system_device_crosststamp An upcoming extension to the PTP IOCTL requires to return the system counter value and the clocksource ID to user space. get_device_system_crosststamp() has this information already. Extend struct system_device_crosststamp with a system_counterval_t member and fill in the data. Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260529195557.429406675@kernel.org --- include/linux/timekeeping.h | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) (limited to 'include') diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h index eb64c90c4127..3867db65f391 100644 --- a/include/linux/timekeeping.h +++ b/include/linux/timekeeping.h @@ -296,19 +296,6 @@ struct system_time_snapshot { u8 valid; }; -/** - * struct system_device_crosststamp - system/device cross-timestamp - * (synchronized capture) - * @device: Device time - * @sys_realtime: Realtime simultaneous with device time - * @sys_monoraw: Monotonic raw simultaneous with device time - */ -struct system_device_crosststamp { - ktime_t device; - ktime_t sys_realtime; - ktime_t sys_monoraw; -}; - /** * struct system_counterval_t - system counter value with the ID of the * corresponding clocksource @@ -325,6 +312,21 @@ struct system_counterval_t { bool use_nsecs; }; +/** + * struct system_device_crosststamp - system/device cross-timestamp + * (synchronized capture) + * @device: Device time + * @sys_counter: Clocksource counter value simultaneous with device time + * @sys_realtime: Realtime simultaneous with device time + * @sys_monoraw: Monotonic raw simultaneous with device time + */ +struct system_device_crosststamp { + ktime_t device; + struct system_counterval_t sys_counter; + ktime_t sys_realtime; + ktime_t sys_monoraw; +}; + extern bool ktime_real_to_base_clock(ktime_t treal, enum clocksource_ids base_id, u64 *cycles); extern bool timekeeping_clocksource_has_base(enum clocksource_ids id); -- cgit v1.2.3 From e3b8d03faa4d266d19ff7a7534e7bf810ff681cf Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 22:00:32 +0200 Subject: timekeeping: Add CLOCK ID to system_device_crosststamp The normal capture for system/device cross timestamps is CLOCK_REALTIME, but that's meaningless for AUX clocks. Add a clock_id field to struct system_device_crosststamp and initialize it with CLOCK_REALTIME at the two places which prepare for cross timestamps. After the related code has been cleaned up, the core code will honor the clock_id field when calculating the system time from the system counter snapshot. No functional change. Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260529195557.482153523@kernel.org --- include/linux/timekeeping.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h index 3867db65f391..fff6d9e319c4 100644 --- a/include/linux/timekeeping.h +++ b/include/linux/timekeeping.h @@ -315,12 +315,14 @@ struct system_counterval_t { /** * struct system_device_crosststamp - system/device cross-timestamp * (synchronized capture) + * @clock_id: System time Clock ID to capture * @device: Device time * @sys_counter: Clocksource counter value simultaneous with device time * @sys_realtime: Realtime simultaneous with device time * @sys_monoraw: Monotonic raw simultaneous with device time */ struct system_device_crosststamp { + clockid_t clock_id; ktime_t device; struct system_counterval_t sys_counter; ktime_t sys_realtime; -- cgit v1.2.3 From b21d442c9aebe5ed95303883d3365e430e134cf1 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 22:00:56 +0200 Subject: timekeeping: Remove ktime_get_snapshot() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All users have been converted to ktime_get_snapshot_id(). Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Thomas Weißschuh Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260529195557.795510496@kernel.org --- include/linux/timekeeping.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include') diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h index fff6d9e319c4..2d9860ecb285 100644 --- a/include/linux/timekeeping.h +++ b/include/linux/timekeeping.h @@ -350,11 +350,6 @@ extern int get_device_system_crosststamp( */ extern void ktime_get_snapshot_id(clockid_t clock_id, struct system_time_snapshot *systime_snapshot); -static inline void ktime_get_snapshot(struct system_time_snapshot *systime_snapshot) -{ - ktime_get_snapshot_id(CLOCK_REALTIME, systime_snapshot); -} - /* * Persistent clock related interfaces */ -- cgit v1.2.3 From 09fb74f77e02489d1d8c555d44bab99d4905127c Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 22:01:00 +0200 Subject: timekeeping: Prepare for cross timestamps on arbitrary clock IDs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PTP device system crosstime stamps support only CLOCK_REALTIME, which is meaningless for AUX clocks. The PTP core hands in the clock ID already, so prepare the core code to honor it. - Add a new sys_systime field to struct system_device_crosststamp which aliases the sys_realtime field. Once all users are converted sys_realtime can be removed. - Prepare get_device_system_crosststamp() and the related code for it by switching to sys_systime and providing the initial changes to utilize different time keepers. No functional change intended. Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Thomas Weißschuh Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260529195557.846634842@kernel.org --- include/linux/timekeeping.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h index 2d9860ecb285..017599d04eb4 100644 --- a/include/linux/timekeeping.h +++ b/include/linux/timekeeping.h @@ -319,13 +319,18 @@ struct system_counterval_t { * @device: Device time * @sys_counter: Clocksource counter value simultaneous with device time * @sys_realtime: Realtime simultaneous with device time + * @sys_systime: System time for @clock_id * @sys_monoraw: Monotonic raw simultaneous with device time */ struct system_device_crosststamp { clockid_t clock_id; ktime_t device; struct system_counterval_t sys_counter; - ktime_t sys_realtime; + union { + /* realtime goes away once all users are converted */ + ktime_t sys_realtime; + ktime_t sys_systime; + }; ktime_t sys_monoraw; }; -- cgit v1.2.3 From 5ccaf1e569f04d8fd5f0167be728fdb48f448f81 Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 22:01:17 +0200 Subject: timekeeping: Remove system_device_crosststamp::sys_realtime MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All users are converted to sys_systime. Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Thomas Weißschuh Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260529195558.046694580@kernel.org --- include/linux/timekeeping.h | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h index 017599d04eb4..7f03e1cefcf6 100644 --- a/include/linux/timekeeping.h +++ b/include/linux/timekeeping.h @@ -318,7 +318,6 @@ struct system_counterval_t { * @clock_id: System time Clock ID to capture * @device: Device time * @sys_counter: Clocksource counter value simultaneous with device time - * @sys_realtime: Realtime simultaneous with device time * @sys_systime: System time for @clock_id * @sys_monoraw: Monotonic raw simultaneous with device time */ @@ -326,11 +325,7 @@ struct system_device_crosststamp { clockid_t clock_id; ktime_t device; struct system_counterval_t sys_counter; - union { - /* realtime goes away once all users are converted */ - ktime_t sys_realtime; - ktime_t sys_systime; - }; + ktime_t sys_systime; ktime_t sys_monoraw; }; -- cgit v1.2.3 From a6d799608e6a61b48908bff955200d03c34c90ca Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Fri, 29 May 2026 22:01:25 +0200 Subject: ptp: Switch to ktime_get_snapshot_id() for pre/post timestamps To prepare for a new PTP IOCTL, which exposes the raw counter value along with the requested system time snapshot, switch the pre/post time stamp sampling over to use ktime_get_snapshot_id() and fix up all usage sites. No functional change intended. The ptp_vmclock conversion was simplified by David Woodhouse. Signed-off-by: Thomas Gleixner Tested-by: David Woodhouse Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Jacob Keller Acked-by: Vadim Fedorenko Link: https://patch.msgid.link/20260529195558.149589566@kernel.org --- include/linux/ptp_clock_kernel.h | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/linux/ptp_clock_kernel.h b/include/linux/ptp_clock_kernel.h index 884364596dd3..36a27a910595 100644 --- a/include/linux/ptp_clock_kernel.h +++ b/include/linux/ptp_clock_kernel.h @@ -12,6 +12,7 @@ #include #include #include +#include #include #define PTP_CLOCK_NAME_LEN 32 @@ -45,13 +46,13 @@ struct system_device_crosststamp; /** * struct ptp_system_timestamp - system time corresponding to a PHC timestamp - * @pre_ts: system timestamp before capturing PHC - * @post_ts: system timestamp after capturing PHC - * @clockid: clock-base used for capturing the system timestamps + * @pre_sts: system time snapshot before capturing PHC + * @post_sts: system time snapshot after capturing PHC + * @clockid: clock-base used for capturing the system timestamps */ struct ptp_system_timestamp { - struct timespec64 pre_ts; - struct timespec64 post_ts; + struct system_time_snapshot pre_sts; + struct system_time_snapshot post_sts; clockid_t clockid; }; @@ -510,13 +511,13 @@ static inline ktime_t ptp_convert_timestamp(const ktime_t *hwtstamp, static inline void ptp_read_system_prets(struct ptp_system_timestamp *sts) { if (sts) - ktime_get_clock_ts64(sts->clockid, &sts->pre_ts); + ktime_get_snapshot_id(sts->clockid, &sts->pre_sts); } static inline void ptp_read_system_postts(struct ptp_system_timestamp *sts) { if (sts) - ktime_get_clock_ts64(sts->clockid, &sts->post_ts); + ktime_get_snapshot_id(sts->clockid, &sts->post_sts); } #endif -- cgit v1.2.3 From ca1ec8bfac8c95d0fed9e3611ea21400d1f37262 Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Fri, 29 May 2026 22:01:29 +0200 Subject: timekeeping: Add clocksource read_snapshot() method and hw_cycles to snapshot Add a read_snapshot() callback to struct clocksource which returns the derived clocksource value while also providing the underlying hardware counter reading and the related clocksource ID. This allows ktime_get_snapshot_id() to populate new hw_cycles and hw_csid fields in struct system_time_snapshot. For clocksources that are derived from an underlying counter (e.g., Hyper-V TSC page scales TSC to 10MHz, kvmclock scales TSC to 1GHz), this provides atomic access to both the derived value needed for timekeeping calculations, and the raw hardware counter needed by consumers like KVM's master clock and the vmclock PTP driver. [ tglx: Reworked it slightly ] Signed-off-by: David Woodhouse Signed-off-by: Thomas Gleixner Reviewed-by: Jacob Keller Assisted-by: Kiro:claude-opus-4.6-1m Link: https://patch.msgid.link/20260526230635.136914-1-dwmw2@infradead.org Link: https://patch.msgid.link/20260529195558.202568489@kernel.org --- include/linux/clocksource.h | 24 ++++++++++++++++++++++++ include/linux/timekeeping.h | 6 ++++++ 2 files changed, 30 insertions(+) (limited to 'include') diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h index 7c38190b10bf..6d9ddf1587a2 100644 --- a/include/linux/clocksource.h +++ b/include/linux/clocksource.h @@ -31,6 +31,21 @@ struct module; #include +/** + * struct clocksource_hw_snapshot - Snapshot for the underlying hardware counter of derived + * clocksources like kvmclock or Hyper-V scaled TSC + * @hw_cycles: The hardware counter value + * @hw_csid: Clocksource ID of the hardware counter + * + * Such clocksources must implement the read_snapshot() callback and fill in the + * hardware counter value, the clocksource ID of the hardware counter and derive + * the actual clocksource cycles from @hw_cycles to provide an atomic snapshot + */ +struct clocksource_hw_snapshot { + u64 hw_cycles; + enum clocksource_ids hw_csid; +}; + /** * struct clocksource - hardware abstraction for a free running counter * Provides mostly state-free accessors to the underlying hardware. @@ -72,6 +87,14 @@ struct module; * @flags: Flags describing special properties * @base: Hardware abstraction for clock on which a clocksource * is based + * @read_snapshot: Extended @read() function for clocksources such as + * kvmclock or the Hyper-V scaled TSC where the actual + * clocksource value for timekeeping is calculated from an + * underlying hardware counter. Returns the timekeeping + * relevant cycle value and stores the raw value of the + * underlying counter from which it was calculated + * including the clocksource ID of that counter in the + * clocksource hardware snapshot. * @enable: Optional function to enable the clocksource * @disable: Optional function to disable the clocksource * @suspend: Optional suspend function for the clocksource @@ -113,6 +136,7 @@ struct clocksource { unsigned long flags; struct clocksource_base *base; + u64 (*read_snapshot)(struct clocksource *cs, struct clocksource_hw_snapshot *chs); int (*enable)(struct clocksource *cs); void (*disable)(struct clocksource *cs); void (*suspend)(struct clocksource *cs); diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h index 7f03e1cefcf6..984a866d293b 100644 --- a/include/linux/timekeeping.h +++ b/include/linux/timekeeping.h @@ -279,18 +279,24 @@ static inline bool ktime_get_aux_ts64(clockid_t id, struct timespec64 *kt) { ret * struct system_time_snapshot - Simultaneous time capture of CLOCK_MONOTONIC_RAW, * a selected CLOCK_* and the clocksource counter value * @cycles: Clocksource counter value to produce the system times + * @hw_cycles: For derived clocksources, the hardware counter value from + * which @cycles was derived * @systime: The system time of the selected CLOCK ID * @monoraw: Monotonic raw system time * @cs_id: Clocksource ID + * @hw_csid: Clocksource ID of the underlying hardware counter for derived + * clocksources which implement the read_snapshot() callback. * @clock_was_set_seq: The sequence number of clock-was-set events * @cs_was_changed_seq: The sequence number of clocksource change events * @valid: True if the snapshot is valid */ struct system_time_snapshot { u64 cycles; + u64 hw_cycles; ktime_t systime; ktime_t monoraw; enum clocksource_ids cs_id; + enum clocksource_ids hw_csid; unsigned int clock_was_set_seq; u8 cs_was_changed_seq; u8 valid; -- cgit v1.2.3 From 231a1744dc433e8f39871a8fd0f5eab78202e136 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Tue, 26 May 2026 21:06:06 +0200 Subject: xfrm: add extack to xfrm_init_state Add a struct extack parameter to xfrm_init_state() and pass it through to __xfrm_init_state(). This allows validation errors detected during state initialization to propagate meaningful error messages back to userspace. xfrm_state_migrate() now passes extack so that errors from the XFRM_MSG_MIGRATE_STATE path are properly reported. Callers without an extack context (af_key, ipcomp4, ipcomp6) pass NULL, preserving their existing behaviour. Reviewed-by: Sabrina Dubroca Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 10d3edde6b2f..0c035955d87d 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1774,7 +1774,7 @@ u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); int xfrm_init_replay(struct xfrm_state *x, struct netlink_ext_ack *extack); u32 xfrm_state_mtu(struct xfrm_state *x, int mtu); int __xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack); -int xfrm_init_state(struct xfrm_state *x); +int xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack); int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); int xfrm_input_resume(struct sk_buff *skb, int nexthdr); int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, -- cgit v1.2.3 From e2e92714d08117d18f0e560673206717d10edbd4 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Tue, 26 May 2026 21:07:15 +0200 Subject: xfrm: rename reqid in xfrm_migrate In preparation for a later patch in this series s/reqid/old_reqid/. No functional change. Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 0c035955d87d..368b1dc22e5c 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -685,7 +685,7 @@ struct xfrm_migrate { u8 proto; u8 mode; u16 reserved; - u32 reqid; + u32 old_reqid; u16 old_family; u16 new_family; }; -- cgit v1.2.3 From 8de53883a4bf807a628f0d150a7ca7ddf56a5cc3 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Tue, 26 May 2026 21:07:30 +0200 Subject: xfrm: split xfrm_state_migrate into create and install functions To prepare for subsequent patches, split xfrm_state_migrate() into two functions: - xfrm_state_migrate_create(): creates the migrated state - xfrm_state_migrate_install(): installs it into the state table splitting will help to avoid SN/IV reuse when migrating AEAD SA. And add const whenever possible. No functional change. Reviewed-by: Sabrina Dubroca Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 368b1dc22e5c..4137986f15e2 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1895,6 +1895,17 @@ int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, const struct xfrm_encap_tmpl *encap); struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, u32 if_id); +struct xfrm_state *xfrm_state_migrate_create(struct xfrm_state *x, + const struct xfrm_migrate *m, + const struct xfrm_encap_tmpl *encap, + struct net *net, + struct xfrm_user_offload *xuo, + struct netlink_ext_ack *extack); +int xfrm_state_migrate_install(const struct xfrm_state *x, + struct xfrm_state *xc, + const struct xfrm_migrate *m, + struct xfrm_user_offload *xuo, + struct netlink_ext_ack *extack); struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, struct xfrm_migrate *m, struct xfrm_encap_tmpl *encap, -- cgit v1.2.3 From bac7a60e267831471ecdf54881fc62a2c80c446c Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Tue, 26 May 2026 21:08:17 +0200 Subject: xfrm: add state synchronization after migration Add xfrm_migrate_sync() to copy curlft and replay state from the old SA to the new one before installation. The function allocates no memory, so it can be called under a spinlock. In preparation for a subsequent patch in this series. A subsequent patch calls this under x->lock, atomically capturing the latest lifetime counters and replay state from the original SA and deleting it in the same critical section to prevent SN/IV reuse for XFRM_MSG_MIGRATE_STATE method. No functional change. Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 46 +++++++++++++++++++++++++++++++++++++--------- 1 file changed, 37 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 4137986f15e2..be22c26e4661 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -2024,23 +2024,51 @@ static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_es #ifdef CONFIG_XFRM_MIGRATE static inline int xfrm_replay_clone(struct xfrm_state *x, - struct xfrm_state *orig) + const struct xfrm_state *orig) { + /* Counters synced later in xfrm_replay_sync() */ - x->replay_esn = kmemdup(orig->replay_esn, + x->replay = orig->replay; + x->preplay = orig->preplay; + + if (orig->replay_esn) { + x->replay_esn = kmemdup(orig->replay_esn, xfrm_replay_state_esn_len(orig->replay_esn), GFP_KERNEL); - if (!x->replay_esn) - return -ENOMEM; - x->preplay_esn = kmemdup(orig->preplay_esn, - xfrm_replay_state_esn_len(orig->preplay_esn), - GFP_KERNEL); - if (!x->preplay_esn) - return -ENOMEM; + if (!x->replay_esn) + return -ENOMEM; + x->preplay_esn = kmemdup(orig->preplay_esn, + xfrm_replay_state_esn_len(orig->preplay_esn), + GFP_KERNEL); + if (!x->preplay_esn) + return -ENOMEM; + } return 0; } +static inline void xfrm_replay_sync(struct xfrm_state *x, const struct xfrm_state *orig) +{ + x->replay = orig->replay; + x->preplay = orig->preplay; + + if (orig->replay_esn) { + memcpy(x->replay_esn, orig->replay_esn, + xfrm_replay_state_esn_len(orig->replay_esn)); + + memcpy(x->preplay_esn, orig->preplay_esn, + xfrm_replay_state_esn_len(orig->preplay_esn)); + } +} + +static inline void xfrm_migrate_sync(struct xfrm_state *x, + const struct xfrm_state *orig) +{ + /* called under lock so no race conditions or mallocs allowed */ + memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft)); + xfrm_replay_sync(x, orig); +} + static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) { return kmemdup(orig, aead_len(orig), GFP_KERNEL); -- cgit v1.2.3 From 1d97daee303847bd9f0ff97dc257380fc156206d Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Tue, 26 May 2026 21:08:46 +0200 Subject: xfrm: move encap and xuo into struct xfrm_migrate In preparation for an upcoming patch, move the xfrm_encap_tmpl and xfrm_user_offload pointers from separate parameters into struct xfrm_migrate, reducing the parameter count of xfrm_state_migrate_create(), xfrm_state_migrate_install() and xfrm_state_migrate() The fields are placed after the four xfrm_address_t members where the struct is naturally 8-byte aligned, avoiding padding. No functional change. Reviewed-by: Sabrina Dubroca Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index be22c26e4661..4b29ab92c2a7 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -682,6 +682,8 @@ struct xfrm_migrate { xfrm_address_t old_saddr; xfrm_address_t new_daddr; xfrm_address_t new_saddr; + struct xfrm_encap_tmpl *encap; + struct xfrm_user_offload *xuo; u8 proto; u8 mode; u16 reserved; @@ -1897,20 +1899,15 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n u32 if_id); struct xfrm_state *xfrm_state_migrate_create(struct xfrm_state *x, const struct xfrm_migrate *m, - const struct xfrm_encap_tmpl *encap, struct net *net, - struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack); int xfrm_state_migrate_install(const struct xfrm_state *x, struct xfrm_state *xc, const struct xfrm_migrate *m, - struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack); struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, struct xfrm_migrate *m, - struct xfrm_encap_tmpl *encap, struct net *net, - struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack); int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, struct xfrm_migrate *m, int num_bundles, -- cgit v1.2.3 From 8eed5ba25734bfeec766f9518515be7cf6d1de2a Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Tue, 26 May 2026 21:09:35 +0200 Subject: xfrm: make xfrm_dev_state_add xuo parameter const The xuo pointer is not modified by xfrm_dev_state_add(); make it const. Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 4b29ab92c2a7..5515c7b10020 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -2104,7 +2104,7 @@ void xfrm_dev_resume(struct sk_buff *skb); void xfrm_dev_backlog(struct softnet_data *sd); struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again); int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, - struct xfrm_user_offload *xuo, + const struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack); int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, struct xfrm_user_offload *xuo, u8 dir, @@ -2175,7 +2175,9 @@ static inline struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_fea return skb; } -static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, struct xfrm_user_offload *xuo, struct netlink_ext_ack *extack) +static inline int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, + const struct xfrm_user_offload *xuo, + struct netlink_ext_ack *extack) { return 0; } -- cgit v1.2.3 From a9d155ea9b44d9b979796506bec518222f10b9e6 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Tue, 26 May 2026 21:09:51 +0200 Subject: xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration Add a new netlink method to migrate a single xfrm_state. Unlike the existing migration mechanism (SA + policy), this supports migrating only the SA and allows changing the reqid. The SA is looked up via xfrm_usersa_id, which uniquely identifies it, so old_saddr is not needed. old_daddr is carried in xfrm_usersa_id.daddr. The reqid is invariant in the old migration. Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 10 +++++++++- include/uapi/linux/xfrm.h | 25 +++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 5515c7b10020..e2cb2d0e5cee 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -684,12 +684,20 @@ struct xfrm_migrate { xfrm_address_t new_saddr; struct xfrm_encap_tmpl *encap; struct xfrm_user_offload *xuo; + struct xfrm_mark old_mark; + const struct xfrm_mark *new_mark; + struct xfrm_mark smark; u8 proto; u8 mode; - u16 reserved; + u16 msg_type; /* XFRM_MSG_MIGRATE or XFRM_MSG_MIGRATE_STATE */ + u32 flags; u32 old_reqid; + u32 new_reqid; + u32 nat_keepalive_interval; + u32 mapping_maxage; u16 old_family; u16 new_family; + const struct xfrm_selector *new_sel; }; #define XFRM_KM_TIMEOUT 30 diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h index a23495c0e0a1..051f8066efd1 100644 --- a/include/uapi/linux/xfrm.h +++ b/include/uapi/linux/xfrm.h @@ -227,6 +227,9 @@ enum { #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT XFRM_MSG_GETDEFAULT, #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT + + XFRM_MSG_MIGRATE_STATE, +#define XFRM_MSG_MIGRATE_STATE XFRM_MSG_MIGRATE_STATE __XFRM_MSG_MAX }; #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1) @@ -507,6 +510,28 @@ struct xfrm_user_migrate { __u16 new_family; }; +struct xfrm_user_migrate_state { + struct xfrm_usersa_id id; + xfrm_address_t new_daddr; + xfrm_address_t new_saddr; + struct xfrm_mark old_mark; + struct xfrm_selector new_sel; + __u32 new_reqid; + __u32 flags; + __u16 new_family; + __u16 reserved; +}; + +/* Flags for xfrm_user_migrate_state.flags */ +enum xfrm_migrate_state_flags { + XFRM_MIGRATE_STATE_CLEAR_OFFLOAD = 1, /* do not inherit offload from existing SA */ + XFRM_MIGRATE_STATE_UPDATE_H2H_SEL = 2, /* update H2H selector from new daddr/saddr */ +}; + +/* All flags defined as of this header version; unknown bits are rejected. */ +#define XFRM_MIGRATE_STATE_KNOWN_FLAGS \ + (XFRM_MIGRATE_STATE_CLEAR_OFFLOAD | XFRM_MIGRATE_STATE_UPDATE_H2H_SEL) + struct xfrm_user_mapping { struct xfrm_usersa_id id; __u32 reqid; -- cgit v1.2.3 From 66c75c7e04983f96f6b2f467305eea404aa096d7 Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Thu, 28 May 2026 00:46:46 +0000 Subject: ASoC: soc-core: remove card->dmi_longname Current Card has dmi_longname[80] (when CONFIG_DMI), but no need to have it in Card, we can alloc it. Tidyup it. This is prepare for Card capsuling Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87a4tk2weh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/soc.h | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/sound/soc.h b/include/sound/soc.h index ed8921835069..10ad80f930c2 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -976,9 +976,6 @@ struct snd_soc_card { const char *long_name; const char *driver_name; const char *components; -#ifdef CONFIG_DMI - char dmi_longname[80]; -#endif /* CONFIG_DMI */ #ifdef CONFIG_PCI /* -- cgit v1.2.3 From 899ee91156e57784090c5565e4f31bd7dbffbc5a Mon Sep 17 00:00:00 2001 From: Rajat Gupta Date: Sun, 31 May 2026 08:32:21 -0400 Subject: net/sched: fix pedit partial COW leading to page cache corruption MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb_ensure_writable() inside the per-key loop where the actual write offset is known, and add overflow checking on the offset arithmetic. For negative offsets (e.g. Ethernet header edits at ingress), use skb_cow() to COW the headroom instead. Guard offset_valid() against INT_MIN, where negation is undefined. Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable") Reported-by: Yiming Qian Reported-by: Keenan Dong Reported-by: Han Guidong <2045gemini@gmail.com> Reported-by: Zhang Cen Reviewed-by: Han Guidong <2045gemini@gmail.com> Tested-by: Han Guidong <2045gemini@gmail.com> Reviewed-by: Davide Caratti Tested-by: Davide Caratti Reviewed-by: Toke Høiland-Jørgensen Tested-by: Toke Høiland-Jørgensen Reviewed-by: Victor Nogueira Tested-by: Victor Nogueira Acked-by: Jamal Hadi Salim Signed-off-by: Rajat Gupta Link: https://patch.msgid.link/20260531123221.48732-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski --- include/net/tc_act/tc_pedit.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h index f58ee15cd858..cb7b82f2cbc7 100644 --- a/include/net/tc_act/tc_pedit.h +++ b/include/net/tc_act/tc_pedit.h @@ -15,7 +15,6 @@ struct tcf_pedit_parms { struct tc_pedit_key *tcfp_keys; struct tcf_pedit_key_ex *tcfp_keys_ex; int action; - u32 tcfp_off_max_hint; unsigned char tcfp_nkeys; unsigned char tcfp_flags; struct rcu_head rcu; -- cgit v1.2.3 From 551f209164c4d2cb8d5542351f145e8257c44702 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Thu, 21 May 2026 08:53:16 +0200 Subject: vdso/datastore: Always provide symbol declarations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Allow callers to easily reference these symbols in code that is built even when the generic datastore is disabled. As there are no good default no-op variants of these symbols, do not provide stubs but require users to have their own fallback handling using IS_ENABLED(CONFIG_HAVE_GENERIC_VDSO). Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260521-vdso-mips-kconfig-v1-2-2f79dcd6c78f@linutronix.de --- include/linux/vdso_datastore.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/vdso_datastore.h b/include/linux/vdso_datastore.h index 0b530428db71..3dfba9502d78 100644 --- a/include/linux/vdso_datastore.h +++ b/include/linux/vdso_datastore.h @@ -2,12 +2,12 @@ #ifndef _LINUX_VDSO_DATASTORE_H #define _LINUX_VDSO_DATASTORE_H -#ifdef CONFIG_HAVE_GENERIC_VDSO #include extern const struct vm_special_mapping vdso_vvar_mapping; struct vm_area_struct *vdso_install_vvar_mapping(struct mm_struct *mm, unsigned long addr); +#ifdef CONFIG_HAVE_GENERIC_VDSO void __init vdso_setup_data_pages(void); #else /* !CONFIG_HAVE_GENERIC_VDSO */ static inline void vdso_setup_data_pages(void) { } -- cgit v1.2.3 From 251bc9db88fb351ea2dfbd976c4e6aaae6507a91 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Tue, 2 Jun 2026 18:28:30 -0700 Subject: net: rename netdev_ops_assert_locked() Jakub suggests renaming the existing assert to match the netdev_lock_ops_compat() semantics. We want netdev_assert_locked_ops() to mean - if the driver is ops locked - check that it's holding the device lock. The existing helper check for either ops lock or rtnl_lock, which is the locking behavior of netdev_lock_ops_compat(). The reason for naming divergence is likely that netdev_ops_assert_locked() predated the _compat() helpers. Suggested-by: Jakub Sitnicki Reviewed-by: Nicolai Buchwitz Reviewed-by: Jakub Sitnicki Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260603012840.2254293-2-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/net/netdev_lock.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/netdev_lock.h b/include/net/netdev_lock.h index 3d3aef80beac..8e84d29b0bfb 100644 --- a/include/net/netdev_lock.h +++ b/include/net/netdev_lock.h @@ -64,7 +64,7 @@ static inline void netdev_unlock_full_to_ops(struct net_device *dev) netdev_unlock(dev); } -static inline void netdev_ops_assert_locked(const struct net_device *dev) +static inline void netdev_assert_locked_ops_compat(const struct net_device *dev) { if (netdev_need_ops_lock(dev)) lockdep_assert_held(&dev->lock); @@ -73,11 +73,11 @@ static inline void netdev_ops_assert_locked(const struct net_device *dev) } static inline void -netdev_ops_assert_locked_or_invisible(const struct net_device *dev) +netdev_assert_locked_ops_compat_or_invisible(const struct net_device *dev) { if (dev->reg_state == NETREG_REGISTERED || dev->reg_state == NETREG_UNREGISTERING) - netdev_ops_assert_locked(dev); + netdev_assert_locked_ops_compat(dev); } static inline void netdev_lock_ops_compat(struct net_device *dev) -- cgit v1.2.3 From 1d3964e29e53b02a7c61ed6d6e4aeccba3275ebc Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Tue, 2 Jun 2026 18:28:31 -0700 Subject: net: ethtool: cmis_cdb: hold instance lock for ops locked devices FW module flashing was written so that the flashing happens without holding rtnl_lock. This allows flashing multiple modules at once. Current drivers can handle that well, but we should let drivers depend on the netdev instance lock. Instance lock is per netdev, and so is the module so we won't break parallel updates. Reviewed-by: Jakub Sitnicki Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260603012840.2254293-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/net/netdev_lock.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/net/netdev_lock.h b/include/net/netdev_lock.h index 8e84d29b0bfb..d3daec4e93f3 100644 --- a/include/net/netdev_lock.h +++ b/include/net/netdev_lock.h @@ -80,6 +80,12 @@ netdev_assert_locked_ops_compat_or_invisible(const struct net_device *dev) netdev_assert_locked_ops_compat(dev); } +static inline void netdev_assert_locked_ops(const struct net_device *dev) +{ + if (netdev_need_ops_lock(dev)) + netdev_assert_locked(dev); +} + static inline void netdev_lock_ops_compat(struct net_device *dev) { if (netdev_need_ops_lock(dev)) -- cgit v1.2.3 From f32fe1d79a18592b96342a0016cd62cf9601a054 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Tue, 2 Jun 2026 18:28:33 -0700 Subject: net: ethtool: add netif_get_link_ksettings() for correct ops-locked use __ethtool_get_link_ksettings() is exported and called from sysfs and many drivers. It invokes ethtool_ops->get_link_ksettings so by our own docs it should be holding netdev lock for ops locked devices. Looks like commit 2bcf4772e45a ("net: ethtool: try to protect all callback with netdev instance lock") missed adding the ops lock here. There's a number of callers we need to fix up so let's add the netif_get_link_ksettings() helper first, without any actual locking changes (this commit is a nop). Not treating this as a fix because I don't think any driver cares at this point, but if we want to remove the rtnl_lock protection this will become critical. Reviewed-by: Maxime Chevallier Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260603012840.2254293-5-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/ethtool.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index 1cb0740ba331..f51346a6a686 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -325,6 +325,8 @@ struct ethtool_link_ksettings { extern int __ethtool_get_link_ksettings(struct net_device *dev, struct ethtool_link_ksettings *link_ksettings); +int netif_get_link_ksettings(struct net_device *dev, + struct ethtool_link_ksettings *link_ksettings); struct ethtool_keee { __ETHTOOL_DECLARE_LINK_MODE_MASK(supported); -- cgit v1.2.3 From 17986198a7b99485d7b2bc4eb8d700fbf8c8629e Mon Sep 17 00:00:00 2001 From: Lorenzo Stoakes Date: Tue, 2 Jun 2026 12:06:25 +0100 Subject: drivers/char/mem: eliminate unnecessary use of success_hook Patch series "remove mmap_action success, error hooks", v3. The mmap_action->success_hook was a strange beast added to enable code which appeared to absolutely require access to a VMA pointer to work correctly. Primarily this was for hugetlb, however a different approach will be taken there, as clearly more work is required to figure out a sensible way of converting hugetlb to use mmap_prepare. The other user was the memory char driver, specifically /dev/zero which has the unusual property of explicitly setting file-backed VMAs anonymous. Providing the success hook was always foolish, as it allowed drivers a way to workaround the restriction that they should not access a pointer to a not-yet-correctly-initialised VMA - which defeats the purpose of the mmap_prepare work. We can achieve the same thing in memory char driver without needing the success hook, so this series removes that, then removes the success hook altogether. The error hook is also unnecessary - the motivation for this was for functions which need to override the error code when performing an mmap action in order to avoid breaking userspace. We can achieve this by just providing a field for the error code. Doing this means we don't have to worry about the hook doing anything odd. We also add a check to ensure the error code is in fact valid. Again the memory char driver is the only current user of this, so this series updates it to use that. After this change mmap_action has no custom hooks at all, which seems rather more cromulent than before. This patch (of 3): /dev/zero, uniquely, marks memory mapped there as anonymous. This is currently achieved using the mmap_action->success_hook. However this hook circumvents the abstraction of VMA initialisation so it's preferable to do things a different way. To achieve this, this patch firstly defaults the VMA descriptor's vm_ops field to the dummy VMA operations, which is what file-backed VMAs default this field to. That way, we can detect whether a driver sets this field to NULL in order to mark it anonymous. We then introduce vma_desc_set_anonymous() to do this explicitly, and invoke it in mmap_zero_prepare(). This way, any driver which does not explicitly set desc->vm_ops, retains the dummy vm_ops as they would previously. We also update set_vma_user_defined_fields() to make clear that we are either setting vma->vm_ops to what is provided by the driver (or defaulting to dummy_vm_ops if not set), or setting the VMA anonymous. This lays the groundwork for removing the success hook. Link: https://lore.kernel.org/cover.1780397980.git.ljs@kernel.org Link: https://lore.kernel.org/010579cca6787cf7bb057ab1f7228978b10601c8.1780397980.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Jann Horn Cc: Liam R. Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/mm.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/mm.h b/include/linux/mm.h index 11f440e9d7cd..0f2612a70fb1 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1489,6 +1489,11 @@ static inline void vma_set_anonymous(struct vm_area_struct *vma) vma->vm_ops = NULL; } +static inline void vma_desc_set_anonymous(struct vm_area_desc *desc) +{ + desc->vm_ops = NULL; +} + static inline bool vma_is_anonymous(struct vm_area_struct *vma) { return !vma->vm_ops; -- cgit v1.2.3 From 8876dc0780f23eb499b42cc84df2dd795aada6be Mon Sep 17 00:00:00 2001 From: Lorenzo Stoakes Date: Tue, 2 Jun 2026 12:06:26 +0100 Subject: mm/vma: remove mmap_action->success_hook This hook was introduced to work around code that seemed to absolutely require access to a VMA pointer upon mmap(). However, providing this hook leaves a backdoor to drivers getting access to the very thing mmap_prepare eliminates - a pointer to the VMA. Let's solve this contradiction by removing it. The key intended user was hugetlb, however it seems that the best course now is to avoid allowing all drivers the ability to work around mmap_prepare, and find a different solution there. Link: https://lore.kernel.org/f79434e6d30af6d92999be6b76e197f1847105fa.1780397980.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Jann Horn Cc: Liam R. Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/mm_types.h | 10 ---------- 1 file changed, 10 deletions(-) (limited to 'include') diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index a308e2c23b82..945c0a5386d6 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -843,16 +843,6 @@ struct mmap_action { }; enum mmap_action_type type; - /* - * If specified, this hook is invoked after the selected action has been - * successfully completed. Note that the VMA write lock still held. - * - * The absolute minimum ought to be done here. - * - * Returns 0 on success, or an error code. - */ - int (*success_hook)(const struct vm_area_struct *vma); - /* * If specified, this hook is invoked when an error occurred when * attempting the selected action. -- cgit v1.2.3 From 4f5b8759262e5e65373638346307836de1290b22 Mon Sep 17 00:00:00 2001 From: Lorenzo Stoakes Date: Tue, 2 Jun 2026 12:06:27 +0100 Subject: mm/vma: eliminate mmap_action->error_hook, introduce error_override Rather than providing a hook, simplify things by providing the ability to override mmap action errors. This allows us to more carefully validate the value provided and thus ensure only a valid error code is specified, and simplifies the interface. This way, we eliminate all hooks but mmap_prepare and allow only mmap actions to be specified (which core mm controls). This significantly improves robustness and eliminates any unnecessary code duplication in driver mmap hooks. We also update the /dev/mem logic (the only user) to use mmap_action->error_override instead. Link: https://lore.kernel.org/55d13f7d016b827c459946d46a56105635be111c.1780397980.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Jann Horn Cc: Liam R. Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/mm_types.h | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 945c0a5386d6..5ef78617ce93 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -844,13 +844,10 @@ struct mmap_action { enum mmap_action_type type; /* - * If specified, this hook is invoked when an error occurred when - * attempting the selected action. - * - * The hook can return an error code in order to filter the error, but - * it is not valid to clear the error here. + * If non-zero, replace errors that arise from mmap actions with this + * value instead. Only valid error codes may be specified. */ - int (*error_hook)(int err); + int error_override; /* * This should be set in rare instances where the operation required -- cgit v1.2.3 From 9cf7ef2d6665dff35b3b522c84509c2d256bf3aa Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Fri, 22 May 2026 08:40:16 -0700 Subject: mm/damon/core: hide damon_add_region() damon_add_region() is being used by only DAMON core, but exposed to DAMON API callers. Exposing something that is not really being used by others will only increase the maintenance cost. Hide it. Link: https://lore.kernel.org/20260522154026.80546-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: Shuah Khan Signed-off-by: Andrew Morton --- include/linux/damon.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 4014fd0d463c..b9370c1779cb 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -1024,7 +1024,6 @@ static inline void damon_insert_region(struct damon_region *r, t->nr_regions++; } -void damon_add_region(struct damon_region *r, struct damon_target *t); void damon_destroy_region(struct damon_region *r, struct damon_target *t); int damon_set_regions(struct damon_target *t, struct damon_addr_range *ranges, unsigned int nr_ranges, unsigned long min_region_sz); -- cgit v1.2.3 From 26d6f6960ff91ebb267cd80efe7772c6427b4cc1 Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Fri, 22 May 2026 08:40:17 -0700 Subject: mm/damon/core: hide damon_insert_region() damon_insert_region() is being used by only DAMON core, but exposed to DAMON API callers. Exposing something that is not really being used by others will only increase the maintenance cost. Hide it. Link: https://lore.kernel.org/20260522154026.80546-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: Shuah Khan Signed-off-by: Andrew Morton --- include/linux/damon.h | 11 ----------- 1 file changed, 11 deletions(-) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index b9370c1779cb..3acca7deb169 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -1013,17 +1013,6 @@ void damon_add_probe(struct damon_ctx *ctx, struct damon_probe *probe); struct damon_region *damon_new_region(unsigned long start, unsigned long end); -/* - * Add a region between two other regions - */ -static inline void damon_insert_region(struct damon_region *r, - struct damon_region *prev, struct damon_region *next, - struct damon_target *t) -{ - __list_add(&r->list, &prev->list, &next->list); - t->nr_regions++; -} - void damon_destroy_region(struct damon_region *r, struct damon_target *t); int damon_set_regions(struct damon_target *t, struct damon_addr_range *ranges, unsigned int nr_ranges, unsigned long min_region_sz); -- cgit v1.2.3 From 50d2dec8af1a09056b6b29b54a30e32281b30e2c Mon Sep 17 00:00:00 2001 From: SeongJae Park Date: Fri, 22 May 2026 08:40:18 -0700 Subject: mm/damon/core: hide damon_destroy_region() damon_destroy_region() is being used by only DAMON core, but exposed to DAMON API callers. Exposing something that is not really being used by others will only increase the maintenance cost. Hide it. Link: https://lore.kernel.org/20260522154026.80546-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: Brendan Higgins Cc: Shuah Khan Signed-off-by: Andrew Morton --- include/linux/damon.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 3acca7deb169..638ee65f88dc 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -1013,7 +1013,6 @@ void damon_add_probe(struct damon_ctx *ctx, struct damon_probe *probe); struct damon_region *damon_new_region(unsigned long start, unsigned long end); -void damon_destroy_region(struct damon_region *r, struct damon_target *t); int damon_set_regions(struct damon_target *t, struct damon_addr_range *ranges, unsigned int nr_ranges, unsigned long min_region_sz); void damon_update_region_access_rate(struct damon_region *r, bool accessed, -- cgit v1.2.3 From d63e9d829e42b29201ebbcf0a070acea8ed40b2c Mon Sep 17 00:00:00 2001 From: Maksym Shcherba Date: Thu, 21 May 2026 23:20:19 +0300 Subject: mm/damon: fix missing parens in macro arguments Patch series "mm/damon: fix macro arguments and clarify quota goals doc", v2. This patch (of 2): The DAMON iterator macros do not wrap their pointer arguments with parentheses. This can cause build failures when the argument is a complex expression due to operator precedence issues. Add missing parentheses around the arguments in the following macros to prevent potential build failures: - damon_for_each_region() - damon_for_each_region_from() - damon_for_each_region_safe() - damos_for_each_quota_goal() Link: https://lore.kernel.org/20260521202020.126500-1-maksym.shcherba@lnu.edu.ua Link: https://lore.kernel.org/20260521202020.126500-2-maksym.shcherba@lnu.edu.ua Signed-off-by: Maksym Shcherba Reviewed-by: SeongJae Park Assisted-by: Antigravity:Gemini-3.1-Pro Signed-off-by: Andrew Morton --- include/linux/damon.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/damon.h b/include/linux/damon.h index 638ee65f88dc..6f7edb3590ef 100644 --- a/include/linux/damon.h +++ b/include/linux/damon.h @@ -963,13 +963,13 @@ static inline unsigned long damon_sz_region(struct damon_region *r) list_for_each_entry_safe(p, next, &(ctx)->probes, list) #define damon_for_each_region(r, t) \ - list_for_each_entry(r, &t->regions_list, list) + list_for_each_entry(r, &(t)->regions_list, list) #define damon_for_each_region_from(r, t) \ - list_for_each_entry_from(r, &t->regions_list, list) + list_for_each_entry_from(r, &(t)->regions_list, list) #define damon_for_each_region_safe(r, next, t) \ - list_for_each_entry_safe(r, next, &t->regions_list, list) + list_for_each_entry_safe(r, next, &(t)->regions_list, list) #define damon_for_each_target(t, ctx) \ list_for_each_entry(t, &(ctx)->adaptive_targets, list) @@ -984,7 +984,7 @@ static inline unsigned long damon_sz_region(struct damon_region *r) list_for_each_entry_safe(s, next, &(ctx)->schemes, list) #define damos_for_each_quota_goal(goal, quota) \ - list_for_each_entry(goal, "a->goals, list) + list_for_each_entry(goal, &(quota)->goals, list) #define damos_for_each_quota_goal_safe(goal, next, quota) \ list_for_each_entry_safe(goal, next, &(quota)->goals, list) -- cgit v1.2.3 From 6cbdd9726fb50d749b06ab45a8ef81dff02e69b8 Mon Sep 17 00:00:00 2001 From: "Barry Song (Xiaomi)" Date: Tue, 26 May 2026 21:09:38 +0800 Subject: mm/mglru: use folio_mark_accessed to replace folio_set_active MGLRU gives high priority to folios mapped in page tables. As a result, folio_set_active() is invoked for all folios read during page faults. In practice, however, readahead can bring in many folios that are never accessed via page tables. A previous attempt by Lei Liu proposed introducing a separate LRU for readahead[1] to make readahead pages easier to reclaim, but that approach is likely over-engineered. Before commit 4d5d14a01e2c ("mm/mglru: rework workingset protection"), folios with PG_active were always placed in the youngest generation, leading to over-protection and increased refaults. After that commit, PG_active folios are placed in the second youngest generation, which is still too optimistic given the presence of readahead. In contrast, the classic active/inactive scheme is more conservative. This patch switches to using folio_mark_accessed() and begins prefaulted file folios from the second oldest generation instead of active generations. We should also adjust the following accordingly: - WORKINGSET_ACTIVATE: aligned with setting active for refaulted workingset folios; - lru_gen_folio_seq(): place (pre)faulted file folios into the second oldest generation; - promote second-scanned folios to workingset in folio_check_references(): we now have to depend on folio_lru_refs() > 1, since we previously relied on PG_referenced being set during the first scan, but PG_referenced is now set earlier. On x86, running a kernel build inside a memcg with a 1GB memory limit using 20 threads. w/o patch: real 1m50.764s user 25m32.305s sys 4m0.012s pswpin: 1333245 pswpout: 4366443 pgpgin: 6962592 pgpgout: 17780712 swpout_zero: 1019603 swpin_zero: 14764 refault_file: 287794 refault_anon: 1347963 w/ patch: real 1m48.879s user 25m29.224s sys 3m37.421s pswpin: 568480 pswpout: 2322657 pgpgin: 4073416 pgpgout: 9613408 swpout_zero: 593275 swpin_zero: 9118 refault_file: 262505 refault_anon: 577550 active/inactive LRU: real 1m49.928s user 25m28.196s sys 3m40.740s pswpin: 463452 pswpout: 2309119 pgpgin: 4438856 pgpgout: 9568628 swpout_zero: 743704 swpin_zero: 7244 refault_file: 562555 refault_anon: 470694 Lance and Xueyuan made a huge contribution to this patch through testing. Link: https://lore.kernel.org/20260526130938.66253-1-baohua@kernel.org Link: https://lore.kernel.org/linux-mm/20250916072226.220426-1-liulei.rjpt@vivo.com/ [1] Signed-off-by: Barry Song (Xiaomi) Tested-by: Lance Yang Tested-by: Xueyuan Chen Cc: Pedro Falcato Cc: Kairui Song Cc: Qi Zheng Cc: Shakeel Butt Cc: wangzicheng Cc: Suren Baghdasaryan Cc: Lei Liu Cc: Matthew Wilcox (Oracle) Cc: Axel Rasmussen Cc: Yuanchu Xie Cc: Wei Xu Cc: Will Deacon Cc: Kalesh Singh Signed-off-by: Andrew Morton --- include/linux/mm_inline.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h index a171070e15f0..a8430a7ae054 100644 --- a/include/linux/mm_inline.h +++ b/include/linux/mm_inline.h @@ -247,7 +247,7 @@ static inline unsigned long lru_gen_folio_seq(const struct lruvec *lruvec, (folio_test_dirty(folio) || folio_test_writeback(folio)))) gen = MIN_NR_GENS; else - gen = MAX_NR_GENS - folio_test_workingset(folio); + gen = MAX_NR_GENS - (folio_test_workingset(folio) || folio_test_referenced(folio)); return max(READ_ONCE(lrugen->max_seq) - gen + 1, READ_ONCE(lrugen->min_seq[type])); } -- cgit v1.2.3 From b182633f8ce52172a40097ccc0c60047e58c2320 Mon Sep 17 00:00:00 2001 From: "Mike Rapoport (Microsoft)" Date: Sat, 23 May 2026 20:37:59 +0300 Subject: userfaultfd: make functions that are not used outside uffd static After merging fs/userfaultfd.c into mm/userfaultfd.c, several functions that were previously shared between the two files are now only used within mm/userfaultfd.c. Make them static and remove their declarations from include/linux/userfaultfd_k.h. Link: https://lore.kernel.org/20260523173759.3964908-3-rppt@kernel.org Assisted-by: Copilot:claude-opus-4-6 Signed-off-by: Mike Rapoport (Microsoft) Cc: Al Viro Cc: Christian Brauner Cc: David Hildenbrand Cc: Jan Kara Cc: "Kirill A. Shutemov" Cc: Peter Xu Signed-off-by: Andrew Morton --- include/linux/userfaultfd_k.h | 36 ------------------------------------ 1 file changed, 36 deletions(-) (limited to 'include') diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h index d2920f98ab86..3ec8e1071673 100644 --- a/include/linux/userfaultfd_k.h +++ b/include/linux/userfaultfd_k.h @@ -147,26 +147,12 @@ static inline uffd_flags_t uffd_flags_set_mode(uffd_flags_t flags, enum mfill_at /* Flags controlling behavior. These behavior changes are mode-independent. */ #define MFILL_ATOMIC_WP MFILL_ATOMIC_FLAG(0) -extern ssize_t mfill_atomic_copy(struct userfaultfd_ctx *ctx, unsigned long dst_start, - unsigned long src_start, unsigned long len, - uffd_flags_t flags); -extern ssize_t mfill_atomic_zeropage(struct userfaultfd_ctx *ctx, - unsigned long dst_start, - unsigned long len); -extern ssize_t mfill_atomic_continue(struct userfaultfd_ctx *ctx, unsigned long dst_start, - unsigned long len, uffd_flags_t flags); -extern ssize_t mfill_atomic_poison(struct userfaultfd_ctx *ctx, unsigned long start, - unsigned long len, uffd_flags_t flags); -extern int mwriteprotect_range(struct userfaultfd_ctx *ctx, unsigned long start, - unsigned long len, bool enable_wp); extern long uffd_wp_range(struct vm_area_struct *vma, unsigned long start, unsigned long len, bool enable_wp); /* move_pages */ void double_pt_lock(spinlock_t *ptl1, spinlock_t *ptl2); void double_pt_unlock(spinlock_t *ptl1, spinlock_t *ptl2); -ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start, - unsigned long src_start, unsigned long len, __u64 flags); int move_pages_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd, pmd_t dst_pmdval, struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma, @@ -239,9 +225,6 @@ static inline bool userfaultfd_armed(struct vm_area_struct *vma) return vma->vm_flags & __VM_UFFD_FLAGS; } -bool vma_can_userfault(struct vm_area_struct *vma, vm_flags_t vm_flags, - bool wp_async); - static inline bool vma_has_uffd_without_event_remap(struct vm_area_struct *vma) { struct userfaultfd_ctx *uffd_ctx = vma->vm_userfaultfd_ctx.ctx; @@ -271,25 +254,6 @@ extern void userfaultfd_unmap_complete(struct mm_struct *mm, extern bool userfaultfd_wp_unpopulated(struct vm_area_struct *vma); extern bool userfaultfd_wp_async(struct vm_area_struct *vma); -void userfaultfd_reset_ctx(struct vm_area_struct *vma); - -struct vm_area_struct *userfaultfd_clear_vma(struct vma_iterator *vmi, - struct vm_area_struct *prev, - struct vm_area_struct *vma, - unsigned long start, - unsigned long end); - -int userfaultfd_register_range(struct userfaultfd_ctx *ctx, - struct vm_area_struct *vma, - vm_flags_t vm_flags, - unsigned long start, unsigned long end, - bool wp_async); - -void userfaultfd_release_new(struct userfaultfd_ctx *ctx); - -void userfaultfd_release_all(struct mm_struct *mm, - struct userfaultfd_ctx *ctx); - static inline bool userfaultfd_wp_use_markers(struct vm_area_struct *vma) { /* Only wr-protect mode uses pte markers */ -- cgit v1.2.3 From 9c87962f85106a4d330a91b26b054376245f47c0 Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Tue, 26 May 2026 21:00:30 +0100 Subject: mm: document the folio refcount a little better Expand the documentation of folio_ref_count() to talk about expected, temporary and spurious refcounts as well as the concept of freezing. Link: https://lore.kernel.org/20260526200032.353868-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton --- include/linux/page_ref.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'include') diff --git a/include/linux/page_ref.h b/include/linux/page_ref.h index 94d3f0e71c06..9f5c75d06f76 100644 --- a/include/linux/page_ref.h +++ b/include/linux/page_ref.h @@ -71,6 +71,12 @@ static inline int page_ref_count(const struct page *page) * folio_ref_count - The reference count on this folio. * @folio: The folio. * + * Folios contain a reference count. When that reference count reaches + * zero, the folio is referred to as frozen. At this point, it will + * usually be returned to the memory allocator, but some parts of the + * kernel freeze folios in order to perform unusual operations on them + * such as splitting or migration. + * * The refcount is usually incremented by calls to folio_get() and * decremented by calls to folio_put(). Some typical users of the * folio refcount: @@ -82,6 +88,18 @@ static inline int page_ref_count(const struct page *page) * - Pipes * - Direct IO which references this page in the process address space * + * The reference count has three components: expected, temporary and + * spurious. The expected reference count of a folio is that which + * we would logically expect it to be from just reading the code. + * Temporary refcounts are gained by threads which need a temporary + * reference to make sure the folio isn't reallocated while they use it. + * Spurious refcounts are gained by threads which, thanks to RCU walks + * of the page tables or file cache, find a stale pointer to a folio. + * These threads will drop the refcount after discoveering the pointer + * is stale, but it can surprise other users to see the spurious refcount + * on a freshly allocated folio (eg they may see a refcount of 2 instead + * of 1). + * * Return: The number of references to this folio. */ static inline int folio_ref_count(const struct folio *folio) -- cgit v1.2.3 From 94bfc7f3b0c7c33331ba4ff6cc64ff309dfcbce8 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 26 May 2026 12:18:41 +0200 Subject: err.h: use __always_inline on all error pointer helpers While testing randconfig builds on s390, I came across a link failure with CONFIG_DMA_SHARED_BUFFER disabled: ERROR: modpost: "dma_buf_put" [drivers/iommu/iommufd/iommufd.ko] undefined! The problem here is that IS_ERR() is not inlined and dead code elimination fails as a consequence. The err.h helpers all turn into a trivial assignment of a bit mask and should never result in a function call, so force them to always be inline. This should generally result in better object code aside from avoiding the link failure above. Link: https://lore.kernel.org/20260526101851.2495110-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Lobakin Reviewed-by: Nathan Chancellor Tested-by: Tamir Duberstein Cc: Alexander Gordeev Cc: Andriy Shevchenko Cc: Ansuel Smith Cc: Bjorn Andersson Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Signed-off-by: Andrew Morton --- include/linux/err.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/err.h b/include/linux/err.h index 8c37be0620ab..d3e38d5b3a98 100644 --- a/include/linux/err.h +++ b/include/linux/err.h @@ -36,7 +36,7 @@ * * Return: A pointer with @error encoded within its value. */ -static inline void * __must_check ERR_PTR(long error) +static __always_inline void * __must_check ERR_PTR(long error) { return (void *) error; } @@ -60,7 +60,7 @@ static inline void * __must_check ERR_PTR(long error) * @ptr: An error pointer. * Return: The error code within @ptr. */ -static inline long __must_check PTR_ERR(__force const void *ptr) +static __always_inline long __must_check PTR_ERR(__force const void *ptr) { return (long) ptr; } @@ -73,7 +73,7 @@ static inline long __must_check PTR_ERR(__force const void *ptr) * @ptr: The pointer to check. * Return: true if @ptr is an error pointer, false otherwise. */ -static inline bool __must_check IS_ERR(__force const void *ptr) +static __always_inline bool __must_check IS_ERR(__force const void *ptr) { return IS_ERR_VALUE((unsigned long)ptr); } @@ -87,7 +87,7 @@ static inline bool __must_check IS_ERR(__force const void *ptr) * * Like IS_ERR(), but also returns true for a null pointer. */ -static inline bool __must_check IS_ERR_OR_NULL(__force const void *ptr) +static __always_inline bool __must_check IS_ERR_OR_NULL(__force const void *ptr) { return unlikely(!ptr) || IS_ERR_VALUE((unsigned long)ptr); } @@ -99,7 +99,7 @@ static inline bool __must_check IS_ERR_OR_NULL(__force const void *ptr) * Explicitly cast an error-valued pointer to another pointer type in such a * way as to make it clear that's what's going on. */ -static inline void * __must_check ERR_CAST(__force const void *ptr) +static __always_inline void * __must_check ERR_CAST(__force const void *ptr) { /* cast away the const */ return (void *) ptr; @@ -122,7 +122,7 @@ static inline void * __must_check ERR_CAST(__force const void *ptr) * * Return: The error code within @ptr if it is an error pointer; 0 otherwise. */ -static inline int __must_check PTR_ERR_OR_ZERO(__force const void *ptr) +static __always_inline int __must_check PTR_ERR_OR_ZERO(__force const void *ptr) { if (IS_ERR(ptr)) return PTR_ERR(ptr); -- cgit v1.2.3 From 0e0e490f5d5ec2f91209b77a95f9c7185d97cfc6 Mon Sep 17 00:00:00 2001 From: NeilBrown Date: Thu, 30 Apr 2026 15:42:43 -0400 Subject: VFS: use wait_var_event for waiting in d_alloc_parallel() Parallel lookup starts with a call of d_alloc_parallel(). That primitive either returns a matching hashed dentry or allocates a new one in the in-lookup state and returns it to the caller. Once the caller is done with lookup, it indicates so either by call of d_{splice_alias,add}() or by call of d_done_lookup(); at that point dentry leaves the in-lookup state. If d_alloc_parallel() finds a matching in-lookup dentry, it must wait for that dentry to leave the in-lookup state, one way or another. Currently by supplying wait_queue_head to d_alloc_parallel(). If d_alloc_parallel() creates a new in-lookup dentry, the address of that wait_queue_head is stored in ->d_wait of new dentry and stays there while it's in the in-lookup; subsequent d_alloc_parallel() will wait on the queue found in the matching in-lookup dentry. Transition out of in-lookup state wakes waiters on that queue (if any). That works, but the calling conventions are inconvenient - the caller must supply wait_queue_head and make sure that it survives at least until the new in-lookup dentry leaves the in-lookup state. That amounts to boilerplate in the d_alloc_parallel() callers that are followed by a call of d_lookup_done() in the same function; in cases like nfs asynchronous unlink it gets worse than that. This patch changes d_alloc_parallel() to use wake_up_var_locked() to wake up waiters, and wait_var_event_spinlock() to wait. dentry->d_lock is used for synchronisation as it is already held and the relevant times. That eliminates the need of caller-supplied wait_queue_head, simplifying the calling conventions. Better yet, we only need one bit of information stored in dentry itself: whether there are any waiters to be woken up, and that can be easily stored in ->d_flags; ->d_wait goes away. The reason we need that bit (DCACHE_LOOKUP_WAITERS) is that with wait_var machinery the queues are shared with all kinds of stuff and there's no way tell if any of the waiters have anything to do with our dentry; most of the time none of them will be relevant, so we need to avoid the pointless wakeups. Another benefit of the new scheme comes from the fact that wakeups have to be done outside of write-side critical areas of ->i_dir_seq; with the old scheme we need to carry the value picked from ->d_wait from __d_lookup_unhash() to the place where we actually wake the waiters up. Now we can just leave DCACHE_LOOKUP_WAITERS in ->d_flags until we get to doing wakeups - that's done within the same ->d_lock scope, so we are fine; new bit is accessed only under ->d_lock and it's seen only on dentries with DCACHE_PAR_LOOKUP in ->d_flags. __d_lookup_unhash() no longer needs to re-init ->d_lru. That was previously shared (in a union) with ->d_wait but ->d_wait is now gone so it no longer corrupts ->d_lru. Co-developed-by: Al Viro # saner handling of flags Signed-off-by: NeilBrown Signed-off-by: Al Viro --- include/linux/dcache.h | 11 +++++------ include/linux/nfs_xdr.h | 1 - 2 files changed, 5 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/linux/dcache.h b/include/linux/dcache.h index 2577c05f84ec..97a887be150a 100644 --- a/include/linux/dcache.h +++ b/include/linux/dcache.h @@ -116,10 +116,7 @@ struct dentry { * possible! */ - union { - struct list_head d_lru; /* LRU list */ - wait_queue_head_t *d_wait; /* in-lookup ones only */ - }; + struct list_head d_lru; /* LRU list */ struct hlist_node d_sib; /* child of parent list */ struct hlist_head d_children; /* our children */ /* @@ -210,6 +207,9 @@ enum dentry_flags { DCACHE_REFERENCED = BIT(6), /* Recently used, don't discard. */ DCACHE_DONTCACHE = BIT(7), /* Purge from memory on final dput() */ DCACHE_CANT_MOUNT = BIT(8), + DCACHE_LOOKUP_WAITERS = BIT(9), /* A thread is waiting for + * PAR_LOOKUP to clear + */ DCACHE_SHRINK_LIST = BIT(10), DCACHE_OP_WEAK_REVALIDATE = BIT(11), /* @@ -256,8 +256,7 @@ extern void d_delete(struct dentry *); /* allocate/de-allocate */ extern struct dentry * d_alloc(struct dentry *, const struct qstr *); extern struct dentry * d_alloc_anon(struct super_block *); -extern struct dentry * d_alloc_parallel(struct dentry *, const struct qstr *, - wait_queue_head_t *); +extern struct dentry * d_alloc_parallel(struct dentry *, const struct qstr *); extern struct dentry * d_splice_alias(struct inode *, struct dentry *); /* weird procfs mess; *NOT* exported */ extern struct dentry * d_splice_alias_ops(struct inode *, struct dentry *, diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h index fcbd21b5685f..6aced49d5f00 100644 --- a/include/linux/nfs_xdr.h +++ b/include/linux/nfs_xdr.h @@ -1743,7 +1743,6 @@ struct nfs_unlinkdata { struct nfs_removeargs args; struct nfs_removeres res; struct dentry *dentry; - wait_queue_head_t wq; const struct cred *cred; struct nfs_fattr dir_attr; long timeout; -- cgit v1.2.3 From 1a967a7ec70ff951716e84739f79b6e167ac1e0b Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 3 May 2026 23:00:09 -0400 Subject: fix a race between d_find_any_alias() and final dput() of NORCU dentries Refcount of a NORCU dentry must not be incremented after having dropped to zero. Otherwise we might end up with the following race: CPU1: in fast_dput(d), rcu_read_lock(); CPU1: decrements refcount of d to 0 CPU1: notice that it's unhashed CPU2: grab a reference to d CPU2: dput(d), freeing d CPU1: ... looks like we need to evict d, let's grab ->d_lock, recheck the refcount, etc. and that spin_lock(&d->d_lock) ends up a UAF, despite still being in an RCU read-side critical area started back when the refcount had been positive. If not for DCACHE_NORCU in d->d_flags freeing would've been RCU-delayed, so we'd have grabbed ->d_lock, noticed the negative value stored into refcount by __dentry_kill(), dropped the locks and that would be it. For NORCU dentries freeing is _not_ delayed, though. Most of the non-counting references are excluded for NORCU dentries - they are not allowed to be hashed, they never get placed on LRU, they never get placed into anyone's list of children and while dput_to_list() might put them into a shrink list, nobody bumps refcount of something that had been reached that way. However, inode's list of aliases can be a problem - it does not contribute to dentry refcount (for obvious reasons) and we *do* have places that grab references to something found on that list - that's precisely what d_find_alias() is. In case of d_find_alias() we are safe - it skips unhashed aliases, so all NORCU ones are ignored there. d_find_any_alias() is *not* limited to hashed ones, though, and while it's usually called for directories (which never get NORCU dentries), there are callers that use it to get something for non-directories with no hashed aliases. Having d_find_any_alias() hit a NORCU dentry is not impossible - it can be easily arranged if you have CAP_DAC_READ_SEARCH (memfd_create() + mmap() + name_to_handle_at() for /proc/self/map_files/<...> + munmap() + open_by_handle_at() will do that, and adding a second memfd_create() for mount_fd makes it possible to do that without having memfd pinned). The race window is narrow, and it's probably not feasible on bare hardware, but... It's not hard to fix, fortunately: * separate __d_find_dir_alias() (== current __d_find_any_alias()) to be used for directory inodes. * provide dget_alias_ilocked() that would return false for NORCU dentries with zero refcount and return true incrementing refcount otherwise * make __d_find_any_alias() go over the list of aliases, using dget_alias_ilocked() and returning the alias it succeeds on (normally the first one). Any NORCU alias with zero refcount is going to be evicted by the thread that had dropped the final reference; this makes __d_find_any_alias() pretend it had lost the race with eviction. Signed-off-by: Al Viro --- include/linux/dcache.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'include') diff --git a/include/linux/dcache.h b/include/linux/dcache.h index 97a887be150a..a3409de3f490 100644 --- a/include/linux/dcache.h +++ b/include/linux/dcache.h @@ -365,6 +365,24 @@ static inline struct dentry *dget(struct dentry *dentry) return dentry; } +/* dentry->d_inode->i_lock must be held by caller */ +static inline bool dget_alias_ilocked(struct dentry *dentry) +{ + if (likely(!(READ_ONCE(dentry->d_flags) & DCACHE_NORCU))) { + lockref_get(&dentry->d_lockref); + return true; + } + // NORCU dentries with zero refcount MUST NOT be grabbed + spin_lock(&dentry->d_lock); + if (dentry->d_lockref.count > 0) { + dget_dlock(dentry); + spin_unlock(&dentry->d_lock); + return true; + } + spin_unlock(&dentry->d_lock); + return false; +} + extern struct dentry *dget_parent(struct dentry *dentry); /** -- cgit v1.2.3 From 67132b5e5de8a01493ddbb217e936415ca4e09af Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sun, 12 Apr 2026 23:39:16 -0400 Subject: kill d_dispose_if_unused() Rename to_shrink_list() into __move_to_shrink_list(), document and export it. Switch d_dispose_if_unused() users to that and kill d_dispose_if_unused() itself. Signed-off-by: Al Viro --- include/linux/dcache.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/dcache.h b/include/linux/dcache.h index a3409de3f490..4b1ff99608e0 100644 --- a/include/linux/dcache.h +++ b/include/linux/dcache.h @@ -280,7 +280,7 @@ extern void d_tmpfile(struct file *, struct inode *); extern struct dentry *d_find_alias(struct inode *); extern void d_prune_aliases(struct inode *); -extern void d_dispose_if_unused(struct dentry *, struct list_head *); +extern bool __move_to_shrink_list(struct dentry *, struct list_head *); extern void shrink_dentry_list(struct list_head *); extern struct dentry *d_find_alias_rcu(struct inode *); -- cgit v1.2.3 From e9895609cb7f9d9712c5b20044edff5f196eec1b Mon Sep 17 00:00:00 2001 From: Al Viro Date: Sat, 18 Apr 2026 18:39:03 -0400 Subject: wind ->s_roots via ->d_sib instead of ->d_hash shrink_dcache_for_umount() is supposed to handle the possibility of some of the dentries to be evicted being in other threads shrink lists; it either kills them, leaving an empty husk to be freed by the owner of shrink list whenever it gets around to that, or it waits for the eviction in progress to get completed. That relies upon dentry remaining attached to the tree until the eviction reaches dentry_unlist() and its ->d_sib gets removed from the list. Unfortunately, the secondary roots are linked via ->d_hash, rather than ->d_sib and they become removed from that list before their inode references are dropped. If shrink_dentry_list() from another thread ends up evicting one of the secondary roots and gets to that point in dentry_kill() when shrink_dcache_for_umount() is looking for secondary roots, the latter will *not* notice anything, possibly leading to warnings about busy inodes at umount time and all kinds of breakage after that. Moreover, shrink_dcache_for_umount() walks the list of secondary roots with no protection whatsoever, so it might end up calling dget() on a dentry that already passed through lockref_mark_dead(&dentry->d_lockref); ending up with corrupted refcount and possible UAF. AFAICS, the most straightforward way to deal with that would be to have secondary roots linked via ->d_sib rather than ->d_hash; then they would remain on the list until killed, and we could use d_add_waiter() machinery to wait for eviction in progress. Changes: * secondary roots look the same as ->s_root from d_unhashed() and d_unlinked() POV now. * secondary roots are represented as "no parent, but on ->d_sib" instead of "no parent, but on ->d_hash". * since ->d_sib is a plain hlist, we protect it with per-superblock spinlock (sb->s_roots_lock) instead of the LSB of the head pointer (for non-root dentries it would be protected by ->d_lock of parent). * __d_obtain_alias() uses ->d_sib for linkage when allocating a secondary root. * d_splice_alias_ops() detects splicing of a secondary root and removes it from the list before calling __d_move(). * dentry_unlist() detects eviction of a secondary root and removes it from the list; no need to play the games for d_walk() sake, since the latter is not going to look for the next sibling of those anyway. * ___d_drop() doesn't care about ->s_roots anymore. * shrink_dcache_for_umount() uses proper locking for access to the list of secondary roots and if it runs into one that is in the middle of eviction waits for that to finish. Signed-off-by: Al Viro --- include/linux/fs/super_types.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/fs/super_types.h b/include/linux/fs/super_types.h index 383050e7fdf5..23d1c2612d0c 100644 --- a/include/linux/fs/super_types.h +++ b/include/linux/fs/super_types.h @@ -162,7 +162,8 @@ struct super_block { struct unicode_map *s_encoding; __u16 s_encoding_flags; #endif - struct hlist_bl_head s_roots; /* alternate root dentries for NFS */ + struct hlist_head s_roots; /* alternate root dentries for NFS */ + spinlock_t s_roots_lock; struct mount *s_mounts; /* list of mounts; _not_ for fs use */ struct block_device *s_bdev; /* can go away once we use an accessor for @s_bdev_file */ struct file *s_bdev_file; -- cgit v1.2.3 From f3ff3eb0d6a4080fa7f554b8478a3405b8e4befe Mon Sep 17 00:00:00 2001 From: Sven Eckelmann Date: Thu, 4 Jun 2026 21:58:31 +0200 Subject: batman-adv: uapi: keep kernel-doc in struct member order The order of the members of struct batadv_coded_packet and struct batadv_unicast_tvlv_packet didn't match the kernel doc. This is the case for all other structures and should also be done the same way for these two. Signed-off-by: Sven Eckelmann --- include/uapi/linux/batadv_packet.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/batadv_packet.h b/include/uapi/linux/batadv_packet.h index 439132a819ea..1241285b866c 100644 --- a/include/uapi/linux/batadv_packet.h +++ b/include/uapi/linux/batadv_packet.h @@ -518,16 +518,16 @@ struct batadv_mcast_packet { * @packet_type: batman-adv packet type, part of the general header * @version: batman-adv protocol version, part of the general header * @ttl: time to live for this packet, part of the general header + * @first_ttvn: tt-version number of first included packet * @first_source: original source of first included packet * @first_orig_dest: original destination of first included packet * @first_crc: checksum of first included packet - * @first_ttvn: tt-version number of first included packet * @second_ttl: ttl of second packet + * @second_ttvn: tt version number of second included packet * @second_dest: second receiver of this coded packet * @second_source: original source of second included packet * @second_orig_dest: original destination of second included packet * @second_crc: checksum of second included packet - * @second_ttvn: tt version number of second included packet * @coded_len: length of network coded part of the payload */ struct batadv_coded_packet { @@ -554,8 +554,8 @@ struct batadv_coded_packet { * @version: batman-adv protocol version, part of the general header * @ttl: time to live for this packet, part of the general header * @reserved: reserved field (for packet alignment) - * @src: address of the source * @dst: address of the destination + * @src: address of the source * @tvlv_len: length of tvlv data following the unicast tvlv header * @align: 2 bytes to align the header to a 4 byte boundary */ -- cgit v1.2.3 From 06cb687a5132fcffe624c0070576ab852ac6b568 Mon Sep 17 00:00:00 2001 From: Mirela Rabulea Date: Fri, 22 May 2026 17:31:20 +0300 Subject: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() The v4l2 helper v4l2_async_register_subdev_sensor() calls v4l2_async_register_subdev(), which is a macro that expands to __v4l2_async_register_subdev(sd,THIS_MODULE). Since the macro is expanded inside v4l2-fwnode.c, THIS_MODULE resolves to the v4l2-fwnode module rather than the sensor driver module that originally set sd->owner. When v4l2-fwnode is built-in, THIS_MODULE evaluates to NULL, which then overwrites the sensor driver's owner with NULL. This causes the problem that the sensor module's reference count is never incremented during async registration, so the module can be removed while the subdevice is still in use by a notifier (e.g., a CSI-2 receiver bridge driver). Fix this by renaming v4l2_async_register_subdev_sensor() to __v4l2_async_register_subdev_sensor() with an added explicit module argument and introducing a wrapper macro: #define v4l2_async_register_subdev_sensor(sd) \ __v4l2_async_register_subdev_sensor(sd, THIS_MODULE) This ensures the sensor driver module is properly referenced even when the sensor driver does not init the owner field before calling v4l2_async_register_subdev_sensor() and prevents premature module removal. Fixes: aef69d54755d ("media: v4l: fwnode: Add a convenience function for registering sensors") Cc: stable@vger.kernel.org Suggested-by: Frank Li Link: https://lore.kernel.org/linux-media/20240315073125.275501-2-sakari.ailus@linux.intel.com/ Signed-off-by: Mirela Rabulea Reviewed-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Sakari Ailus --- include/media/v4l2-async.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/media/v4l2-async.h b/include/media/v4l2-async.h index f26c323e9c96..54a2d9620ed5 100644 --- a/include/media/v4l2-async.h +++ b/include/media/v4l2-async.h @@ -333,8 +333,10 @@ int __v4l2_async_register_subdev(struct v4l2_subdev *sd, struct module *module); * An error is returned if the module is no longer loaded on any attempts * to register it. */ +#define v4l2_async_register_subdev_sensor(sd) \ + __v4l2_async_register_subdev_sensor(sd, THIS_MODULE) int __must_check -v4l2_async_register_subdev_sensor(struct v4l2_subdev *sd); +__v4l2_async_register_subdev_sensor(struct v4l2_subdev *sd, struct module *module); /** * v4l2_async_unregister_subdev - unregisters a sub-device to the asynchronous -- cgit v1.2.3 From dfb67ae569bf0726187725b1ef8d89377778861e Mon Sep 17 00:00:00 2001 From: Thiyagarajan Pandiyan Date: Fri, 5 Jun 2026 11:13:07 +0530 Subject: wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications Currently, ie_len in cfg80211_notify_new_peer_candidate is defined as 1-byte field, capping the maximum IE list size at 255 bytes. When a large beacon is received, the IE list is truncated, passing incomplete data to wpa_supplicant. This causes supplicant to fail parsing the IEs. Increasing the size of ie_len to allow the full length of the IE list to be forwarded properly. Signed-off-by: Thiyagarajan Pandiyan Link: https://patch.msgid.link/20260605054307.427874-1-thiyagarajan@aerlync.com Signed-off-by: Johannes Berg --- include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index f91a71c7f4db..8188ad200de5 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -8685,7 +8685,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, * cfg80211 then sends a notification to userspace. */ void cfg80211_notify_new_peer_candidate(struct net_device *dev, - const u8 *macaddr, const u8 *ie, u8 ie_len, + const u8 *macaddr, const u8 *ie, size_t ie_len, int sig_dbm, gfp_t gfp); /** -- cgit v1.2.3 From 198c3b90e600d442f8333d254a23c5da989c5cb4 Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Mon, 18 May 2026 20:46:55 +0900 Subject: iomap: introduce IOMAP_F_ZERO_TAIL flag In filesystems that maintain a separate Valid Data Length, such as exFAT and NTFS, a partial write may start at or beyond the current valid_size and extend it. In this case, the region after the previous valid_size but within the same filesystem block is considered unwritten. This patch introduces IOMAP_F_ZERO_TAIL. When this flag is set in iomap, __iomap_write_begin() will zero only the tail portion while preserving any valid data before it in the same block. Without this tail zeroing, stale data in the unwritten portion of the block can remain in the page cache. Subsequent reads can then return incorrect contents from that region. Acked-by: Christoph Hellwig Signed-off-by: Namjae Jeon Link: https://patch.msgid.link/20260518114705.9601-2-linkinjeon@kernel.org Acked-by: "Darrick J. Wong" Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner (Amutable) --- include/linux/iomap.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/iomap.h b/include/linux/iomap.h index 52bfd6783417..cea6bbc97b6e 100644 --- a/include/linux/iomap.h +++ b/include/linux/iomap.h @@ -67,6 +67,9 @@ struct vm_fault; * bio, i.e. set REQ_ATOMIC. * * IOMAP_F_INTEGRITY indicates that the filesystems handles integrity metadata. + * + * IOMAP_F_ZERO_TAIL indicates the remainder of the block after the data + * written should be zeroed. */ #define IOMAP_F_NEW (1U << 0) #define IOMAP_F_DIRTY (1U << 1) @@ -86,6 +89,7 @@ struct vm_fault; #else #define IOMAP_F_INTEGRITY 0 #endif /* CONFIG_BLK_DEV_INTEGRITY */ +#define IOMAP_F_ZERO_TAIL (1U << 10) /* * Flag reserved for file system specific usage -- cgit v1.2.3 From 9f7f685758c6988a6076d4a494d20e99337b79ed Mon Sep 17 00:00:00 2001 From: Ard Biesheuvel Date: Thu, 4 Jun 2026 17:11:54 +0200 Subject: kasan: Move generic KASAN page tables out of BSS too Make sure that all KASAN page tables are emitted into the .pgtbl section (provided that the arch has one - otherwise, fall back to page aligned BSS) This is needed because BSS itself is no longer accessible via the linear map on arm64. Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: kasan-dev@googlegroups.com Signed-off-by: Ard Biesheuvel Signed-off-by: Will Deacon --- include/linux/linkage.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/linkage.h b/include/linux/linkage.h index b11660b706c5..53fe1f48fd28 100644 --- a/include/linux/linkage.h +++ b/include/linux/linkage.h @@ -39,6 +39,10 @@ #define __page_aligned_data __section(".data..page_aligned") __aligned(PAGE_SIZE) #define __page_aligned_bss __section(".bss..page_aligned") __aligned(PAGE_SIZE) +#ifndef __bss_pgtbl +#define __bss_pgtbl __page_aligned_bss +#endif + /* * For assembly routines. * -- cgit v1.2.3 From 4a15044a2b06748c99a8c8c3c6b3ee0a01f8004d Mon Sep 17 00:00:00 2001 From: Julian Anastasov Date: Mon, 25 May 2026 06:54:39 +0300 Subject: ipvs: add conn_max sysctl to limit connections Currently, we are using atomic_t to track the number of connections. On 64-bit setups with large memory there is a risk this counter to overflow. Also, setups with many containers may need to tune the limit for connections. Add sysctl control to limit the number of connections to 1,073,741,824 (64-bit) and 16,777,216 (32-bit). Depending on the admin's privilege, the value is used to change a soft or hard limit allowing unprivileged admins to change the soft limit in range determined by privileged admins. Link: https://sashiko.dev/#/patchset/20260523172715.94795-1-ja%40ssi.bg Link: https://sashiko.dev/#/patchset/20260430074420.26697-7-ja%40ssi.bg Link: https://sashiko.dev/#/patchset/20260522105546.13732-1-ja%40ssi.bg Signed-off-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso --- include/net/ip_vs.h | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'include') diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h index e517eaaa177b..49297fec448a 100644 --- a/include/net/ip_vs.h +++ b/include/net/ip_vs.h @@ -44,6 +44,14 @@ #define IP_VS_CONN_TAB_MAX_BITS 20 #endif +/* conn_max limits */ +#if BITS_PER_LONG > 32 +/* Limit of atomic_t but restricted by roundup_pow_of_two() in ip_vs_core.c */ +#define IP_VS_CONN_MAX (1 << 30) +#else +#define IP_VS_CONN_MAX (1 << 24) +#endif + /* svc_table limits */ #define IP_VS_SVC_TAB_MIN_BITS 4 #define IP_VS_SVC_TAB_MAX_BITS 20 @@ -1220,6 +1228,10 @@ struct netns_ipvs { /* sysctl variables */ int sysctl_amemthresh; int sysctl_am_droprate; +#ifdef CONFIG_SYSCTL + int sysctl_conn_max;/* soft limit for conns */ + int conn_max_limit; /* hard limit for conn_max */ +#endif int sysctl_drop_entry; int sysctl_drop_packet; int sysctl_secure_tcp; @@ -1317,6 +1329,11 @@ struct netns_ipvs { #ifdef CONFIG_SYSCTL +static inline int sysctl_conn_max(struct netns_ipvs *ipvs) +{ + return READ_ONCE(ipvs->sysctl_conn_max); +} + static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs) { return ipvs->sysctl_sync_threshold[0]; @@ -1436,6 +1453,11 @@ static inline int sysctl_est_nice(struct netns_ipvs *ipvs) #else +static inline int sysctl_conn_max(struct netns_ipvs *ipvs) +{ + return IP_VS_CONN_MAX; +} + static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs) { return DEFAULT_SYNC_THRESHOLD; -- cgit v1.2.3 From 7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 4 Jun 2026 08:21:08 +0200 Subject: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf_ct_timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used by a conntrack entry. When the last conntrack entry drops the refcount on the ct timeout, the ct timeout is released. Remove the refcount for control plane which controls if the ruleset refers to the timeout policy. After this update, it is possible to remove the ct timeout policy from nfnetlink_cttimeout immediately. This is for simplicity not to handle two refcounts on a single object. Remove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just hold a reference to the nf_ct_timeout object until packet is reinjected, since this is part of the ct extension, this will be released by the time the conntrack is freed. nf_ct_untimeout() is still called to clean up in a best effort basis: the ct timeout on existing entries gets removed when the ct timeout goes away, but as long as the iptables ruleset still refers to the ct timeout through a template, new conntracks may keep attaching it and extend its lifetime until the rule is removed. nf_ct_untimeout() is not called anymore from module removal path, this is unlikely to find timeouts give module refcount is bumped, and the new refcount already tracks the ct timeout policy use so it is released when unused. Fixes: 50978462300f ("netfilter: add cttimeout infrastructure for fine timeout tuning") Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_timeout.h | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h index 3a66d4abb6d6..d60aa86be019 100644 --- a/include/net/netfilter/nf_conntrack_timeout.h +++ b/include/net/netfilter/nf_conntrack_timeout.h @@ -12,6 +12,7 @@ #define CTNL_TIMEOUT_NAME_MAX 32 struct nf_ct_timeout { + refcount_t refcnt; __u16 l3num; const struct nf_conntrack_l4proto *l4proto; struct rcu_head rcu; @@ -22,6 +23,22 @@ struct nf_conn_timeout { struct nf_ct_timeout __rcu *timeout; }; +static inline void nf_ct_timeout_put(const struct nf_conn *ct) +{ +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT + struct nf_conn_timeout *timeout_ext; + struct nf_ct_timeout *timeout; + + timeout_ext = nf_ct_ext_find(ct, NF_CT_EXT_TIMEOUT); + if (!timeout_ext) + return; + + timeout = rcu_dereference(timeout_ext->timeout); + if (timeout && refcount_dec_and_test(&timeout->refcnt)) + kfree_rcu(timeout, rcu); +#endif +} + static inline unsigned int * nf_ct_timeout_data(const struct nf_conn_timeout *t) { @@ -56,8 +73,14 @@ struct nf_conn_timeout *nf_ct_timeout_ext_add(struct nf_conn *ct, #ifdef CONFIG_NF_CONNTRACK_TIMEOUT struct nf_conn_timeout *timeout_ext; + if (!timeout) + return NULL; + timeout_ext = nf_ct_ext_add(ct, NF_CT_EXT_TIMEOUT, gfp); - if (timeout_ext == NULL) + if (!timeout_ext || timeout_ext->timeout) + return NULL; + + if (!refcount_inc_not_zero(&timeout->refcnt)) return NULL; rcu_assign_pointer(timeout_ext->timeout, timeout); @@ -75,7 +98,7 @@ static inline unsigned int *nf_ct_timeout_lookup(const struct nf_conn *ct) struct nf_conn_timeout *timeout_ext; timeout_ext = nf_ct_timeout_find(ct); - if (timeout_ext) + if (timeout_ext && rcu_access_pointer(timeout_ext->timeout)) timeouts = nf_ct_timeout_data(timeout_ext); #endif return timeouts; -- cgit v1.2.3 From 6031487d4e273d7e7c8c7deea5061b7a9aaa9db3 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 4 Jun 2026 08:21:09 +0200 Subject: netfilter: nf_conntrack_helper: dynamically allocate struct nf_conntrack_helper Adapt all existing helpers to use a modified version of nf_ct_helper_init(), to dynamically allocate struct nf_conntrack_helper. Allocate expect_policy[] built-in into the helper to ensure this area is reachable after helper removal since a follow up patch adds refcount to track use of the nf_conntrack_helper structure from packet path so it remains around until last reference from ct helper extension is dropped. Export __nf_conntrack_helper_register() which allows to register nfnetlink_cthelper dynamically allocated helper. Adapt nfnetlink_cthelper to use the built-in expect_policy[]. This is a preparation patch to add packet path refcounting to helpers. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_helper.h | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index de2f956abf34..1956bc12bf56 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -29,13 +29,16 @@ enum nf_ct_helper_flags { #define NF_CT_HELPER_NAME_LEN 16 +/* Must be kept in sync with the classes defined by helpers */ +#define NF_CT_MAX_EXPECT_CLASSES 4 + struct nf_conntrack_helper { struct hlist_node hnode; /* Internal use. */ char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */ refcount_t refcnt; struct module *me; /* pointer to self */ - const struct nf_conntrack_expect_policy *expect_policy; + struct nf_conntrack_expect_policy expect_policy[NF_CT_MAX_EXPECT_CLASSES]; /* Tuple of things we will help (compared against server response) */ struct nf_conntrack_tuple tuple; @@ -63,9 +66,6 @@ struct nf_conntrack_helper { char nat_mod_name[NF_CT_HELPER_NAME_LEN]; }; -/* Must be kept in sync with the classes defined by helpers */ -#define NF_CT_MAX_EXPECT_CLASSES 4 - /* nf_conn feature for connections that have a helper */ struct nf_conn_help { /* Helper. if any */ @@ -103,11 +103,13 @@ void nf_ct_helper_init(struct nf_conntrack_helper *helper, struct nf_conn *ct), struct module *module); -int nf_conntrack_helper_register(struct nf_conntrack_helper *); +int nf_conntrack_helper_register(struct nf_conntrack_helper *, struct nf_conntrack_helper **); +int __nf_conntrack_helper_register(struct nf_conntrack_helper *); void nf_conntrack_helper_unregister(struct nf_conntrack_helper *); -int nf_conntrack_helpers_register(struct nf_conntrack_helper *, unsigned int); -void nf_conntrack_helpers_unregister(struct nf_conntrack_helper *, +int nf_conntrack_helpers_register(struct nf_conntrack_helper *, unsigned int, + struct nf_conntrack_helper **); +void nf_conntrack_helpers_unregister(struct nf_conntrack_helper **, unsigned int); struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp); -- cgit v1.2.3 From 07d09774e2bfa21dedcee3ef45892bb20827b12c Mon Sep 17 00:00:00 2001 From: Andrey Albershteyn Date: Wed, 20 May 2026 14:37:02 +0200 Subject: fsverity: generate and store zero-block hash Compute the hash of one filesystem block's worth of zeros. A filesystem implementation can decide to elide merkle tree blocks containing only this hash and synthesize the contents at read time. Let's pretend that there's a file containing 131 data block and whose merkle tree looks roughly like this: root +--leaf0 | +--data0 | +--data1 | +--... | `--data128 `--leaf1 +--data129 +--data130 `--data131 If data[0-128] are sparse holes, then leaf0 will contain a repeating sequence of @zero_digest. Therefore, leaf0 need not be written to disk because its contents can be synthesized. A subsequent xfs patch will use this to reduce the size of the merkle tree when dealing with sparse gold master disk images and the like. Note that this works only on the first-level (data holes). fsverity doesn't store/generate zero_digest for any higher levels. Add a helper to pre-fill folio with hashes of empty blocks. This will be used by iomap to synthesize blocks full of zero hashes on the fly. Signed-off-by: Darrick J. Wong Acked-by: Eric Biggers Signed-off-by: Andrey Albershteyn Link: https://patch.msgid.link/20260520123722.405752-5-aalbersh@kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/fsverity.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h index a8f9aa75b792..6c467ded9751 100644 --- a/include/linux/fsverity.h +++ b/include/linux/fsverity.h @@ -201,6 +201,8 @@ bool fsverity_verify_blocks(struct fsverity_info *vi, struct folio *folio, size_t len, size_t offset); void fsverity_verify_bio(struct fsverity_info *vi, struct bio *bio); void fsverity_enqueue_verify_work(struct work_struct *work); +void fsverity_fill_zerohash(struct folio *folio, size_t offset, size_t len, + struct fsverity_info *vi); #else /* !CONFIG_FS_VERITY */ @@ -281,6 +283,12 @@ static inline void fsverity_enqueue_verify_work(struct work_struct *work) WARN_ON_ONCE(1); } +static inline void fsverity_fill_zerohash(struct folio *folio, size_t offset, + size_t len, struct fsverity_info *vi) +{ + WARN_ON_ONCE(1); +} + #endif /* !CONFIG_FS_VERITY */ static inline bool fsverity_verify_folio(struct fsverity_info *vi, -- cgit v1.2.3 From 63e242afa4661632786a2129cf297a135a6995ba Mon Sep 17 00:00:00 2001 From: Andrey Albershteyn Date: Wed, 20 May 2026 14:37:05 +0200 Subject: iomap: introduce IOMAP_F_FSVERITY and teach writeback to handle fsverity This flag indicates that I/O is for fsverity metadata. In the write path skip i_size check and i_size updates as metadata is past EOF. In writeback don't update i_size and continue writeback if even folio is beyond EOF. In read path don't zero fsverity folios, again they are past EOF. The iomap_block_needs_zeroing() is also called from write path. For folios of larger order we don't want to zero out pages in the folio as these could contain other merkle tree blocks. For fsverity, filesystem will request to read PAGE_SIZE memory regions. For data folios, iomap will zero the rest of the folio for anything which is beyond EOF. We don't want this for fsverity folios. Christian Brauner says: Changed IOMAP_F_FSVERITY from (1U << 10) to (1U << 11) to avoid colliding with IOMAP_F_ZERO_TAIL, which already uses (1U << 10). Signed-off-by: Andrey Albershteyn Link: https://patch.msgid.link/20260520123722.405752-8-aalbersh@kernel.org Reviewed-by: "Darrick J. Wong" Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner (Amutable) --- include/linux/iomap.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/iomap.h b/include/linux/iomap.h index cea6bbc97b6e..5b2b40e81b61 100644 --- a/include/linux/iomap.h +++ b/include/linux/iomap.h @@ -91,6 +91,14 @@ struct vm_fault; #endif /* CONFIG_BLK_DEV_INTEGRITY */ #define IOMAP_F_ZERO_TAIL (1U << 10) +/* + * Indicates reads and writes of fsverity metadata. + * + * Fsverity metadata is stored after the regular file data and thus beyond + * i_size. + */ +#define IOMAP_F_FSVERITY (1U << 11) + /* * Flag reserved for file system specific usage */ -- cgit v1.2.3 From 1d140731753a277be36637300a0f3faa396edec1 Mon Sep 17 00:00:00 2001 From: Andrey Albershteyn Date: Wed, 20 May 2026 14:37:06 +0200 Subject: iomap: teach iomap to read files with fsverity Obtain fsverity info for folios with file data and fsverity metadata. Filesystem can pass vi down to ioend and then to fsverity for verification. This is different from other filesystems ext4, f2fs, btrfs supporting fsverity, these filesystems don't need fsverity_info for reading fsverity metadata. While reading merkle tree iomap requires fsverity info to synthesize hashes for zeroed data block. fsverity metadata has two kinds of holes - ones in merkle tree and one after fsverity descriptor. Merkle tree holes are blocks full of hashes of zeroed data blocks. These are not stored on the disk but synthesized on the fly. This saves a bit of space for sparse files. Due to this iomap also need to lookup fsverity_info for folios with fsverity metadata. ->vi has a hash of the zeroed data block which will be used to fill the merkle tree block. The hole past descriptor is interpreted as end of metadata region. As we don't have EOF here we use this hole as an indication that rest of the folio is empty. This patch marks rest of the folio beyond fsverity descriptor as uptodate. For file data, fsverity needs to verify consistency of the whole file against the root hash, hashes of holes are included in the merkle tree. Verify them too. Issue reading of fsverity merkle tree on the fsverity inodes. This way metadata will be available at I/O completion time. Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Andrey Albershteyn Link: https://patch.msgid.link/20260520123722.405752-9-aalbersh@kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/iomap.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/iomap.h b/include/linux/iomap.h index 5b2b40e81b61..1be2e16b696a 100644 --- a/include/linux/iomap.h +++ b/include/linux/iomap.h @@ -429,6 +429,7 @@ struct iomap_ioend { loff_t io_offset; /* offset in the file */ sector_t io_sector; /* start sector of ioend */ void *io_private; /* file system private data */ + struct fsverity_info *io_vi; /* fsverity info */ struct bio io_bio; /* MUST BE LAST! */ }; @@ -503,6 +504,7 @@ struct iomap_read_folio_ctx { struct readahead_control *rac; void *read_ctx; loff_t read_ctx_file_offset; + struct fsverity_info *vi; }; struct iomap_read_ops { -- cgit v1.2.3 From 36a36c4cac914510123071fb58270f6380faed1b Mon Sep 17 00:00:00 2001 From: Andrey Albershteyn Date: Wed, 20 May 2026 14:37:07 +0200 Subject: iomap: introduce iomap_fsverity_write() for writing fsverity metadata This is just a wrapper around iomap_file_buffered_write() to create necessary iterator over metadata. Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Andrey Albershteyn Link: https://patch.msgid.link/20260520123722.405752-10-aalbersh@kernel.org Reviewed-by: "Darrick J. Wong" Signed-off-by: Christian Brauner (Amutable) --- include/linux/iomap.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/iomap.h b/include/linux/iomap.h index 1be2e16b696a..3582ed1fe236 100644 --- a/include/linux/iomap.h +++ b/include/linux/iomap.h @@ -353,6 +353,9 @@ static inline bool iomap_want_unshare_iter(const struct iomap_iter *iter) ssize_t iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *from, const struct iomap_ops *ops, const struct iomap_write_ops *write_ops, void *private); +int iomap_fsverity_write(struct file *file, loff_t pos, size_t length, + const void *buf, const struct iomap_ops *ops, + const struct iomap_write_ops *write_ops); void iomap_read_folio(const struct iomap_ops *ops, struct iomap_read_folio_ctx *ctx, void *private); void iomap_readahead(const struct iomap_ops *ops, -- cgit v1.2.3 From a40e0f8eadd44d7b0f856b54c876aea1b93415f4 Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Fri, 5 Jun 2026 03:06:22 -0700 Subject: cleanup: Specify nonnull argument index The guard constructors were annotated with an empty __nonnull_args(), relying on __nonnull__() marking every pointer parameter as non-NULL. Sparse cannot parse the empty argument list. Both constructors take the lock pointer as their first parameter, so specify the index explicitly: __nonnull_args(1). Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aiJi0WcYE8FZt-jO@stanley.mountain/ Signed-off-by: Dmitry Ilvokhin Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/aiKpH3cLBEj3TF2Q@shell.ilvokhin.com --- include/linux/cleanup.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/cleanup.h b/include/linux/cleanup.h index 65416938e318..b1b5698cbf1b 100644 --- a/include/linux/cleanup.h +++ b/include/linux/cleanup.h @@ -397,7 +397,7 @@ static __maybe_unused const bool class_##_name##_is_conditional = _is_cond __DEFINE_GUARD_LOCK_PTR(_name, _T) #define DEFINE_GUARD(_name, _type, _lock, _unlock) \ - static __always_inline __nonnull_args() _type class_##_name##_constructor(_type _T); \ + static __always_inline __nonnull_args(1) _type class_##_name##_constructor(_type _T); \ DEFINE_CLASS(_name, _type, _unlock, ({ _lock; _T; }), _type _T); \ DEFINE_CLASS_IS_GUARD(_name) @@ -498,7 +498,7 @@ static __always_inline void class_##_name##_destructor(class_##_name##_t *_T) \ __DEFINE_GUARD_LOCK_PTR(_name, &_T->lock) #define __DEFINE_LOCK_GUARD_1(_name, _type, ...) \ -static __always_inline __nonnull_args() \ +static __always_inline __nonnull_args(1) \ class_##_name##_t class_##_name##_constructor(_type *l) \ __no_context_analysis \ { \ -- cgit v1.2.3 From 4cc0cc0b297c17c2b106d6892bd13d9c32fe66ce Mon Sep 17 00:00:00 2001 From: Tamizh Chelvam Raja Date: Thu, 4 Jun 2026 21:54:03 +0530 Subject: wifi: mac80211: Add 802.3 multicast encapsulation offload support mac80211 converts 802.3 multicast packets to 802.11 format before driver TX, even when Ethernet encapsulation offload is enabled. This prevents drivers that support multicast Ethernet encapsulation offload from receiving frames in native 802.3 format. Introduce the IEEE80211_OFFLOAD_ENCAP_MCAST flag to bypass the 802.11 encapsulation step and pass the multicast packet to the driver in 802.3 format. Drivers that support multicast Ethernet encapsulation offload can advertise this flag. Disable multicast encapsulation offload in MLO case for drivers not advertising MLO_MCAST_MULTI_LINK_TX support for AP mode and for 3-address AP_VLAN multicast packets. Signed-off-by: Tamizh Chelvam Raja Link: https://patch.msgid.link/20260604162403.1563729-4-tamizh.raja@oss.qualcomm.com [fix unlikely(), indentation] Signed-off-by: Johannes Berg --- include/net/mac80211.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/net/mac80211.h b/include/net/mac80211.h index 7dd558f4025b..4f95da023746 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -2014,12 +2014,16 @@ enum ieee80211_vif_flags { * @IEEE80211_OFFLOAD_DECAP_ENABLED: rx encapsulation offload is enabled * The driver supports passing received 802.11 frames as 802.3 frames to * mac80211. + * @IEEE80211_OFFLOAD_ENCAP_MCAST: tx multicast encapsulation offload is enabled + * The driver supports sending multicast frames passed as 802.3 frames + * by mac80211. */ enum ieee80211_offload_flags { IEEE80211_OFFLOAD_ENCAP_ENABLED = BIT(0), IEEE80211_OFFLOAD_ENCAP_4ADDR = BIT(1), IEEE80211_OFFLOAD_DECAP_ENABLED = BIT(2), + IEEE80211_OFFLOAD_ENCAP_MCAST = BIT(3), }; #define IEEE80211_NAN_AVAIL_BLOB_MAX_LEN 54 -- cgit v1.2.3 From fe97fd540a03034a780224f24b0b2f0e21c9c763 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 4 Jun 2026 08:21:10 +0200 Subject: netfilter: nf_conntrack_pptp: move GRE specific cleanup to GRE tracker Move the GRE specific cleanup to nf_conntrack_proto_gre.c to ensure that the .destroy callback for the pptp helper is still reachable by existing conntrack entries while pptp module is being removed. This is a preparation patch, no functional changes are intended. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/ipv4/nf_conntrack_ipv4.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/net/netfilter/ipv4/nf_conntrack_ipv4.h b/include/net/netfilter/ipv4/nf_conntrack_ipv4.h index b39417ad955e..0b07d5e69c15 100644 --- a/include/net/netfilter/ipv4/nf_conntrack_ipv4.h +++ b/include/net/netfilter/ipv4/nf_conntrack_ipv4.h @@ -20,4 +20,8 @@ extern const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp; extern const struct nf_conntrack_l4proto nf_conntrack_l4proto_gre; #endif +#if IS_ENABLED(CONFIG_NF_CONNTRACK_PPTP) +void gre_pptp_destroy_siblings(struct nf_conn *ct); +#endif + #endif /*_NF_CONNTRACK_IPV4_H*/ -- cgit v1.2.3 From ac46f3f35b6e68fb062ae7cf780d516c0cf4c00a Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 4 Jun 2026 08:21:11 +0200 Subject: netfilter: nf_conntrack_helper: add refcounting from datapath This patch adds a new ->ct_refcnt field to struct nf_conntrack_helper which is bumped when the helper is used by the ct helper extension. Drop this reference count when the conntrack entry is released. This is a packet path refcount which ensures that struct nf_conntrack_helper remains in place for tricky scenarios where a packet sits in nfqueue, or elsewhere, with a conntrack that refers to this helper. For simplicity, this leaves a single refcount for helper objects in place, remove the existing refcount for control plane that ensures that the helper does not go away if it is used by ruleset. On helper removal, the help callback is set to NULL to disable it from packet path and, after rcu grace period, existing expectations are removed. Update ctnetlink to disable access to .to_nlattr and .from_nlattr if the helper is going away. Remove nf_queue_nf_hook_drop() since it has proven not to be effective because packets with unconfirmed conntracks which are still flying to sit in nfqueue. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_helper.h | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index 1956bc12bf56..ed93a5a1adc8 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -35,20 +35,22 @@ enum nf_ct_helper_flags { struct nf_conntrack_helper { struct hlist_node hnode; /* Internal use. */ + struct rcu_head rcu; + char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */ - refcount_t refcnt; struct module *me; /* pointer to self */ struct nf_conntrack_expect_policy expect_policy[NF_CT_MAX_EXPECT_CLASSES]; + refcount_t ct_refcnt; + /* Tuple of things we will help (compared against server response) */ struct nf_conntrack_tuple tuple; /* Function to call when data passes; return verdict, or -1 to invalidate. */ - int (*help)(struct sk_buff *skb, - unsigned int protoff, - struct nf_conn *ct, - enum ip_conntrack_info conntrackinfo); + int __rcu (*help)(struct sk_buff *skb, unsigned int protoff, + struct nf_conn *ct, + enum ip_conntrack_info conntrackinfo); void (*destroy)(struct nf_conn *ct); @@ -138,6 +140,20 @@ static inline void *nfct_help_data(const struct nf_conn *ct) return (void *)help->data; } +static inline void nf_ct_help_put(const struct nf_conn *ct) +{ + struct nf_conntrack_helper *helper; + struct nf_conn_help *help; + + help = nfct_help(ct); + if (!help) + return; + + helper = rcu_dereference(help->helper); + if (helper && refcount_dec_and_test(&helper->ct_refcnt)) + kfree_rcu(helper, rcu); +} + int nf_conntrack_helper_init(void); void nf_conntrack_helper_fini(void); -- cgit v1.2.3 From 35e21a4dccc5c255ba59ccfbfeb4629ed21da972 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 4 Jun 2026 08:21:12 +0200 Subject: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 ("netfilter: extensions: introduce extension genid count") this patch disables all ct extensions (leading to NULL) for unconfirmed conntracks, when this is only targeted at ct helper and ct timeout. There is also codebase that dereferences the ct extension without checking for NULL which could lead to crash. Fixes: c56716c69ce1 ("netfilter: extensions: introduce extension genid count") Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_extend.h | 12 ------------ 1 file changed, 12 deletions(-) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h index 0b247248b032..fd5c4dbf72ca 100644 --- a/include/net/netfilter/nf_conntrack_extend.h +++ b/include/net/netfilter/nf_conntrack_extend.h @@ -38,7 +38,6 @@ enum nf_ct_ext_id { struct nf_ct_ext { u8 offset[NF_CT_EXT_NUM]; u8 len; - unsigned int gen_id; char data[] __aligned(8); }; @@ -52,8 +51,6 @@ static inline bool nf_ct_ext_exist(const struct nf_conn *ct, u8 id) return (ct->ext && __nf_ct_ext_exist(ct->ext, id)); } -void *__nf_ct_ext_find(const struct nf_ct_ext *ext, u8 id); - static inline void *nf_ct_ext_find(const struct nf_conn *ct, u8 id) { struct nf_ct_ext *ext = ct->ext; @@ -61,19 +58,10 @@ static inline void *nf_ct_ext_find(const struct nf_conn *ct, u8 id) if (!ext || !__nf_ct_ext_exist(ext, id)) return NULL; - if (unlikely(ext->gen_id)) - return __nf_ct_ext_find(ext, id); - return (void *)ct->ext + ct->ext->offset[id]; } /* Add this type, returns pointer to data or NULL. */ void *nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp); -/* ext genid. if ext->id != ext_genid, extensions cannot be used - * anymore unless conntrack has CONFIRMED bit set. - */ -extern atomic_t nf_conntrack_ext_genid; -void nf_ct_ext_bump_genid(void); - #endif /* _NF_CONNTRACK_EXTEND_H */ -- cgit v1.2.3 From 8f4fa9f89b72845fa8ac956bff2e1d2ba5722f2e Mon Sep 17 00:00:00 2001 From: Mykyta Yatsenko Date: Fri, 5 Jun 2026 04:41:18 -0700 Subject: rhashtable: Add rhashtable_next_key() API MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce a simpler iteration mechanism for rhashtable that lets the caller continue from an arbitrary position by supplying the previous key, without the per-iterator state of the rhashtable_walk_* API. void *rhashtable_next_key(struct rhashtable *ht, const void *prev_key); Caller holds RCU; passes NULL prev_key for the first element or the previously returned key to advance. Walks tbl->future_tbl chain so in-flight rehashes are observed. Best-effort: in case of concurrent resize, provides no guarantees: - may produce duplicate elements - may skip any amount of elements - termination of the loop is not guaranteed in case of sustained rehash. Callers are advised to bound loop externally or avoid inserting new elements during such loop. Returns ERR_PTR(-ENOENT) if prev_key is not found. Behavior on tables with duplicate keys is undefined. rhltable is not supported — returns ERR_PTR(-EOPNOTSUPP). Signed-off-by: Mykyta Yatsenko Acked-by: Herbert Xu Link: https://lore.kernel.org/r/20260605-rhash-v7-1-5b8e05f8630d@meta.com Signed-off-by: Alexei Starovoitov --- include/linux/rhashtable.h | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) (limited to 'include') diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h index ef5230cece36..6f3aea498515 100644 --- a/include/linux/rhashtable.h +++ b/include/linux/rhashtable.h @@ -650,6 +650,46 @@ restart: return NULL; } +/** + * rhashtable_next_key - return next element after a given key + * @ht: hash table + * @prev_key: pointer to previous key, or NULL for the first element + * + * WARNING: this walk is highly unstable. Unlike rhashtable_walk_*(), + * it cannot detect a concurrent resize or rehash, so a full iteration + * is NOT guaranteed to terminate under adversarial or sustained + * rehashing. Callers MUST tolerate skipped and duplicated elements and + * SHOULD bound their loop externally. + * + * Returns the next element in best-effort iteration order, walking the + * @tbl chain (including any future_tbl in flight). Caller must hold RCU. + * + * Pass @prev_key == NULL to obtain the first element. To iterate, set + * @prev_key to the key of the previously returned element on each call, + * and stop when NULL is returned. + * + * Best-effort semantics: + * - Across the tbl->future_tbl chain, an element being migrated may + * transiently appear in both tables and be observed twice. + * - Concurrent inserts may or may not be observed. + * - Termination of a full iteration loop is NOT guaranteed under + * adversarial continuous rehash; callers MUST tolerate skips and + * repeats and SHOULD bound their loop externally. + * - Behavior on tables that contain duplicate keys is undefined: + * duplicates may be skipped, repeated, or trap the walk in a + * cycle. Callers requiring duplicate-key iteration must use + * rhashtable_walk_*() instead. + * - rhltable instances are not supported and return + * ERR_PTR(-EOPNOTSUPP). + * - If prev_key was concurrently deleted and is not present in any + * in-flight table, returns ERR_PTR(-ENOENT). + * + * Returns entry of the next element, or NULL when iteration is exhausted, + * or ERR_PTR(-ENOENT) if prev_key is not found, or + * ERR_PTR(-EOPNOTSUPP) if @ht is an rhltable. + */ +void *rhashtable_next_key(struct rhashtable *ht, const void *prev_key); + /** * rhashtable_lookup - search hash table * @ht: hash table -- cgit v1.2.3 From 46730ee6e884be667365e4d3a380ac504697559a Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Fri, 5 Jun 2026 04:41:20 -0700 Subject: rhashtable: Use irq work for shrinking Use irq work for automatic shrinking so that this may be called in NMI context. Signed-off-by: Herbert Xu Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260605-rhash-v7-3-5b8e05f8630d@meta.com Signed-off-by: Alexei Starovoitov --- include/linux/rhashtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h index 6f3aea498515..3de3412d53c8 100644 --- a/include/linux/rhashtable.h +++ b/include/linux/rhashtable.h @@ -1157,7 +1157,7 @@ unlocked: atomic_dec(&ht->nelems); if (unlikely(ht->p.automatic_shrinking && rht_shrink_below_30(ht, tbl))) - schedule_work(&ht->run_work); + irq_work_queue(&ht->run_irq_work); err = 0; } -- cgit v1.2.3 From 16b4d3e2fb24aac3e68a8d86e3bc5e302e1b5cb7 Mon Sep 17 00:00:00 2001 From: Mykyta Yatsenko Date: Fri, 5 Jun 2026 04:41:21 -0700 Subject: bpf: Implement resizable hashmap basic functions Use rhashtable_lookup_likely() for lookups, rhashtable_remove_fast() for deletes, and rhashtable_lookup_get_insert_fast() for inserts. Updates modify values in place under RCU rather than allocating a new element and swapping the pointer (as regular htab does). This trades read consistency for performance: concurrent readers may see partial updates. BPF_F_LOCK support and special-field handling (timers, kptrs, etc.) follow in a later commit. Initialize rhashtable with bpf_mem_alloc element cache. Require BPF_F_NO_PREALLOC. Limit max_entries to 2^31. Free elements via rhashtable_free_and_destroy(). Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260605-rhash-v7-4-5b8e05f8630d@meta.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_types.h | 1 + include/uapi/linux/bpf.h | 6 ++++++ 2 files changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index b13de31e163f..56e4c3f983d3 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -134,6 +134,7 @@ BPF_MAP_TYPE(BPF_MAP_TYPE_BLOOM_FILTER, bloom_filter_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_USER_RINGBUF, user_ringbuf_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_ARENA, arena_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_INSN_ARRAY, insn_array_map_ops) +BPF_MAP_TYPE(BPF_MAP_TYPE_RHASH, rhtab_map_ops) BPF_LINK_TYPE(BPF_LINK_TYPE_RAW_TRACEPOINT, raw_tracepoint) BPF_LINK_TYPE(BPF_LINK_TYPE_TRACING, tracing) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index aec171ccb6ef..bed9b1b4d5ef 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1047,6 +1047,7 @@ enum bpf_map_type { BPF_MAP_TYPE_CGRP_STORAGE, BPF_MAP_TYPE_ARENA, BPF_MAP_TYPE_INSN_ARRAY, + BPF_MAP_TYPE_RHASH, __MAX_BPF_MAP_TYPE }; @@ -1545,6 +1546,11 @@ union bpf_attr { * * BPF_MAP_TYPE_ARENA - contains the address where user space * is going to mmap() the arena. It has to be page aligned. + * + * BPF_MAP_TYPE_RHASH - initial table size hint + * (nelem_hint). 0 = use rhashtable default. Must be + * <= min(max_entries, U16_MAX). Upper 32 bits reserved, + * must be zero. */ __u64 map_extra; -- cgit v1.2.3 From f64c723741c911544cca4c838d7a291b06b3ad1d Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Mon, 1 Jun 2026 08:37:28 -1000 Subject: bpf: Replace scratch PTE atomically when allocating arena pages apply_range_set_cb() maps the pages for a new arena allocation and returned -EBUSY when the target PTE was already populated. Kernel-fault recovery leaves the per-arena scratch page in unallocated arena PTEs, so a later bpf_arena_alloc_pages() over such a page hits that -EBUSY, and every subsequent allocation of it fails the same way. Allocation must install the real page over scratch instead. Overwriting the scratch PTE in place is a valid->valid change, which arm64 forbids without break-before-make. Route through an invalid entry instead: ptep_try_set() fills only a none slot, so the PTE goes scratch->none->page. On finding scratch, clear it and flush_tlb_before_set() before retrying. The new flush_tlb_before_set() is a no-op except on arches like arm64 that need the break-before-make TLB invalidate. The loop also copes with a concurrent fault re-scratching the slot. Arches without ptep_try_set() never install the scratch page, so keep the must-be-empty check and set_pte_at() for them. Fixes: dc11a4dba246 ("bpf: Recover arena kernel faults with scratch page") Signed-off-by: Tejun Heo Cc: Alexei Starovoitov Cc: David Hildenbrand Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260601183728.1800490-1-tj@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/pgtable.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'include') diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h index b5739bb99fc1..4c6c4081ef71 100644 --- a/include/linux/pgtable.h +++ b/include/linux/pgtable.h @@ -1061,6 +1061,24 @@ static inline bool ptep_try_set(pte_t *ptep, pte_t new_pte) } #endif +#ifndef flush_tlb_before_set +/** + * flush_tlb_before_set - invalidate a kernel PTE's TLB before re-setting it + * @addr: kernel virtual address whose PTE was just cleared + * + * Some architectures (e.g. arm64) do not allow a live page-table entry to be + * repointed at a different page in one step. The old entry must first be made + * invalid and its translation flushed from every TLB, and only then may the new + * entry be written. + * + * This is only for the lockless atomic kernel-PTE installers (ptep_try_set()). + * It must be callable with interrupts disabled. + */ +static inline void flush_tlb_before_set(unsigned long addr) +{ +} +#endif + #ifndef wrprotect_ptes /** * wrprotect_ptes - Write-protect PTEs that map consecutive pages of the same -- cgit v1.2.3 From 09ea6837a0434fb4db99528a5055b6d822135dcf Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Mon, 1 Jun 2026 13:52:32 -0300 Subject: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Several corner cases, especially important on 32 bits: - umem->iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the length is not too large for the iova - Check that lengths > 4G don't overflow the GENMASK Link: https://patch.msgid.link/r/2-v1-88303e9e509f+f7-ib_umem_types_jgg@nvidia.com Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index bc1e6ed73b3f..4c8f433ba246 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -109,7 +109,7 @@ int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length); unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - unsigned long virt); + u64 virt); /** * ib_umem_find_best_pgoff - Find best HW page size @@ -234,7 +234,7 @@ static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offs } static inline unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - unsigned long virt) + u64 virt) { return 0; } -- cgit v1.2.3 From 55d984dae65262fbb0a673cff7cc9824a5e19bdb Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Mon, 1 Jun 2026 13:52:33 -0300 Subject: RDMA/umem: Make ib_umem_is_contiguous() safe on 32 bit Sashiko points out the roundup_pow_of_two() only uses unsigned long but dma_addr_t can be u64. Change this algorithm to be simpler, compute the page size, if any page size is found and it results in a single block then it is contiguous. Link: https://patch.msgid.link/r/3-v1-88303e9e509f+f7-ib_umem_types_jgg@nvidia.com Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 4c8f433ba246..bb4005a9c690 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -145,16 +145,11 @@ static inline unsigned long ib_umem_find_best_pgoff(struct ib_umem *umem, static inline bool ib_umem_is_contiguous(struct ib_umem *umem) { - dma_addr_t dma_addr; unsigned long pgsz; - /* - * Select the smallest aligned page that can contain the whole umem if - * it was contiguous. - */ - dma_addr = ib_umem_start_dma_addr(umem); - pgsz = roundup_pow_of_two((dma_addr ^ (umem->length - 1 + dma_addr)) + 1); - return !!ib_umem_find_best_pgoff(umem, pgsz, U64_MAX); + pgsz = ib_umem_find_best_pgsz(umem, ULONG_MAX, + ib_umem_start_dma_addr(umem)); + return pgsz && ib_umem_num_dma_blocks(umem, pgsz) == 1; } struct ib_umem_dmabuf *ib_umem_dmabuf_get(struct ib_device *device, -- cgit v1.2.3 From 0ee8ac903e5aa100a70bef8d0afc19a336ffa775 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 2 Jun 2026 16:04:34 +0200 Subject: RDMA/hfi1: Open-code rvt_set_ibdev_name() clang warns about a function missing a printf attribute: include/rdma/rdma_vt.h:457:47: error: diagnostic behavior may be improved by adding the 'format(printf, 2, 3)' attribute to the declaration of 'rvt_set_ibdev_name' [-Werror,-Wmissing-format-attribute] 447 | static inline void rvt_set_ibdev_name(struct rvt_dev_info *rdi, | __attribute__((format(printf, 2, 3))) 448 | const char *fmt, const char *name, 449 | const int unit) The helper was originally added as an abstraction for the hfi1 and qib drivers needing the same thing, but now qib is gone, and hfi1 is the only remaining user of rdma_vt. Avoid the warning and allow the compiler to check the format string by open-coding the helper and directly assigning the device name. Fixes: 5084c8ff21f2 ("IB/{rdmavt, hfi1, qib}: Self determine driver name") Link: https://patch.msgid.link/r/20260602140453.3542427-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: Kees Cook Signed-off-by: Jason Gunthorpe --- include/rdma/rdma_vt.h | 20 -------------------- 1 file changed, 20 deletions(-) (limited to 'include') diff --git a/include/rdma/rdma_vt.h b/include/rdma/rdma_vt.h index 7d8de561f71b..7ffc83262a01 100644 --- a/include/rdma/rdma_vt.h +++ b/include/rdma/rdma_vt.h @@ -438,26 +438,6 @@ struct rvt_dev_info { struct rvt_wss *wss; }; -/** - * rvt_set_ibdev_name - Craft an IB device name from client info - * @rdi: pointer to the client rvt_dev_info structure - * @name: client specific name - * @unit: client specific unit number. - */ -static inline void rvt_set_ibdev_name(struct rvt_dev_info *rdi, - const char *fmt, const char *name, - const int unit) -{ - /* - * FIXME: rvt and its users want to touch the ibdev before - * registration and have things like the name work. We don't have the - * infrastructure in the core to support this directly today, hack it - * to work by setting the name manually here. - */ - dev_set_name(&rdi->ibdev.dev, fmt, name, unit); - strscpy(rdi->ibdev.name, dev_name(&rdi->ibdev.dev), IB_DEVICE_NAME_MAX); -} - /** * rvt_get_ibdev_name - return the IB name * @rdi: rdmavt device -- cgit v1.2.3 From 682ecb14e83840e87ea36c6d7c16c5111ce18784 Mon Sep 17 00:00:00 2001 From: Ankit Agrawal Date: Tue, 2 Jun 2026 06:30:15 +0000 Subject: vfio/nvgrace-gpu: Add Blackwell-Next GPU readiness check via CXL DVSEC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a CXL DVSEC-based readiness check for Blackwell-Next GPUs alongside the existing legacy BAR0 polling path. The CXL Device DVSEC offset is discovered at probe time. Probe, fault and read/write paths then branch on that to use either the legacy BAR0 polling or the CXL DVSEC polling. The CXL path polls Memory_Active, requiring MEM_INFO_VALID within 1s and MEM_ACTIVE within Memory_Active_Timeout (up to 256s) as per CXL spec r4.0 sec 8.1.3.8.2. Given the long worst-case wait, the CXL poll runs outside memory_lock with only a quick readiness check is done under the lock. The poll loops sleep with schedule_timeout_killable() and return -EINTR on a fatal signal. This avoids hung-task panics during the long uninterruptible wait. Extend this to the legacy based wait as well for improvement. In the fault handler the wait runs locklessly before memory_lock. If a reset races in, the in-lock recheck returns -EAGAIN and the wait is retried rather than returning a spurious VM_FAULT_SIGBUS. Add PCI_DVSEC_CXL_MEM_ACTIVE_TIMEOUT to pci_regs.h for the timeout field. Cc: Ilpo Järvinen Cc: Kevin Tian Suggested-by: Alex Williamson Signed-off-by: Ankit Agrawal Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260602063015.3915-1-ankita@nvidia.com Signed-off-by: Alex Williamson --- include/uapi/linux/pci_regs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h index 14f634ab9350..718fb630f5bb 100644 --- a/include/uapi/linux/pci_regs.h +++ b/include/uapi/linux/pci_regs.h @@ -1357,6 +1357,7 @@ #define PCI_DVSEC_CXL_RANGE_SIZE_LOW(i) (0x1C + (i * 0x10)) #define PCI_DVSEC_CXL_MEM_INFO_VALID _BITUL(0) #define PCI_DVSEC_CXL_MEM_ACTIVE _BITUL(1) +#define PCI_DVSEC_CXL_MEM_ACTIVE_TIMEOUT __GENMASK(15, 13) #define PCI_DVSEC_CXL_MEM_SIZE_LOW __GENMASK(31, 28) #define PCI_DVSEC_CXL_RANGE_BASE_HIGH(i) (0x20 + (i * 0x10)) #define PCI_DVSEC_CXL_RANGE_BASE_LOW(i) (0x24 + (i * 0x10)) -- cgit v1.2.3 From 08d912bc44dab63f2637677712d2a0b86922389a Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Fri, 5 Jun 2026 11:00:54 -0700 Subject: block: Annotate the queue limits functions Let the thread-safety checker verify whether every start of a queue limits update is followed by a call to a function that finishes a queue limits update. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Bart Van Assche Reviewed-by: Chaitanya Kulkarni Link: https://patch.msgid.link/8f71062b6d0fcf2b80bc8cda701c453224755439.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe --- include/linux/blkdev.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 17270a28c66d..65efbd7fe1a3 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -1092,15 +1092,17 @@ static inline unsigned int blk_boundary_sectors_left(sector_t offset, */ static inline struct queue_limits queue_limits_start_update(struct request_queue *q) + __acquires(&q->limits_lock) { mutex_lock(&q->limits_lock); return q->limits; } int queue_limits_commit_update_frozen(struct request_queue *q, - struct queue_limits *lim); + struct queue_limits *lim) __releases(&q->limits_lock); int queue_limits_commit_update(struct request_queue *q, - struct queue_limits *lim); -int queue_limits_set(struct request_queue *q, struct queue_limits *lim); + struct queue_limits *lim) __releases(&q->limits_lock); +int queue_limits_set(struct request_queue *q, struct queue_limits *lim) + __must_not_hold(&q->limits_lock); int blk_validate_limits(struct queue_limits *lim); /** @@ -1112,6 +1114,7 @@ int blk_validate_limits(struct queue_limits *lim); * starting update. */ static inline void queue_limits_cancel_update(struct request_queue *q) + __releases(&q->limits_lock) { mutex_unlock(&q->limits_lock); } -- cgit v1.2.3 From 3033c86fa1a8bb31d0a13738fe8c5f9e5bbaf98a Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Fri, 5 Jun 2026 11:00:55 -0700 Subject: block/bdev: Annotate the blk_holder_ops callback functions The four callback functions in blk_holder_ops all release the bd_holder_lock. Annotate these functions accordingly. Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Bart Van Assche Reviewed-by: Chaitanya Kulkarni Link: https://patch.msgid.link/be51cf81110f691ebd5868ac2f15ceb847805bc8.1780682325.git.bvanassche@acm.org Signed-off-by: Jens Axboe --- include/linux/blkdev.h | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 65efbd7fe1a3..57e84d59a642 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -1746,22 +1746,26 @@ void blkdev_show(struct seq_file *seqf, off_t offset); #endif struct blk_holder_ops { - void (*mark_dead)(struct block_device *bdev, bool surprise); + void (*mark_dead)(struct block_device *bdev, bool surprise) + __releases(&bdev->bd_holder_lock); /* * Sync the file system mounted on the block device. */ - void (*sync)(struct block_device *bdev); + void (*sync)(struct block_device *bdev) + __releases(&bdev->bd_holder_lock); /* * Freeze the file system mounted on the block device. */ - int (*freeze)(struct block_device *bdev); + int (*freeze)(struct block_device *bdev) + __releases(&bdev->bd_holder_lock); /* * Thaw the file system mounted on the block device. */ - int (*thaw)(struct block_device *bdev); + int (*thaw)(struct block_device *bdev) + __releases(&bdev->bd_holder_lock); }; /* -- cgit v1.2.3 From e2a49fdb1beed150125b4104c90eb2a96ec7f63a Mon Sep 17 00:00:00 2001 From: Leon Hwang Date: Fri, 5 Jun 2026 23:52:47 +0800 Subject: bpf: Check tail zero of bpf_map_info Since there're 4 bytes padding at the end of struct bpf_map_info, they won't be checked by bpf_check_uarg_tail_zero(). pahole -C bpf_map_info ./vmlinux struct bpf_map_info { ... __u64 hash __attribute__((__aligned__(8))); /* 88 8 */ __u32 hash_size; /* 96 4 */ /* size: 104, cachelines: 2, members: 18 */ /* padding: 4 */ /* forced alignments: 1 */ /* last cacheline: 40 bytes */ } __attribute__((__aligned__(8))); If a future kernel extension adds a new 4-byte field, older userspace programs allocating this structure on the stack might inadvertently pass uninitialized stack garbage into the new field, permanently breaking backward compatibility. -- sashiko [1] Fix it by changing sizeof(info) to offsetofend(struct bpf_map_info, hash_size). And, add "__u32 :32" to the tail of struct bpf_map_info. [1] https://lore.kernel.org/bpf/20260513224823.6494FC19425@smtp.kernel.org/ Fixes: ea2e6467ac36 ("bpf: Return hashes of maps in BPF_OBJ_GET_INFO_BY_FD") Acked-by: Mykyta Yatsenko Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260605155249.20772-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov --- include/uapi/linux/bpf.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index bed9b1b4d5ef..e1730f449d9e 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -6733,6 +6733,7 @@ struct bpf_map_info { __u64 map_extra; __aligned_u64 hash; __u32 hash_size; + __u32 :32; } __attribute__((aligned(8))); struct bpf_btf_info { -- cgit v1.2.3 From 786be2b05980a5828e67fc564ad7517e2adbe9bd Mon Sep 17 00:00:00 2001 From: Leon Hwang Date: Fri, 5 Jun 2026 23:52:48 +0800 Subject: bpf: Check tail zero of bpf_prog_info Since there're 4 bytes padding at the end of struct bpf_prog_info, they won't be checked by bpf_check_uarg_tail_zero(). pahole -C bpf_prog_info ./vmlinux struct bpf_prog_info { ... __u32 attach_btf_obj_id; /* 220 4 */ __u32 attach_btf_id; /* 224 4 */ /* size: 232, cachelines: 4, members: 38 */ /* sum members: 224 */ /* sum bitfield members: 1 bits, bit holes: 1, sum bit holes: 31 bits */ /* padding: 4 */ /* forced alignments: 9 */ /* last cacheline: 40 bytes */ } __attribute__((__aligned__(8))); If a future kernel extension adds a new 4-byte field, older userspace programs allocating this structure on the stack might inadvertently pass uninitialized stack garbage into the new field, permanently breaking backward compatibility. -- sashiko [1] Fix it by changing sizeof(info) to offsetofend(struct bpf_prog_info, attach_btf_id). And, add "__u32 :32" to the tail of struct bpf_prog_info. [1] https://lore.kernel.org/bpf/20260513224823.6494FC19425@smtp.kernel.org/ Fixes: aba64c7da983 ("bpf: Add verified_insns to bpf_prog_info and fdinfo") Acked-by: Mykyta Yatsenko Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20260605155249.20772-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov --- include/uapi/linux/bpf.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index e1730f449d9e..d5238df5e5eb 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -6712,6 +6712,7 @@ struct bpf_prog_info { __u32 verified_insns; __u32 attach_btf_obj_id; __u32 attach_btf_id; + __u32 :32; } __attribute__((aligned(8))); struct bpf_map_info { -- cgit v1.2.3 From 87020def2529ec26fc9077e889fa1c34f53f1f83 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 4 Jun 2026 14:13:34 +0000 Subject: bridge: add bridge_flags_bit enum We want to use atomic operations for lockless p->flags changes and reads. Add definitions for bits in addition of masks so that we can use test_bit(), clear_bit() and set_bit() in subsequent patches. Signed-off-by: Eric Dumazet Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20260604141343.2124500-3-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/if_bridge.h | 78 ++++++++++++++++++++++++++++++++--------------- 1 file changed, 53 insertions(+), 25 deletions(-) (limited to 'include') diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h index ec9ffea1e46e..75673b8bffcb 100644 --- a/include/linux/if_bridge.h +++ b/include/linux/if_bridge.h @@ -36,32 +36,60 @@ struct br_ip_list { struct br_ip addr; }; -#define BR_HAIRPIN_MODE BIT(0) -#define BR_BPDU_GUARD BIT(1) -#define BR_ROOT_BLOCK BIT(2) -#define BR_MULTICAST_FAST_LEAVE BIT(3) -#define BR_ADMIN_COST BIT(4) -#define BR_LEARNING BIT(5) -#define BR_FLOOD BIT(6) +enum bridge_flags_bit { + BR_HAIRPIN_MODE_BIT, + BR_BPDU_GUARD_BIT, + BR_ROOT_BLOCK_BIT, + BR_MULTICAST_FAST_LEAVE_BIT, + BR_ADMIN_COST_BIT, + BR_LEARNING_BIT, + BR_FLOOD_BIT, + BR_PROMISC_BIT, + BR_PROXYARP_BIT, + BR_LEARNING_SYNC_BIT, + BR_PROXYARP_WIFI_BIT, + BR_MCAST_FLOOD_BIT, + BR_MULTICAST_TO_UNICAST_BIT, + BR_VLAN_TUNNEL_BIT, + BR_BCAST_FLOOD_BIT, + BR_NEIGH_SUPPRESS_BIT, + BR_ISOLATED_BIT, + BR_MRP_AWARE_BIT, + BR_MRP_LOST_CONT_BIT, + BR_MRP_LOST_IN_CONT_BIT, + BR_TX_FWD_OFFLOAD_BIT, + BR_PORT_LOCKED_BIT, + BR_PORT_MAB_BIT, + BR_NEIGH_VLAN_SUPPRESS_BIT, + BR_NEIGH_FORWARD_GRAT_BIT, +}; + +#define BR_HAIRPIN_MODE BIT(BR_HAIRPIN_MODE_BIT) +#define BR_BPDU_GUARD BIT(BR_BPDU_GUARD_BIT) +#define BR_ROOT_BLOCK BIT(BR_ROOT_BLOCK_BIT) +#define BR_MULTICAST_FAST_LEAVE BIT(BR_MULTICAST_FAST_LEAVE_BIT) +#define BR_ADMIN_COST BIT(BR_ADMIN_COST_BIT) +#define BR_LEARNING BIT(BR_LEARNING_BIT) +#define BR_FLOOD BIT(BR_FLOOD_BIT) #define BR_AUTO_MASK (BR_FLOOD | BR_LEARNING) -#define BR_PROMISC BIT(7) -#define BR_PROXYARP BIT(8) -#define BR_LEARNING_SYNC BIT(9) -#define BR_PROXYARP_WIFI BIT(10) -#define BR_MCAST_FLOOD BIT(11) -#define BR_MULTICAST_TO_UNICAST BIT(12) -#define BR_VLAN_TUNNEL BIT(13) -#define BR_BCAST_FLOOD BIT(14) -#define BR_NEIGH_SUPPRESS BIT(15) -#define BR_ISOLATED BIT(16) -#define BR_MRP_AWARE BIT(17) -#define BR_MRP_LOST_CONT BIT(18) -#define BR_MRP_LOST_IN_CONT BIT(19) -#define BR_TX_FWD_OFFLOAD BIT(20) -#define BR_PORT_LOCKED BIT(21) -#define BR_PORT_MAB BIT(22) -#define BR_NEIGH_VLAN_SUPPRESS BIT(23) -#define BR_NEIGH_FORWARD_GRAT BIT(24) +#define BR_PROMISC BIT(BR_PROMISC_BIT) +#define BR_PROXYARP BIT(BR_PROXYARP_BIT) +#define BR_LEARNING_SYNC BIT(BR_LEARNING_SYNC_BIT) +#define BR_PROXYARP_WIFI BIT(BR_PROXYARP_WIFI_BIT) +#define BR_MCAST_FLOOD BIT(BR_MCAST_FLOOD_BIT) +#define BR_MULTICAST_TO_UNICAST BIT(BR_MULTICAST_TO_UNICAST_BIT) +#define BR_VLAN_TUNNEL BIT(BR_VLAN_TUNNEL_BIT) +#define BR_BCAST_FLOOD BIT(BR_BCAST_FLOOD_BIT) +#define BR_NEIGH_SUPPRESS BIT(BR_NEIGH_SUPPRESS_BIT) +#define BR_ISOLATED BIT(BR_ISOLATED_BIT) +#define BR_MRP_AWARE BIT(BR_MRP_AWARE_BIT) +#define BR_MRP_LOST_CONT BIT(BR_MRP_LOST_CONT_BIT) +#define BR_MRP_LOST_IN_CONT BIT(BR_MRP_LOST_IN_CONT_BIT) +#define BR_TX_FWD_OFFLOAD BIT(BR_TX_FWD_OFFLOAD_BIT) +#define BR_PORT_LOCKED BIT(BR_PORT_LOCKED_BIT) +#define BR_PORT_MAB BIT(BR_PORT_MAB_BIT) +#define BR_NEIGH_VLAN_SUPPRESS BIT(BR_NEIGH_VLAN_SUPPRESS_BIT) +#define BR_NEIGH_FORWARD_GRAT BIT(BR_NEIGH_FORWARD_GRAT_BIT) #define BR_DEFAULT_AGEING_TIME (300 * HZ) -- cgit v1.2.3 From 63a673e8a4112af267106264f50584947786845a Mon Sep 17 00:00:00 2001 From: KP Singh Date: Fri, 5 Jun 2026 23:35:17 +0200 Subject: bpf: Expose signature verdict via bpf_prog_aux BPF_PROG_LOAD verifies the loader signature but does not record the outcome on the BPF program. [BPF] LSMs and audit can read attr->signature and attr->keyring_id to infer "was this signed, and if so, against which keyring". Add prog->aux->sig (verdict + keyring_{type,serial}), populated by bpf_prog_load before the LSM hook. keyring_type classifies the keyring the load referenced (builtin, secondary, platform or user), while keyring_serial records the serial of the keyring the signature was actually validated against. System keyrings carry a pseudo key pointer with no user-visible serial and are reported as 0, as are unsigned loads. Failed verifications reject the load before the hook runs, so it observes only either UNSIGNED or VERIFIED. Signed-off-by: KP Singh Co-developed-by: Daniel Borkmann Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20260605213518.544262-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 45 +++++++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 8599b451dd7a..f615b56730d2 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -32,6 +32,7 @@ #include #include #include +#include #include struct bpf_verifier_env; @@ -1674,6 +1675,19 @@ struct bpf_stream_stage { int len; }; +enum bpf_sig_verdict { + BPF_SIG_UNSIGNED = 0, + BPF_SIG_VERIFIED, +}; + +enum bpf_sig_keyring { + BPF_SIG_KEYRING_NONE = 0, + BPF_SIG_KEYRING_BUILTIN, + BPF_SIG_KEYRING_SECONDARY, + BPF_SIG_KEYRING_PLATFORM, + BPF_SIG_KEYRING_USER, +}; + struct bpf_prog_aux { atomic64_t refcnt; u32 used_map_cnt; @@ -1716,6 +1730,11 @@ struct bpf_prog_aux { bool changes_pkt_data; bool might_sleep; bool kprobe_write_ctx; + struct { + s32 keyring_serial; + u8 keyring_type; + u8 verdict; + } sig; u64 prog_array_member_cnt; /* counts how many times as member of prog_array */ struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */ struct bpf_arena *arena; @@ -3697,8 +3716,14 @@ static inline int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, #endif /* CONFIG_BPF_SYSCALL */ #endif /* defined(CONFIG_INET) && defined(CONFIG_BPF_SYSCALL) */ -#if defined(CONFIG_KEYS) && defined(CONFIG_BPF_SYSCALL) +#ifdef CONFIG_KEYS +struct bpf_key { + struct key *key; + bool has_ref; +}; +#endif /* CONFIG_KEYS */ +#if defined(CONFIG_KEYS) && defined(CONFIG_BPF_SYSCALL) struct bpf_key *bpf_lookup_user_key(s32 serial, u64 flags); struct bpf_key *bpf_lookup_system_key(u64 id); void bpf_key_put(struct bpf_key *bkey); @@ -3706,6 +3731,10 @@ int bpf_verify_pkcs7_signature(const struct bpf_dynptr *data_p, const struct bpf_dynptr *sig_p, struct bpf_key *trusted_keyring); +static inline s32 bpf_key_serial(const struct bpf_key *key) +{ + return key->has_ref ? key->key->serial : 0; +} #else static inline struct bpf_key *bpf_lookup_user_key(u32 serial, u64 flags) { @@ -3727,6 +3756,11 @@ static inline int bpf_verify_pkcs7_signature(const struct bpf_dynptr *data_p, { return -EOPNOTSUPP; } + +static inline s32 bpf_key_serial(const struct bpf_key *key) +{ + return 0; +} #endif /* defined(CONFIG_KEYS) && defined(CONFIG_BPF_SYSCALL) */ /* verifier prototypes for helper functions called from eBPF programs */ @@ -4002,15 +4036,6 @@ static inline void bpf_cgroup_atype_get(u32 attach_btf_id, int cgroup_atype) {} static inline void bpf_cgroup_atype_put(int cgroup_atype) {} #endif /* CONFIG_BPF_LSM */ -struct key; - -#ifdef CONFIG_KEYS -struct bpf_key { - struct key *key; - bool has_ref; -}; -#endif /* CONFIG_KEYS */ - static inline bool type_is_alloc(u32 type) { return type & MEM_ALLOC; -- cgit v1.2.3 From 2566fa7b2f2402a77dae6a5e9b28a1bae1c20793 Mon Sep 17 00:00:00 2001 From: Rong Xu Date: Thu, 4 Jun 2026 12:56:08 -0700 Subject: kconfig: Remove the architecture specific config for Propeller The CONFIG_PROPELLER_CLANG option currently depends on ARCH_SUPPORTS_PROPELLER_CLANG, but this dependency seems unnecessary. Remove ARCH_SUPPORTS_PROPELLER_CLANG and allow users to control Propeller builds solely through CONFIG_PROPELLER_CLANG. This simplifies the kconfig and avoids potential confusion. Move the .llvm_bb_addr_map sections grouping to include/asm-generic/vmlinux.lds.h. The Propeller documentation has been updated to reflect the most recent tool location and now includes instructions for arm64. Contributor Acknowledgments: * SPE instructions: Daniel Hoekwater Signed-off-by: Rong Xu Suggested-by: Will Deacon Suggested-by: Nathan Chancellor Tested-by: Yabin Cui Reviewed-by: Kees Cook Link: https://patch.msgid.link/20260604195612.3757860-3-xur@google.com Signed-off-by: Nathan Chancellor --- include/asm-generic/vmlinux.lds.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h index 60c8c22fd3e4..5659f4b5a125 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -1011,6 +1011,12 @@ #define PERCPU_DECRYPTED_SECTION #endif +#ifdef CONFIG_PROPELLER_CLANG +#define PROPELLER_DATA \ + .llvm_bb_addr_map : { *(.llvm_bb_addr_map) } +#else +#define PROPELLER_DATA +#endif /* * Default discarded sections. -- cgit v1.2.3 From 6a07814ff643b5c8e1353d8c6229f52fde205cde Mon Sep 17 00:00:00 2001 From: Miklos Szeredi Date: Fri, 5 Jun 2026 15:53:16 +0200 Subject: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with different namespaces can share the same kernfs_node when kernfs_test_super() finds a matching root but different namespace. This means multiple inodes from different superblocks can reference the same kernfs_node->iattr->xattrs structure. The VFS layer only holds per-inode locks during xattr operations, which is insufficient to serialize concurrent xattr modifications on the shared kernfs_node. This can lead to race conditions in simple_xattr_set() where the lookup->replace/remove sequence is not atomic with respect to operations from other superblocks. Fix this by protecting xattr operations with the existing hashed kernfs_locks->open_file_mutex[] array, which is already used to protect per-node open file data. The hashed mutex array provides scalable per-node serialization (scaled by CPU count, up to 1024 locks on 32+ CPU systems) with zero memory overhead. Changes: - Rename open_file_mutex[] to node_mutex[] to reflect dual purpose - Add kernfs_node_lock_ptr() and kernfs_node_lock() helpers - Protect simple_xattr_set() calls in kernfs_xattr_set() and kernfs_vfs_user_xattr_set() with the hashed mutex - Update file.c to use new helpers via compatibility wrappers - Update documentation to explain the extended lock usage Fixes: b32c4a213698 ("xattr: add rhashtable-based simple_xattr infrastructure") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260601162454.2116375-1-mszeredi%40redhat.com Assisted-by: Claude:claude-sonnet-4-5 Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260605135322.2632068-2-mszeredi@redhat.com Signed-off-by: Christian Brauner (Amutable) --- include/linux/kernfs.h | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h index e21b2f7f4159..351a5101c862 100644 --- a/include/linux/kernfs.h +++ b/include/linux/kernfs.h @@ -76,20 +76,25 @@ struct kernfs_iattrs; * kernfs_open_file. * * kernfs_open_files are chained at kernfs_open_node->files, which is - * protected by kernfs_global_locks.open_file_mutex[i]. + * protected by kernfs_global_locks.node_mutex[i]. * * To reduce possible contention in sysfs access, arising due to single - * locks, use an array of locks (e.g. open_file_mutex) and use kernfs_node + * locks, use an array of locks (e.g. node_mutex) and use kernfs_node * object address as hash keys to get the index of these locks. * * Hashed mutexes are safe to use here because operations using these don't * rely on global exclusion. * + * The hashed mutex array protects per-node data: the kernfs_open_node for + * open file management, and kernfs_node xattr operations (necessary because + * multiple superblocks with different namespaces can share the same + * kernfs_node, making per-inode locking insufficient). + * * In future we intend to replace other global locks with hashed ones as well. * kernfs_global_locks acts as a holder for all such hash tables. */ struct kernfs_global_locks { - struct mutex open_file_mutex[NR_KERNFS_LOCKS]; + struct mutex node_mutex[NR_KERNFS_LOCKS]; }; enum kernfs_node_type { -- cgit v1.2.3 From 076e5cef28e27febfc09b5f72544d2b857c75201 Mon Sep 17 00:00:00 2001 From: Miklos Szeredi Date: Fri, 5 Jun 2026 15:53:18 +0200 Subject: simple_xattr: change interface to pass struct simple_xattrs ** Change the simple_xattr API to accept pointer-to-pointer (struct simple_xattrs **) instead of pointer. This allows the functions to handle lazy allocation internally without requiring callers to use simple_xattrs_lazy_alloc(). The simple_xattr_set(), simple_xattr_set_limited() and simple_xattr_add() functions now handle allocation when xattrs is NULL. simple_xattrs_free() now also frees the xattrs structure itself and sets the pointer to NULL. This simplifies callers and removes the need for most callers to explicitly manage xattrs allocation and lifetime. In shmem_initxattrs(), the total required space for all initial xattrs (ispace) is pre-calculated and deducted from sbinfo->free_ispace. Since this patch modifies the function to add new xattrs directly to the inode's &info->xattrs list rather than using a local temporary variable, a failure means that the partially populated info->xattrs list remains attached to the inode. When the VFS caller handles the -ENOMEM error, it drops the newly created inode via iput(), shmem_free_inode() adds freed to sbinfo->free_ispace a second time, permanently inflating the tmpfs free space quota. Fix by substracting already added xattrs from ispace. Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260605135322.2632068-4-mszeredi@redhat.com Signed-off-by: Christian Brauner (Amutable) --- include/linux/xattr.h | 21 ++++++--------------- 1 file changed, 6 insertions(+), 15 deletions(-) (limited to 'include') diff --git a/include/linux/xattr.h b/include/linux/xattr.h index 8b6601367eae..ded446c1ef81 100644 --- a/include/linux/xattr.h +++ b/include/linux/xattr.h @@ -133,26 +133,23 @@ static inline void simple_xattr_limits_init(struct simple_xattr_limits *limits) } int simple_xattrs_init(struct simple_xattrs *xattrs); -struct simple_xattrs *simple_xattrs_alloc(void); -struct simple_xattrs *simple_xattrs_lazy_alloc(struct simple_xattrs **xattrsp, - const void *value, int flags); -void simple_xattrs_free(struct simple_xattrs *xattrs, size_t *freed_space); +void simple_xattrs_free(struct simple_xattrs **xattrs, size_t *freed_space); size_t simple_xattr_space(const char *name, size_t size); struct simple_xattr *simple_xattr_alloc(const void *value, size_t size); void simple_xattr_free(struct simple_xattr *xattr); void simple_xattr_free_rcu(struct simple_xattr *xattr); -int simple_xattr_get(struct simple_xattrs *xattrs, const char *name, +int simple_xattr_get(struct simple_xattrs **xattrs, const char *name, void *buffer, size_t size); -struct simple_xattr *simple_xattr_set(struct simple_xattrs *xattrs, +struct simple_xattr *simple_xattr_set(struct simple_xattrs **xattrs, const char *name, const void *value, size_t size, int flags); -int simple_xattr_set_limited(struct simple_xattrs *xattrs, +int simple_xattr_set_limited(struct simple_xattrs **xattrs, struct simple_xattr_limits *limits, const char *name, const void *value, size_t size, int flags); -ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, +ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs **xattrs, char *buffer, size_t size); -int simple_xattr_add(struct simple_xattrs *xattrs, +int simple_xattr_add(struct simple_xattrs **xattrs, struct simple_xattr *new_xattr); int xattr_list_one(char **buffer, ssize_t *remaining_size, const char *name); @@ -162,10 +159,4 @@ DEFINE_CLASS(simple_xattr, simple_xattr_alloc(value, size), const void *value, size_t size) -DEFINE_CLASS(simple_xattrs, - struct simple_xattrs *, - if (!IS_ERR_OR_NULL(_T)) { simple_xattrs_free(_T, NULL); kfree(_T); }, - simple_xattrs_alloc(), - void) - #endif /* _LINUX_XATTR_H */ -- cgit v1.2.3 From 1e7cd8a53b72a58a44c4d282aed95f6ce0e76db0 Mon Sep 17 00:00:00 2001 From: Miklos Szeredi Date: Fri, 5 Jun 2026 15:53:19 +0200 Subject: simpe_xattr: use per-sb cache Move the hash table to the super block to remove excessive overhead in case of small number of xattrs per inode. Add linked list to the inode, used for listxattr and eviction. Listxattr uses rcu protection to iterate the list of xattrs. Before being made per-sb, lazy allocation was protected by inode lock. Now inode lock no longer provides sufficient exclusion, so use cmpxchg() to ensure atomicity. Though I haven't found a description of this pattern, after some research it seems that cmpxchg_release() and READ_ONCE() should provide the necessary memory barriers. Use simple_xattr_free_rcu() in simple_xattrs_free(). This is needed because the hash table is now shared between inodes and lookup on a different inode might be running the compare function on the just freed element within the RCU grace period. Following stats are based on slabinfo diff, after creating 100k empty files, then adding a "user.test=foo" xattr to each: v7.0 (no rhashtable): File creation: 993.40 bytes/file Xattr addition: 79.99 bytes/file v7.1-rc2 (per-inode rhashtable): File creation: 939.73 bytes/file Xattr addition: 1296.08 bytes/file v7.1-rc2 + this patch (per-sb rhashtable) File creation: 946.84 bytes/file Xattr addition: 111.86 bytes/file The overhead of a single xattr is reduced to nearly v7.0 levels. The per xattr overhead is slightly larger due to the addition of three pointers to struct simple_xattr. Fixes: b32c4a213698 ("xattr: add rhashtable-based simple_xattr infrastructure") Signed-off-by: Miklos Szeredi Link: https://patch.msgid.link/20260605135322.2632068-5-mszeredi@redhat.com Signed-off-by: Christian Brauner (Amutable) --- include/linux/shmem_fs.h | 3 ++- include/linux/xattr.h | 26 ++++++++++++++++---------- 2 files changed, 18 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h index 93a0ba872ebe..69b0177da156 100644 --- a/include/linux/shmem_fs.h +++ b/include/linux/shmem_fs.h @@ -48,7 +48,7 @@ struct shmem_inode_info { }; struct timespec64 i_crtime; /* file creation time */ struct shared_policy policy; /* NUMA memory alloc policy */ - struct simple_xattrs *xattrs; /* list of xattrs */ + struct list_head xattrs; /* list of xattrs */ pgoff_t fallocend; /* highest fallocate endindex */ unsigned int fsflags; /* for FS_IOC_[SG]ETFLAGS */ atomic_t stop_eviction; /* hold when working on inode */ @@ -89,6 +89,7 @@ struct shmem_sb_info { struct list_head shrinklist; /* List of shinkable inodes */ unsigned long shrinklist_len; /* Length of shrinklist */ struct shmem_quota_limits qlimits; /* Default quota limits */ + struct simple_xattr_cache xa_cache; }; static inline struct shmem_inode_info *SHMEM_I(struct inode *inode) diff --git a/include/linux/xattr.h b/include/linux/xattr.h index ded446c1ef81..7aaaf4f8aff5 100644 --- a/include/linux/xattr.h +++ b/include/linux/xattr.h @@ -106,12 +106,14 @@ static inline const char *xattr_prefix(const struct xattr_handler *handler) return handler->prefix ?: handler->name; } -struct simple_xattrs { - struct rhashtable ht; +struct simple_xattr_cache { + struct rhashtable *ht; }; struct simple_xattr { struct rhash_head hash_node; + struct list_head *parent; + struct list_head node; struct rcu_head rcu; char *name; size_t size; @@ -132,27 +134,31 @@ static inline void simple_xattr_limits_init(struct simple_xattr_limits *limits) atomic_set(&limits->xattr_size, 0); } -int simple_xattrs_init(struct simple_xattrs *xattrs); -void simple_xattrs_free(struct simple_xattrs **xattrs, size_t *freed_space); +void simple_xattrs_free(struct simple_xattr_cache *cache, struct list_head *xattrs, + size_t *freed_space); size_t simple_xattr_space(const char *name, size_t size); struct simple_xattr *simple_xattr_alloc(const void *value, size_t size); void simple_xattr_free(struct simple_xattr *xattr); void simple_xattr_free_rcu(struct simple_xattr *xattr); -int simple_xattr_get(struct simple_xattrs **xattrs, const char *name, - void *buffer, size_t size); -struct simple_xattr *simple_xattr_set(struct simple_xattrs **xattrs, +int simple_xattr_get(struct simple_xattr_cache *cache, struct list_head *xattrs, + const char *name, void *buffer, size_t size); +struct simple_xattr *simple_xattr_set(struct simple_xattr_cache *cache, + struct list_head *xattrs, const char *name, const void *value, size_t size, int flags); -int simple_xattr_set_limited(struct simple_xattrs **xattrs, +int simple_xattr_set_limited(struct simple_xattr_cache *cache, + struct list_head *xattrs, struct simple_xattr_limits *limits, const char *name, const void *value, size_t size, int flags); -ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs **xattrs, +ssize_t simple_xattr_list(struct inode *inode, struct list_head *xattrs, char *buffer, size_t size); -int simple_xattr_add(struct simple_xattrs **xattrs, +int simple_xattr_add(struct simple_xattr_cache *cache, struct list_head *xattrs, struct simple_xattr *new_xattr); int xattr_list_one(char **buffer, ssize_t *remaining_size, const char *name); +void simple_xattr_cache_cleanup(struct simple_xattr_cache *cache); + DEFINE_CLASS(simple_xattr, struct simple_xattr *, if (!IS_ERR_OR_NULL(_T)) simple_xattr_free(_T), -- cgit v1.2.3 From 9722955b54307e9070994f2382ec06af3d7405e0 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Tue, 2 Jun 2026 09:40:12 +0200 Subject: bpf: Add simple xattr support to bpffs Add support for extended attributes on bpffs inodes so that user space and BPF LSM programs can attach metadata, for example, a content hash or a security label - to a pinned object or directory. BPF LSM or user space tooling can then uniformly look at this (e.g. security.bpf.*) in similar way to other fs'es. The store is in-memory and non-persistent: it lives only for the lifetime of the mount, like everything else in bpffs. The modelling is similar to tmpfs. bpffs serves the trusted.* and security.* namespaces; user.* is left unsupported. As bpffs is FS_USERNS_MOUNT, security.* is reachable by the unprivileged mounter in a user namespace, and thus we are using the simple_xattr_set_limited infra there (trusted.* needs global CAP_SYS_ADMIN). bpf_fill_super() is open-coded instead of using simple_fill_super(), because the root inode must now be allocated through bpf_fs_alloc_inode() i.e. carry the bpf_fs_inode wrapper and come from the right cache - which requires s_op (and s_xattr) to be installed before the first inode is created. While at it, also harden s_iflags with SB_I_NOEXEC and SB_I_NODEV. bpf_fs_listxattr() is only reachable through the filesystem via i_op->listxattr, so the BPF token inode is left untouched. Name-based fsetxattr()/fgetxattr() on a token fd still work since the get/set handlers are installed at the superblock. For security.* namespace, we use simple_xattr_set_limited() but there was no simple_xattr_add_limited() API yet which was needed in bpf_fs_initxattrs() to avoid underflows in the accounting. The symlink target is freed in bpf_free_inode() rather than in bpf_destroy_inode() so that it is released only after an RCU grace period, as an RCU path walk following the symlink may still dereference inode->i_link in security_inode_follow_link(). Lastly, the bpf_symlink() allocated the symlink target is switched to GFP_KERNEL_ACCOUNT, so the string is charged to the caller's memcg. Signed-off-by: Daniel Borkmann Link: https://patch.msgid.link/20260602074012.416289-1-daniel@iogearbox.net Cc: Christian Brauner Signed-off-by: Christian Brauner (Amutable) --- include/linux/bpf.h | 3 +++ include/linux/xattr.h | 4 ++++ 2 files changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index b4b703c90ca9..434ba91401c6 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -31,6 +31,7 @@ #include #include #include +#include #include struct bpf_verifier_env; @@ -1918,6 +1919,8 @@ struct bpf_mount_opts { u64 delegate_maps; u64 delegate_progs; u64 delegate_attachs; + + struct simple_xattr_cache xa_cache; }; struct bpf_token { diff --git a/include/linux/xattr.h b/include/linux/xattr.h index 7aaaf4f8aff5..54ac3cbc133f 100644 --- a/include/linux/xattr.h +++ b/include/linux/xattr.h @@ -155,6 +155,10 @@ ssize_t simple_xattr_list(struct inode *inode, struct list_head *xattrs, char *buffer, size_t size); int simple_xattr_add(struct simple_xattr_cache *cache, struct list_head *xattrs, struct simple_xattr *new_xattr); +int simple_xattr_add_limited(struct simple_xattr_cache *cache, + struct list_head *xattrs, + struct simple_xattr_limits *limits, + struct simple_xattr *new_xattr); int xattr_list_one(char **buffer, ssize_t *remaining_size, const char *name); void simple_xattr_cache_cleanup(struct simple_xattr_cache *cache); -- cgit v1.2.3 From 0da79c259ad0554b36761a7135d4f92eb7c46263 Mon Sep 17 00:00:00 2001 From: Jori Koolstra Date: Fri, 5 Jun 2026 00:24:05 +0200 Subject: vfs: uapi: retire octal and hex numbers in favor of (1 << n) for O_ flags A recent build failure[1] exposed the diffculty of working with the current octal and hex definitions of O_ flags when trying to find a gap for a new flag. This difficulty is compounded by the fact that O_ flags may have architectural specific values. Replace the hex/octal #defines, which are hard to parse when looking for free bits, with explicit bit shifts like (1 << 11). Also, add comments that identify which architectures redefine some of the seemingly free ("cursed") bits in uapi/asm-generic/fcntl.h. These should not be used to define new O_ flags (for now, at least). The translastion was done with Claude Opus 4.8, and verified with a (non-AI) gawk script. The accounting of which architectures claim which bit-gaps in uapi/asm-generic/fcntl.h is also done by hand. [1]: https://lore.kernel.org/all/agruPPybCx8q2XcJ@sirena.org.uk/ Assisted-by: Claude:Opus 4.8 Signed-off-by: Jori Koolstra Link: https://patch.msgid.link/20260604222405.5382-1-jkoolstra@xs4all.nl Signed-off-by: Christian Brauner (Amutable) --- include/uapi/asm-generic/fcntl.h | 50 +++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 21 deletions(-) (limited to 'include') diff --git a/include/uapi/asm-generic/fcntl.h b/include/uapi/asm-generic/fcntl.h index 613475285643..359622b083d5 100644 --- a/include/uapi/asm-generic/fcntl.h +++ b/include/uapi/asm-generic/fcntl.h @@ -15,51 +15,55 @@ * When introducing new O_* bits, please check its uniqueness in fcntl_init(). */ -#define O_ACCMODE 00000003 -#define O_RDONLY 00000000 -#define O_WRONLY 00000001 -#define O_RDWR 00000002 +#define O_ACCMODE 3 +#define O_RDONLY 0 +#define O_WRONLY (1 << 0) +#define O_RDWR (1 << 1) +/* (1 << 2) must not be used -- it collides with flags on alpha, sparc */ +/* (1 << 3) must not be used -- it collides with flags on alpha, mips, parisc, sparc */ +/* (1 << 4) must not be used -- it collides with flags on mips */ +/* (1 << 5) is free */ #ifndef O_CREAT -#define O_CREAT 00000100 /* not fcntl */ +#define O_CREAT (1 << 6) /* not fcntl */ #endif #ifndef O_EXCL -#define O_EXCL 00000200 /* not fcntl */ +#define O_EXCL (1 << 7) /* not fcntl */ #endif #ifndef O_NOCTTY -#define O_NOCTTY 00000400 /* not fcntl */ +#define O_NOCTTY (1 << 8) /* not fcntl */ #endif #ifndef O_TRUNC -#define O_TRUNC 00001000 /* not fcntl */ +#define O_TRUNC (1 << 9) /* not fcntl */ #endif #ifndef O_APPEND -#define O_APPEND 00002000 +#define O_APPEND (1 << 10) #endif #ifndef O_NONBLOCK -#define O_NONBLOCK 00004000 +#define O_NONBLOCK (1 << 11) #endif #ifndef O_DSYNC -#define O_DSYNC 00010000 /* used to be O_SYNC, see below */ +#define O_DSYNC (1 << 12) /* used to be O_SYNC, see below */ #endif #ifndef FASYNC -#define FASYNC 00020000 /* fcntl, for BSD compatibility */ +#define FASYNC (1 << 13) /* fcntl, for BSD compatibility */ #endif #ifndef O_DIRECT -#define O_DIRECT 00040000 /* direct disk access hint */ +#define O_DIRECT (1 << 14) /* direct disk access hint */ #endif #ifndef O_LARGEFILE -#define O_LARGEFILE 00100000 +#define O_LARGEFILE (1 << 15) #endif #ifndef O_DIRECTORY -#define O_DIRECTORY 00200000 /* must be a directory */ +#define O_DIRECTORY (1 << 16) /* must be a directory */ #endif #ifndef O_NOFOLLOW -#define O_NOFOLLOW 00400000 /* don't follow links */ +#define O_NOFOLLOW (1 << 17) /* don't follow links */ #endif #ifndef O_NOATIME -#define O_NOATIME 01000000 +#define O_NOATIME (1 << 18) #endif #ifndef O_CLOEXEC -#define O_CLOEXEC 02000000 /* set close_on_exec */ +#define O_CLOEXEC (1 << 19) /* set close_on_exec */ #endif /* @@ -76,16 +80,16 @@ * Note: __O_SYNC must never be used directly. */ #ifndef O_SYNC -#define __O_SYNC 04000000 +#define __O_SYNC (1 << 20) #define O_SYNC (__O_SYNC|O_DSYNC) #endif #ifndef O_PATH -#define O_PATH 010000000 +#define O_PATH (1 << 21) #endif #ifndef __O_TMPFILE -#define __O_TMPFILE 020000000 +#define __O_TMPFILE (1 << 22) #endif /* a horrid kludge trying to make sure that this will fail on old kernels */ @@ -95,6 +99,10 @@ #define O_NDELAY O_NONBLOCK #endif +/* (1 << 23) must not be used -- it collides with flags on alpha, parisc, sparc */ +/* (1 << 24) must not be used -- it collides with flags on alpha, sparc */ +/* (1 << 25) must not be used -- it collides with flags on sparc */ + #define F_DUPFD 0 /* dup */ #define F_GETFD 1 /* get close_on_exec */ #define F_SETFD 2 /* set/clear close_on_exec */ -- cgit v1.2.3 From 979c294509f9248fe1e7c358d582fb37dd5ca12d Mon Sep 17 00:00:00 2001 From: Nathan Chancellor Date: Thu, 4 Jun 2026 17:33:21 -0700 Subject: cfi: Include uaccess.h for get_kernel_nofault() After commit 0652a3daa787 ("tracing: Fix CFI violation in probestub being called by tprobes"), there are many build errors when building ARCH=arm multi_v7_defconfig + CONFIG_CFI=y like: In file included from drivers/base/devres.c:17: In file included from drivers/base/trace.h:16: In file included from include/linux/tracepoint.h:23: include/linux/cfi.h:44:6: error: call to undeclared function 'get_kernel_nofault'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 44 | if (get_kernel_nofault(hash, func - cfi_get_offset())) | ^ 1 error generated. get_kernel_nofault() is called in the generic version of cfi_get_func_hash() but nothing ensures uaccess.h is always included for a proper expansion and prototype. Include uaccess.h in cfi.h to clear up the errors. Cc: stable@vger.kernel.org Fixes: 0652a3daa787 ("tracing: Fix CFI violation in probestub being called by tprobes") Signed-off-by: Nathan Chancellor Acked-by: Masami Hiramatsu (Google) Reviewed-by: Sami Tolvanen Signed-off-by: Linus Torvalds --- include/linux/cfi.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/cfi.h b/include/linux/cfi.h index 1fd22ea6eba4..0f220d29225c 100644 --- a/include/linux/cfi.h +++ b/include/linux/cfi.h @@ -9,6 +9,7 @@ #include #include +#include #include #ifdef CONFIG_CFI -- cgit v1.2.3 From 9ae38c69196e7edd367fe55a3db676a33cc735dc Mon Sep 17 00:00:00 2001 From: Jagadeesh Kona Date: Thu, 7 May 2026 11:08:26 +0530 Subject: dt-bindings: clock: qcom: Add X1P42100 video clock controller Add device tree bindings for the video clock controller on Qualcomm X1P42100 (Purwa) SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jagadeesh Kona Link: https://lore.kernel.org/r/20260507-purwa-videocc-camcc-v5-1-fc3af4130282@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/clock/qcom,x1p42100-videocc.h | 48 +++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 include/dt-bindings/clock/qcom,x1p42100-videocc.h (limited to 'include') diff --git a/include/dt-bindings/clock/qcom,x1p42100-videocc.h b/include/dt-bindings/clock/qcom,x1p42100-videocc.h new file mode 100644 index 000000000000..996408d1a0c3 --- /dev/null +++ b/include/dt-bindings/clock/qcom,x1p42100-videocc.h @@ -0,0 +1,48 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#ifndef _DT_BINDINGS_CLK_QCOM_VIDEO_CC_X1P42100_H +#define _DT_BINDINGS_CLK_QCOM_VIDEO_CC_X1P42100_H + +/* VIDEO_CC clocks */ +#define VIDEO_CC_MVS0_CLK 0 +#define VIDEO_CC_MVS0_CLK_SRC 1 +#define VIDEO_CC_MVS0_DIV_CLK_SRC 2 +#define VIDEO_CC_MVS0C_CLK 3 +#define VIDEO_CC_MVS0C_DIV2_DIV_CLK_SRC 4 +#define VIDEO_CC_MVS1_CLK 5 +#define VIDEO_CC_MVS1_CLK_SRC 6 +#define VIDEO_CC_MVS1_DIV_CLK_SRC 7 +#define VIDEO_CC_MVS1C_CLK 8 +#define VIDEO_CC_MVS1C_DIV2_DIV_CLK_SRC 9 +#define VIDEO_CC_PLL0 10 +#define VIDEO_CC_PLL1 11 +#define VIDEO_CC_MVS0_SHIFT_CLK 12 +#define VIDEO_CC_MVS0C_SHIFT_CLK 13 +#define VIDEO_CC_MVS1_SHIFT_CLK 14 +#define VIDEO_CC_MVS1C_SHIFT_CLK 15 +#define VIDEO_CC_XO_CLK_SRC 16 +#define VIDEO_CC_MVS0_BSE_CLK 17 +#define VIDEO_CC_MVS0_BSE_CLK_SRC 18 +#define VIDEO_CC_MVS0_BSE_DIV4_DIV_CLK_SRC 19 + +/* VIDEO_CC power domains */ +#define VIDEO_CC_MVS0C_GDSC 0 +#define VIDEO_CC_MVS0_GDSC 1 +#define VIDEO_CC_MVS1C_GDSC 2 +#define VIDEO_CC_MVS1_GDSC 3 + +/* VIDEO_CC resets */ +#define CVP_VIDEO_CC_INTERFACE_BCR 0 +#define CVP_VIDEO_CC_MVS0_BCR 1 +#define CVP_VIDEO_CC_MVS0C_BCR 2 +#define CVP_VIDEO_CC_MVS1_BCR 3 +#define CVP_VIDEO_CC_MVS1C_BCR 4 +#define VIDEO_CC_MVS0C_CLK_ARES 5 +#define VIDEO_CC_MVS1C_CLK_ARES 6 +#define VIDEO_CC_XO_CLK_ARES 7 +#define VIDEO_CC_MVS0_BSE_BCR 8 + +#endif -- cgit v1.2.3 From 97a5e120be5d3d7cf7d221b8703921046b73f0d2 Mon Sep 17 00:00:00 2001 From: Jagadeesh Kona Date: Thu, 7 May 2026 11:08:27 +0530 Subject: dt-bindings: clock: qcom: Add X1P42100 camera clock controller Add X1P42100 camera clock controller support and clock bindings for camera QDSS debug clocks which are applicable for both X1E80100 and X1P42100 platforms. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jagadeesh Kona Link: https://lore.kernel.org/r/20260507-purwa-videocc-camcc-v5-2-fc3af4130282@oss.qualcomm.com Signed-off-by: Bjorn Andersson --- include/dt-bindings/clock/qcom,x1e80100-camcc.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/dt-bindings/clock/qcom,x1e80100-camcc.h b/include/dt-bindings/clock/qcom,x1e80100-camcc.h index d72fdfb06a7c..06c316022fb0 100644 --- a/include/dt-bindings/clock/qcom,x1e80100-camcc.h +++ b/include/dt-bindings/clock/qcom,x1e80100-camcc.h @@ -115,6 +115,9 @@ #define CAM_CC_SLEEP_CLK_SRC 105 #define CAM_CC_SLOW_AHB_CLK_SRC 106 #define CAM_CC_XO_CLK_SRC 107 +#define CAM_CC_QDSS_DEBUG_CLK 108 +#define CAM_CC_QDSS_DEBUG_CLK_SRC 109 +#define CAM_CC_QDSS_DEBUG_XO_CLK 110 /* CAM_CC power domains */ #define CAM_CC_BPS_GDSC 0 -- cgit v1.2.3 From 771ed1b12942dbf592c34554c81f25a627fd254e Mon Sep 17 00:00:00 2001 From: Luca Weiss Date: Fri, 1 May 2026 11:18:29 +0200 Subject: interconnect: Add devm_of_icc_get_by_index() as exported API for users Users can use devm version of of_icc_get_by_index() to benefit from automatic resource release. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Acked-by: Georgi Djakov Link: https://lore.kernel.org/r/20260501-milos-camcc-icc-v2-1-bb83c1256cc3@fairphone.com Signed-off-by: Bjorn Andersson --- include/linux/interconnect.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/interconnect.h b/include/linux/interconnect.h index 4b12821528a6..75a32ad0482e 100644 --- a/include/linux/interconnect.h +++ b/include/linux/interconnect.h @@ -47,6 +47,7 @@ struct icc_path *of_icc_get(struct device *dev, const char *name); struct icc_path *devm_of_icc_get(struct device *dev, const char *name); int devm_of_icc_bulk_get(struct device *dev, int num_paths, struct icc_bulk_data *paths); struct icc_path *of_icc_get_by_index(struct device *dev, int idx); +struct icc_path *devm_of_icc_get_by_index(struct device *dev, int idx); void icc_put(struct icc_path *path); int icc_enable(struct icc_path *path); int icc_disable(struct icc_path *path); @@ -79,6 +80,11 @@ static inline struct icc_path *of_icc_get_by_index(struct device *dev, int idx) return NULL; } +static inline struct icc_path *devm_of_icc_get_by_index(struct device *dev, int idx) +{ + return NULL; +} + static inline void icc_put(struct icc_path *path) { } -- cgit v1.2.3 From 4bbcff264b678859cc404669bd145bcd6819804b Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Sun, 7 Jun 2026 11:40:28 +0200 Subject: filelock: fix break_lease() stub signature for CONFIG_FILE_LOCKING=n The CONFIG_FILE_LOCKING=n stub for break_lease() takes a 'bool wait' argument, whereas the CONFIG_FILE_LOCKING=y version and every caller pass an openmode as an 'unsigned int mode'. The mismatch was introduced when __break_lease() was reworked to use flags: only the stub was switched to 'bool wait', a stray leftover from the neighbouring break_layout() helper. The real prototype kept 'unsigned int mode'. This was harmless until O_WRONLY changed from the octal literal 00000001 to (1 << 0). clang's -Wtautological-constant-compare then fires on the implicit shift-to-bool conversion at the first FILE_LOCKING=n caller: fs/open.c:112:29: warning: converting the result of '<<' to a boolean always evaluates to true [-Wtautological-constant-compare] 112 | error = break_lease(inode, O_WRONLY); Restore the stub's parameter to 'unsigned int mode' so it matches the real prototype and every caller. The stub still just returns 0, so there is no functional change; it removes the type inconsistency and silences the warning. Root cause diagnosed by Nathan Chancellor. Fixes: 4be9f3cc582a ("filelock: rework the __break_lease API to use flags") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202606071029.DKCs8WOs-lkp@intel.com/ Signed-off-by: Christian Brauner (Amutable) --- include/linux/filelock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/filelock.h b/include/linux/filelock.h index 5f0a2fb31450..77e1cc4afbaa 100644 --- a/include/linux/filelock.h +++ b/include/linux/filelock.h @@ -564,7 +564,7 @@ static inline bool is_delegated(struct delegated_inode *di) return false; } -static inline int break_lease(struct inode *inode, bool wait) +static inline int break_lease(struct inode *inode, unsigned int mode) { return 0; } -- cgit v1.2.3 From cc71b7f32f0ba8bd95f57e519303ce79f01fd467 Mon Sep 17 00:00:00 2001 From: Dragos Tatulea Date: Fri, 29 May 2026 08:23:58 +0300 Subject: net/mlx5: Update IFC allowed_list_size field bits The vport context allowed_list_size was increased from 12 to 16 bits. Writing to this field is protected by the log_max_current_uc/mc_list capabilities. On older FW versions these capabilities are limited to < 2K and only the high bits of the field are extended. This means that the change is backward compatible with older FW versions. Signed-off-by: Dragos Tatulea Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260529052359.389413-2-tariqt@nvidia.com Signed-off-by: Leon Romanovsky --- include/linux/mlx5/mlx5_ifc.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h index 6a675f918c40..d23332cdd9b3 100644 --- a/include/linux/mlx5/mlx5_ifc.h +++ b/include/linux/mlx5/mlx5_ifc.h @@ -4487,8 +4487,8 @@ struct mlx5_ifc_nic_vport_context_bits { u8 promisc_all[0x1]; u8 reserved_at_783[0x2]; u8 allowed_list_type[0x3]; - u8 reserved_at_788[0xc]; - u8 allowed_list_size[0xc]; + u8 reserved_at_788[0x8]; + u8 allowed_list_size[0x10]; struct mlx5_ifc_mac_address_layout_bits permanent_address; -- cgit v1.2.3 From ddbddbf8aee54bee038149187270c93a45478473 Mon Sep 17 00:00:00 2001 From: Shay Drory Date: Fri, 29 May 2026 08:23:59 +0300 Subject: net/mlx5: Add sd_group_size bits for SD management Currently, mlx5 is querying the MPIR register to get the number of PFs that should comprise the SD group. However, this register does not reflect the correct number in complex deployments. Hence, add an sd_group_size field to nic_vport_context to determine the correct number of PFs, and add an sd_group_size capability bit to indicate whether FW supports it. Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260529052359.389413-3-tariqt@nvidia.com Signed-off-by: Leon Romanovsky --- include/linux/mlx5/mlx5_ifc.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h index d23332cdd9b3..4f59b7e8a3d5 100644 --- a/include/linux/mlx5/mlx5_ifc.h +++ b/include/linux/mlx5/mlx5_ifc.h @@ -1986,7 +1986,8 @@ struct mlx5_ifc_cmd_hca_cap_bits { u8 basic_cyclic_rcv_wqe[0x1]; u8 reserved_at_381[0x2]; u8 log_max_rmp[0x5]; - u8 reserved_at_388[0x3]; + u8 sd_group_size[0x1]; + u8 reserved_at_389[0x2]; u8 log_max_rqt[0x5]; u8 reserved_at_390[0x3]; u8 log_max_rqt_size[0x5]; @@ -4469,7 +4470,9 @@ struct mlx5_ifc_nic_vport_context_bits { u8 reserved_at_100[0x1]; u8 sd_group[0x3]; - u8 reserved_at_104[0x1c]; + u8 reserved_at_104[0x4]; + u8 sd_group_size[0x8]; + u8 reserved_at_110[0x10]; u8 reserved_at_120[0x10]; u8 mtu[0x10]; -- cgit v1.2.3 From e57f13eaab259ece7c9e8d81ba2c40c4f057ca2c Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:26 +0200 Subject: ftrace: Add ftrace_hash_count function Adding external ftrace_hash_count function so we could get hash count outside of ftrace object. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/ftrace.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h index 28b30c6f1031..02c24bf766ce 100644 --- a/include/linux/ftrace.h +++ b/include/linux/ftrace.h @@ -551,6 +551,8 @@ int update_ftrace_direct_mod(struct ftrace_ops *ops, struct ftrace_hash *hash, b void ftrace_stub_direct_tramp(void); +unsigned long ftrace_hash_count(struct ftrace_hash *hash); + #else struct ftrace_ops; static inline unsigned long ftrace_find_rec_direct(unsigned long ip) @@ -590,6 +592,11 @@ static inline int update_ftrace_direct_mod(struct ftrace_ops *ops, struct ftrace return -ENODEV; } +static inline unsigned long ftrace_hash_count(struct ftrace_hash *hash) +{ + return 0; +} + /* * This must be implemented by the architecture. * It is the way the ftrace direct_ops helper, when called -- cgit v1.2.3 From af7c32365090a1a8ff981f85d7c24b344a2eaa75 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:27 +0200 Subject: ftrace: Add ftrace_hash_remove function Adding ftrace_hash_remove function that removes all entries from struct ftrace_hash object without freeing them. It will be used in following changes where entries are allocated as part of another structure and are free-ed separately. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/ftrace.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h index 02c24bf766ce..b55ec9b25bb3 100644 --- a/include/linux/ftrace.h +++ b/include/linux/ftrace.h @@ -415,6 +415,7 @@ struct ftrace_hash *alloc_ftrace_hash(int size_bits); void free_ftrace_hash(struct ftrace_hash *hash); struct ftrace_func_entry *add_ftrace_hash_entry_direct(struct ftrace_hash *hash, unsigned long ip, unsigned long direct); +void ftrace_hash_remove(struct ftrace_hash *hash); /* The hash used to know what functions callbacks trace */ struct ftrace_ops_hash { -- cgit v1.2.3 From 2cd298c106e00ba1d8799b022594f131703f32fa Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:28 +0200 Subject: ftrace: Add add_ftrace_hash_entry function Renaming __add_hash_entry to add_ftrace_hash_entry and making it global, it will be used in following changes outside ftrace.c object. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-4-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/ftrace.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h index b55ec9b25bb3..02bc5027523a 100644 --- a/include/linux/ftrace.h +++ b/include/linux/ftrace.h @@ -415,6 +415,7 @@ struct ftrace_hash *alloc_ftrace_hash(int size_bits); void free_ftrace_hash(struct ftrace_hash *hash); struct ftrace_func_entry *add_ftrace_hash_entry_direct(struct ftrace_hash *hash, unsigned long ip, unsigned long direct); +void add_ftrace_hash_entry(struct ftrace_hash *hash, struct ftrace_func_entry *entry); void ftrace_hash_remove(struct ftrace_hash *hash); /* The hash used to know what functions callbacks trace */ -- cgit v1.2.3 From e6abd4cd157bf63cd89c74f8f10abae76e7b0359 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:29 +0200 Subject: bpf: Use mutex lock pool for bpf trampolines Adding mutex lock pool that replaces bpf trampolines mutex. For tracing_multi link coming in following changes we need to lock all the involved trampolines during the attachment. This could mean thousands of mutex locks, which is not convenient. As suggested by Andrii we can replace bpf trampolines mutex with mutex pool, where each trampoline is hash-ed to one of the locks from the pool. It's better to lock all the pool mutexes (32 at the moment) than thousands of them. There is 48 (MAX_LOCK_DEPTH) lock limit allowed to be simultaneously held by task, so we need to keep 32 mutexes (5 bits) in the pool, so when we lock them all in following changes the lockdep won't scream. Removing the mutex_is_locked in bpf_trampoline_put, because we removed the mutex from bpf_trampoline. Suggested-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-5-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index f615b56730d2..f6056bab6f23 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1353,8 +1353,6 @@ struct bpf_trampoline { /* hlist for trampoline_ip_table */ struct hlist_node hlist_ip; struct ftrace_ops *fops; - /* serializes access to fields of this trampoline */ - struct mutex mutex; refcount_t refcnt; u32 flags; u64 key; -- cgit v1.2.3 From 65499074efaf574fef6365ac63b785a3ec98913d Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:33 +0200 Subject: bpf: Add struct bpf_tramp_node object Adding struct bpf_tramp_node to decouple the link out of the trampoline attachment info. At the moment the object for attaching bpf program to the trampoline is 'struct bpf_tramp_link': struct bpf_tramp_link { struct bpf_link link; struct hlist_node tramp_hlist; u64 cookie; } The link holds the bpf_prog pointer and forces one link - one program binding logic. In following changes we want to attach program to multiple trampolines but we want to keep just one bpf_link object. Splitting struct bpf_tramp_link into: struct bpf_tramp_link { struct bpf_link link; struct bpf_tramp_node node; }; struct bpf_tramp_node { struct bpf_link *link; struct hlist_node tramp_hlist; u64 cookie; }; The 'struct bpf_tramp_link' defines standard single trampoline link and 'struct bpf_tramp_node' is the attachment trampoline object with pointer to the bpf_link object. This will allow us to define link for multiple trampolines, like: struct bpf_tracing_multi_link { struct bpf_link link; ... int nodes_cnt; struct bpf_tracing_multi_node nodes[] __counted_by(nodes_cnt); }; Cc: Hengqi Chen Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-9-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 60 +++++++++++++++++++++++++++++++++-------------------- 1 file changed, 37 insertions(+), 23 deletions(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index f6056bab6f23..6ff35491d9c0 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1251,9 +1251,9 @@ enum { #define BPF_TRAMP_COOKIE_INDEX_SHIFT 8 #define BPF_TRAMP_IS_RETURN_SHIFT 63 -struct bpf_tramp_links { - struct bpf_tramp_link *links[BPF_MAX_TRAMP_LINKS]; - int nr_links; +struct bpf_tramp_nodes { + struct bpf_tramp_node *nodes[BPF_MAX_TRAMP_LINKS]; + int nr_nodes; }; struct bpf_tramp_run_ctx; @@ -1281,13 +1281,13 @@ struct bpf_tramp_run_ctx; struct bpf_tramp_image; int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *image_end, const struct btf_func_model *m, u32 flags, - struct bpf_tramp_links *tlinks, + struct bpf_tramp_nodes *tnodes, void *func_addr); void *arch_alloc_bpf_trampoline(unsigned int size); void arch_free_bpf_trampoline(void *image, unsigned int size); int __must_check arch_protect_bpf_trampoline(void *image, unsigned int size); int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags, - struct bpf_tramp_links *tlinks, void *func_addr); + struct bpf_tramp_nodes *tnodes, void *func_addr); u64 notrace __bpf_prog_enter_sleepable_recur(struct bpf_prog *prog, struct bpf_tramp_run_ctx *run_ctx); @@ -1471,10 +1471,10 @@ static inline int bpf_dynptr_check_off_len(const struct bpf_dynptr_kern *ptr, u6 } #ifdef CONFIG_BPF_JIT -int bpf_trampoline_link_prog(struct bpf_tramp_link *link, +int bpf_trampoline_link_prog(struct bpf_tramp_node *node, struct bpf_trampoline *tr, struct bpf_prog *tgt_prog); -int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, +int bpf_trampoline_unlink_prog(struct bpf_tramp_node *node, struct bpf_trampoline *tr, struct bpf_prog *tgt_prog); struct bpf_trampoline *bpf_trampoline_get(u64 key, @@ -1561,13 +1561,13 @@ bool bpf_insn_is_indirect_target(const struct bpf_verifier_env *env, const struc int insn_idx); u16 bpf_out_stack_arg_cnt(const struct bpf_verifier_env *env, const struct bpf_prog *prog); #else -static inline int bpf_trampoline_link_prog(struct bpf_tramp_link *link, +static inline int bpf_trampoline_link_prog(struct bpf_tramp_node *node, struct bpf_trampoline *tr, struct bpf_prog *tgt_prog) { return -ENOTSUPP; } -static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, +static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_node *node, struct bpf_trampoline *tr, struct bpf_prog *tgt_prog) { @@ -1909,12 +1909,17 @@ struct bpf_link_ops { __poll_t (*poll)(struct file *file, struct poll_table_struct *pts); }; -struct bpf_tramp_link { - struct bpf_link link; +struct bpf_tramp_node { + struct bpf_link *link; struct hlist_node tramp_hlist; u64 cookie; }; +struct bpf_tramp_link { + struct bpf_link link; + struct bpf_tramp_node node; +}; + struct bpf_shim_tramp_link { struct bpf_tramp_link link; struct bpf_trampoline *trampoline; @@ -2132,8 +2137,8 @@ void bpf_struct_ops_put(const void *kdata); int bpf_struct_ops_supported(const struct bpf_struct_ops *st_ops, u32 moff); int bpf_struct_ops_map_sys_lookup_elem(struct bpf_map *map, void *key, void *value); -int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_links *tlinks, - struct bpf_tramp_link *link, +int bpf_struct_ops_prepare_trampoline(struct bpf_tramp_nodes *tnodes, + struct bpf_tramp_node *node, const struct btf_func_model *model, void *stub_func, void **image, u32 *image_off, @@ -2228,31 +2233,31 @@ static inline void bpf_struct_ops_desc_release(struct bpf_struct_ops_desc *st_op #endif -static inline int bpf_fsession_cnt(struct bpf_tramp_links *links) +static inline int bpf_fsession_cnt(struct bpf_tramp_nodes *nodes) { - struct bpf_tramp_links fentries = links[BPF_TRAMP_FENTRY]; + struct bpf_tramp_nodes fentries = nodes[BPF_TRAMP_FENTRY]; int cnt = 0; - for (int i = 0; i < links[BPF_TRAMP_FENTRY].nr_links; i++) { - if (fentries.links[i]->link.prog->expected_attach_type == BPF_TRACE_FSESSION) + for (int i = 0; i < nodes[BPF_TRAMP_FENTRY].nr_nodes; i++) { + if (fentries.nodes[i]->link->prog->expected_attach_type == BPF_TRACE_FSESSION) cnt++; } return cnt; } -static inline bool bpf_prog_calls_session_cookie(struct bpf_tramp_link *link) +static inline bool bpf_prog_calls_session_cookie(struct bpf_tramp_node *node) { - return link->link.prog->call_session_cookie; + return node->link->prog->call_session_cookie; } -static inline int bpf_fsession_cookie_cnt(struct bpf_tramp_links *links) +static inline int bpf_fsession_cookie_cnt(struct bpf_tramp_nodes *nodes) { - struct bpf_tramp_links fentries = links[BPF_TRAMP_FENTRY]; + struct bpf_tramp_nodes fentries = nodes[BPF_TRAMP_FENTRY]; int cnt = 0; - for (int i = 0; i < links[BPF_TRAMP_FENTRY].nr_links; i++) { - if (bpf_prog_calls_session_cookie(fentries.links[i])) + for (int i = 0; i < nodes[BPF_TRAMP_FENTRY].nr_nodes; i++) { + if (bpf_prog_calls_session_cookie(fentries.nodes[i])) cnt++; } @@ -2800,6 +2805,9 @@ void bpf_link_init(struct bpf_link *link, enum bpf_link_type type, void bpf_link_init_sleepable(struct bpf_link *link, enum bpf_link_type type, const struct bpf_link_ops *ops, struct bpf_prog *prog, enum bpf_attach_type attach_type, bool sleepable); +void bpf_tramp_link_init(struct bpf_tramp_link *link, enum bpf_link_type type, + const struct bpf_link_ops *ops, struct bpf_prog *prog, + enum bpf_attach_type attach_type, u64 cookie); int bpf_link_prime(struct bpf_link *link, struct bpf_link_primer *primer); int bpf_link_settle(struct bpf_link_primer *primer); void bpf_link_cleanup(struct bpf_link_primer *primer); @@ -3223,6 +3231,12 @@ static inline void bpf_link_init_sleepable(struct bpf_link *link, enum bpf_link_ { } +static inline void bpf_tramp_link_init(struct bpf_tramp_link *link, enum bpf_link_type type, + const struct bpf_link_ops *ops, struct bpf_prog *prog, + enum bpf_attach_type attach_type, u64 cookie) +{ +} + static inline int bpf_link_prime(struct bpf_link *link, struct bpf_link_primer *primer) { -- cgit v1.2.3 From 880db5d4abb29e931d82b9feefb4382f76fcf9e5 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:34 +0200 Subject: bpf: Factor fsession link to use struct bpf_tramp_node Now that we split trampoline attachment object (bpf_tramp_node) from the link object (bpf_tramp_link) we can use bpf_tramp_node as fsession's fexit attachment object and get rid of the bpf_fsession_link object. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-10-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 6ff35491d9c0..428789a9e736 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1927,15 +1927,11 @@ struct bpf_shim_tramp_link { struct bpf_tracing_link { struct bpf_tramp_link link; + struct bpf_tramp_node fexit; struct bpf_trampoline *trampoline; struct bpf_prog *tgt_prog; }; -struct bpf_fsession_link { - struct bpf_tracing_link link; - struct bpf_tramp_link fexit; -}; - struct bpf_raw_tp_link { struct bpf_link link; struct bpf_raw_event_map *btp; -- cgit v1.2.3 From d14e6b4346bf397eca7cb5f4b7b0b8054be632d8 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:35 +0200 Subject: bpf: Add multi tracing attach types Adding new program attach types multi tracing attachment: BPF_TRACE_FENTRY_MULTI BPF_TRACE_FEXIT_MULTI and their base support in verifier code. Programs with such attach type will use specific link attachment interface coming in following changes. This was suggested by Andrii some (long) time ago and turned out to be easier than having special program flag for that. Bpf programs with such types have 'bpf_multi_func' function set as their attach_btf_id and keep module reference when it's specified by attach_prog_fd. They are also accepted as sleepable programs during verification, and the real validation for specific BTF_IDs/functions will happen during the multi link attachment in following changes. Suggested-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-11-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 5 +++++ include/linux/btf_ids.h | 1 + include/uapi/linux/bpf.h | 2 ++ 3 files changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 428789a9e736..b52dc64ec92d 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2113,6 +2113,11 @@ static inline void bpf_prog_put_recursion_context(struct bpf_prog *prog) #endif } +static inline bool is_tracing_multi(enum bpf_attach_type type) +{ + return type == BPF_TRACE_FENTRY_MULTI || type == BPF_TRACE_FEXIT_MULTI; +} + #if defined(CONFIG_BPF_JIT) && defined(CONFIG_BPF_SYSCALL) /* This macro helps developer to register a struct_ops type and generate * type information correctly. Developers should use this macro to register diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h index af011db39ab3..8b5a9ee92513 100644 --- a/include/linux/btf_ids.h +++ b/include/linux/btf_ids.h @@ -284,5 +284,6 @@ extern u32 bpf_cgroup_btf_id[]; extern u32 bpf_local_storage_map_btf_id[]; extern u32 btf_bpf_map_id[]; extern u32 bpf_kmem_cache_btf_id[]; +extern u32 bpf_multi_func_btf_id[]; #endif diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index d5238df5e5eb..28d127e5040a 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1156,6 +1156,8 @@ enum bpf_attach_type { BPF_TRACE_KPROBE_SESSION, BPF_TRACE_UPROBE_SESSION, BPF_TRACE_FSESSION, + BPF_TRACE_FENTRY_MULTI, + BPF_TRACE_FEXIT_MULTI, __MAX_BPF_ATTACH_TYPE }; -- cgit v1.2.3 From aef4dfa790b22d8052cfb78044eadbe03c876c39 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:37 +0200 Subject: bpf: Add bpf_trampoline_multi_attach/detach functions Adding bpf_trampoline_multi_attach/detach functions that allows to attach/detach tracing program to multiple functions/trampolines. The attachment is defined with bpf_program and array of BTF ids of functions to attach the bpf program to. Adding bpf_tracing_multi_link object that holds all the attached trampolines and is initialized in attach and used in detach. The attachment allocates or uses currently existing trampoline for each function to attach and links it with the bpf program. The attach works as follows: - we get all the needed trampolines - lock them and add the bpf program to each (__bpf_trampoline_link_prog) - the trampoline_multi_ops passed in __bpf_trampoline_link_prog gathers ftrace_hash (ip -> trampoline) objects - we call update_ftrace_direct_add/mod to update needed locations - we unlock all the trampolines The detach works as follows: - we lock all the needed trampolines - remove the program from each (__bpf_trampoline_unlink_prog) - the trampoline_multi_ops passed in __bpf_trampoline_unlink_prog gathers ftrace_hash (ip -> trampoline) objects - we call update_ftrace_direct_del/mod to update needed locations - we unlock and put all the trampolines We store the old image/flags in the trampoline before the update and use it in case we need to rollback the attachment. We keep the ftrace_hash objects allocated during attach in the link so they can be used for detach as well. Adding trampoline_(un)lock_all functions to (un)lock all trampolines to gate the tracing_multi attachment. Note this is supported only for archs (x86_64) with ftrace direct and have single ops support. CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS && CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS It also needs CONFIG_BPF_SYSCALL enabled. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-13-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 43 +++++++++++++++++++++++++++++++++++++++++++ include/linux/bpf_verifier.h | 4 ++++ 2 files changed, 47 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index b52dc64ec92d..bcf70f810d2c 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -33,6 +33,7 @@ #include #include #include +#include #include struct bpf_verifier_env; @@ -1373,6 +1374,11 @@ struct bpf_trampoline { int progs_cnt[BPF_TRAMP_MAX]; /* Executable image of trampoline */ struct bpf_tramp_image *cur_image; + /* Used as temporary old image storage for multi_attach */ + struct { + struct bpf_tramp_image *old_image; + u32 old_flags; + } multi_attach; }; struct bpf_attach_target_info { @@ -1470,6 +1476,8 @@ static inline int bpf_dynptr_check_off_len(const struct bpf_dynptr_kern *ptr, u6 return 0; } +struct bpf_tracing_multi_link; + #ifdef CONFIG_BPF_JIT int bpf_trampoline_link_prog(struct bpf_tramp_node *node, struct bpf_trampoline *tr, @@ -1482,6 +1490,11 @@ struct bpf_trampoline *bpf_trampoline_get(u64 key, void bpf_trampoline_put(struct bpf_trampoline *tr); int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcs); +int bpf_trampoline_multi_attach(struct bpf_prog *prog, u32 *ids, + struct bpf_tracing_multi_link *link); +int bpf_trampoline_multi_detach(struct bpf_prog *prog, + struct bpf_tracing_multi_link *link); + /* * When the architecture supports STATIC_CALL replace the bpf_dispatcher_fn * indirection with a direct call to the bpf program. If the architecture does @@ -1594,6 +1607,16 @@ static inline bool bpf_prog_has_trampoline(const struct bpf_prog *prog) { return false; } +static inline int bpf_trampoline_multi_attach(struct bpf_prog *prog, u32 *ids, + struct bpf_tracing_multi_link *link) +{ + return -ENOTSUPP; +} +static inline int bpf_trampoline_multi_detach(struct bpf_prog *prog, + struct bpf_tracing_multi_link *link) +{ + return -ENOTSUPP; +} #endif struct bpf_func_info_aux { @@ -1932,6 +1955,26 @@ struct bpf_tracing_link { struct bpf_prog *tgt_prog; }; +struct bpf_tracing_multi_node { + struct bpf_tramp_node node; + struct bpf_trampoline *trampoline; + struct ftrace_func_entry entry; +}; + +struct bpf_tracing_multi_data { + struct ftrace_hash *unreg; + struct ftrace_hash *modify; + struct ftrace_hash *reg; + struct ftrace_func_entry *entry; +}; + +struct bpf_tracing_multi_link { + struct bpf_link link; + struct bpf_tracing_multi_data data; + int nodes_cnt; + struct bpf_tracing_multi_node nodes[] __counted_by(nodes_cnt); +}; + struct bpf_raw_tp_link { struct bpf_link link; struct bpf_raw_event_map *btp; diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index c248ff41f42a..d57b339a8cb8 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -1591,6 +1591,10 @@ int bpf_add_kfunc_call(struct bpf_verifier_env *env, u32 func_id, u16 offset); int bpf_fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, struct bpf_insn *insn_buf, int insn_idx, int *cnt); +/* Functions exported from verifier.c, used by trampoline.c */ +int bpf_check_attach_btf_id_multi(struct btf *btf, struct bpf_prog *prog, u32 btf_id, + struct bpf_attach_target_info *tgt_info); + /* Functions in fixups.c, called from bpf_check() */ int bpf_remove_fastcall_spills_fills(struct bpf_verifier_env *env); int bpf_optimize_bpf_loop(struct bpf_verifier_env *env); -- cgit v1.2.3 From c1d32dea5d4694c1a6c14d1d1c3192d0e18ffc7b Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:38 +0200 Subject: bpf: Add support for tracing multi link Adding new link to allow to attach program to multiple function BTF IDs. The link is represented by struct bpf_tracing_multi_link. To configure the link, new fields are added to bpf_attr::link_create to pass array of BTF IDs; struct { __aligned_u64 ids; __u32 cnt; } tracing_multi; Each BTF ID represents function (BTF_KIND_FUNC) that the link will attach bpf program to. We use previously added bpf_trampoline_multi_attach/detach functions to attach/detach the link. The linkinfo/fdinfo callbacks will be implemented in following changes. Note this is supported only for archs (x86_64) with ftrace direct and have single ops support. CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS && CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS Note using sort_r (instead of plain sort) in check_dup_ids, because we will use the swap callback in following changes. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-14-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf_types.h | 1 + include/linux/trace_events.h | 6 ++++++ include/uapi/linux/bpf.h | 5 +++++ 3 files changed, 12 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index 56e4c3f983d3..e5906829aa6f 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -156,3 +156,4 @@ BPF_LINK_TYPE(BPF_LINK_TYPE_PERF_EVENT, perf) BPF_LINK_TYPE(BPF_LINK_TYPE_KPROBE_MULTI, kprobe_multi) BPF_LINK_TYPE(BPF_LINK_TYPE_STRUCT_OPS, struct_ops) BPF_LINK_TYPE(BPF_LINK_TYPE_UPROBE_MULTI, uprobe_multi) +BPF_LINK_TYPE(BPF_LINK_TYPE_TRACING_MULTI, tracing_multi) diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h index d49338c44014..308c76b57d13 100644 --- a/include/linux/trace_events.h +++ b/include/linux/trace_events.h @@ -787,6 +787,7 @@ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id, unsigned long *missed); int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prog); int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prog); +int bpf_tracing_multi_attach(struct bpf_prog *prog, const union bpf_attr *attr); #else static inline unsigned int trace_call_bpf(struct trace_event_call *call, void *ctx) { @@ -844,6 +845,11 @@ bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prog) { return -EOPNOTSUPP; } +static inline int +bpf_tracing_multi_attach(struct bpf_prog *prog, const union bpf_attr *attr) +{ + return -EOPNOTSUPP; +} #endif enum { diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 28d127e5040a..9f603731d267 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1182,6 +1182,7 @@ enum bpf_link_type { BPF_LINK_TYPE_UPROBE_MULTI = 12, BPF_LINK_TYPE_NETKIT = 13, BPF_LINK_TYPE_SOCKMAP = 14, + BPF_LINK_TYPE_TRACING_MULTI = 15, __MAX_BPF_LINK_TYPE, }; @@ -1877,6 +1878,10 @@ union bpf_attr { }; __u64 expected_revision; } cgroup; + struct { + __aligned_u64 ids; + __u32 cnt; + } tracing_multi; }; } link_create; -- cgit v1.2.3 From 46b42af27d40021a97c147d23de8cb29eb5020df Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:39 +0200 Subject: bpf: Add support for tracing_multi link cookies Add support to specify cookies for tracing_multi link. Cookies are provided in array where each value is paired with provided BTF ID value with the same array index. Such cookie can be retrieved by bpf program with bpf_get_attach_cookie helper call. We need to sort cookies array together with ids array in check_dup_ids, to keep the id->cookie relation. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-15-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 1 + include/uapi/linux/bpf.h | 1 + 2 files changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index bcf70f810d2c..e9d2b42a3981 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1971,6 +1971,7 @@ struct bpf_tracing_multi_data { struct bpf_tracing_multi_link { struct bpf_link link; struct bpf_tracing_multi_data data; + u64 *cookies; int nodes_cnt; struct bpf_tracing_multi_node nodes[] __counted_by(nodes_cnt); }; diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 9f603731d267..569c15e1cae3 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1880,6 +1880,7 @@ union bpf_attr { } cgroup; struct { __aligned_u64 ids; + __aligned_u64 cookies; __u32 cnt; } tracing_multi; }; -- cgit v1.2.3 From ba042ed6446fc524c1d804227765b45616f9cba3 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sat, 6 Jun 2026 14:39:40 +0200 Subject: bpf: Add support for tracing_multi link session Adding support to use session attachment with tracing_multi link. Adding new BPF_TRACE_FSESSION_MULTI program attach type, that follows the BPF_TRACE_FSESSION behaviour but on the tracing_multi link. Such program is called on entry and exit of the attached function and allows to pass cookie value from entry to exit execution. Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-16-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 6 +++++- include/uapi/linux/bpf.h | 1 + 2 files changed, 6 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index e9d2b42a3981..62bba7a4876f 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1972,6 +1972,7 @@ struct bpf_tracing_multi_link { struct bpf_link link; struct bpf_tracing_multi_data data; u64 *cookies; + struct bpf_tramp_node *fexits; int nodes_cnt; struct bpf_tracing_multi_node nodes[] __counted_by(nodes_cnt); }; @@ -2159,7 +2160,8 @@ static inline void bpf_prog_put_recursion_context(struct bpf_prog *prog) static inline bool is_tracing_multi(enum bpf_attach_type type) { - return type == BPF_TRACE_FENTRY_MULTI || type == BPF_TRACE_FEXIT_MULTI; + return type == BPF_TRACE_FENTRY_MULTI || type == BPF_TRACE_FEXIT_MULTI || + type == BPF_TRACE_FSESSION_MULTI; } #if defined(CONFIG_BPF_JIT) && defined(CONFIG_BPF_SYSCALL) @@ -2286,6 +2288,8 @@ static inline int bpf_fsession_cnt(struct bpf_tramp_nodes *nodes) for (int i = 0; i < nodes[BPF_TRAMP_FENTRY].nr_nodes; i++) { if (fentries.nodes[i]->link->prog->expected_attach_type == BPF_TRACE_FSESSION) cnt++; + if (fentries.nodes[i]->link->prog->expected_attach_type == BPF_TRACE_FSESSION_MULTI) + cnt++; } return cnt; diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 569c15e1cae3..11dd610fa5fa 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1158,6 +1158,7 @@ enum bpf_attach_type { BPF_TRACE_FSESSION, BPF_TRACE_FENTRY_MULTI, BPF_TRACE_FEXIT_MULTI, + BPF_TRACE_FSESSION_MULTI, __MAX_BPF_ATTACH_TYPE }; -- cgit v1.2.3 From 1444ee886e6fedf20b9c5bc74a273c6b7d100fdc Mon Sep 17 00:00:00 2001 From: Mykyta Yatsenko Date: Sat, 6 Jun 2026 10:30:32 -0700 Subject: rhashtable: Fix rhashtable_next_key() build warnings rhashtable.o builds with warnings as rhashtable_next_key() kdoc from lib/rhashtable.c does not have the arguments descriptions. Move rhashtable_next_key() kdoc from header to c file, matching other functions. Move rhashtable_next_key() next to the other forward declarations in the header file. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202606061925.WI4bYI8k-lkp@intel.com/ Fixes: 8f4fa9f89b72 ("rhashtable: Add rhashtable_next_key() API") Signed-off-by: Mykyta Yatsenko Link: https://lore.kernel.org/r/20260606-rhash_fixes_1-v1-1-932ab036e6bc@meta.com Signed-off-by: Alexei Starovoitov --- include/linux/rhashtable.h | 42 ++---------------------------------------- 1 file changed, 2 insertions(+), 40 deletions(-) (limited to 'include') diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h index 3de3412d53c8..79f83b6eec27 100644 --- a/include/linux/rhashtable.h +++ b/include/linux/rhashtable.h @@ -263,6 +263,8 @@ struct rhash_lock_head __rcu **__rht_bucket_nested( struct rhash_lock_head __rcu **rht_bucket_nested_insert( struct rhashtable *ht, struct bucket_table *tbl, unsigned int hash); +void *rhashtable_next_key(struct rhashtable *ht, const void *prev_key); + #define rht_dereference(p, ht) \ rcu_dereference_protected(p, lockdep_rht_mutex_is_held(ht)) @@ -650,46 +652,6 @@ restart: return NULL; } -/** - * rhashtable_next_key - return next element after a given key - * @ht: hash table - * @prev_key: pointer to previous key, or NULL for the first element - * - * WARNING: this walk is highly unstable. Unlike rhashtable_walk_*(), - * it cannot detect a concurrent resize or rehash, so a full iteration - * is NOT guaranteed to terminate under adversarial or sustained - * rehashing. Callers MUST tolerate skipped and duplicated elements and - * SHOULD bound their loop externally. - * - * Returns the next element in best-effort iteration order, walking the - * @tbl chain (including any future_tbl in flight). Caller must hold RCU. - * - * Pass @prev_key == NULL to obtain the first element. To iterate, set - * @prev_key to the key of the previously returned element on each call, - * and stop when NULL is returned. - * - * Best-effort semantics: - * - Across the tbl->future_tbl chain, an element being migrated may - * transiently appear in both tables and be observed twice. - * - Concurrent inserts may or may not be observed. - * - Termination of a full iteration loop is NOT guaranteed under - * adversarial continuous rehash; callers MUST tolerate skips and - * repeats and SHOULD bound their loop externally. - * - Behavior on tables that contain duplicate keys is undefined: - * duplicates may be skipped, repeated, or trap the walk in a - * cycle. Callers requiring duplicate-key iteration must use - * rhashtable_walk_*() instead. - * - rhltable instances are not supported and return - * ERR_PTR(-EOPNOTSUPP). - * - If prev_key was concurrently deleted and is not present in any - * in-flight table, returns ERR_PTR(-ENOENT). - * - * Returns entry of the next element, or NULL when iteration is exhausted, - * or ERR_PTR(-ENOENT) if prev_key is not found, or - * ERR_PTR(-EOPNOTSUPP) if @ht is an rhltable. - */ -void *rhashtable_next_key(struct rhashtable *ht, const void *prev_key); - /** * rhashtable_lookup - search hash table * @ht: hash table -- cgit v1.2.3 From b224d18b1e5d1cddfc67f63f41d80023b2ec8889 Mon Sep 17 00:00:00 2001 From: Bryam Vargas Date: Sat, 6 Jun 2026 07:43:45 +0000 Subject: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = elem->data and elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + tim_len). When walking the encoded blocks the function passes the walker an end sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end) and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read *ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The +2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong. Pass the correct element end, (const u8 *)tim + tim_len. Fixes: e0c47c6229c2 ("wifi: mac80211: support parsing S1G TIM PVB") Signed-off-by: Bryam Vargas Link: https://patch.msgid.link/20260606074341.49135-1-hexlabsecurity@proton.me Signed-off-by: Johannes Berg --- include/linux/ieee80211-s1g.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h index 22dde4cbc1b0..3f9626ad3d97 100644 --- a/include/linux/ieee80211-s1g.h +++ b/include/linux/ieee80211-s1g.h @@ -556,7 +556,7 @@ static inline bool ieee80211_s1g_check_tim(const struct ieee80211_tim_ie *tim, */ err = ieee80211_s1g_find_target_block(&enc_blk, &target_aid, tim->virtual_map, - (const u8 *)tim + tim_len + 2); + (const u8 *)tim + tim_len); if (err) return false; -- cgit v1.2.3 From c1fd2c9f7f855caace046c789cdbf24628565d50 Mon Sep 17 00:00:00 2001 From: Len Bao Date: Sat, 23 May 2026 14:08:07 +0000 Subject: xen: constify xsd_errors array The 'xsd_errors' array is initialized in the declaration and never changed. So, constify it to reduce the attack surface. At the same time, use the preferred '__maybe_unused' form over the '__attribute__((unused))' form. Signed-off-by: Len Bao Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260523140809.30915-1-len.bao@gmx.us> --- include/xen/interface/io/xs_wire.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/xen/interface/io/xs_wire.h b/include/xen/interface/io/xs_wire.h index b62365478ac0..29d0394b8154 100644 --- a/include/xen/interface/io/xs_wire.h +++ b/include/xen/interface/io/xs_wire.h @@ -51,7 +51,7 @@ struct xsd_errors const char *errstring; }; #define XSD_ERROR(x) { x, #x } -static struct xsd_errors xsd_errors[] __attribute__((unused)) = { +static const struct xsd_errors xsd_errors[] __maybe_unused = { XSD_ERROR(EINVAL), XSD_ERROR(EACCES), XSD_ERROR(EEXIST), -- cgit v1.2.3 From c9305cdd5f8ea7b1df45c2adce69dc16e3efb1a6 Mon Sep 17 00:00:00 2001 From: Juergen Gross Date: Fri, 22 May 2026 17:21:13 +0200 Subject: x86/xen: Cleanup Xen related trace points Since dropping Xen-PV support for 32-bit, include/trace/events/xen.h contains several stale trace point definitions. Remove them. Signed-off-by: Juergen Gross Message-ID: <20260522152114.77319-3-jgross@suse.com> --- include/trace/events/xen.h | 62 +++------------------------------------------- 1 file changed, 3 insertions(+), 59 deletions(-) (limited to 'include') diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h index 0577f0cdd231..e3f139f0bc78 100644 --- a/include/trace/events/xen.h +++ b/include/trace/events/xen.h @@ -129,9 +129,10 @@ TRACE_EVENT(xen_mc_extend_args, __entry->res == XEN_MC_XE_NO_SPACE ? "NO_SPACE" : "???") ); -TRACE_DEFINE_SIZEOF(pteval_t); /* mmu */ -DECLARE_EVENT_CLASS(xen_mmu__set_pte, +TRACE_DEFINE_SIZEOF(pteval_t); + +TRACE_EVENT(xen_mmu_set_pte, TP_PROTO(pte_t *ptep, pte_t pteval), TP_ARGS(ptep, pteval), TP_STRUCT__entry( @@ -146,13 +147,6 @@ DECLARE_EVENT_CLASS(xen_mmu__set_pte, (int)sizeof(pteval_t) * 2, (unsigned long long)__entry->pteval) ); -#define DEFINE_XEN_MMU_SET_PTE(name) \ - DEFINE_EVENT(xen_mmu__set_pte, name, \ - TP_PROTO(pte_t *ptep, pte_t pteval), \ - TP_ARGS(ptep, pteval)) - -DEFINE_XEN_MMU_SET_PTE(xen_mmu_set_pte); - TRACE_DEFINE_SIZEOF(pmdval_t); TRACE_EVENT(xen_mmu_set_pmd, @@ -170,37 +164,6 @@ TRACE_EVENT(xen_mmu_set_pmd, (int)sizeof(pmdval_t) * 2, (unsigned long long)__entry->pmdval) ); -#ifdef CONFIG_X86_PAE -DEFINE_XEN_MMU_SET_PTE(xen_mmu_set_pte_atomic); - -TRACE_EVENT(xen_mmu_pte_clear, - TP_PROTO(struct mm_struct *mm, unsigned long addr, pte_t *ptep), - TP_ARGS(mm, addr, ptep), - TP_STRUCT__entry( - __field(struct mm_struct *, mm) - __field(unsigned long, addr) - __field(pte_t *, ptep) - ), - TP_fast_assign(__entry->mm = mm; - __entry->addr = addr; - __entry->ptep = ptep), - TP_printk("mm %p addr %lx ptep %p", - __entry->mm, __entry->addr, __entry->ptep) - ); - -TRACE_EVENT(xen_mmu_pmd_clear, - TP_PROTO(pmd_t *pmdp), - TP_ARGS(pmdp), - TP_STRUCT__entry( - __field(pmd_t *, pmdp) - ), - TP_fast_assign(__entry->pmdp = pmdp), - TP_printk("pmdp %p", __entry->pmdp) - ); -#endif - -#if CONFIG_PGTABLE_LEVELS >= 4 - TRACE_DEFINE_SIZEOF(pudval_t); TRACE_EVENT(xen_mmu_set_pud, @@ -236,24 +199,6 @@ TRACE_EVENT(xen_mmu_set_p4d, (int)sizeof(p4dval_t) * 2, (unsigned long long)pgd_val(native_make_pgd(__entry->p4dval)), (int)sizeof(p4dval_t) * 2, (unsigned long long)__entry->p4dval) ); -#else - -TRACE_EVENT(xen_mmu_set_pud, - TP_PROTO(pud_t *pudp, pud_t pudval), - TP_ARGS(pudp, pudval), - TP_STRUCT__entry( - __field(pud_t *, pudp) - __field(pudval_t, pudval) - ), - TP_fast_assign(__entry->pudp = pudp; - __entry->pudval = native_pud_val(pudval)), - TP_printk("pudp %p pudval %0*llx (raw %0*llx)", - __entry->pudp, - (int)sizeof(pudval_t) * 2, (unsigned long long)pgd_val(native_make_pgd(__entry->pudval)), - (int)sizeof(pudval_t) * 2, (unsigned long long)__entry->pudval) - ); - -#endif DECLARE_EVENT_CLASS(xen_mmu_ptep_modify_prot, TP_PROTO(struct mm_struct *mm, unsigned long addr, @@ -452,7 +397,6 @@ TRACE_EVENT(xen_cpu_set_ldt, __entry->addr, __entry->entries) ); - #endif /* _TRACE_XEN_H */ /* This part must be outside protection */ -- cgit v1.2.3 From 3b8d9415b88bc4107b0a69aca0e68945de8a675b Mon Sep 17 00:00:00 2001 From: Juergen Gross Date: Tue, 26 May 2026 17:05:10 +0200 Subject: x86/xen: Drop lazy mode from trace entries Drop the lazy mode (cpu or mmu) from the xen_mc_batch and xen_mc_issue trace entries. This is done in preparation of removing the xen_lazy_mode percpu variable. Signed-off-by: Juergen Gross Message-ID: <20260526150514.129330-2-jgross@suse.com> --- include/trace/events/xen.h | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) (limited to 'include') diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h index e3f139f0bc78..ad384969e2cb 100644 --- a/include/trace/events/xen.h +++ b/include/trace/events/xen.h @@ -12,24 +12,29 @@ struct multicall_entry; /* Multicalls */ -DECLARE_EVENT_CLASS(xen_mc__batch, - TP_PROTO(enum xen_lazy_mode mode), - TP_ARGS(mode), +TRACE_EVENT(xen_mc_batch, + TP_PROTO(unsigned long flags), + TP_ARGS(flags), TP_STRUCT__entry( - __field(enum xen_lazy_mode, mode) + __field(unsigned long, flags) ), - TP_fast_assign(__entry->mode = mode), - TP_printk("start batch LAZY_%s", - (__entry->mode == XEN_LAZY_MMU) ? "MMU" : - (__entry->mode == XEN_LAZY_CPU) ? "CPU" : "NONE") + TP_fast_assign(__entry->flags = flags), + TP_printk("start batch lazy flags %lx", __entry->flags) ); -#define DEFINE_XEN_MC_BATCH(name) \ - DEFINE_EVENT(xen_mc__batch, name, \ - TP_PROTO(enum xen_lazy_mode mode), \ - TP_ARGS(mode)) -DEFINE_XEN_MC_BATCH(xen_mc_batch); -DEFINE_XEN_MC_BATCH(xen_mc_issue); +TRACE_EVENT(xen_mc_issue, + TP_PROTO(bool flush, unsigned long flags), + TP_ARGS(flush, flags), + TP_STRUCT__entry( + __field(unsigned long, flags) + __field(bool, flush) + ), + TP_fast_assign(__entry->flush = flush; + __entry->flags = flags; + ), + TP_printk("flush: %s, flags %lx", + __entry->flush ? "yes" : "no", __entry->flags) + ); TRACE_DEFINE_SIZEOF(ulong); -- cgit v1.2.3 From 811f0d8caa407b7acd8d1ff9e2dd69835a7b3d9a Mon Sep 17 00:00:00 2001 From: Juergen Gross Date: Tue, 26 May 2026 17:05:12 +0200 Subject: mm: Refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume() In order to allow pausing and resuming MMU lazy mode for other tasks than current, refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume(). This will be needed when dropping the Xen PV private lazy MMU bookkeeping. Acked-by: "David Hildenbrand (Arm)" Signed-off-by: Juergen Gross Message-ID: <20260526150514.129330-4-jgross@suse.com> --- include/linux/pgtable.h | 56 +++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 11 deletions(-) (limited to 'include') diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h index cdd68ed3ae1a..07483ed9b3ce 100644 --- a/include/linux/pgtable.h +++ b/include/linux/pgtable.h @@ -300,6 +300,28 @@ static inline void lazy_mmu_mode_disable(void) } +/** + * __task_lazy_mmu_mode_pause() - Pause the lazy MMU mode for a task. + * @tsk: The task to check. + * + * Pauses the lazy MMU mode of @tsk. + * + * This function only operates on the state saved in task_struct; to pause + * current lazy_mmu_mode_pause() should be used instead. + * + * This function is intended for architectures that implement the lazy MMU + * mode; it must not be called from generic code. + */ +static inline void __task_lazy_mmu_mode_pause(struct task_struct *tsk) +{ + struct lazy_mmu_state *state = &tsk->lazy_mmu_state; + + VM_WARN_ON_ONCE(state->pause_count == U8_MAX); + + if (state->pause_count++ == 0 && state->enable_count > 0) + arch_leave_lazy_mmu_mode(); +} + /** * lazy_mmu_mode_pause() - Pause the lazy MMU mode. * @@ -315,15 +337,32 @@ static inline void lazy_mmu_mode_disable(void) */ static inline void lazy_mmu_mode_pause(void) { - struct lazy_mmu_state *state = ¤t->lazy_mmu_state; - if (in_interrupt()) return; - VM_WARN_ON_ONCE(state->pause_count == U8_MAX); + __task_lazy_mmu_mode_pause(current); +} - if (state->pause_count++ == 0 && state->enable_count > 0) - arch_leave_lazy_mmu_mode(); +/** + * __task_lazy_mmu_mode_resume() - Resume the lazy MMU mode for a task. + * @tsk: The task to check. + * + * Resumes the lazy MMU mode of @tsk. + * + * This function only operates on the state saved in task_struct; to resume + * current lazy_mmu_mode_resume() should be used instead. + * + * This function is intended for architectures that implement the lazy MMU + * mode; it must not be called from generic code. + */ +static inline void __task_lazy_mmu_mode_resume(struct task_struct *tsk) +{ + struct lazy_mmu_state *state = &tsk->lazy_mmu_state; + + VM_WARN_ON_ONCE(state->pause_count == 0); + + if (--state->pause_count == 0 && state->enable_count > 0) + arch_enter_lazy_mmu_mode(); } /** @@ -341,15 +380,10 @@ static inline void lazy_mmu_mode_pause(void) */ static inline void lazy_mmu_mode_resume(void) { - struct lazy_mmu_state *state = ¤t->lazy_mmu_state; - if (in_interrupt()) return; - VM_WARN_ON_ONCE(state->pause_count == 0); - - if (--state->pause_count == 0 && state->enable_count > 0) - arch_enter_lazy_mmu_mode(); + __task_lazy_mmu_mode_resume(current); } #else static inline void lazy_mmu_mode_enable(void) {} -- cgit v1.2.3 From 9085f71285375485c86c06071a13111606b404d7 Mon Sep 17 00:00:00 2001 From: Manivannan Sadhasivam Date: Tue, 19 May 2026 14:26:01 +0530 Subject: power: sequencing: Add an API to return the pwrseq device's 'dev' pointer The consumer drivers can make use of the pwrseq device's 'dev' pointer to query the pwrseq provider's DT node to check for existence of specific properties. Hence, add an API to return the pwrseq device's 'dev' pointer to consumers. Note that since pwrseq_get() would've increased the pwrseq refcount, there is no need to increase the refcount in this API again. Tested-by: Wei Deng Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260519-pwrseq-m2-bt-v3-6-b39dc2ae3966@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski --- include/linux/pwrseq/consumer.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/pwrseq/consumer.h b/include/linux/pwrseq/consumer.h index 7d583b4f266e..3c907c9e1885 100644 --- a/include/linux/pwrseq/consumer.h +++ b/include/linux/pwrseq/consumer.h @@ -23,6 +23,8 @@ devm_pwrseq_get(struct device *dev, const char *target); int pwrseq_power_on(struct pwrseq_desc *desc); int pwrseq_power_off(struct pwrseq_desc *desc); +struct device *pwrseq_to_device(struct pwrseq_desc *desc); + #else /* CONFIG_POWER_SEQUENCING */ static inline struct pwrseq_desc * __must_check @@ -51,6 +53,11 @@ static inline int pwrseq_power_off(struct pwrseq_desc *desc) return -ENOSYS; } +static inline struct device *pwrseq_to_device(struct pwrseq_desc *desc) +{ + return NULL; +} + #endif /* CONFIG_POWER_SEQUENCING */ #endif /* __POWER_SEQUENCING_CONSUMER_H__ */ -- cgit v1.2.3 From 5d596b9139f59ce412f41283baadaf809936eaf4 Mon Sep 17 00:00:00 2001 From: John Madieu Date: Mon, 25 May 2026 11:07:49 +0000 Subject: irqchip/renesas-rzv2h: Add DMA ACK signal routing support Some peripherals on RZ/G3E SoCs (SSIU, SPDIF, SCU/SRC, DVC) require explicit ACK signal routing through the ICU via the ICU_DMACKSELk registers for level-based DMA handshaking. Add rzv2h_icu_register_dma_ack() to configure ICU_DMACKSELk, routing a DMAC channel's ACK signal to the specified peripheral. Signed-off-by: John Madieu Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20260525110750.4020112-2-john.madieu.xa@bp.renesas.com Signed-off-by: Vinod Koul --- include/linux/irqchip/irq-renesas-rzv2h.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/irqchip/irq-renesas-rzv2h.h b/include/linux/irqchip/irq-renesas-rzv2h.h index 618a60d2eac0..4ffa898eaaf2 100644 --- a/include/linux/irqchip/irq-renesas-rzv2h.h +++ b/include/linux/irqchip/irq-renesas-rzv2h.h @@ -11,13 +11,18 @@ #include #define RZV2H_ICU_DMAC_REQ_NO_DEFAULT 0x3ff +#define RZV2H_ICU_DMAC_ACK_NO_DEFAULT 0x7f #ifdef CONFIG_RENESAS_RZV2H_ICU void rzv2h_icu_register_dma_req(struct platform_device *icu_dev, u8 dmac_index, u8 dmac_channel, u16 req_no); +void rzv2h_icu_register_dma_ack(struct platform_device *icu_dev, u8 dmac_index, + u8 dmac_channel, u16 ack_no); #else static inline void rzv2h_icu_register_dma_req(struct platform_device *icu_dev, u8 dmac_index, u8 dmac_channel, u16 req_no) { } +static inline void rzv2h_icu_register_dma_ack(struct platform_device *icu_dev, u8 dmac_index, + u8 dmac_channel, u16 ack_no) { } #endif #endif /* __LINUX_IRQ_RENESAS_RZV2H */ -- cgit v1.2.3 From b2d44b3ea95e10315559d8deedd8af2977c7f534 Mon Sep 17 00:00:00 2001 From: Vladimir Zapolskiy Date: Wed, 14 Jan 2026 07:14:58 +0200 Subject: dmaengine: iop32x-adma: Remove a leftover header file The Intel IOPx3xx platform was completely removed in commit b91a69d162aa ("ARM: iop32x: remove the platform"), and it'd be safe to remove an unused and leftover platform data specific header file dma-iop32x.h also. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Frank Li Link: https://patch.msgid.link/20260114051508.3908807-1-vz@mleia.com [vkoul: fixed subsystem tag] Signed-off-by: Vinod Koul --- include/linux/platform_data/dma-iop32x.h | 110 ------------------------------- 1 file changed, 110 deletions(-) delete mode 100644 include/linux/platform_data/dma-iop32x.h (limited to 'include') diff --git a/include/linux/platform_data/dma-iop32x.h b/include/linux/platform_data/dma-iop32x.h deleted file mode 100644 index ac83cff89549..000000000000 --- a/include/linux/platform_data/dma-iop32x.h +++ /dev/null @@ -1,110 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * Copyright © 2006, Intel Corporation. - */ -#ifndef IOP_ADMA_H -#define IOP_ADMA_H -#include -#include -#include - -#define IOP_ADMA_SLOT_SIZE 32 -#define IOP_ADMA_THRESHOLD 4 -#ifdef DEBUG -#define IOP_PARANOIA 1 -#else -#define IOP_PARANOIA 0 -#endif -#define iop_paranoia(x) BUG_ON(IOP_PARANOIA && (x)) - -#define DMA0_ID 0 -#define DMA1_ID 1 -#define AAU_ID 2 - -/** - * struct iop_adma_device - internal representation of an ADMA device - * @pdev: Platform device - * @id: HW ADMA Device selector - * @dma_desc_pool: base of DMA descriptor region (DMA address) - * @dma_desc_pool_virt: base of DMA descriptor region (CPU address) - * @common: embedded struct dma_device - */ -struct iop_adma_device { - struct platform_device *pdev; - int id; - dma_addr_t dma_desc_pool; - void *dma_desc_pool_virt; - struct dma_device common; -}; - -/** - * struct iop_adma_chan - internal representation of an ADMA device - * @pending: allows batching of hardware operations - * @lock: serializes enqueue/dequeue operations to the slot pool - * @mmr_base: memory mapped register base - * @chain: device chain view of the descriptors - * @device: parent device - * @common: common dmaengine channel object members - * @last_used: place holder for allocation to continue from where it left off - * @all_slots: complete domain of slots usable by the channel - * @slots_allocated: records the actual size of the descriptor slot pool - * @irq_tasklet: bottom half where iop_adma_slot_cleanup runs - */ -struct iop_adma_chan { - int pending; - spinlock_t lock; /* protects the descriptor slot pool */ - void __iomem *mmr_base; - struct list_head chain; - struct iop_adma_device *device; - struct dma_chan common; - struct iop_adma_desc_slot *last_used; - struct list_head all_slots; - int slots_allocated; - struct tasklet_struct irq_tasklet; -}; - -/** - * struct iop_adma_desc_slot - IOP-ADMA software descriptor - * @slot_node: node on the iop_adma_chan.all_slots list - * @chain_node: node on the op_adma_chan.chain list - * @hw_desc: virtual address of the hardware descriptor chain - * @phys: hardware address of the hardware descriptor chain - * @group_head: first operation in a transaction - * @slot_cnt: total slots used in an transaction (group of operations) - * @slots_per_op: number of slots per operation - * @idx: pool index - * @tx_list: list of descriptors that are associated with one operation - * @async_tx: support for the async_tx api - * @group_list: list of slots that make up a multi-descriptor transaction - * for example transfer lengths larger than the supported hw max - * @xor_check_result: result of zero sum - * @crc32_result: result crc calculation - */ -struct iop_adma_desc_slot { - struct list_head slot_node; - struct list_head chain_node; - void *hw_desc; - struct iop_adma_desc_slot *group_head; - u16 slot_cnt; - u16 slots_per_op; - u16 idx; - struct list_head tx_list; - struct dma_async_tx_descriptor async_tx; - union { - u32 *xor_check_result; - u32 *crc32_result; - u32 *pq_check_result; - }; -}; - -struct iop_adma_platform_data { - int hw_id; - dma_cap_mask_t cap_mask; - size_t pool_size; -}; - -#define to_iop_sw_desc(addr_hw_desc) \ - container_of(addr_hw_desc, struct iop_adma_desc_slot, hw_desc) -#define iop_hw_desc_slot_idx(hw_desc, idx) \ - ( (void *) (((unsigned long) hw_desc) + ((idx) << 5)) ) -#endif -- cgit v1.2.3 From 71e6a19fe2669faf7dcb96ba8a4fde927485e60e Mon Sep 17 00:00:00 2001 From: Tze Yee Ng Date: Tue, 2 Jun 2026 22:28:42 -0700 Subject: firmware: stratix10-svc: Add support to query Arm Trusted Firmware (ATF) version Add entry in Stratix10 service layer that allow client to retrieve the ATF version at runtime, which is useful for system diagnostics, compatibility checks, and ensuring the correct secure firmware is in use. The change introduces: - A new service command definition in the Stratix10 service layer to initiate the ATF version query. - A corresponding macro definition in the header file to expose the command ID for use by other components. The service layer uses a Secure Monitor Call (SMC) to communicate with the ATF and retrieve the version string, which can then be logged or validated by client application. Signed-off-by: Tze Yee Ng Signed-off-by: Dinh Nguyen --- include/linux/firmware/intel/stratix10-smc.h | 19 +++++++++++++++++++ include/linux/firmware/intel/stratix10-svc-client.h | 7 ++++++- 2 files changed, 25 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/firmware/intel/stratix10-smc.h b/include/linux/firmware/intel/stratix10-smc.h index 36ea619ea2ad..9116512169dc 100644 --- a/include/linux/firmware/intel/stratix10-smc.h +++ b/include/linux/firmware/intel/stratix10-smc.h @@ -514,6 +514,25 @@ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE) #define INTEL_SIP_SMC_SVC_VERSION \ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_SVC_FUNCID_VERSION) +/** + * Request INTEL_SIP_SMC_ATF_BUILD_VER + * + * Sync call used to query the ATF Build Version + * + * Call register usage: + * a0 INTEL_SIP_SMC_ATF_BUILD_VER + * a1-a7 not used + * + * Return status: + * a0 INTEL_SIP_SMC_STATUS_OK + * a1 Major + * a2 Minor + * a3 Patch + */ +#define INTEL_SIP_SMC_ATF_BUILD_VERSION 155 +#define INTEL_SIP_SMC_ATF_BUILD_VER \ + INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_ATF_BUILD_VERSION) + /** * SMC call protocol for FPGA Crypto Service (FCS) * FUNCID starts from 90 diff --git a/include/linux/firmware/intel/stratix10-svc-client.h b/include/linux/firmware/intel/stratix10-svc-client.h index 91013161e9db..3edd93502bf8 100644 --- a/include/linux/firmware/intel/stratix10-svc-client.h +++ b/include/linux/firmware/intel/stratix10-svc-client.h @@ -154,6 +154,10 @@ struct stratix10_svc_chan; * * @COMMAND_HWMON_READVOLT: query the voltage from the hardware monitor, * return status is SVC_STATUS_OK or SVC_STATUS_ERROR + * + * @COMMAND_SMC_ATF_BUILD_VER: Non-mailbox SMC ATF Build Version, + * return status is SVC_STATUS_OK + * */ enum stratix10_svc_command_code { /* for FPGA */ @@ -187,7 +191,8 @@ enum stratix10_svc_command_code { COMMAND_SMC_SVC_VERSION = 200, /* for HWMON */ COMMAND_HWMON_READTEMP, - COMMAND_HWMON_READVOLT + COMMAND_HWMON_READVOLT, + COMMAND_SMC_ATF_BUILD_VER }; /** -- cgit v1.2.3 From c6153ed23ed6a2bb8a5891382c06134674610f86 Mon Sep 17 00:00:00 2001 From: Mark Harmstone Date: Thu, 16 Apr 2026 19:01:18 +0100 Subject: btrfs: add ioctl GET_CSUMS to read raw checksums from file range Add a new unprivileged BTRFS_IOC_GET_CSUMS ioctl, which can be used to query the on-disk csums for a file range. The ioctl is deliberately per-file rather than exposing raw csum tree lookups, to avoid leaking information to users about files they may not have access to. This is done by userspace passing a struct btrfs_ioctl_get_csums_args to the kernel, which details the offset and length we're interested in, and a buffer for the kernel to write its results into. The kernel writes a struct btrfs_ioctl_get_csums_entry into the buffer, followed by the csums if available. The maximum size of the user buffer is capped to 16MiB. If the extent is an uncompressed, non-NODATASUM extent, the kernel sets the entry type to BTRFS_GET_CSUMS_HAS_CSUMS and follows it with the csums. If it is sparse, preallocated, or beyond the EOF, it sets the type to BTRFS_GET_CSUMS_ZEROED - this is so userspace knows it can use the precomputed hash of the zero sector. Otherwise, it sets the type to BTRFS_GET_CSUMS_NODATASUM, BTRFS_GET_CSUMS_COMPRESSED, BTRFS_GET_CSUM_ENCRYPTED, or BTRFS_GET_CSUM_INLINE. For example, a file with a [0, 4K) hole and [4K, 12K) data extent would produce the following output buffer: | [0, 4K) ZEROED | [4K, 12K) HAS_CSUMS | csum data | We do store the csums of compressed extents, but we deliberately don't return them here: they're calculated over the compressed data, not the uncompressed data that's returned to userspace. Similarly for encrypted data, once encryption is supported, in which the csums will be on the ciphertext. The main use case for this is for speeding up mkfs.btrfs --rootdir. For the case when the source FS is btrfs and using the same csum algorithm, we can avoid having to recalculate the csums - in my synthetic benchmarks (16GB file on a spinning-rust drive), this resulted in a ~11% speed-up (218s to 196s). When using the --reflink option added in btrfs-progs v6.16.1, we can forgo reading the data entirely, resulting a ~2200% speed-up on the same test (128s to 6s). # mkdir rootdir # dd if=/dev/urandom of=rootdir/file bs=4096 count=4194304 (without ioctl) # echo 3 > /proc/sys/vm/drop_caches # time mkfs.btrfs --rootdir rootdir testimg ... real 3m37.965s user 0m5.496s sys 0m6.125s # echo 3 > /proc/sys/vm/drop_caches # time mkfs.btrfs --rootdir rootdir --reflink testimg ... real 2m8.342s user 0m5.472s sys 0m1.667s (with ioctl) # echo 3 > /proc/sys/vm/drop_caches # time mkfs.btrfs --rootdir rootdir testimg ... real 3m15.865s user 0m4.258s sys 0m6.261s # echo 3 > /proc/sys/vm/drop_caches # time mkfs.btrfs --rootdir rootdir --reflink testimg ... real 0m5.847s user 0m2.899s sys 0m0.097s Another notable use case is for deduplication, where reading the checksums may serve as a hint instead of reading the whole file data. Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Signed-off-by: David Sterba --- include/uapi/linux/btrfs.h | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h index 9165154a274d..9b576603b3f1 100644 --- a/include/uapi/linux/btrfs.h +++ b/include/uapi/linux/btrfs.h @@ -1100,6 +1100,38 @@ enum btrfs_err_code { BTRFS_ERROR_DEV_RAID1C4_MIN_NOT_MET, }; +/* Flags for struct btrfs_ioctl_get_csums_entry::type. */ +#define BTRFS_GET_CSUMS_HAS_CSUMS (1U << 0) +#define BTRFS_GET_CSUMS_ZEROED (1U << 1) +#define BTRFS_GET_CSUMS_NODATASUM (1U << 2) +#define BTRFS_GET_CSUMS_COMPRESSED (1U << 3) +#define BTRFS_GET_CSUMS_ENCRYPTED (1U << 4) +#define BTRFS_GET_CSUMS_INLINE (1U << 5) + +struct btrfs_ioctl_get_csums_entry { + /* File offset of this range. */ + __u64 offset; + /* Length in bytes. */ + __u64 length; + /* One of BTRFS_GET_CSUMS_* types. */ + __u32 type; + /* Padding, must be 0. */ + __u32 reserved; +}; + +struct btrfs_ioctl_get_csums_args { + /* In/out: file offset in bytes. */ + __u64 offset; + /* In/out: range length in bytes. */ + __u64 length; + /* In/out: buffer capacity / bytes written. */ + __u64 buf_size; + /* In: flags, must be 0 for now. */ + __u64 flags; + /* Out: entries of type btrfs_ioctl_get_csums_entry + csum data */ + __u8 buf[]; +}; + /* Flags for IOC_SHUTDOWN, must match XFS_FSOP_GOING_FLAGS_* flags. */ #define BTRFS_SHUTDOWN_FLAGS_DEFAULT 0x0 #define BTRFS_SHUTDOWN_FLAGS_LOGFLUSH 0x1 @@ -1226,6 +1258,8 @@ enum btrfs_err_code { struct btrfs_ioctl_encoded_io_args) #define BTRFS_IOC_SUBVOL_SYNC_WAIT _IOW(BTRFS_IOCTL_MAGIC, 65, \ struct btrfs_ioctl_subvol_wait) +#define BTRFS_IOC_GET_CSUMS _IOWR(BTRFS_IOCTL_MAGIC, 66, \ + struct btrfs_ioctl_get_csums_args) /* Shutdown ioctl should follow XFS's interfaces, thus not using btrfs magic. */ #define BTRFS_IOC_SHUTDOWN _IOR('X', 125, __u32) -- cgit v1.2.3 From c69e110455f49eb625623076b3bbd1be0e7362a9 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Fri, 17 Apr 2026 18:06:32 +0100 Subject: btrfs: tracepoints: remove double negation in finish ordered extent event There is no need to add a double negation (!!) to the update field because the field has a boolean type. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index ec1df8b94517..99ae9c923070 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -670,7 +670,7 @@ TRACE_EVENT(btrfs_finish_ordered_extent, TP_printk_btrfs("root=%llu(%s) ino=%llu start=%llu len=%llu uptodate=%d", show_root_type(__entry->root_objectid), __entry->ino, __entry->start, - __entry->len, !!__entry->uptodate) + __entry->len, __entry->uptodate) ); DECLARE_EVENT_CLASS(btrfs__writepage, -- cgit v1.2.3 From 645927cefdb5e024480b5639105fa53a52f986d8 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Fri, 17 Apr 2026 17:22:59 +0100 Subject: btrfs: tracepoints: remove pointless root field from transaction commit event A transaction commit is global, not per root, and we are currently always emitting a root id field matching the root tree for no good reason at all, causing confusion for no reason at all. So remove the root field. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 99ae9c923070..a8cdc50677a5 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -188,17 +188,13 @@ TRACE_EVENT(btrfs_transaction_commit, TP_STRUCT__entry_btrfs( __field( u64, generation ) - __field( u64, root_objectid ) ), TP_fast_assign_btrfs(fs_info, __entry->generation = fs_info->generation; - __entry->root_objectid = BTRFS_ROOT_TREE_OBJECTID; ), - TP_printk_btrfs("root=%llu(%s) gen=%llu", - show_root_type(__entry->root_objectid), - __entry->generation) + TP_printk_btrfs("gen=%llu", __entry->generation) ); DECLARE_EVENT_CLASS(btrfs__inode, -- cgit v1.2.3 From e1ad307c7ab1af0b5c14549b23982464c22996cc Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Fri, 17 Apr 2026 17:43:19 +0100 Subject: btrfs: tracepoints: pass a transaction handle to transaction commit event The transaction commit tracepoint prints fs_info->generation as if it were the ID of the committed transaction but this does not always match that ID. This is because the trace point is called in the transaction commit path after the transaction is in the TRANS_STATE_COMPLETED state, which means another transaction may have already started (which can happen as soon as the transaction state was set to TRANS_STATE_UNBLOCKED), in which case fs_info->generation was incremented and does not correspond to the committed transaction anymore. So fix this by passing a transaction handle to the trace event instead of fs_info. This will also allow later for the trace event to dump other useful information about the transaction. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index a8cdc50677a5..4cec2f8838f5 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -31,6 +31,7 @@ struct btrfs_space_info; struct btrfs_raid_bio; struct raid56_bio_trace_info; struct find_free_extent_ctl; +struct btrfs_trans_handle; #define show_ref_type(type) \ __print_symbolic(type, \ @@ -182,16 +183,16 @@ FLUSH_STATES TRACE_EVENT(btrfs_transaction_commit, - TP_PROTO(const struct btrfs_fs_info *fs_info), + TP_PROTO(const struct btrfs_trans_handle *trans), - TP_ARGS(fs_info), + TP_ARGS(trans), TP_STRUCT__entry_btrfs( __field( u64, generation ) ), - TP_fast_assign_btrfs(fs_info, - __entry->generation = fs_info->generation; + TP_fast_assign_btrfs(trans->fs_info, + __entry->generation = trans->transid; ), TP_printk_btrfs("gen=%llu", __entry->generation) -- cgit v1.2.3 From 889ad3845a8c029e93a46251f78d61b277cf5e61 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Fri, 17 Apr 2026 18:12:16 +0100 Subject: btrfs: tracepoints: add in_fsync field to transaction commit event Include the in_fsync value from the transaction handle so that we can know if a transaction commit was triggered by a fsync call. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 4cec2f8838f5..4e077abd6704 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -189,13 +189,16 @@ TRACE_EVENT(btrfs_transaction_commit, TP_STRUCT__entry_btrfs( __field( u64, generation ) + __field( bool, in_fsync ) ), TP_fast_assign_btrfs(trans->fs_info, __entry->generation = trans->transid; + __entry->in_fsync = trans->in_fsync; ), - TP_printk_btrfs("gen=%llu", __entry->generation) + TP_printk_btrfs("gen=%llu in_fsync=%d", __entry->generation, + __entry->in_fsync) ); DECLARE_EVENT_CLASS(btrfs__inode, -- cgit v1.2.3 From b4bbe7d7591e65cf9cc4975ea124fc717df9f128 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 23 Apr 2026 15:17:16 +0100 Subject: btrfs: tracepoints: add trace event for transaction aborts While tracing it's useful to know not just when a transaction is committed but also when one is aborted. So add a trace event for transaction aborts. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 4e077abd6704..cb9b6188fcdd 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -201,6 +201,28 @@ TRACE_EVENT(btrfs_transaction_commit, __entry->in_fsync) ); +TRACE_EVENT(btrfs_transaction_abort, + + TP_PROTO(const struct btrfs_trans_handle *trans), + + TP_ARGS(trans), + + TP_STRUCT__entry_btrfs( + __field( u64, generation ) + __field( bool, in_fsync ) + __field( int, error ) + ), + + TP_fast_assign_btrfs(trans->fs_info, + __entry->generation = trans->transid; + __entry->in_fsync = trans->in_fsync; + __entry->error = trans->aborted; + ), + + TP_printk_btrfs("gen=%llu in_fsync=%d error=%d", __entry->generation, + __entry->in_fsync, __entry->error) +); + DECLARE_EVENT_CLASS(btrfs__inode, TP_PROTO(const struct inode *inode), -- cgit v1.2.3 From 99314d7cc711b4105a9546e63a210ead0d3f6178 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 23 Apr 2026 15:56:52 +0100 Subject: btrfs: tracepoints: add trace event for the start of a new transaction While tracing it's useful to know not just when a transaction is committed or aborted, but also when a new one is started. So add a trace event for transaction starts. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index cb9b6188fcdd..e43528003848 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -32,6 +32,7 @@ struct btrfs_raid_bio; struct raid56_bio_trace_info; struct find_free_extent_ctl; struct btrfs_trans_handle; +struct btrfs_transaction; #define show_ref_type(type) \ __print_symbolic(type, \ @@ -181,6 +182,23 @@ FLUSH_STATES #define TP_printk_btrfs(fmt, args...) \ TP_printk("%pU: " fmt, __entry->fsid, args) +TRACE_EVENT(btrfs_transaction_start, + + TP_PROTO(const struct btrfs_transaction *trans), + + TP_ARGS(trans), + + TP_STRUCT__entry_btrfs( + __field( u64, generation ) + ), + + TP_fast_assign_btrfs(trans->fs_info, + __entry->generation = trans->transid; + ), + + TP_printk_btrfs("gen=%llu", __entry->generation) +); + TRACE_EVENT(btrfs_transaction_commit, TP_PROTO(const struct btrfs_trans_handle *trans), -- cgit v1.2.3 From 17819dc282f15d49fac8d7eb94d571e69c22cbdf Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 23 Apr 2026 17:05:23 +0100 Subject: btrfs: tracepoints: trace transaction states during commit phase Currently the trace event is fired only when a transaction is fully complete (its state is TRANS_STATE_COMPLETED). However during a transaction commit we go through several states and as soon as the state reaches TRANS_STATE_UNBLOCKED, another transaction can start. Therefore it's useful to track every transaction state changed during the commit of a transaction, so that we can see if a new transaction is started before the current one is completed. Add the transaction state to the transaction commit event and call the event everytime we change the transaction state during commit. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index e43528003848..801f4793e002 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -105,6 +105,15 @@ struct btrfs_transaction; EM( COMMIT_TRANS, "COMMIT_TRANS") \ EMe(RESET_ZONES, "RESET_ZONES") +#define TRANSACTION_STATES \ + EM( TRANS_STATE_RUNNING, "TRANS_STATE_RUNNING") \ + EM( TRANS_STATE_COMMIT_PREP, "TRANS_STATE_COMMIT_PREP") \ + EM( TRANS_STATE_COMMIT_START, "TRANS_STATE_COMMIT_START") \ + EM( TRANS_STATE_COMMIT_DOING, "TRANS_STATE_COMMIT_DOING") \ + EM( TRANS_STATE_UNBLOCKED, "TRANS_STATE_UNBLOCKED") \ + EM( TRANS_STATE_SUPER_COMMITTED, "TRANS_STATE_SUPER_COMMITTED") \ + EMe(TRANS_STATE_COMPLETED, "TRANS_STATE_COMPLETED") + /* * First define the enums in the above macros to be exported to userspace via * TRACE_DEFINE_ENUM(). @@ -120,6 +129,7 @@ FI_TYPES QGROUP_RSV_TYPES IO_TREE_OWNER FLUSH_STATES +TRANSACTION_STATES /* * Now redefine the EM and EMe macros to map the enums to the strings that will @@ -208,15 +218,18 @@ TRACE_EVENT(btrfs_transaction_commit, TP_STRUCT__entry_btrfs( __field( u64, generation ) __field( bool, in_fsync ) + __field( int, state ) ), TP_fast_assign_btrfs(trans->fs_info, __entry->generation = trans->transid; __entry->in_fsync = trans->in_fsync; + __entry->state = trans->transaction->state; ), - TP_printk_btrfs("gen=%llu in_fsync=%d", __entry->generation, - __entry->in_fsync) + TP_printk_btrfs("gen=%llu in_fsync=%d state=%d(%s)", __entry->generation, + __entry->in_fsync, __entry->state, + __print_symbolic(__entry->state, TRANSACTION_STATES)) ); TRACE_EVENT(btrfs_transaction_abort, -- cgit v1.2.3 From 658d72fe491380582ddfa7e536142d829a7b3688 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Tue, 28 Apr 2026 15:32:15 +0100 Subject: btrfs: tracepoints: add trace event for when fsync finishes Currently we only have a trace event for when a fsync operation starts, but this alone is not very helpful. Add a trace event for when fsync finishes, which reports its return value, so that using tracing we can see which other trace events happened in between (several will be added soon for inode logging steps) and even measure execution time. So rename the existing trace event btrfs_sync_file to btrfs_sync_file_enter and add the trace event btrfs_sync_file_exit. The naming is similar to what ext4 does (ext4_sync_file_enter and ext4_sync_file_exit) and with similar information reported. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 801f4793e002..1b19364eabff 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -808,7 +808,7 @@ TRACE_EVENT(btrfs_writepage_end_io_hook, __entry->end, __entry->uptodate) ); -TRACE_EVENT(btrfs_sync_file, +TRACE_EVENT(btrfs_sync_file_enter, TP_PROTO(const struct file *file, int datasync), @@ -840,6 +840,32 @@ TRACE_EVENT(btrfs_sync_file, __entry->datasync) ); +TRACE_EVENT(btrfs_sync_file_exit, + + TP_PROTO(const struct file *file, int ret), + + TP_ARGS(file, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, ino ) + __field( int, ret ) + __field( u64, root_objectid ) + ), + + TP_fast_assign( + struct btrfs_inode *inode = BTRFS_I(file_inode(file)); + + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu ret=%d", + show_root_type(__entry->root_objectid), + __entry->ino, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From d32609208782127d99917fb7aeee26738ad89e3f Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Tue, 28 Apr 2026 16:52:09 +0100 Subject: btrfs: tracepoints: add trace event for btrfs_log_inode_parent() btrfs_log_inode_parent() is one of the most important steps called during a fsync operation as well as during rename and link operations on inodes that were previously logged. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 85 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 1b19364eabff..cd127c79a535 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -34,6 +34,16 @@ struct find_free_extent_ctl; struct btrfs_trans_handle; struct btrfs_transaction; +#define show_inode_type(mode) \ + __print_symbolic((mode) & S_IFMT, \ + { S_IFDIR, "DIR" }, \ + { S_IFREG, "REG" }, \ + { S_IFLNK, "LNK" }, \ + { S_IFIFO, "FIFO" }, \ + { S_IFCHR, "CHR" }, \ + { S_IFBLK, "BLK" }, \ + { S_IFSOCK, "SOCK" }) + #define show_ref_type(type) \ __print_symbolic(type, \ { BTRFS_TREE_BLOCK_REF_KEY, "TREE_BLOCK_REF" }, \ @@ -866,6 +876,81 @@ TRACE_EVENT(btrfs_sync_file_exit, __entry->ino, __entry->ret) ); +TRACE_EVENT(btrfs_log_inode_parent_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, struct btrfs_inode *inode), + + TP_ARGS(trans, inode), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( umode_t, mode ) + __field( u64, transid ) + __field( u64, generation ) + __field( u64, logged_trans ) + __field( u64, last_unlink_trans ) + __field( int, last_sub_trans ) + __field( int, inode_last_log_commit ) + __field( int, root_last_log_commit ) + ), + + TP_fast_assign( + struct btrfs_root *root = inode->root; + + TP_fast_assign_fsid(root->fs_info); + __entry->root_objectid = btrfs_root_id(root); + __entry->ino = btrfs_ino(inode); + __entry->mode = inode->vfs_inode.i_mode; + __entry->transid = trans->transid; + __entry->generation = inode->generation; + spin_lock(&inode->lock); + __entry->logged_trans = inode->logged_trans; + __entry->last_unlink_trans = inode->last_unlink_trans; + __entry->last_sub_trans = inode->last_sub_trans; + __entry->inode_last_log_commit = inode->last_log_commit; + spin_unlock(&inode->lock); + __entry->root_last_log_commit = btrfs_get_root_last_log_commit(root); + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu type=%s transid=%llu gen=%llu" + " logged_trans=%llu last_unlink_trans=%llu last_sub_trans=%d" + " inode_last_log_commit=%d root_last_log_commit=%d", + show_root_type(__entry->root_objectid), __entry->ino, + show_inode_type(__entry->mode), __entry->transid, + __entry->generation, __entry->logged_trans, + __entry->last_unlink_trans, __entry->last_sub_trans, + __entry->inode_last_log_commit, __entry->root_last_log_commit) +); + +TRACE_EVENT(btrfs_log_inode_parent_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode, + int ret), + + TP_ARGS(trans, inode, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( u64, transid ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->transid = trans->transid; + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu transid=%llu ret=%d", + show_root_type(__entry->root_objectid), __entry->ino, + __entry->transid, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From e2f67524f4855c5fd8b7d853f283f35222ae875f Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 30 Apr 2026 16:05:56 +0100 Subject: btrfs: tracepoints: add trace event for btrfs_log_inode() btrfs_log_inode() is one of the most important steps called during a fsync, as well as during rename and link operations on inodes that were previously logged. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 116 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 116 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index cd127c79a535..9f195d0d5378 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -33,6 +33,7 @@ struct raid56_bio_trace_info; struct find_free_extent_ctl; struct btrfs_trans_handle; struct btrfs_transaction; +struct btrfs_log_ctx; #define show_inode_type(mode) \ __print_symbolic((mode) & S_IFMT, \ @@ -124,6 +125,9 @@ struct btrfs_transaction; EM( TRANS_STATE_SUPER_COMMITTED, "TRANS_STATE_SUPER_COMMITTED") \ EMe(TRANS_STATE_COMPLETED, "TRANS_STATE_COMPLETED") +#define LOG_MODES \ + EM( LOG_INODE_ALL, "LOG_INODE_ALL") \ + EMe(LOG_INODE_EXISTS, "LOG_INODE_EXISTS") /* * First define the enums in the above macros to be exported to userspace via * TRACE_DEFINE_ENUM(). @@ -140,6 +144,7 @@ QGROUP_RSV_TYPES IO_TREE_OWNER FLUSH_STATES TRANSACTION_STATES +LOG_MODES /* * Now redefine the EM and EMe macros to map the enums to the strings that will @@ -951,6 +956,117 @@ TRACE_EVENT(btrfs_log_inode_parent_exit, __entry->transid, __entry->ret) ); +TRACE_EVENT(btrfs_log_inode_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, struct btrfs_inode *inode, + const struct btrfs_log_ctx *ctx, int log_mode), + + TP_ARGS(trans, inode, ctx, log_mode), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( umode_t, mode ) + __field( u64, transid ) + __field( u64, generation ) + __field( u64, logged_trans ) + __field( u64, last_unlink_trans ) + __field( u64, last_reflink_trans ) + __field( int, last_sub_trans ) + __field( int, last_log_commit ) + __field( bool, logging_new_name ) + __field( bool, logging_new_delayed_dentries ) + __field( bool, is_conflict_inode ) + __field( bool, full_sync ) + __field( bool, copy_everything ) + __field( bool, no_xattrs ) + __field( int, log_mode ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->mode = inode->vfs_inode.i_mode; + __entry->transid = trans->transid; + __entry->generation = inode->generation; + spin_lock(&inode->lock); + __entry->logged_trans = inode->logged_trans; + __entry->last_unlink_trans = inode->last_unlink_trans; + __entry->last_reflink_trans = inode->last_reflink_trans; + __entry->last_sub_trans = inode->last_sub_trans; + __entry->last_log_commit = inode->last_log_commit; + spin_unlock(&inode->lock); + __entry->logging_new_name = ctx->logging_new_name; + __entry->logging_new_delayed_dentries = ctx->logging_new_delayed_dentries; + __entry->is_conflict_inode = ctx->logging_conflict_inodes; + __entry->full_sync = + test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &inode->runtime_flags); + __entry->copy_everything = + test_bit(BTRFS_INODE_COPY_EVERYTHING, &inode->runtime_flags); + __entry->no_xattrs = + test_bit(BTRFS_INODE_NO_XATTRS, &inode->runtime_flags); + __entry->log_mode = log_mode; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu type=%s transid=%llu gen=%llu" + " logged_trans=%llu last_unlink_trans=%llu" + " last_reflink_trans=%llu last_sub_trans=%d last_log_commit=%d" + " logging_new_name=%d logging_new_delayed_dentries=%d" + " is_conflict_inode=%d full_sync=%d copy_everything=%d" + " no_xattrs=%d log_mode=%d(%s)", + show_root_type(__entry->root_objectid), __entry->ino, + show_inode_type(__entry->mode), __entry->transid, + __entry->generation, __entry->logged_trans, + __entry->last_unlink_trans, __entry->last_reflink_trans, + __entry->last_sub_trans, __entry->last_log_commit, + __entry->logging_new_name, __entry->logging_new_delayed_dentries, + __entry->is_conflict_inode, __entry->log_mode, + __entry->full_sync, __entry->copy_everything, __entry->no_xattrs, + __print_symbolic(__entry->log_mode, LOG_MODES)) +); + +TRACE_EVENT(btrfs_log_inode_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, struct btrfs_inode *inode, + int ret), + + TP_ARGS(trans, inode, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( u64, transid ) + __field( u64, logged_trans ) + __field( u64, last_reflink_trans ) + __field( int, last_sub_trans ) + __field( int, last_log_commit ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->transid = trans->transid; + spin_lock(&inode->lock); + __entry->logged_trans = inode->logged_trans; + __entry->last_reflink_trans = inode->last_reflink_trans; + __entry->last_sub_trans = inode->last_sub_trans; + __entry->last_log_commit = inode->last_log_commit; + spin_unlock(&inode->lock); + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu transid=%llu logged_trans=%llu" + " last_reflink_trans=%llu last_sub_trans=%d" + " last_log_commit=%d ret=%d", + show_root_type(__entry->root_objectid), __entry->ino, + __entry->transid, __entry->logged_trans, + __entry->last_reflink_trans, __entry->last_sub_trans, + __entry->last_log_commit, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From 0f24ea456ae16cf489080f7cdb565f55792e72b7 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 30 Apr 2026 17:10:01 +0100 Subject: btrfs: tracepoints: add trace event for btrfs_log_all_parents() btrfs_log_all_parents() is an important step called during a fsync, as well as during rename and link operations on inodes that were previously logged. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 53 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 9f195d0d5378..2c145240d809 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1067,6 +1067,59 @@ TRACE_EVENT(btrfs_log_inode_exit, __entry->last_log_commit, __entry->ret) ); +TRACE_EVENT(btrfs_log_all_parents_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode), + + TP_ARGS(trans, inode), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( u64, transid ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->transid = trans->transid; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu transid=%llu", + show_root_type(__entry->root_objectid), __entry->ino, + __entry->transid) +); + +TRACE_EVENT(btrfs_log_all_parents_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode, + int ret), + + TP_ARGS(trans, inode, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( u64, transid ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->transid = trans->transid; + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu transid=%llu ret=%d", + show_root_type(__entry->root_objectid), __entry->ino, + __entry->transid, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From e61574f1a961760df2dfd164a967797ce3346249 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Tue, 5 May 2026 15:31:16 +0100 Subject: btrfs: tracepoints: add trace event for log_all_new_ancestors() log_all_new_ancestors() is an important step called during a fsync, as well as during rename and link operations on inodes that were previously logged. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 55 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 2c145240d809..d16de652a815 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1120,6 +1120,61 @@ TRACE_EVENT(btrfs_log_all_parents_exit, __entry->transid, __entry->ret) ); +TRACE_EVENT(btrfs_log_all_new_ancestors_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode), + + TP_ARGS(trans, inode), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( u64, transid ) + __field( unsigned int, nlink ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->transid = trans->transid; + __entry->nlink = inode->vfs_inode.i_nlink; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu transid=%llu nlink=%u", + show_root_type(__entry->root_objectid), __entry->ino, + __entry->transid, __entry->nlink) +); + +TRACE_EVENT(btrfs_log_all_new_ancestors_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode, + int ret), + + TP_ARGS(trans, inode, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( u64, transid ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->transid = trans->transid; + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu transid=%llu ret=%d", + show_root_type(__entry->root_objectid), __entry->ino, + __entry->transid, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From bb10bfba7526f6c1fc27dc60bd4f53b213dc3102 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Tue, 5 May 2026 15:59:37 +0100 Subject: btrfs: tracepoints: add trace event for log_new_dir_dentries() log_new_dir_dentries() is an important step called during a fsync, as well as during rename and link operations on inodes that were previously logged. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 53 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index d16de652a815..c13c1ce0b344 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1175,6 +1175,59 @@ TRACE_EVENT(btrfs_log_all_new_ancestors_exit, __entry->transid, __entry->ret) ); +TRACE_EVENT(btrfs_log_new_dir_dentries_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode), + + TP_ARGS(trans, inode), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( u64, transid ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->transid = trans->transid; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu transid=%llu", + show_root_type(__entry->root_objectid), __entry->ino, + __entry->transid) +); + +TRACE_EVENT(btrfs_log_new_dir_dentries_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode, + int ret), + + TP_ARGS(trans, inode, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, ino ) + __field( u64, transid ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(inode->root->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->ino = btrfs_ino(inode); + __entry->transid = trans->transid; + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) ino=%llu transid=%llu ret=%d", + show_root_type(__entry->root_objectid), __entry->ino, + __entry->transid, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From 0cad7630425f4c9ee0dfa376ff8bf60c88ff2566 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 12 May 2026 12:12:42 -0400 Subject: nfs: store the full NFS fileid in inode->i_ino Now that inode->i_ino is a 64-bit value, store the full NFS fileid in it directly instead of an XOR-folded hash. This makes NFS_FILEID() and set_nfs_fileid() operate on inode->i_ino rather than the separate nfsi->fileid field. Since iget5_locked() and ilookup5() now accept a u64 hashval, pass the full fileid as the hash parameter directly. Convert direct nfsi->fileid accesses in nfs_check_inode_attributes(), nfs_update_inode(), and nfs_same_file() to use inode->i_ino. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton Signed-off-by: Anna Schumaker --- include/linux/nfs_fs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 4623262da3c0..8e48053b3069 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -396,12 +396,12 @@ static inline int NFS_STALE(const struct inode *inode) static inline __u64 NFS_FILEID(const struct inode *inode) { - return NFS_I(inode)->fileid; + return inode->i_ino; } static inline void set_nfs_fileid(struct inode *inode, __u64 fileid) { - NFS_I(inode)->fileid = fileid; + inode->i_ino = fileid; } static inline void nfs_mark_for_revalidate(struct inode *inode) -- cgit v1.2.3 From 0e06a884f5ba6226829441bfc656ff9f5e9e90ac Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 12 May 2026 12:12:43 -0400 Subject: nfs: remove nfs_compat_user_ino64() and deprecate enable_ino64 Now that inode->i_ino stores the full 64-bit NFS fileid, the nfs_compat_user_ino64() function is no longer needed. generic_fillattr() already copies inode->i_ino into stat->ino, so the explicit override in nfs_getattr() is also redundant. Also remove the now-unused nfs_fileid_to_ino_t() and nfs_fattr_to_ino_t() helper functions that were used to XOR-fold 64-bit fileids into the old unsigned long i_ino. Keep the enable_ino64 module parameter as a deprecated stub that accepts but ignores the value, logging a notice when set. This avoids breaking existing configurations that pass nfs.enable_ino64 on the kernel command line or in modprobe.d. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton Signed-off-by: Anna Schumaker --- include/linux/nfs_fs.h | 10 ---------- 1 file changed, 10 deletions(-) (limited to 'include') diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 8e48053b3069..6d6fa62ede10 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -473,7 +473,6 @@ extern void nfs_file_set_open_context(struct file *filp, struct nfs_open_context extern void nfs_file_clear_open_context(struct file *flip); extern struct nfs_lock_context *nfs_get_lock_context(struct nfs_open_context *ctx); extern void nfs_put_lock_context(struct nfs_lock_context *l_ctx); -extern u64 nfs_compat_user_ino64(u64 fileid); extern void nfs_fattr_init(struct nfs_fattr *fattr); extern void nfs_fattr_set_barrier(struct nfs_fattr *fattr); extern unsigned long nfs_inc_attr_generation_counter(void); @@ -668,15 +667,6 @@ static inline loff_t nfs_size_to_loff_t(__u64 size) return min_t(u64, size, OFFSET_MAX); } -static inline ino_t -nfs_fileid_to_ino_t(u64 fileid) -{ - ino_t ino = (ino_t) fileid; - if (sizeof(ino_t) < sizeof(u64)) - ino ^= fileid >> (sizeof(u64)-sizeof(ino_t)) * 8; - return ino; -} - static inline void nfs_ooo_clear(struct nfs_inode *nfsi) { nfsi->cache_validity &= ~NFS_INO_DATA_INVAL_DEFER; -- cgit v1.2.3 From 2026c8a96afe6e5783497860c4af0a0e1a53991b Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 12 May 2026 12:12:44 -0400 Subject: nfs: replace NFS_FILEID() and nfsi->fileid with inode->i_ino Now that inode->i_ino stores the full 64-bit NFS fileid, replace all uses of NFS_FILEID(), set_nfs_fileid(), and direct nfsi->fileid accesses with inode->i_ino throughout the NFS client. Remove the NFS_FILEID() and set_nfs_fileid() helper functions from include/linux/nfs_fs.h since they are no longer needed. Also fix two pre-existing truncation bugs in nfs4trace.h where fileid trace fields were declared as u32 instead of u64. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton Signed-off-by: Anna Schumaker --- include/linux/nfs_fs.h | 10 ---------- 1 file changed, 10 deletions(-) (limited to 'include') diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 6d6fa62ede10..83063f4ab488 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -394,16 +394,6 @@ static inline int NFS_STALE(const struct inode *inode) return test_bit(NFS_INO_STALE, &NFS_I(inode)->flags); } -static inline __u64 NFS_FILEID(const struct inode *inode) -{ - return inode->i_ino; -} - -static inline void set_nfs_fileid(struct inode *inode, __u64 fileid) -{ - inode->i_ino = fileid; -} - static inline void nfs_mark_for_revalidate(struct inode *inode) { struct nfs_inode *nfsi = NFS_I(inode); -- cgit v1.2.3 From bd5e6b056bd0900d8efde90da7a5877dc50842c7 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Tue, 12 May 2026 12:12:45 -0400 Subject: nfs: remove fileid field from struct nfs_inode Now that all NFS client code uses inode->i_ino directly to store and access the 64-bit NFS fileid, the separate fileid field in struct nfs_inode is unused. Remove it to save 8 bytes per NFS inode. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Jeff Layton Signed-off-by: Anna Schumaker --- include/linux/nfs_fs.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include') diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 83063f4ab488..ec17e602c979 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -145,11 +145,6 @@ struct nfs4_xattr_cache; * nfs fs inode data in memory */ struct nfs_inode { - /* - * The 64bit 'inode number' - */ - __u64 fileid; - /* * NFS file handle */ -- cgit v1.2.3 From 3ff72e1cdf5c337b6acfcf3fcef748c5b9a5316b Mon Sep 17 00:00:00 2001 From: Clark Wang Date: Tue, 2 Jun 2026 19:04:38 +0800 Subject: nfs: keep PG_UPTODATE clear after read errors in page groups When a read request is split into multiple subrequests, earlier completions may advance PG_UPTODATE state for the page group once their bytes fall within hdr->good_bytes. If a later subrequest in the same group then completes with NFS_IOHDR_ERROR, the read path needs to clear any accumulated PG_UPTODATE state and keep later completions from rebuilding it. Otherwise, a subsequent successful subrequest can re-enter nfs_page_group_set_uptodate(), restore the page-group sync state, and leave stale PG_UPTODATE behind for nfs_page_group_destroy() to trip over in nfs_free_request(). Add a sticky page-group read-failed flag. Once any subrequest in the group is known to be bad, mark the group failed, clear any accumulated PG_UPTODATE state, and refuse further PG_UPTODATE synchronization for the rest of the completion walk. Fixes: 67d0338edd71 ("nfs: page group syncing in read path") Signed-off-by: Clark Wang Signed-off-by: Anna Schumaker --- include/linux/nfs_page.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h index afe1d8f09d89..4b9a35dbc062 100644 --- a/include/linux/nfs_page.h +++ b/include/linux/nfs_page.h @@ -33,6 +33,7 @@ enum { PG_TEARDOWN, /* page group sync for destroy */ PG_UNLOCKPAGE, /* page group sync bit in read path */ PG_UPTODATE, /* page group sync bit in read path */ + PG_READ_FAILED, /* page group saw a read error */ PG_WB_END, /* page group sync bit in write path */ PG_REMOVE, /* page group sync bit in write path */ PG_CONTENDED1, /* Is someone waiting for a lock? */ -- cgit v1.2.3 From badad6fad60def1b9805559dd81dbab3d97b82aa Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Thu, 4 Jun 2026 15:03:13 -0300 Subject: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be re-evaluated to ensure it is properly pinned as RW. Since the umem is hidden inside each driver's mr struct add a ib_umem_check_rereg() function that each driver has to call before processing IB_MR_REREG_ACCESS. mlx4 has to retain its duplicate ib_access_writable check because it implements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items in place sequentially while the MR is live, so it will continue to not support this combination. Cc: stable@vger.kernel.org Fixes: b40656aa7d55 ("RDMA/umem: remove FOLL_FORCE usage") Link: https://patch.msgid.link/r/0-v1-06fb1a2d6cf5+107-rereg_access_jgg@nvidia.com Reported-by: Philip Tsukerman Signed-off-by: Jason Gunthorpe --- include/rdma/ib_umem.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 2ad52cc1d52b..49172098a8de 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -156,6 +156,8 @@ void ib_umem_dmabuf_revoke_lock(struct ib_umem_dmabuf *umem_dmabuf); void ib_umem_dmabuf_revoke_unlock(struct ib_umem_dmabuf *umem_dmabuf); void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf); +int ib_umem_check_rereg(struct ib_umem *umem, int flags, int new_access_flags); + #else /* CONFIG_INFINIBAND_USER_MEM */ #include @@ -230,5 +232,11 @@ static inline void ib_umem_dmabuf_revoke_lock(struct ib_umem_dmabuf *umem_dmabuf static inline void ib_umem_dmabuf_revoke_unlock(struct ib_umem_dmabuf *umem_dmabuf) {} static inline void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf) {} +static inline int ib_umem_check_rereg(struct ib_umem *umem, int flags, + int new_access_flags) +{ + return -EOPNOTSUPP; +} + #endif /* CONFIG_INFINIBAND_USER_MEM */ #endif /* IB_UMEM_H */ -- cgit v1.2.3 From 50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3 Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Wed, 3 Jun 2026 22:27:43 -0300 Subject: RDMA/nldev: Fix locking when accessing mr->pd Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer. Fixes: da5c85078215 ("RDMA/nldev: add driver-specific resource tracking") Link: https://patch.msgid.link/r/4-v1-29ebd2c229b5+fd5-ib_mr_pd_jgg@nvidia.com Signed-off-by: Jason Gunthorpe --- include/rdma/ib_verbs.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 0daa5089d539..794746de8db0 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1977,6 +1977,11 @@ struct ib_dmah { struct ib_mr { struct ib_device *device; + /* + * Due to IB_MR_REREG_PD pd is not a fixed pointer and can change. For a + * user MR, this value should only be read from a system call that holds + * the uobject lock, or the driver should disable in-place REREG_PD. + */ struct ib_pd *pd; u32 lkey; u32 rkey; -- cgit v1.2.3 From 325fea33e141a9c131475c97fb8e040f63fa4cab Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Wed, 27 May 2026 06:45:52 +0000 Subject: ASoC: simple-card: remove platform data style Simple-Card has created for "platform data" style first, and expanded to "DT style". Current Simple-Card "platform data" style should not work during almost 10 years, but no one reported it. No one is using "platform data" style. Let's remove its support. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87v7c9e4f4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/simple_card.h | 26 -------------------------- 1 file changed, 26 deletions(-) delete mode 100644 include/sound/simple_card.h (limited to 'include') diff --git a/include/sound/simple_card.h b/include/sound/simple_card.h deleted file mode 100644 index 2e999916dbd7..000000000000 --- a/include/sound/simple_card.h +++ /dev/null @@ -1,26 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 - * - * ASoC simple sound card support - * - * Copyright (C) 2012 Renesas Solutions Corp. - * Kuninori Morimoto - */ - -#ifndef __SIMPLE_CARD_H -#define __SIMPLE_CARD_H - -#include -#include - -struct simple_util_info { - const char *name; - const char *card; - const char *codec; - const char *platform; - - unsigned int daifmt; - struct simple_util_dai cpu_dai; - struct simple_util_dai codec_dai; -}; - -#endif /* __SIMPLE_CARD_H */ -- cgit v1.2.3 From 06ff6ffec2f73f315558483d723a4bf81f2bcd3a Mon Sep 17 00:00:00 2001 From: Baojun Xu Date: Tue, 2 Jun 2026 18:05:32 +0800 Subject: ASoC: tas2781: Add TAS2573 support The TAS2573 belongs to the TAS257x device family, featuring an integrated DSP and IV sensing capability. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20260602100532.6463-2-baojun.xu@ti.com Signed-off-by: Mark Brown --- include/sound/tas2781.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/sound/tas2781.h b/include/sound/tas2781.h index 95296bb4a33a..d45f805b5d18 100644 --- a/include/sound/tas2781.h +++ b/include/sound/tas2781.h @@ -120,6 +120,7 @@ enum audio_device { TAS2568, TAS2570, TAS2572, + TAS2573, TAS2574, TAS2781, TAS5802, -- cgit v1.2.3 From 4d72cac328911a0ceb2292678b1f6163adeffca1 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Fri, 29 May 2026 14:20:21 -0700 Subject: watchdog: linux/watchdog.h: repair kernel-doc comments Convert struct comments to correct kernel-doc format and add one missing struct member description. Signed-off-by: Randy Dunlap Signed-off-by: Guenter Roeck --- include/linux/watchdog.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/watchdog.h b/include/linux/watchdog.h index 62cdd26fd025..29cd03686154 100644 --- a/include/linux/watchdog.h +++ b/include/linux/watchdog.h @@ -26,7 +26,8 @@ struct watchdog_device; struct watchdog_core_data; struct watchdog_governor; -/** struct watchdog_ops - The watchdog-devices operations +/** + * struct watchdog_ops - The watchdog-devices operations * * @owner: The module owner. * @start: The routine for starting the watchdog device. @@ -59,7 +60,8 @@ struct watchdog_ops { long (*ioctl)(struct watchdog_device *, unsigned int, unsigned long); }; -/** struct watchdog_device - The structure that defines a watchdog device +/** + * struct watchdog_device - The structure that defines a watchdog device * * @id: The watchdog's ID. (Allocated by watchdog_register_device) * @parent: The parent bus device @@ -83,6 +85,8 @@ struct watchdog_ops { * Replaces max_timeout if specified. * @reboot_nb: The notifier block to stop watchdog on reboot. * @restart_nb: The notifier block to register a restart function. + * @pm_nb: The notifier block to stop watchdog on suspend and restart it + * on resume. * @driver_data:Pointer to the drivers private data. * @wd_data: Pointer to watchdog core internal data. * @status: Field that contains the devices internal status bits. -- cgit v1.2.3 From 38ecabc9af8be21fcb07f19634b56b6ec2d70268 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Fri, 29 May 2026 14:20:22 -0700 Subject: watchdog: uapi: add comments for what bit masks apply to Add comments similar to those in include/linux/watchdog.h so that the reader/user doesn't have to dig into the API documentation files for this. Signed-off-by: Randy Dunlap Signed-off-by: Guenter Roeck --- include/uapi/linux/watchdog.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/watchdog.h b/include/uapi/linux/watchdog.h index b15cde5c9054..fc73c17ee182 100644 --- a/include/uapi/linux/watchdog.h +++ b/include/uapi/linux/watchdog.h @@ -36,6 +36,7 @@ struct watchdog_info { #define WDIOF_UNKNOWN -1 /* Unknown flag error */ #define WDIOS_UNKNOWN -1 /* Unknown status error */ +/* Bit masks for watchdog_info.options, GETSTATUS and GETBOOTSTATUS ioctls */ #define WDIOF_OVERHEAT 0x0001 /* Reset due to CPU overheat */ #define WDIOF_FANFAULT 0x0002 /* Fan failed */ #define WDIOF_EXTERN1 0x0004 /* External relay 1 */ @@ -50,6 +51,7 @@ struct watchdog_info { other external alarm not a reboot */ #define WDIOF_KEEPALIVEPING 0x8000 /* Keep alive ping reply */ +/* Bit masks for WDIOC_SETOPTIONS ioctl */ #define WDIOS_DISABLECARD 0x0001 /* Turn off the watchdog timer */ #define WDIOS_ENABLECARD 0x0002 /* Turn on the watchdog timer */ #define WDIOS_TEMPPANIC 0x0004 /* Kernel panic on temperature trip */ -- cgit v1.2.3 From 4837fb36219e6c08b666bc31a86841bad8526358 Mon Sep 17 00:00:00 2001 From: Yang Erkun Date: Thu, 26 Feb 2026 09:22:03 +0800 Subject: nfs: use nfsi->rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the fix is to also use nfsi->rwsem in this case. Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into _nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4: nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also, nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore, nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set. Reported-by: Li Lingfeng Closes: https://lore.kernel.org/all/20250419085709.1452492-1-lilingfeng3@huawei.com/ Closes: https://lore.kernel.org/all/20250715030559.2906634-1-lilingfeng3@huawei.com/ Fixes: c69899a17ca4 ("NFSv4: Update of VFS byte range lock must be atomic with the stateid update") Signed-off-by: Yang Erkun Reviewed-by: Jeff Layton Signed-off-by: Anna Schumaker --- include/linux/nfs_xdr.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h index fcbd21b5685f..40417e3a7f85 100644 --- a/include/linux/nfs_xdr.h +++ b/include/linux/nfs_xdr.h @@ -580,7 +580,6 @@ struct nfs_lock_args { struct nfs_lowner lock_owner; unsigned char block : 1; unsigned char reclaim : 1; - unsigned char new_lock : 1; unsigned char new_lock_owner : 1; }; -- cgit v1.2.3 From efc22b3f89a3cab9a779f604ef66e7b9c3bfaa72 Mon Sep 17 00:00:00 2001 From: Shashank Balaji Date: Mon, 18 May 2026 19:19:59 +0900 Subject: coresight: pass THIS_MODULE implicitly through a macro Rename coresight_init_driver() to coresight_init_driver_with_owner() and replace it with a macro wrapper that passes THIS_MODULE implicitly. This is in line with what other buses do. Suggested-by: Greg Kroah-Hartman Reviewed-by: Leo Yan Co-developed-by: Rahul Bukte Signed-off-by: Rahul Bukte Signed-off-by: Shashank Balaji Link: https://patch.msgid.link/20260518-acpi_mod_name-v5-3-705ccc430885@sony.com Signed-off-by: Danilo Krummrich --- include/linux/coresight.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/coresight.h b/include/linux/coresight.h index 2131febebee9..cd8fb47a1192 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -691,8 +691,10 @@ coresight_find_output_type(struct coresight_platform_data *pdata, enum coresight_dev_type type, union coresight_dev_subtype subtype); -int coresight_init_driver(const char *drv, struct amba_driver *amba_drv, - struct platform_driver *pdev_drv, struct module *owner); +int coresight_init_driver_with_owner(const char *drv, struct amba_driver *amba_drv, + struct platform_driver *pdev_drv, struct module *owner); +#define coresight_init_driver(drv, amba_drv, pdev_drv) \ + coresight_init_driver_with_owner(drv, amba_drv, pdev_drv, THIS_MODULE) void coresight_remove_driver(struct amba_driver *amba_drv, struct platform_driver *pdev_drv); -- cgit v1.2.3 From a7a7dc5c46a036e8a581a4269839d92aded0e0ea Mon Sep 17 00:00:00 2001 From: Shashank Balaji Date: Mon, 18 May 2026 19:20:00 +0900 Subject: driver core: platform: set mod_name in driver registration Pass KBUILD_MODNAME through the driver registration macro so that the driver core can create the module symlink in sysfs for built-in drivers, and fixup all callers. The Rust platform adapter is updated to pass the module name through to the new parameter. Tested on qemu with: - x86 defconfig + CONFIG_RUST - arm64 defconfig + CONFIG_RUST + CONFIG_CORESIGHT stuff Examples after this patch: /sys/bus/platform/drivers/... coresight-itnoc/module -> coresight_tnoc coresight-static-tpdm/module -> coresight_tpdm coresight-catu-platform/module -> coresight_catu serial8250/module -> 8250 acpi-ged/module -> acpi vmclock/module -> ptp_vmclock Co-developed-by: Rahul Bukte Signed-off-by: Rahul Bukte Signed-off-by: Shashank Balaji Link: https://patch.msgid.link/20260518-acpi_mod_name-v5-4-705ccc430885@sony.com Signed-off-by: Danilo Krummrich --- include/linux/coresight.h | 5 +++-- include/linux/platform_device.h | 17 +++++++++-------- 2 files changed, 12 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/coresight.h b/include/linux/coresight.h index cd8fb47a1192..1cf85d772bea 100644 --- a/include/linux/coresight.h +++ b/include/linux/coresight.h @@ -692,9 +692,10 @@ coresight_find_output_type(struct coresight_platform_data *pdata, union coresight_dev_subtype subtype); int coresight_init_driver_with_owner(const char *drv, struct amba_driver *amba_drv, - struct platform_driver *pdev_drv, struct module *owner); + struct platform_driver *pdev_drv, struct module *owner, + const char *mod_name); #define coresight_init_driver(drv, amba_drv, pdev_drv) \ - coresight_init_driver_with_owner(drv, amba_drv, pdev_drv, THIS_MODULE) + coresight_init_driver_with_owner(drv, amba_drv, pdev_drv, THIS_MODULE, KBUILD_MODNAME) void coresight_remove_driver(struct amba_driver *amba_drv, struct platform_driver *pdev_drv); diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h index 975400a472e3..26e6a43358e2 100644 --- a/include/linux/platform_device.h +++ b/include/linux/platform_device.h @@ -293,18 +293,19 @@ struct platform_driver { * use a macro to avoid include chaining to get THIS_MODULE */ #define platform_driver_register(drv) \ - __platform_driver_register(drv, THIS_MODULE) + __platform_driver_register(drv, THIS_MODULE, KBUILD_MODNAME) extern int __platform_driver_register(struct platform_driver *, - struct module *); + struct module *, const char *mod_name); extern void platform_driver_unregister(struct platform_driver *); /* non-hotpluggable platform devices may use this so that probe() and * its support may live in __init sections, conserving runtime memory. */ #define platform_driver_probe(drv, probe) \ - __platform_driver_probe(drv, probe, THIS_MODULE) + __platform_driver_probe(drv, probe, THIS_MODULE, KBUILD_MODNAME) extern int __platform_driver_probe(struct platform_driver *driver, - int (*probe)(struct platform_device *), struct module *module); + int (*probe)(struct platform_device *), struct module *module, + const char *mod_name); static inline void *platform_get_drvdata(const struct platform_device *pdev) { @@ -368,19 +369,19 @@ static int __init __platform_driver##_init(void) \ device_initcall(__platform_driver##_init); \ #define platform_create_bundle(driver, probe, res, n_res, data, size) \ - __platform_create_bundle(driver, probe, res, n_res, data, size, THIS_MODULE) + __platform_create_bundle(driver, probe, res, n_res, data, size, THIS_MODULE, KBUILD_MODNAME) extern struct platform_device *__platform_create_bundle( struct platform_driver *driver, int (*probe)(struct platform_device *), struct resource *res, unsigned int n_res, - const void *data, size_t size, struct module *module); + const void *data, size_t size, struct module *module, const char *mod_name); int __platform_register_drivers(struct platform_driver * const *drivers, - unsigned int count, struct module *owner); + unsigned int count, struct module *owner, const char *mod_name); void platform_unregister_drivers(struct platform_driver * const *drivers, unsigned int count); #define platform_register_drivers(drivers, count) \ - __platform_register_drivers(drivers, count, THIS_MODULE) + __platform_register_drivers(drivers, count, THIS_MODULE, KBUILD_MODNAME) #ifdef CONFIG_SUSPEND extern int platform_pm_suspend(struct device *dev); -- cgit v1.2.3 From 01d5e237b33931b970dd190dd6a19c5ef32c105d Mon Sep 17 00:00:00 2001 From: Hongjie Fang Date: Fri, 5 Jun 2026 19:20:34 +0800 Subject: scsi: ufs: core: Handle PM commands timeout before SCSI EH A PM START STOP sent from the UFS well-known LU resume path can race with SCSI EH: The "wl resume" task flow is: __ufshcd_wl_resume() ufshcd_set_dev_pwr_mode(UFS_ACTIVE_PWR_MODE) ufshcd_execute_start_stop() scsi_execute_cmd() blk_execute_rq <-- wait scsi_check_passthrough() <-- may retry START STOP If the first START STOP time out, SCSI EH may already recover the link and reset the device before scsi_execute_cmd() returns: scsi_timeout() scsi_eh_scmd_add() scsi_error_handler() scsi_unjam_host() scsi_eh_ready_devs() scsi_eh_host_reset() ufshcd_eh_host_reset_handler() if (hba->pm_op_in_progress) ufshcd_link_recovery() ufshcd_device_reset() ufshcd_host_reset_and_restore() ... scsi_eh_flush_done_q() <-- wakeup "wl resume" task ... <-- host still in SHOST_RECOVERY scsi_restart_operations() A later passthrough retry can then run while the host is still in SHOST_RECOVERY and hit the SCMD_FAIL_IF_RECOVERING path: scsi_queue_rq() if (scsi_host_in_recovery(shost) && cmd->flags & SCMD_FAIL_IF_RECOVERING) return BLK_STS_OFFLINE That retry completes with DID_ERROR or DID_NO_CONNECT even though EH may already have restored the device to an operational ACTIVE state. Handle these PM timeouts directly from ufshcd_eh_timed_out() instead. After ufshcd_link_recovery(), complete the timed-out command immediately if it has not been completed already. For regular SCSI commands, complete them with DID_REQUEUE to match the existing MCQ force-completion semantics and allow scsi_execute_cmd() to retry if needed. For reserved internal device-management commands, finish the request with DID_TIME_OUT without calling ufshcd_release_scsi_cmd() since those commands use different resource lifetime rules. The system_suspending flag is no longer needed because PM command timeout handling now uses pm_op_in_progress. Fixes: b8c3a7bac9b6 ("scsi: ufs: Have midlayer retry start stop errors") Signed-off-by: Hongjie Fang Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Link: https://patch.msgid.link/20260605112034.3802540-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen --- include/ufs/ufshcd.h | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h index 3eaae082329c..248d0a5bef40 100644 --- a/include/ufs/ufshcd.h +++ b/include/ufs/ufshcd.h @@ -1029,8 +1029,6 @@ enum ufshcd_mcq_opr { * @caps: bitmask with information about UFS controller capabilities * @devfreq: frequency scaling information owned by the devfreq core * @clk_scaling: frequency scaling information owned by the UFS driver - * @system_suspending: system suspend has been started and system resume has - * not yet finished. * @is_sys_suspended: UFS device has been suspended because of system suspend * @urgent_bkops_lvl: keeps track of urgent bkops level for device * @is_urgent_bkops_lvl_checked: keeps track if the urgent bkops level for @@ -1206,7 +1204,6 @@ struct ufs_hba { struct devfreq *devfreq; struct ufs_clk_scaling clk_scaling; - bool system_suspending; bool is_sys_suspended; enum bkops_status urgent_bkops_lvl; -- cgit v1.2.3 From a543cb49e603f88917e3258bbcb59a60d9c3c2fa Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Thu, 4 Jun 2026 22:46:25 +0000 Subject: net: Remove rtnl_held of struct fib_dump_filter. Commit 22e36ea9f5d7 ("inet: allow ip_valid_fib_dump_req() to be called with RTNL or RCU") introduced the rtnl_held field in struct fib_dump_filter to switch __dev_get_by_index() and dev_get_by_index_rcu() depending on the caller's context. This field served as an interim measure while we were incrementally converting all callers of ip_valid_fib_dump_req() to RCU. Now that all users (IPv4, IPv6, ipmr, ip6mr, and MPLS) have been converted to RCU, the field is no longer necessary. Let's remove it. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-8-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/ip_fib.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h index 318593743b6e..1142ffad7444 100644 --- a/include/net/ip_fib.h +++ b/include/net/ip_fib.h @@ -269,7 +269,6 @@ struct fib_dump_filter { bool filter_set; bool dump_routes; bool dump_exceptions; - bool rtnl_held; unsigned char protocol; unsigned char rt_type; unsigned int flags; -- cgit v1.2.3 From a4c98421720a79587ad6c528f81fe7976a45976b Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Thu, 4 Jun 2026 22:46:32 +0000 Subject: ip6mr: Replace RTNL with a dedicated mutex for MFC. ip6mr does not have rtnetlink interface for MFC unlike ipmr, which uses dev_get_by_index_rcu() to set struct mfcctl.mfcc_parent. ip6mr_mfc_add() and ip6mr_mfc_delete() are called under RTNL from ip6_mroute_setsockopt() only. There are no RTNL dependant, but ip6_mroute_setsockopt() reuses RTNL just for mrt->mfc_hash and mrt->mfc_cache_list. Let's replace RTNL with a new per-netns mutex. Later, ip6mr_notifier_ops and ipmr_seq will be moved under CONFIG_IPV6_MROUTE. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-15-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/netns/ipv6.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h index 875916d60bfe..668f10498c5c 100644 --- a/include/net/netns/ipv6.h +++ b/include/net/netns/ipv6.h @@ -112,6 +112,7 @@ struct netns_ipv6 { struct list_head mr6_tables; struct fib_rules_ops *mr6_rules_ops; #endif + struct mutex mfc_mutex; #endif atomic_t dev_addr_genid; atomic_t fib6_sernum; -- cgit v1.2.3 From 5499868699eebf14ff143495766264964b3a2e9e Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Thu, 4 Jun 2026 22:46:33 +0000 Subject: ip6mr: Define net->ipv6.{ip6mr_notifier_ops,ipmr_seq} under CONFIG_IPV6_MROUTE. net->ipv6.ip6mr_notifier_ops and net->ipv6.ipmr_seq are used only in net/ipv6/ip6mr.c. Let's move these definitions under CONFIG_IPV6_MROUTE. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260604224712.3209821-16-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/netns/ipv6.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h index 668f10498c5c..ffda15318be5 100644 --- a/include/net/netns/ipv6.h +++ b/include/net/netns/ipv6.h @@ -112,14 +112,14 @@ struct netns_ipv6 { struct list_head mr6_tables; struct fib_rules_ops *mr6_rules_ops; #endif + struct fib_notifier_ops *ip6mr_notifier_ops; + atomic_t ipmr_seq; struct mutex mfc_mutex; #endif atomic_t dev_addr_genid; atomic_t fib6_sernum; struct seg6_pernet_data *seg6_data; struct fib_notifier_ops *notifier_ops; - struct fib_notifier_ops *ip6mr_notifier_ops; - atomic_t ipmr_seq; int flowlabel_count; struct { struct hlist_head head; -- cgit v1.2.3 From f5cf8c92a2b9fd176d90b6e217ed50fbb5d1f48d Mon Sep 17 00:00:00 2001 From: Joshua Hahn Date: Fri, 29 May 2026 13:27:54 -0700 Subject: mm/nodemask: correctly describe nodemask operation return types Commit 0dfe54071d7c8 ("nodemask: Fix return values to be unsigned") changed a number of nodemask operations that used to return int to returning a bool instead. However, it did not update the comment block that described these functions, leaving the documentation incorrect. Fix the comment block to accurately describe the functions. Also fix a typo (unsigend --> unsigned), and fix a callsite in mempolicy.c that did not get updated during the conversion. No functional changes intended; changes are purely cosmetic. Link: https://lore.kernel.org/20260529202755.1846800-1-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Reviewed-by: SeongJae Park Cc: Alistair Popple Cc: Byungchul Park Cc: David Hildenbrand Cc: Gregory Price Cc: Matthew Brost Cc: Rakie Kim Cc: Rasmus Villemoes Cc: Ying Huang Cc: Yury Norov (NVIDIA) Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/nodemask.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h index 204c92462f3c..b842aa525546 100644 --- a/include/linux/nodemask.h +++ b/include/linux/nodemask.h @@ -24,23 +24,23 @@ * void nodes_setall(mask) set all bits * void nodes_clear(mask) clear all bits * int node_isset(node, mask) true iff bit 'node' set in mask - * int node_test_and_set(node, mask) test and set bit 'node' in mask + * bool node_test_and_set(node, mask) test and set bit 'node' in mask * - * void nodes_and(dst, src1, src2) dst = src1 & src2 [intersection] + * bool nodes_and(dst, src1, src2) dst = src1 & src2 [intersection] * void nodes_or(dst, src1, src2) dst = src1 | src2 [union] * void nodes_xor(dst, src1, src2) dst = src1 ^ src2 - * void nodes_andnot(dst, src1, src2) dst = src1 & ~src2 + * bool nodes_andnot(dst, src1, src2) dst = src1 & ~src2 * void nodes_complement(dst, src) dst = ~src * - * int nodes_equal(mask1, mask2) Does mask1 == mask2? - * int nodes_intersects(mask1, mask2) Do mask1 and mask2 intersect? - * int nodes_subset(mask1, mask2) Is mask1 a subset of mask2? - * int nodes_empty(mask) Is mask empty (no bits sets)? - * int nodes_full(mask) Is mask full (all bits sets)? + * bool nodes_equal(mask1, mask2) Does mask1 == mask2? + * bool nodes_intersects(mask1, mask2) Do mask1 and mask2 intersect? + * bool nodes_subset(mask1, mask2) Is mask1 a subset of mask2? + * bool nodes_empty(mask) Is mask empty (no bits sets)? + * bool nodes_full(mask) Is mask full (all bits sets)? * int nodes_weight(mask) Hamming weight - number of set bits * * unsigned int first_node(mask) Number lowest set bit, or MAX_NUMNODES - * unsigend int next_node(node, mask) Next node past 'node', or MAX_NUMNODES + * unsigned int next_node(node, mask) Next node past 'node', or MAX_NUMNODES * unsigned int next_node_in(node, mask) Next node past 'node', or wrap to first, * or MAX_NUMNODES * unsigned int first_unset_node(mask) First node not set in mask, or -- cgit v1.2.3 From 1479b44c7203b2cad3393533c64aa16d42056310 Mon Sep 17 00:00:00 2001 From: Johannes Weiner Date: Wed, 27 May 2026 16:45:13 -0400 Subject: mm: list_lru: introduce caller locking for additions and deletions Locking is currently internal to the list_lru API. However, a caller might want to keep auxiliary state synchronized with the LRU state. For example, the THP shrinker uses the lock of its custom LRU to keep PG_partially_mapped and vmstats consistent. To allow the THP shrinker to switch to list_lru, provide normal and irqsafe locking primitives as well as caller-locked variants of the addition and deletion functions. Link: https://lore.kernel.org/20260527204757.2544958-7-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: David Hildenbrand (Arm) Acked-by: Shakeel Butt Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Liam R. Howlett (Oracle) Cc: Baolin Wang Cc: Barry Song Cc: Dave Chinner Cc: Dev Jain Cc: Kairui Song Cc: Lance Yang Cc: Michal Hocko Cc: Mikhail Zaslonko Cc: Muchun Song Cc: Nico Pache Cc: Roman Gushchin Cc: Ryan Roberts Cc: Usama Arif Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/list_lru.h | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) (limited to 'include') diff --git a/include/linux/list_lru.h b/include/linux/list_lru.h index fe739d35a864..134cb3e5652a 100644 --- a/include/linux/list_lru.h +++ b/include/linux/list_lru.h @@ -83,6 +83,46 @@ int memcg_list_lru_alloc(struct mem_cgroup *memcg, struct list_lru *lru, gfp_t gfp); void memcg_reparent_list_lrus(struct mem_cgroup *memcg, struct mem_cgroup *parent); +/** + * list_lru_lock: lock the sublist for the given node and memcg + * @lru: the lru pointer + * @nid: the node id of the sublist to lock. + * @memcg: pointer to the cgroup of the sublist to lock. On return, + * updated to the cgroup whose sublist was actually locked, + * which may be an ancestor if the original memcg was dying. + * + * Returns the locked list_lru_one sublist. The caller must call + * list_lru_unlock() when done. + * + * You must ensure that the memcg is not freed during this call (e.g., with + * rcu or by taking a css refcnt). + * + * Return: the locked list_lru_one, or NULL on failure + */ +struct list_lru_one *list_lru_lock(struct list_lru *lru, int nid, + struct mem_cgroup **memcg); + +/** + * list_lru_unlock: unlock a sublist locked by list_lru_lock() + * @l: the list_lru_one to unlock + */ +void list_lru_unlock(struct list_lru_one *l); + +struct list_lru_one *list_lru_lock_irq(struct list_lru *lru, int nid, + struct mem_cgroup **memcg); +void list_lru_unlock_irq(struct list_lru_one *l); + +struct list_lru_one *list_lru_lock_irqsave(struct list_lru *lru, int nid, + struct mem_cgroup **memcg, unsigned long *irq_flags); +void list_lru_unlock_irqrestore(struct list_lru_one *l, + unsigned long *irq_flags); + +/* Caller-locked variants, see list_lru_add() etc for documentation */ +bool __list_lru_add(struct list_lru *lru, struct list_lru_one *l, + struct list_head *item, int nid, struct mem_cgroup *memcg); +bool __list_lru_del(struct list_lru *lru, struct list_lru_one *l, + struct list_head *item, int nid); + /** * list_lru_add: add an element to the lru list's tail * @lru: the lru pointer @@ -115,6 +155,9 @@ void memcg_reparent_list_lrus(struct mem_cgroup *memcg, struct mem_cgroup *paren bool list_lru_add(struct list_lru *lru, struct list_head *item, int nid, struct mem_cgroup *memcg); +bool list_lru_add_irq(struct list_lru *lru, struct list_head *item, int nid, + struct mem_cgroup *memcg); + /** * list_lru_add_obj: add an element to the lru list's tail * @lru: the lru pointer -- cgit v1.2.3 From ae64f07a6a4018c73111b3cd4e1c5598ce5cfa84 Mon Sep 17 00:00:00 2001 From: Johannes Weiner Date: Wed, 27 May 2026 16:45:14 -0400 Subject: mm: list_lru: introduce folio_memcg_list_lru_alloc() memcg_list_lru_alloc() is called every time an object that may end up on the list_lru is created. It needs to quickly check if the list_lru heads for the memcg already exist, and allocate them when they don't. Doing this with folio objects is tricky: folio_memcg() is not stable and requires either RCU protection or pinning the cgroup. But it's desirable to make the existence check lightweight under RCU, and only pin the memcg when we need to allocate list_lru heads and may block. In preparation for switching the THP shrinker to list_lru, add a helper function for allocating list_lru heads coming from a folio. Link: https://lore.kernel.org/20260527204757.2544958-8-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: David Hildenbrand (Arm) Acked-by: Shakeel Butt Reviewed-by: Lorenzo Stoakes (Oracle) Cc: Baolin Wang Cc: Barry Song Cc: Dave Chinner Cc: Dev Jain Cc: Kairui Song Cc: Lance Yang Cc: Liam R. Howlett Cc: Michal Hocko Cc: Mikhail Zaslonko Cc: Muchun Song Cc: Nico Pache Cc: Roman Gushchin Cc: Ryan Roberts Cc: Usama Arif Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/list_lru.h | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'include') diff --git a/include/linux/list_lru.h b/include/linux/list_lru.h index 134cb3e5652a..a450fffe1550 100644 --- a/include/linux/list_lru.h +++ b/include/linux/list_lru.h @@ -81,6 +81,33 @@ static inline int list_lru_init_memcg_key(struct list_lru *lru, struct shrinker int memcg_list_lru_alloc(struct mem_cgroup *memcg, struct list_lru *lru, gfp_t gfp); + +#ifdef CONFIG_MEMCG +/** + * folio_memcg_list_lru_alloc - allocate list_lru heads for shrinkable folio + * @folio: the newly allocated & charged folio + * @lru: the list_lru this might be queued on + * @gfp: gfp mask + * + * Allocate list_lru heads (per-memcg, per-node) needed to queue this + * particular folio down the line. + * + * This does memcg_list_lru_alloc(), but on the memcg that @folio is + * associated with. Handles folio_memcg() access rules in the fast + * path (list_lru heads allocated) and the allocation slowpath. + * + * Returns 0 on success, a negative error value otherwise. + */ +int folio_memcg_list_lru_alloc(struct folio *folio, struct list_lru *lru, + gfp_t gfp); +#else +static inline int folio_memcg_list_lru_alloc(struct folio *folio, + struct list_lru *lru, gfp_t gfp) +{ + return 0; +} +#endif + void memcg_reparent_list_lrus(struct mem_cgroup *memcg, struct mem_cgroup *parent); /** -- cgit v1.2.3 From fafaeceb89a5e2e856ff04c2cacb6cae4a2ecb67 Mon Sep 17 00:00:00 2001 From: Johannes Weiner Date: Wed, 27 May 2026 16:45:16 -0400 Subject: mm: switch deferred split shrinker to list_lru The deferred split queue handles cgroups in a suboptimal fashion. The queue is per-NUMA node or per-cgroup, not the intersection. That means on a cgrouped system, a node-restricted allocation entering reclaim can end up splitting large pages on other nodes: alloc/unmap deferred_split_folio() list_add_tail(memcg->split_queue) set_shrinker_bit(memcg, node, deferred_shrinker_id) for_each_zone_zonelist_nodemask(restricted_nodes) mem_cgroup_iter() shrink_slab(node, memcg) shrink_slab_memcg(node, memcg) if test_shrinker_bit(memcg, node, deferred_shrinker_id) deferred_split_scan() walks memcg->split_queue The shrinker bit adds an imperfect guard rail. As soon as the cgroup has a single large page on the node of interest, all large pages owned by that memcg, including those on other nodes, will be split. list_lru properly sets up per-node, per-cgroup lists. As a bonus, it streamlines a lot of the list operations and reclaim walks. It's used widely by other major shrinkers already. Convert the deferred split queue as well. The list_lru per-memcg heads are instantiated on demand when the first object of interest is allocated for a cgroup, by calling folio_memcg_alloc_deferred(). Add calls to where splittable pages are created: anon faults, swapin faults, khugepaged collapse. These calls create all possible node heads for the cgroup at once, so the migration code (between nodes) doesn't need any special care. [akpm@linux-foundation.org: fix build with CONFIG_TRANSPARENT_HUGEPAGE=n] Link: https://lore.kernel.org/202605281620.lc3rtkBm-lkp@intel.com [hannes@cmpxchg.org: fix cgroup.memory=nokmem handling] Link: https://lore.kernel.org/ah9PGv12mqai84ES@cmpxchg.org Link: https://lore.kernel.org/20260527204757.2544958-10-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reported-by: Mikhail Zaslonko Tested-by: Mikhail Zaslonko Acked-by: Shakeel Butt Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: Usama Arif Reviewed-by: Kairui Song Cc: Baolin Wang Cc: Barry Song Cc: Dave Chinner Cc: David Hildenbrand (Arm) Cc: Dev Jain Cc: Lance Yang Cc: Liam R. Howlett Cc: Michal Hocko Cc: Muchun Song Cc: Nico Pache Cc: Roman Gushchin Cc: Ryan Roberts Cc: Vasily Gorbik Cc: Vlastimil Babka Cc: Zi Yan Cc: kernel test robot Signed-off-by: Andrew Morton --- include/linux/huge_mm.h | 17 ++++++++++++----- include/linux/memcontrol.h | 4 ---- include/linux/mmzone.h | 12 ------------ 3 files changed, 12 insertions(+), 21 deletions(-) (limited to 'include') diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 58382e97a66d..c0d223d0c556 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -439,10 +439,10 @@ static inline int split_huge_page(struct page *page) { return split_huge_page_to_list_to_order(page, NULL, 0); } + +int folio_memcg_alloc_deferred(struct folio *folio); + void deferred_split_folio(struct folio *folio, bool partially_mapped); -#ifdef CONFIG_MEMCG -void reparent_deferred_split_queue(struct mem_cgroup *memcg); -#endif void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, unsigned long address, bool freeze); @@ -679,8 +679,15 @@ static inline int try_folio_split_to_order(struct folio *folio, return -EINVAL; } -static inline void deferred_split_folio(struct folio *folio, bool partially_mapped) {} -static inline void reparent_deferred_split_queue(struct mem_cgroup *memcg) {} +static inline int folio_memcg_alloc_deferred(struct folio *folio) +{ + return 0; +} + +static inline void deferred_split_folio(struct folio *folio, bool partially_mapped) +{ +} + #define split_huge_pmd(__vma, __pmd, __address) \ do { } while (0) diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 8f2662db166b..e1f46a0016fc 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -278,10 +278,6 @@ struct mem_cgroup { struct memcg_cgwb_frn cgwb_frn[MEMCG_CGWB_FRN_CNT]; #endif -#ifdef CONFIG_TRANSPARENT_HUGEPAGE - struct deferred_split deferred_split_queue; -#endif - #ifdef CONFIG_LRU_GEN_WALKS_MMU /* per-memcg mm_struct list */ struct lru_gen_mm_list mm_list; diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h index 1331a7b93f33..8e449f524f26 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h @@ -1431,14 +1431,6 @@ struct zonelist { */ extern struct page *mem_map; -#ifdef CONFIG_TRANSPARENT_HUGEPAGE -struct deferred_split { - spinlock_t split_queue_lock; - struct list_head split_queue; - unsigned long split_queue_len; -}; -#endif - #ifdef CONFIG_MEMORY_FAILURE /* * Per NUMA node memory failure handling statistics. @@ -1564,10 +1556,6 @@ typedef struct pglist_data { unsigned long first_deferred_pfn; #endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */ -#ifdef CONFIG_TRANSPARENT_HUGEPAGE - struct deferred_split deferred_split_queue; -#endif - #ifdef CONFIG_NUMA_BALANCING /* start time in ms of current promote rate limit period */ unsigned int nbp_rl_start; -- cgit v1.2.3 From ed384eb3a3e121c1d6d5c5d36950fbd286b92026 Mon Sep 17 00:00:00 2001 From: fujunjie Date: Tue, 26 May 2026 12:22:41 +0000 Subject: mm/compaction: respect cpusets when checking retry suitability should_compact_retry() handles COMPACT_SKIPPED by asking compaction_zonelist_suitable() whether reclaim can make a later compaction attempt worthwhile. That answer is used for the current allocation, so it should follow the same zone eligibility rules as the allocation itself. When cpusets are enabled, allocator slowpath decisions are marked with ALLOC_CPUSET. The allocation path, direct compaction and reclaim retry all skip zones rejected by __cpuset_zone_allowed(). compaction_zonelist_suitable() does not apply that filter. It only walks ac->zonelist/ac->nodemask, so it can return true because a zone that is not usable for the current allocation would pass __compaction_suitable(). That does not let the allocation use the disallowed zone. Later allocation and direct compaction paths still apply cpuset filtering. However, it can make should_compact_retry() retry based on memory that this allocation cannot use. Pass gfp_mask down and apply the same ALLOC_CPUSET check in compaction_zonelist_suitable(). This keeps the retry decision aligned with the zones that the allocation is allowed to use. A temporary debugfs probe was also used to call the old and new compaction_zonelist_suitable() predicates in the same two-node NUMA guest. The task was restricted to mems=0 while ac->nodemask covered nodes 0-1. After putting pressure on node0, node0 failed __compaction_suitable() for order-10 and node1 passed it, but node1 was rejected by __cpuset_zone_allowed(). In that state the old predicate returned true and the patched predicate returned false. Link: https://lore.kernel.org/tencent_F59F2BA2CC5779308E10DF54593C736D3E0A@qq.com Fixes: 435b3894e742 ("mm:page_alloc: fix the NULL ac->nodemask in __alloc_pages_slowpath()") Signed-off-by: fujunjie Reviewed-by: Vlastimil Babka (SUSE) Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/compaction.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/compaction.h b/include/linux/compaction.h index 173d9c07a895..c829c48d1c71 100644 --- a/include/linux/compaction.h +++ b/include/linux/compaction.h @@ -101,7 +101,7 @@ extern void compaction_defer_reset(struct zone *zone, int order, bool alloc_success); bool compaction_zonelist_suitable(struct alloc_context *ac, int order, - int alloc_flags); + int alloc_flags, gfp_t gfp_mask); extern void __meminit kcompactd_run(int nid); extern void __meminit kcompactd_stop(int nid); -- cgit v1.2.3 From cdea4acce026f4dc6a1689cb991a2bf3a4333ecd Mon Sep 17 00:00:00 2001 From: Brendan Jackman Date: Mon, 1 Jun 2026 11:40:09 +0000 Subject: mm: delete stale comment about cachelines These comments have been wrong since commit a211c6550efc ("mm: page_alloc: defrag_mode kswapd/kcompactd watermarks") added NR_FREE_PAGES_BLOCKS. Since nobody has complained about it in the last year, it seems unlikely these comments were particularly useful anyway, so delete them. Link: https://lore.kernel.org/20260601-zone_stat_item-comment-v1-1-f452dd91d5eb@google.com Signed-off-by: Brendan Jackman Acked-by: David Hildenbrand (Arm) Reviewed-by: Lorenzo Stoakes Acked-by: Vlastimil Babka (SUSE) Signed-off-by: Andrew Morton --- include/linux/mmzone.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h index 8e449f524f26..ca2712187147 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h @@ -214,7 +214,6 @@ enum numa_stat_item { #endif enum zone_stat_item { - /* First 128 byte cacheline (assuming 64 bit words) */ NR_FREE_PAGES, NR_FREE_PAGES_BLOCKS, NR_ZONE_LRU_BASE, /* Used only for compaction and reclaim retry */ @@ -225,7 +224,6 @@ enum zone_stat_item { NR_ZONE_UNEVICTABLE, NR_ZONE_WRITE_PENDING, /* Count of dirty, writeback and unstable pages */ NR_MLOCK, /* mlock()ed pages found and moved off LRU */ - /* Second 128 byte cacheline */ #if IS_ENABLED(CONFIG_ZSMALLOC) NR_ZSPAGES, /* allocated in zsmalloc */ #endif -- cgit v1.2.3 From cc7a9f6e57c4f71e8e1fee3274b1ae8770f2a743 Mon Sep 17 00:00:00 2001 From: "Kiryl Shutsemau (Meta)" Date: Fri, 29 May 2026 18:23:30 +0100 Subject: userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks The VMA flags bitmap is a single word today: NUM_VMA_FLAG_BITS is BITS_PER_LONG, so on 32-bit vma_flags_t holds only 32 bits. (The bitmap type exists so this can grow past BITS_PER_LONG later; until it does, anything declared above the first word is out of range on 32-bit.) The bit enum nevertheless declares some bits unconditionally above BITS_PER_LONG -- VMA_UFFD_MINOR_BIT is 41, with VM_UFFD_MINOR == VM_NONE on 32-bit so no VMA actually carries the bit. __VMA_UFFD_FLAGS feeds VMA_UFFD_MINOR_BIT to mk_vma_flags() unconditionally. On 32-bit that becomes __set_bit(41, &one_long), a write one word past the end of the single-word bitmap. The compiler folds the out-of-bounds store with wraparound (1UL << (41 % 32) == bit 9) into the first word; bit 9 is already in __VMA_UFFD_FLAGS so the mask happens to come out right today, but it is an out-of-bounds write all the same, and any high-numbered bit whose mod-BITS_PER_LONG position is otherwise unused would silently OR an extra bit into the mask. Rather than feed bit numbers that may not exist on the current build to mk_vma_flags(), build the mask from whole per-mode masks that collapse to EMPTY_VMA_FLAGS when their feature is unavailable. Add mk_vma_flags_from_masks() for that, and define VMA_UFFD_MISSING / _WP / _MINOR alongside the VM_UFFD_* flags, gating VMA_UFFD_MINOR on the same config as VM_UFFD_MINOR (which implies 64BIT, where bit 41 fits). An out-of-range bit is then never materialised, on any arch, and the in-range fast path stays a compile-time constant. Link: https://lore.kernel.org/20260529172331.356655-7-kas@kernel.org Fixes: 9ea35a25d51b ("mm: introduce VMA flags bitmap type") Signed-off-by: Kiryl Shutsemau Reported-by: Sashiko AI review Suggested-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Assisted-by: Claude:claude-opus-4-8 Cc: David Hildenbrand Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Balbir Singh Cc: Signed-off-by: Andrew Morton --- include/linux/mm.h | 39 +++++++++++++++++++++++++++++++++++++++ include/linux/userfaultfd_k.h | 4 ++-- 2 files changed, 41 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mm.h b/include/linux/mm.h index 0f2612a70fb1..485df9c2dbdd 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -496,6 +496,21 @@ enum { #else #define VM_UFFD_MINOR VM_NONE #endif + +/* + * vma_flags_t masks for the userfaultfd VMA flags. VMA_UFFD_MINOR is gated on + * the same config as VM_UFFD_MINOR -- which implies 64BIT, where the bit fits + * -- so an out-of-range bit is never fed to mk_vma_flags() on a build whose + * bitmap cannot hold it. + */ +#define VMA_UFFD_MISSING mk_vma_flags(VMA_UFFD_MISSING_BIT) +#define VMA_UFFD_WP mk_vma_flags(VMA_UFFD_WP_BIT) +#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_MINOR +#define VMA_UFFD_MINOR mk_vma_flags(VMA_UFFD_MINOR_BIT) +#else +#define VMA_UFFD_MINOR EMPTY_VMA_FLAGS +#endif + #ifdef CONFIG_64BIT #define VM_ALLOW_ANY_UNCACHED INIT_VM_FLAG(ALLOW_ANY_UNCACHED) #define VM_SEALED INIT_VM_FLAG(SEALED) @@ -1238,6 +1253,30 @@ static __always_inline void vma_flags_set_mask(vma_flags_t *flags, #define vma_flags_set(flags, ...) \ vma_flags_set_mask(flags, mk_vma_flags(__VA_ARGS__)) +static __always_inline vma_flags_t __mk_vma_flags_from_masks(size_t count, + const vma_flags_t *masks) +{ + vma_flags_t flags = EMPTY_VMA_FLAGS; + size_t i; + + for (i = 0; i < count; i++) + vma_flags_set_mask(&flags, masks[i]); + return flags; +} + +/* + * Combine pre-computed vma_flags_t masks into one value, e.g.: + * + * vma_flags_t flags = mk_vma_flags_from_masks(VMA_UFFD_WP, VMA_UFFD_MINOR); + * + * Unlike mk_vma_flags(), which takes bit numbers, this takes whole masks -- + * each of which may be EMPTY_VMA_FLAGS when its feature is unavailable -- so a + * bit that does not exist on the current build is never materialised. + */ +#define mk_vma_flags_from_masks(...) \ + __mk_vma_flags_from_masks(COUNT_ARGS(__VA_ARGS__), \ + (const vma_flags_t []){__VA_ARGS__}) + /* Clear all of the to-clear flags in flags, non-atomically. */ static __always_inline void vma_flags_clear_mask(vma_flags_t *flags, vma_flags_t to_clear) diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h index 3ec8e1071673..68edac4dcd78 100644 --- a/include/linux/userfaultfd_k.h +++ b/include/linux/userfaultfd_k.h @@ -23,8 +23,8 @@ /* The set of all possible UFFD-related VM flags. */ #define __VM_UFFD_FLAGS (VM_UFFD_MISSING | VM_UFFD_WP | VM_UFFD_MINOR) -#define __VMA_UFFD_FLAGS mk_vma_flags(VMA_UFFD_MISSING_BIT, VMA_UFFD_WP_BIT, \ - VMA_UFFD_MINOR_BIT) +#define __VMA_UFFD_FLAGS mk_vma_flags_from_masks(VMA_UFFD_MISSING, VMA_UFFD_WP, \ + VMA_UFFD_MINOR) /* * CAREFUL: Check include/uapi/asm-generic/fcntl.h when defining -- cgit v1.2.3 From c55dd3b46c1208d6d2ea737a8aefef4aa4c70cb8 Mon Sep 17 00:00:00 2001 From: Hui Zhu Date: Fri, 29 May 2026 09:41:30 +0800 Subject: vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() find_vm_area() can return NULL if the given address is not a valid vmalloc area. Check the return value before dereferencing it to avoid a kernel crash. Link: https://lore.kernel.org/20260529014130.671291-1-hui.zhu@linux.dev Fixes: 121e6f3258fe ("mm/vmalloc: hugepage vmalloc mappings") Signed-off-by: Hui Zhu Reviewed-by: Dev Jain Reviewed-by: Uladzislau Rezki (Sony) Cc: Nicholas Piggin Signed-off-by: Andrew Morton --- include/linux/vmalloc.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h index 3b02c0c6b371..d87dc7f77f4e 100644 --- a/include/linux/vmalloc.h +++ b/include/linux/vmalloc.h @@ -265,7 +265,9 @@ static inline bool is_vm_area_hugepages(const void *addr) * allocated in the vmalloc layer. */ #ifdef CONFIG_HAVE_ARCH_HUGE_VMALLOC - return find_vm_area(addr)->page_order > 0; + struct vm_struct *area = find_vm_area(addr); + + return area && area->page_order > 0; #else return false; #endif -- cgit v1.2.3 From c13a0316aef5f4b73e8b4bf6943737f836d65e1d Mon Sep 17 00:00:00 2001 From: Youngjun Park Date: Tue, 24 Mar 2026 01:08:21 +0900 Subject: mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap device Patch series "mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap device", v8. Currently, in the uswsusp path, only the swap type value is retrieved at lookup time without holding a reference. If swapoff races after the type is acquired, subsequent slot allocations operate on a stale swap device. Additionally, grabbing and releasing the swap device reference on every slot allocation is inefficient across the entire hibernation swap path. This patch series addresses these issues: - Patch 1: Fixes the swapoff race in uswsusp by pinning the swap device from the point it is looked up until the session completes. - Patch 2: Removes the overhead of per-slot reference counting in alloc/free paths and cleans up the redundant SWP_WRITEOK check. This patch (of 2): Hibernation via uswsusp (/dev/snapshot ioctls) has a race window: after selecting the resume swap area but before user space is frozen, swapoff may run and invalidate the selected swap device. Fix this by pinning the swap device with SWP_HIBERNATION while it is in use. The pin is exclusive, which is sufficient since hibernate_acquire() already prevents concurrent hibernation sessions. The kernel swsusp path (sysfs-based hibernate/resume) uses find_hibernation_swap_type() which is not affected by the pin. It freezes user space before touching swap, so swapoff cannot race. Introduce dedicated helpers: - pin_hibernation_swap_type(): Look up and pin the swap device. Used by the uswsusp path. - find_hibernation_swap_type(): Lookup without pinning. Used by the kernel swsusp path. - unpin_hibernation_swap_type(): Clear the hibernation pin. While a swap device is pinned, swapoff is prevented from proceeding. Link: https://lore.kernel.org/20260323160822.1409904-1-youngjun.park@lge.com Link: https://lore.kernel.org/20260323160822.1409904-2-youngjun.park@lge.com Signed-off-by: Youngjun Park Reviewed-by: Kairui Song Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Kemeng Shi Cc: Nhat Pham Cc: "Rafael J . Wysocki" Signed-off-by: Andrew Morton --- include/linux/swap.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/swap.h b/include/linux/swap.h index 8c43bc3055c9..8f0f68e245ba 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -213,6 +213,7 @@ enum { SWP_PAGE_DISCARD = (1 << 10), /* freed swap page-cluster discards */ SWP_STABLE_WRITES = (1 << 11), /* no overwrite PG_writeback pages */ SWP_SYNCHRONOUS_IO = (1 << 12), /* synchronous IO is efficient */ + SWP_HIBERNATION = (1 << 13), /* pinned for hibernation */ /* add others here before... */ }; @@ -432,7 +433,9 @@ static inline long get_nr_swap_pages(void) } extern void si_swapinfo(struct sysinfo *); -int swap_type_of(dev_t device, sector_t offset); +extern int pin_hibernation_swap_type(dev_t device, sector_t offset); +extern void unpin_hibernation_swap_type(int type); +extern int find_hibernation_swap_type(dev_t device, sector_t offset); int find_first_swap(dev_t *device); extern unsigned int count_swap_pages(int, int); extern sector_t swapdev_block(int, pgoff_t); -- cgit v1.2.3 From 32a2b73ec232b284b029d34bcfaa9a7f424151d2 Mon Sep 17 00:00:00 2001 From: JP Kobryn Date: Wed, 3 Jun 2026 23:17:25 -0700 Subject: mm/compaction: cap compact_gap() at COMPACT_CLUSTER_MAX compact_gap() returns 2 << order, which is used as watermark headroom in __compaction_suitable() and as a threshold in kswapd reclaim decisions. The computed value scales exponentially by order. For order-9 THP allocations this evaluates to 1024 pages, but the compaction free scanner's working set is bounded by COMPACT_CLUSTER_MAX (32 pages). The scanner stops isolating free pages once it matches the migration batch. The current gap over-reserves by 32x. On fragmented production hosts, kswapd will try to reclaim up to the gap, but it only reaches that threshold in 18% of attempts. As a result, reclaim continues in the majority of cases despite many lower-order free pages being available. The over-sized gap also causes 46% of order-9 compaction suitability checks to fail unnecessarily: the zone has sufficient free pages for the scanner to operate, but not enough to clear the inflated threshold. Cap compact_gap() at COMPACT_CLUSTER_MAX so the watermark headroom reflects the scanner's actual capacity. This function is used by two key heuristics. The first is when kswapd can stop high-order reclaim and downgrade to order-0 balancing, allowing kcompactd to be woken for the original higher allocation order. The second is zone suitability checking, where the smaller gap allows compaction to start sooner. Note that orders 0-4 are unaffected since their gap is already less than or equal to COMPACT_CLUSTER_MAX. A/B test on v6.13-based instagram production hosts (64GB, 60s measurement): Unpatched (43 hosts) pgscan_kswapd (mean/host): ~1.6M reclaim efficiency (steal/scan): 83.8% per-compaction success (success/stall): 2.1% THP success (alloc/alloc+fallback): 4.9% forced lru_add_drain (mean/host): ~107K Patched (59 hosts) pgscan_kswapd (mean/host): ~449K reclaim efficiency (steal/scan): 91.0% per-compaction success (success/stall): 28.3% THP success (alloc/alloc+fallback): 17.2% forced lru_add_drain (mean/host): ~64K Additional tests were also performed using a workload of similar shape and based on mm-new at the time of testing. Across three 60s runs, the patch showed improvements consistent with the previous test: reduced kswapd reclaim and fewer THP fault fallbacks. Unpatched kswapd_shrink_node downgrade to order-0 (mean): 0 thp_fault_fallback (mean): 1217 pgscan_kswapd (mean): 6328 pgsteal_kswapd (mean): 5657 Patched kswapd_shrink_node downgrade to order-0 (mean): 28 thp_fault_fallback (mean): 738 pgscan_kswapd (mean): 3773 pgsteal_kswapd (mean): 3243 Link: https://lore.kernel.org/20260604061725.13800-1-jp.kobryn@linux.dev Signed-off-by: JP Kobryn (Meta) Reviewed-by: Vlastimil Babka (SUSE) Cc: Brendan Jackman Cc: Johannes Weiner Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/compaction.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/compaction.h b/include/linux/compaction.h index c829c48d1c71..f29ef0653546 100644 --- a/include/linux/compaction.h +++ b/include/linux/compaction.h @@ -2,6 +2,8 @@ #ifndef _LINUX_COMPACTION_H #define _LINUX_COMPACTION_H +#include + /* * Determines how hard direct compaction should try to succeed. * Lower value means higher priority, analogically to reclaim priority. @@ -73,11 +75,9 @@ static inline unsigned long compact_gap(unsigned int order) * effectively limited by COMPACT_CLUSTER_MAX, as that's the maximum * that the migrate scanner can have isolated on migrate list, and free * scanner is only invoked when the number of isolated free pages is - * lower than that. But it's not worth to complicate the formula here - * as a bigger gap for higher orders than strictly necessary can also - * improve chances of compaction success. + * lower than that. */ - return 2UL << order; + return min(2UL << order, COMPACT_CLUSTER_MAX); } static inline int current_is_kcompactd(void) -- cgit v1.2.3 From 894e036a24a26a6dd7b17d8d3fb5c53ab48a6074 Mon Sep 17 00:00:00 2001 From: Dragos Tatulea Date: Thu, 4 Jun 2026 16:58:49 +0300 Subject: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. When querying a VF vport with a larger configured max (via devlink), the firmware response can overflow this buffer: BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core] Read of size 4 at addr ff1100013ffc8a12 by task kworker/u96:2/385 CPU: 12 UID: 0 PID: 385 Comm: kworker/u96:2 Not tainted 7.0.0-rc6+ #1 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core] Call Trace: dump_stack_lvl+0x69/0xa0 print_report+0x176/0x4e4 kasan_report+0xc8/0x100 mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core] esw_update_vport_addr_list+0x2e3/0xda0 [mlx5_core] esw_vport_change_handle_locked+0xa1f/0x1060 [mlx5_core] esw_vport_change_handler+0x6a/0x90 [mlx5_core] process_one_work+0x87f/0x15e0 worker_thread+0x62b/0x1020 kthread+0x375/0x490 ret_from_fork+0x4dc/0x810 ret_from_fork_asm+0x11/0x20 Fix by querying the vport's own HCA caps to size the buffer correctly. Refactor the function to allocate and return the MAC list internally, removing the caller's dependency on knowing the correct max. Fixes: e16aea2744ab ("net/mlx5: Introduce access functions to modify/query vport mac lists") Signed-off-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/20260604135849.458060-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski --- include/linux/mlx5/vport.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mlx5/vport.h b/include/linux/mlx5/vport.h index dfa2fe32217a..282ed5442282 100644 --- a/include/linux/mlx5/vport.h +++ b/include/linux/mlx5/vport.h @@ -102,8 +102,8 @@ int mlx5_query_hca_vport_node_guid(struct mlx5_core_dev *dev, int mlx5_query_nic_vport_mac_list(struct mlx5_core_dev *dev, u16 vport, enum mlx5_list_type list_type, - u8 addr_list[][ETH_ALEN], - int *list_size); + u8 (**mac_list)[ETH_ALEN], + int *mac_list_size); int mlx5_modify_nic_vport_mac_list(struct mlx5_core_dev *dev, enum mlx5_list_type list_type, u8 addr_list[][ETH_ALEN], -- cgit v1.2.3 From 69710a37bad62afc3d2f1fbf7b108e5f8b3808cd Mon Sep 17 00:00:00 2001 From: David 'equinox' Lamparter Date: Fri, 5 Jun 2026 18:41:44 +0200 Subject: if_ether.h: add 802.1AC, warn about GRE 0x00FE Because LLC wasn't complicated/annoying enough, there's 2 more "ethertypes" being used for it: - 0x8870 is pretty "normal", it got standardized in 802.1AC-2016/Cor1-2018 for transporting LLC frames > 1500 bytes. It simply replaces the length value (which is no longer encoded, and must now be derived from the packet.) The actual value dates back to 2001; https://datatracker.ietf.org/doc/html/draft-ietf-isis-ext-eth-01 (it was used without "proper" standardization for a long time) - 0x00fe is a doozy - actually "invalid" depending on how you look at it; it's used in GRE (and possibly GENEVE) tunnels to transport the IS-IS routing protocol. https://seclists.org/tcpdump/2002/q4/61 is the best/oldest source I could find. It's inspired by the 0xfe SAP value, a GRE packet with protocol 0x00fe is followed by a payload "as if" it was Ethernet with " 0xfe 0xfe 0x03". (Again the length isn't encoded explicitly anymore.) The 0x00fe value is quite close to other values the kernel is using internally for various things (after all they "won't clash for 1500 types"). Except this one does clash, and if someone unknowingly starts using it for something internal... we end up in a world of pain in getting IS-IS running on GRE tunnels. Hence the "WARNING". Signed-off-by: David 'equinox' Lamparter Cc: Andrew Lunn Link: https://patch.msgid.link/20260605164144.81184-1-equinox@diac24.net Signed-off-by: Jakub Kicinski --- include/uapi/linux/if_ether.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h index fb5efc8e06cc..1ffac52c39df 100644 --- a/include/uapi/linux/if_ether.h +++ b/include/uapi/linux/if_ether.h @@ -82,6 +82,7 @@ #define ETH_P_PPP_DISC 0x8863 /* PPPoE discovery messages */ #define ETH_P_PPP_SES 0x8864 /* PPPoE session messages */ #define ETH_P_LINK_CTL 0x886c /* HPNA, wlan link local tunnel */ +#define ETH_P_8021AC 0x8870 /* 802.1AC LLC > 1500 bytes */ #define ETH_P_ATMFATE 0x8884 /* Frame-based ATM Transport * over Ethernet */ @@ -164,6 +165,10 @@ #define ETH_P_MCTP 0x00FA /* Management component transport * protocol packets */ +#define ETH_P_GRE_OSI 0x00FE /* GRE tunnels: LLC "fe fe 03" analog, + * used primarily for IS-IS over GRE + * WARNING: not internal, used on wire! + */ /* * This is an Ethernet frame header. -- cgit v1.2.3 From 22f8bf8808dc80a44f88a3ab1776ddb1baaa12d8 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Thu, 4 Jun 2026 13:48:28 -0400 Subject: tls: Suppress spurious saved_data_ready on all receive paths Each record release via tls_strp_msg_done() triggered tls_strp_check_rcv(), which called tls_rx_msg_ready() and fired saved_data_ready(). During a multi-record receive, the first N-1 wakeups are pure overhead: the caller is already running and will pick up subsequent records on the next loop iteration. The recvmsg and splice_read paths share this waste. Suppress per-record notifications and emit a single one on reader exit. tls_rx_rec_done() releases the current record and parses the next without announcing; tls_strp_check_rcv() gains a bool announce parameter so callers can request the quiet form. tls_rx_reader_release() fires the deferred announce on exit through tls_rx_msg_maybe_announce(), an idempotent helper that calls saved_data_ready() only when a record is parsed and has not yet been announced. To keep the final notification idempotent against records that the BH or the worker has already announced, tls_strparser gains a msg_announced bit. tls_rx_msg_maybe_announce() sets the bit when firing saved_data_ready(); the bit is cleared whenever the parsed record is wiped, by tls_strp_msg_consume() on consumption or by tls_strp_msg_load() when the lower socket loses bytes from under the parse. A second call for the same parsed record -- as when recvmsg() satisfies the request from ctx->rx_list without touching the strparser -- becomes a no-op. With no remaining callers, tls_strp_msg_done() is removed. Signed-off-by: Chuck Lever Reviewed-by: Hannes Reinecke Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260604-tls-read-sock-v12-5-b114efa6e3e2@oracle.com Signed-off-by: Jakub Kicinski --- include/net/tls.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/net/tls.h b/include/net/tls.h index ebd2550280ae..3811943288b3 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -111,11 +111,16 @@ struct tls_sw_context_tx { struct tls_strparser { struct sock *sk; + /* Bitfield word and msg_ready are serialized by the lower + * socket lock; BH and worker contexts both acquire it. + */ u32 mark : 8; u32 stopped : 1; u32 copy_mode : 1; u32 mixed_decrypted : 1; + u32 msg_announced : 1; + bool msg_ready; struct strp_msg stm; -- cgit v1.2.3 From 06528596662bf9a34d3691eb5b00bc39b228c994 Mon Sep 17 00:00:00 2001 From: Victor Nogueira Date: Fri, 5 Jun 2026 18:22:39 -0300 Subject: net/sched: Update function name in TCQ_F_NOPARENT comment Commit 2ccccf5fb43f ("net_sched: update hierarchical backlog too") renamed qdisc_tree_decrease_qlen() to qdisc_tree_reduce_backlog(), but this comment was missed. Update it. Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20260605212239.2261320-1-victor@mojatatu.com Signed-off-by: Paolo Abeni --- include/net/sch_generic.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index d0ca932b1871..45a1e8c78222 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -86,7 +86,7 @@ struct Qdisc { #define TCQ_F_WARN_NONWC (1 << 16) #define TCQ_F_CPUSTATS 0x20 /* run using percpu statistics */ #define TCQ_F_NOPARENT 0x40 /* root of its hierarchy : - * qdisc_tree_decrease_qlen() should stop. + * qdisc_tree_reduce_backlog() should stop. */ #define TCQ_F_INVISIBLE 0x80 /* invisible by default in dump */ #define TCQ_F_NOLOCK 0x100 /* qdisc does not require locking */ -- cgit v1.2.3 From 6c537b845c99e32312a1bd84d4c95cdb26efb577 Mon Sep 17 00:00:00 2001 From: Breno Leitao Date: Thu, 4 Jun 2026 09:10:11 -0700 Subject: netconsole: do not dequeue pooled skbs that cannot satisfy len find_skb() falls back to np->skb_pool when the GFP_ATOMIC alloc_skb() fails. The pool is refilled by refill_skbs(), which always allocates buffers of MAX_SKB_SIZE (ethhdr + iphdr + udphdr + MAX_UDP_CHUNK == 1502 bytes). netconsole, however, computes the requested length dynamically as total_len + np->dev->needed_tailroom If the egress device declares a non-zero needed_tailroom (e.g. some tunnel or hardware accelerator devices), the required length can exceed MAX_SKB_SIZE. The pooled skb is then handed back to the caller, which immediately performs skb_put(skb, len), trips the tail > end check, and triggers skb_over_panic(). Leave the normal alloc_skb(len, GFP_ATOMIC) path untouched -- the slab allocator can still satisfy oversized requests when memory is available, so senders to devices with non-zero needed_tailroom keep working in the common case. Only the pool fallback is gated: when alloc_skb() failed and len exceeds the pool buffer size, skip the skb_dequeue() instead of burning a pre-allocated skb on a request that would later trip skb_over_panic(). Reserving pool entries for requests they can actually satisfy also keeps the panic path, which depends on the pool being primed, intact. When that drop happens, emit a rate-limited net_warn() so the user notices that netconsole is unable to push messages on the egress device. The warn is skipped under in_nmi() for the same reason schedule_work() is: printk machinery taken by net_warn_ratelimited() is not NMI-safe and would risk recursing into the same nbcon console we are servicing. MAX_SKB_SIZE / MAX_UDP_CHUNK were private to net/core/netpoll.c. Move them to include/linux/netpoll.h so netconsole can reference the same definition that refill_skbs() uses, keeping the two in sync by construction. The header now pulls in and explicitly so MAX_SKB_SIZE remains self-contained for any future user. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20260604-netcons_fix_before_move-v3-2-ab055b3a6aa5@debian.org Signed-off-by: Paolo Abeni --- include/linux/netpoll.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include') diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h index e4b8f1f91e54..88f7daa8560e 100644 --- a/include/linux/netpoll.h +++ b/include/linux/netpoll.h @@ -13,12 +13,28 @@ #include #include #include +#include +#include union inet_addr { __be32 ip; struct in6_addr in6; }; +/* + * Maximum payload netpoll's preallocated skb pool can carry. Keep this in + * sync with the buffer size used by refill_skbs() in net/core/netpoll.c; + * callers (e.g. netconsole) use it to detect requests the pool can never + * satisfy and avoid dequeuing a pooled skb that would later trip + * skb_over_panic() in skb_put(). + */ +#define MAX_UDP_CHUNK 1460 +#define MAX_SKB_SIZE \ + (sizeof(struct ethhdr) + \ + sizeof(struct iphdr) + \ + sizeof(struct udphdr) + \ + MAX_UDP_CHUNK) + struct netpoll { struct net_device *dev; netdevice_tracker dev_tracker; -- cgit v1.2.3 From aa0487b003a814beedd1af32b79478d834d15b2d Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 7 May 2026 11:17:55 +0100 Subject: btrfs: tracepoints: add trace event for add_conflicting_inode() add_conflicting_inode() is an important step called during a fsync, as well as during rename and link operations on inodes that were previously logged. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 66 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index c13c1ce0b344..ad18b09fb3cd 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1228,6 +1228,72 @@ TRACE_EVENT(btrfs_log_new_dir_dentries_exit, __entry->transid, __entry->ret) ); +TRACE_EVENT(btrfs_add_conflicting_inode_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_log_ctx *ctx, + u64 ino, u64 parent), + + TP_ARGS(trans, ctx, ino, parent), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ctx_ino ) + __field( u64, conflict_ino ) + __field( u64, conflict_ino_parent ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(ctx->inode->root); + __entry->transid = trans->transid; + __entry->ctx_ino = btrfs_ino(ctx->inode); + __entry->conflict_ino = ino; + __entry->conflict_ino_parent = parent; + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ctx_ino=%llu conflict_ino=%llu" + " conflict_ino_parent=%llu", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ctx_ino, __entry->conflict_ino, + __entry->conflict_ino_parent) +); + +TRACE_EVENT(btrfs_add_conflicting_inode_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_log_ctx *ctx, + u64 ino, u64 parent, int ret), + + TP_ARGS(trans, ctx, ino, parent, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ctx_ino ) + __field( u64, conflict_ino ) + __field( u64, conflict_ino_parent ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(ctx->inode->root); + __entry->transid = trans->transid; + __entry->ctx_ino = btrfs_ino(ctx->inode); + __entry->conflict_ino = ino; + __entry->conflict_ino_parent = parent; + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ctx_ino=%llu conflict_ino=%llu" + " conflict_ino_parent=%llu ret=%d", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ctx_ino, __entry->conflict_ino, + __entry->conflict_ino_parent, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From aba309b893ab6ca02761119abeb565f8e71adc8b Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 7 May 2026 13:03:13 +0100 Subject: btrfs: tracepoints: add trace event for log_conflicting_inodes() log_conflicting_inodes() is an important step called during a fsync, as well as during rename and link operations on inodes that were previously logged. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 53 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index ad18b09fb3cd..2eff817026a4 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1294,6 +1294,59 @@ TRACE_EVENT(btrfs_add_conflicting_inode_exit, __entry->conflict_ino_parent, __entry->ret) ); +TRACE_EVENT(btrfs_log_conflicting_inodes_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_log_ctx *ctx), + + TP_ARGS(trans, ctx), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ctx_ino ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(ctx->inode->root); + __entry->transid = trans->transid; + __entry->ctx_ino = btrfs_ino(ctx->inode); + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ctx_ino=%llu", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ctx_ino) +); + +TRACE_EVENT(btrfs_log_conflicting_inodes_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_log_ctx *ctx, + int ret), + + TP_ARGS(trans, ctx, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ctx_ino ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(ctx->inode->root); + __entry->transid = trans->transid; + __entry->ctx_ino = btrfs_ino(ctx->inode); + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ctx_ino=%llu ret=%d", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ctx_ino, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From 5fe47577ad40b6b88fb189cdacdf102ee66ed5bc Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Fri, 8 May 2026 17:09:48 +0100 Subject: btrfs: tracepoints: add trace event for log_new_delayed_dentries() log_new_delayed_dentries() is an important step called during a fsync, as well as during rename and link operations on inodes that were previously logged. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 53 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 2eff817026a4..dd7731b484aa 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1347,6 +1347,59 @@ TRACE_EVENT(btrfs_log_conflicting_inodes_exit, __entry->ctx_ino, __entry->ret) ); +TRACE_EVENT(btrfs_log_new_delayed_dentries_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode), + + TP_ARGS(trans, inode), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ino ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->transid = trans->transid; + __entry->ino = btrfs_ino(inode); + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ino=%llu", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ino) +); + +TRACE_EVENT(btrfs_log_new_delayed_dentries_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode, + int ret), + + TP_ARGS(trans, inode, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ino ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->transid = trans->transid; + __entry->ino = btrfs_ino(inode); + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ino=%llu ret=%d", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ino, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From bc620c48b51ef18ce9331ec0cc4301d3dc059ff3 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Mon, 11 May 2026 15:51:13 +0100 Subject: btrfs: tracepoints: add trace event for btrfs_record_unlink_dir() btrfs_record_unlink_dir() is an important operation that affects inode logging and is called during unlink and rename operations. Add a trace event for it to help debug issues. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index dd7731b484aa..1571c445abe6 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1400,6 +1400,37 @@ TRACE_EVENT(btrfs_log_new_delayed_dentries_exit, __entry->ino, __entry->ret) ); +TRACE_EVENT(btrfs_record_unlink_dir, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *dir, + const struct btrfs_inode *inode, + bool for_rename), + + TP_ARGS(trans, dir, inode, for_rename), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ino ) + __field( u64, dir ) + __field( bool, for_rename ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->transid = trans->transid; + __entry->ino = btrfs_ino(inode); + __entry->dir = btrfs_ino(dir); + __entry->for_rename = for_rename; + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ino=%llu dir=%llu for_rename=%d", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ino, __entry->dir, __entry->for_rename) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From e1443032400a7e9d205c75730e8035e2db779231 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Mon, 11 May 2026 16:05:13 +0100 Subject: btrfs: tracepoints: add trace event for btrfs_record_snapshot_destroy() btrfs_record_snapshot_destroy() is an important operation that affects inode logging and is called during subvolume/snapshot deletion as well as during rmdir. Add a trace event for it to help debug issues. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 1571c445abe6..a14a8d32a6f1 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1431,6 +1431,31 @@ TRACE_EVENT(btrfs_record_unlink_dir, __entry->ino, __entry->dir, __entry->for_rename) ); +TRACE_EVENT(btrfs_record_snapshot_destroy, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *dir), + + TP_ARGS(trans, dir), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, dir ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(dir->root); + __entry->transid = trans->transid; + __entry->dir = btrfs_ino(dir); + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu dir=%llu", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->dir) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From 4f065ebdf8c5ad477dc7be57c76e0fcb50670a6c Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Mon, 11 May 2026 16:13:18 +0100 Subject: btrfs: tracepoints: add trace event for btrfs_record_new_subvolume() btrfs_record_new_subvolume() is an important operation that affects inode logging and is called during subvolume creation. Add a trace event for it to help debug issues. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index a14a8d32a6f1..47e6f382e22a 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1456,6 +1456,31 @@ TRACE_EVENT(btrfs_record_snapshot_destroy, __entry->dir) ); +TRACE_EVENT(btrfs_record_new_subvolume, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *dir), + + TP_ARGS(trans, dir), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, dir ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(dir->root); + __entry->transid = trans->transid; + __entry->dir = btrfs_ino(dir); + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu dir=%llu", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->dir) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From 8c2e738c61f17c3650fd56e0d52518f2904e7b5e Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Mon, 11 May 2026 16:38:25 +0100 Subject: btrfs: tracepoints: add trace event for btrfs_log_new_name() btrfs_log_new_name() is an important function that affects inode logging and is called during link and rename operations. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 66 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 47e6f382e22a..ad9ae2489782 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1481,6 +1481,72 @@ TRACE_EVENT(btrfs_record_new_subvolume, __entry->dir) ); +TRACE_EVENT(btrfs_log_new_name_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode, + const struct btrfs_inode *old_dir, + u64 old_dir_index), + + TP_ARGS(trans, inode, old_dir, old_dir_index), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ino ) + __field( umode_t, mode ) + __field( u64, old_dir_ino ) + __field( u64, old_dir_index ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->transid = trans->transid; + __entry->ino = btrfs_ino(inode); + __entry->mode = inode->vfs_inode.i_mode; + __entry->old_dir_ino = old_dir ? btrfs_ino(old_dir) : 0; + __entry->old_dir_index = old_dir_index; + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ino=%llu type=%s" + " old_dir=%llu old_dir_index=%llu", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ino, show_inode_type(__entry->mode), + __entry->old_dir_ino, __entry->old_dir_index) +); + +TRACE_EVENT(btrfs_log_new_name_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_inode *inode, + const struct btrfs_inode *old_dir, + int ret), + + TP_ARGS(trans, inode, old_dir, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( u64, ino ) + __field( u64, old_dir_ino ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(inode->root); + __entry->transid = trans->transid; + __entry->ino = btrfs_ino(inode); + __entry->old_dir_ino = old_dir ? btrfs_ino(old_dir) : 0; + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ino=%llu old_dir=%llu ret=%d", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ino, __entry->old_dir_ino, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From 375336c17efa3d1ac62c4ecfde7c107ef3712f72 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 14 May 2026 16:11:43 +0100 Subject: btrfs: tracepoints: add trace event for btrfs_sync_log() btrfs_sync_log() is one of the main functions called during a fsync. Add trace events for when entering and exiting that function. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 85 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index ad9ae2489782..0e96633b8b4b 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -1547,6 +1547,91 @@ TRACE_EVENT(btrfs_log_new_name_exit, __entry->ino, __entry->old_dir_ino, __entry->ret) ); +/* Ideally call this while under root->log_mutex (but not always possible). */ +TRACE_EVENT(btrfs_sync_log_enter, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_root *root, + const struct btrfs_log_ctx *ctx), + + TP_ARGS(trans, root, ctx), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( int, ctx_log_transid ) + __field( int, root_log_transid ) + __field( int, log_transid_committed ) + __field( bool, log_committing ) + __field( bool, log_committing_prev ) + __field( int, log_writers ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(root); + __entry->transid = trans->transid; + __entry->ctx_log_transid = ctx->log_transid; + __entry->root_log_transid = btrfs_get_root_log_transid(root); + __entry->log_transid_committed = + data_race(root->log_transid_committed); + __entry->log_committing = + atomic_read(&root->log_commit[ctx->log_transid % 2]); + __entry->log_committing_prev = + atomic_read(&root->log_commit[(ctx->log_transid + 1) % 2]); + __entry->log_writers = atomic_read(&root->log_writers); + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ctx_log_transid=%d" + " root_log_transid=%d log_transid_committed=%d" + " log_committing=%d log_committing_prev=%d log_writers=%d", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ctx_log_transid, __entry->root_log_transid, + __entry->log_transid_committed, __entry->log_committing, + __entry->log_committing_prev, __entry->log_writers) +); + +/* + * Ideally call this while under root->log_mutex and in the same critical + * section that calls the btrfs_sync_log_enter() trace event (though it's not + * always possible). + */ +TRACE_EVENT(btrfs_sync_log_exit, + + TP_PROTO(const struct btrfs_trans_handle *trans, + const struct btrfs_root *root, + const struct btrfs_log_ctx *ctx, + int ret), + + TP_ARGS(trans, root, ctx, ret), + + TP_STRUCT__entry_btrfs( + __field( u64, root_objectid ) + __field( u64, transid ) + __field( int, ctx_log_transid ) + __field( int, root_log_transid ) + __field( int, log_transid_committed ) + __field( int, ret ) + ), + + TP_fast_assign( + TP_fast_assign_fsid(trans->fs_info); + __entry->root_objectid = btrfs_root_id(root); + __entry->transid = trans->transid; + __entry->ctx_log_transid = ctx->log_transid; + __entry->root_log_transid = btrfs_get_root_log_transid(root); + __entry->log_transid_committed = + data_race(root->log_transid_committed); + __entry->ret = ret; + ), + + TP_printk_btrfs("root=%llu(%s) transid=%llu ctx_log_transid=%d" + " root_log_transid=%d log_transid_committed=%d ret=%d", + show_root_type(__entry->root_objectid), __entry->transid, + __entry->ctx_log_transid, __entry->root_log_transid, + __entry->log_transid_committed, __entry->ret) +); + TRACE_EVENT(btrfs_sync_fs, TP_PROTO(const struct btrfs_fs_info *fs_info, int wait), -- cgit v1.2.3 From d8576024fa1bee0e72e44ca8b5a6c95372717a99 Mon Sep 17 00:00:00 2001 From: Filipe Manana Date: Thu, 14 May 2026 17:35:40 +0100 Subject: btrfs: tracepoints: show inode type in btrfs_sync_file_enter() event Print the type of the inode (directory, regular file, symlink, etc) to facilitate debugging. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 0e96633b8b4b..726ca4ddb4d8 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -830,10 +830,11 @@ TRACE_EVENT(btrfs_sync_file_enter, TP_ARGS(file, datasync), TP_STRUCT__entry_btrfs( - __field( u64, ino ) - __field( u64, parent ) - __field( int, datasync ) - __field( u64, root_objectid ) + __field( u64, ino ) + __field( umode_t, mode ) + __field( u64, parent ) + __field( int, datasync ) + __field( u64, root_objectid ) ), TP_fast_assign( @@ -846,13 +847,13 @@ TRACE_EVENT(btrfs_sync_file_enter, __entry->parent = btrfs_ino(BTRFS_I(parent_inode)); __entry->datasync = datasync; __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root); + __entry->mode = inode->i_mode; ), - TP_printk_btrfs("root=%llu(%s) ino=%llu parent=%llu datasync=%d", - show_root_type(__entry->root_objectid), - __entry->ino, - __entry->parent, - __entry->datasync) + TP_printk_btrfs("root=%llu(%s) ino=%llu type=%s parent=%llu datasync=%d", + show_root_type(__entry->root_objectid), __entry->ino, + show_inode_type(__entry->mode), __entry->parent, + __entry->datasync) ); TRACE_EVENT(btrfs_sync_file_exit, -- cgit v1.2.3 From 5b65452756717e89ad2a1e8690701dc3a71f3ec6 Mon Sep 17 00:00:00 2001 From: Johannes Thumshirn Date: Fri, 22 May 2026 11:02:44 +0200 Subject: btrfs: zoned: decode 'RECLAIM_ZONES' state in tracepoints Decode the 'RECLAIM_ZONES' state in tracepoints, as of now only the numerical state is shown in the tracepoints. Reviewed-by: Boris Burkov Reviewed-by: Naohiro Aota Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba --- include/trace/events/btrfs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index 726ca4ddb4d8..4c5c47c5edb7 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -114,6 +114,7 @@ struct btrfs_log_ctx; EM( ALLOC_CHUNK_FORCE, "ALLOC_CHUNK_FORCE") \ EM( RUN_DELAYED_IPUTS, "RUN_DELAYED_IPUTS") \ EM( COMMIT_TRANS, "COMMIT_TRANS") \ + EM( RECLAIM_ZONES, "RECLAIM_ZONES") \ EMe(RESET_ZONES, "RESET_ZONES") #define TRANSACTION_STATES \ -- cgit v1.2.3 From 6f611e5e5f3327cf2e2daabe6ee5acac58cc784e Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Wed, 27 May 2026 17:14:02 +0200 Subject: fbdev: Wrap user-invoked calls to fb_set_var() in helper Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. Only the FBIOPUT_VSCREENINFO ioctl currently does all steps. Other mode-changes callers in sysfs and driver code are missing fbcon-related steps. With the new helper, ps3fb and sh_mobile_lcdcfb no longer maintain fbcon state themselves. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller --- include/linux/fb.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/fb.h b/include/linux/fb.h index 5178a33c752c..88680a7cabd5 100644 --- a/include/linux/fb.h +++ b/include/linux/fb.h @@ -533,6 +533,8 @@ extern int fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var); extern int fb_pan_display(struct fb_info *info, struct fb_var_screeninfo *var); extern int fb_blank(struct fb_info *info, int blank); +int fb_set_var_from_user(struct fb_info *info, struct fb_var_screeninfo *var); + /* * Helpers for framebuffers in I/O memory */ -- cgit v1.2.3 From 2f4230fad9a7af4ebfbadbc3df5c1d99dc9320b1 Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Wed, 27 May 2026 17:14:04 +0200 Subject: fbdev: Wrap fbcon updates from vga-switcheroo in helper Handle console remapping in fbcon in fb_switch_output(). Vga-switcheroo invokes this functionality before switching physical outputs to a new graphics device. Open-coding fbcon state in vga-switcheroo exposed fbdev implementation details. Vga-switcheroo is used for switching physical outputs among graphics hardware. This functionality is only supported by DRM drivers. A later update will further move fb_switch_output() into DRM's fbdev emulation; thus fully decoupling vga-switcheroo from fbdev. v3: - remove Kconfig dependency related to fbcon (Geert) v2: - use '#if defined' (Helge) Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller --- include/linux/fb.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/fb.h b/include/linux/fb.h index 88680a7cabd5..e9a26e82322a 100644 --- a/include/linux/fb.h +++ b/include/linux/fb.h @@ -608,6 +608,7 @@ void fb_pad_unaligned_buffer(u8 *dst, u32 d_pitch, const u8 *src, u32 idx, u32 h u32 shift_high, u32 shift_low, u32 mod); void fb_pad_aligned_buffer(u8 *dst, u32 d_pitch, const u8 *src, u32 s_pitch, u32 height); extern void fb_set_suspend(struct fb_info *info, int state); +extern void fb_switch_outputs(struct fb_info *info); extern int fb_get_color_depth(struct fb_var_screeninfo *var, struct fb_fix_screeninfo *fix); extern int fb_get_options(const char *name, char **option); -- cgit v1.2.3 From 98c2b2551b22d975f8f94ad19169a06339da3d8a Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Wed, 27 May 2026 17:14:05 +0200 Subject: fbdev: Do not export fbcon from fbdev There are no callers of fbcon outside fbdev. Move the declarations into the internal header. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller --- include/linux/fbcon.h | 55 --------------------------------------------------- 1 file changed, 55 deletions(-) delete mode 100644 include/linux/fbcon.h (limited to 'include') diff --git a/include/linux/fbcon.h b/include/linux/fbcon.h deleted file mode 100644 index f206370060e1..000000000000 --- a/include/linux/fbcon.h +++ /dev/null @@ -1,55 +0,0 @@ -#ifndef _LINUX_FBCON_H -#define _LINUX_FBCON_H - -#include - -struct fb_blit_caps; -struct fb_info; -struct fb_var_screeninfo; -struct fb_videomode; - -#ifdef CONFIG_FRAMEBUFFER_CONSOLE -void __init fb_console_init(void); -void __exit fb_console_exit(void); -int fbcon_fb_registered(struct fb_info *info); -void fbcon_fb_unregistered(struct fb_info *info); -void fbcon_fb_unbind(struct fb_info *info); -void fbcon_suspended(struct fb_info *info); -void fbcon_resumed(struct fb_info *info); -int fbcon_mode_deleted(struct fb_info *info, - struct fb_videomode *mode); -void fbcon_delete_modelist(struct list_head *head); -void fbcon_new_modelist(struct fb_info *info); -void fbcon_get_requirement(struct fb_info *info, - struct fb_blit_caps *caps); -void fbcon_fb_blanked(struct fb_info *info, int blank); -int fbcon_modechange_possible(struct fb_info *info, - struct fb_var_screeninfo *var); -void fbcon_update_vcs(struct fb_info *info, bool all); -void fbcon_remap_all(struct fb_info *info); -int fbcon_set_con2fb_map_ioctl(void __user *argp); -int fbcon_get_con2fb_map_ioctl(void __user *argp); -#else -static inline void fb_console_init(void) {} -static inline void fb_console_exit(void) {} -static inline int fbcon_fb_registered(struct fb_info *info) { return 0; } -static inline void fbcon_fb_unregistered(struct fb_info *info) {} -static inline void fbcon_fb_unbind(struct fb_info *info) {} -static inline void fbcon_suspended(struct fb_info *info) {} -static inline void fbcon_resumed(struct fb_info *info) {} -static inline int fbcon_mode_deleted(struct fb_info *info, - struct fb_videomode *mode) { return 0; } -static inline void fbcon_delete_modelist(struct list_head *head) {} -static inline void fbcon_new_modelist(struct fb_info *info) {} -static inline void fbcon_get_requirement(struct fb_info *info, - struct fb_blit_caps *caps) {} -static inline void fbcon_fb_blanked(struct fb_info *info, int blank) {} -static inline int fbcon_modechange_possible(struct fb_info *info, - struct fb_var_screeninfo *var) { return 0; } -static inline void fbcon_update_vcs(struct fb_info *info, bool all) {} -static inline void fbcon_remap_all(struct fb_info *info) {} -static inline int fbcon_set_con2fb_map_ioctl(void __user *argp) { return 0; } -static inline int fbcon_get_con2fb_map_ioctl(void __user *argp) { return 0; } -#endif - -#endif /* _LINUX_FBCON_H */ -- cgit v1.2.3 From c5d6cac28646b0d5d81ef632be748ae93c1f36c7 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Thu, 29 Jan 2026 16:47:43 -0500 Subject: vfs: add FS_USERNS_DELEGATABLE flag and set it for NFS Commit e1c5ae59c0f2 ("fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT") prevents the mount of any filesystem inside a container that doesn't have FS_USERNS_MOUNT set. This broke NFS mounts in our containerized environment. We have a daemon somewhat like systemd-mountfsd running in the init_ns. A process does a fsopen() inside the container and passes it to the daemon via unix socket. The daemon then vets that the request is for an allowed NFS server and performs the mount. This now fails because the fc->user_ns is set to the value in the container and NFS doesn't set FS_USERNS_MOUNT. We don't want to add FS_USERNS_MOUNT to NFS since that would allow the container to mount any NFS server (even malicious ones). Add a new FS_USERNS_DELEGATABLE flag, and enable it on NFS. Fixes: e1c5ae59c0f2 ("fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT") Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260129-twmount-v1-1-4874ed2a15c4@kernel.org Acked-by: Anna Schumaker Reviewed-by: Alexander Mikhalitsyn Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner (Amutable) --- include/linux/fs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/fs.h b/include/linux/fs.h index 11559c513dfb..10d35a68f597 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2281,6 +2281,7 @@ struct file_system_type { #define FS_MGTIME 64 /* FS uses multigrain timestamps */ #define FS_LBS 128 /* FS supports LBS */ #define FS_POWER_FREEZE 256 /* Always freeze on suspend/hibernate */ +#define FS_USERNS_DELEGATABLE 1024 /* Can be mounted inside userns from outside */ #define FS_RENAME_DOES_D_MOVE 32768 /* FS will handle d_move() during rename() internally. */ int (*init_fs_context)(struct fs_context *); const struct fs_parameter_spec *parameters; -- cgit v1.2.3 From d1e720c7328e046049b792d03fae093d4d3a72e4 Mon Sep 17 00:00:00 2001 From: Guenter Roeck Date: Wed, 13 May 2026 07:14:33 -0700 Subject: hwmon: Support guard() and scoped_guard for subsystem locks Add support for guard() and scoped_guard() for the hwmon subsystem lock to simplify its use. Signed-off-by: Guenter Roeck --- include/linux/hwmon.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h index 301a83afbd66..f5330e7ae247 100644 --- a/include/linux/hwmon.h +++ b/include/linux/hwmon.h @@ -13,6 +13,7 @@ #define _HWMON_H_ #include +#include struct device; struct attribute_group; @@ -495,6 +496,8 @@ char *devm_hwmon_sanitize_name(struct device *dev, const char *name); void hwmon_lock(struct device *dev); void hwmon_unlock(struct device *dev); +DEFINE_GUARD(hwmon_lock, struct device *, hwmon_lock(_T), hwmon_unlock(_T)) + /** * hwmon_is_bad_char - Is the char invalid in a hwmon name * @ch: the char to be considered -- cgit v1.2.3 From 3b7f59ffacb131037f592d3a4a7342c6773249a4 Mon Sep 17 00:00:00 2001 From: Shubham Chakraborty Date: Sun, 17 May 2026 13:34:43 +0530 Subject: soc: bcm2835: raspberrypi-firmware: Add voltage domain IDs Add Raspberry Pi firmware voltage domain identifiers for the mailbox property interface. Also add the voltage request structure used with RPI_FIRMWARE_GET_VOLTAGE so firmware clients can share the common API definition from the firmware header. Signed-off-by: Shubham Chakraborty Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20260517080445.103962-2-chakrabortyshubham66@gmail.com Signed-off-by: Guenter Roeck --- include/soc/bcm2835/raspberrypi-firmware.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'include') diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h index e1f87fbfe554..975bef529854 100644 --- a/include/soc/bcm2835/raspberrypi-firmware.h +++ b/include/soc/bcm2835/raspberrypi-firmware.h @@ -156,6 +156,31 @@ enum rpi_firmware_clk_id { RPI_FIRMWARE_NUM_CLK_ID, }; +enum rpi_firmware_volt_id { + RPI_FIRMWARE_VOLT_ID_CORE = 1, + RPI_FIRMWARE_VOLT_ID_SDRAM_C = 2, + RPI_FIRMWARE_VOLT_ID_SDRAM_P = 3, + RPI_FIRMWARE_VOLT_ID_SDRAM_I = 4, + RPI_FIRMWARE_NUM_VOLT_ID, +}; + +/** + * struct rpi_firmware_get_voltage_request - Firmware request for a voltage + * @id: ID of the voltage being queried + * @value: Voltage in microvolts. Set by the firmware. + * + * Used by @RPI_FIRMWARE_GET_VOLTAGE. + */ +struct rpi_firmware_get_voltage_request { + __le32 id; + __le32 value; +} __packed; + +#define RPI_FIRMWARE_GET_VOLTAGE_REQUEST(_id) \ + { \ + .id = cpu_to_le32(_id), \ + } + /** * struct rpi_firmware_clk_rate_request - Firmware Request for a rate * @id: ID of the clock being queried -- cgit v1.2.3 From 103ff3a50e3a50a97e2b123d4dccbc8665eb1552 Mon Sep 17 00:00:00 2001 From: Claudio Imbrenda Date: Tue, 9 Jun 2026 17:09:28 +0200 Subject: KVM: s390: Add capability to support 2G hugepages Add KVM_CAP_S390_HPAGE_2G to signal to userspace that 2G hugepages may be used to back the guest; restrictions apply similar to 1M hugepages. Enable the (for now still ignored) GMAP_FLAG_ALLOW_HPAGE_2G flag for the guest gmap, and propagate / disable it as necessary. Reviewed-by: Steffen Eiden Signed-off-by: Claudio Imbrenda Message-ID: <20260609150930.665370-3-imbrenda@linux.ibm.com> --- include/uapi/linux/kvm.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index 6c8afa2047bf..419011097fa8 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -996,6 +996,7 @@ struct kvm_enable_cap { #define KVM_CAP_S390_USER_OPEREXEC 246 #define KVM_CAP_S390_KEYOP 247 #define KVM_CAP_S390_VSIE_ESAMODE 248 +#define KVM_CAP_S390_HPAGE_2G 249 struct kvm_irq_routing_irqchip { __u32 irqchip; -- cgit v1.2.3 From 60a1646b38d4d03e4fbdcc2c3fbff8096f5ff406 Mon Sep 17 00:00:00 2001 From: Richard Fitzgerald Date: Tue, 9 Jun 2026 13:29:46 +0100 Subject: ASoC: cs35l56: Increase pm_runtime autosuspend delay Increase the pm_runtime autosuspend delay to be longer than the timeout of the firmware's own inactivity timer. There is no point attempting to pm_runtime suspend any sooner than the firmware idle timeout because it would only mean the driver has to poll waiting for the firmware idle. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260609122946.288103-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown --- include/sound/cs35l56.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/sound/cs35l56.h b/include/sound/cs35l56.h index c3b10587cb4c..2490b72c0a7a 100644 --- a/include/sound/cs35l56.h +++ b/include/sound/cs35l56.h @@ -286,6 +286,8 @@ struct snd_ctl_elem_value; #define CS35L56_MBOX_TIMEOUT_US 5000 #define CS35L56_MBOX_POLL_US 250 +#define CS35L56_FW_REQ_ACTIVE_TIMEOUT_MS 250 + #define CS35L56_PS0_POLL_US 500 #define CS35L56_PS0_TIMEOUT_US 50000 #define CS35L56_PS3_POLL_US 500 -- cgit v1.2.3 From ded86da4bbb78cad74cecc368fee3ae3a296e2ca Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Thu, 4 Jun 2026 17:29:02 -0700 Subject: net: ethtool: relax ethnl_req_get_phydev() locking assertion phydev <> netdev linking and lifecycle depends on rtnl_lock. We want to switch to instance locks for most ethtool ops. Let's add an assert that ops locked devices don't use phydev today. If one does we can either opt the phy ops out of being purely ops locked, or do deeper surgery to make phy locking ops-compatible. I don't think there's any fundamental challenge to make that work. Reviewed-by: Nicolai Buchwitz Reviewed-by: Maxime Chevallier Reviewed-by: Eric Dumazet Acked-by: Stanislav Fomichev Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260605002912.3456868-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/phy_link_topology.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/phy_link_topology.h b/include/linux/phy_link_topology.h index 68a59e25821c..95575f68d5bc 100644 --- a/include/linux/phy_link_topology.h +++ b/include/linux/phy_link_topology.h @@ -36,6 +36,11 @@ struct phy_device_node { struct phy_device *phy; }; +static inline bool phy_link_topo_empty(struct net_device *dev) +{ + return !dev->link_topo; +} + #if IS_ENABLED(CONFIG_PHYLIB) int phy_link_topo_add_phy(struct net_device *dev, struct phy_device *phy, -- cgit v1.2.3 From 97f51bf91b3afa8819fa10e9282e3f2328bb78e4 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Thu, 4 Jun 2026 17:29:03 -0700 Subject: net: ethtool: make dev->hwprov ops-protected dev->hwprov tracks the active hwtstamp provider for the device. Make it ops protected (instance lock if the netdev driver opts into holding instance lock around callbacks, otherwise rtnl_lock). hwprov is written and read in: - drivers/net/phy/phy_device.c phydev and ops protection don't currently mix, add a comment - net/ethtool/ as of now holds both rtnl lock and ops lock, this one will soon only hold one lock or the other read in: - net/core/dev_ioctl.c holds both rtnl lock and ops lock - net/core/timestamping.c RCU reader The new netdev_ops_lock_dereference() helper does not have "compat" in the name. The name would be quite long and I think in this case it should be obvious that we need _a_ lock. netdev_lock_dereference() already exists and means dev->lock is always expected. Reviewed-by: Eric Dumazet Acked-by: Stanislav Fomichev Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260605002912.3456868-4-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 3 +++ include/net/netdev_lock.h | 11 +++++++++++ 2 files changed, 14 insertions(+) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 74507c006490..a8709d0cc8d4 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -2583,6 +2583,9 @@ struct net_device { * Double protects: * @up, @moving_ns, @nd_net, @xdp_features * + * Ops protects: + * @hwprov + * * Double ops protects: * @real_num_rx_queues, @real_num_tx_queues * diff --git a/include/net/netdev_lock.h b/include/net/netdev_lock.h index d3daec4e93f3..9fb3e93857c3 100644 --- a/include/net/netdev_lock.h +++ b/include/net/netdev_lock.h @@ -102,6 +102,14 @@ static inline void netdev_unlock_ops_compat(struct net_device *dev) rtnl_unlock(); } +/* Matching "ops protected" category from netdevice.h */ +static inline int netdev_is_locked_ops_compat(const struct net_device *dev) +{ + if (netdev_need_ops_lock(dev)) + return lockdep_is_held(&dev->lock); + return lockdep_rtnl_is_held(); +} + static inline int netdev_lock_cmp_fn(const struct lockdep_map *a, const struct lockdep_map *b) { @@ -138,6 +146,9 @@ static inline int netdev_lock_cmp_fn(const struct lockdep_map *a, #define netdev_lock_dereference(p, dev) \ rcu_dereference_protected(p, lockdep_is_held(&(dev)->lock)) +#define netdev_ops_lock_dereference(p, dev) \ + rcu_dereference_protected(p, netdev_is_locked_ops_compat(dev)) + int netdev_debug_event(struct notifier_block *nb, unsigned long event, void *ptr); -- cgit v1.2.3 From 45079e00133ee78fd216ccc4285534044ea69173 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Thu, 4 Jun 2026 17:29:04 -0700 Subject: net: ethtool: optionally skip rtnl_lock on Netlink path for GET ops ethnl_default_doit() and ethnl_default_dump_one() are both used exclusively for GET callbacks (former to get info for a single device or get global strings). ops-locked devices don't need rtnl_lock for GET callbacks, stop taking it. Introduce an opt-out mechanism for devices which use phylink (fbnic) since phylink currently depends on rtnl_lock protection. Subsequent patches will add more exceptions, anyway. Practically the new helpers for judging if command needs rtnl_lock could also call netdev_need_ops_lock() but I find that it makes the code in the callers slightly less obvious. Add a helper for IOCTLs already, even tho it's unused so that we can keep them in sync as the series progresses. This is the first user-visible step of moving ethtool ops out from under rtnl. Subsequent patches do the same for SET ops, as well as the ioctl path. Reviewed-by: Eric Dumazet Acked-by: Stanislav Fomichev Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260605002912.3456868-5-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/ethtool.h | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index f51346a6a686..1da49161d36f 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -930,6 +930,13 @@ struct kernel_ethtool_ts_info { u32 rx_filters; }; +/* Bits for ethtool_ops::op_needs_rtnl + * LINKSETTINGS cover a number of commands, but in most cases we want to keep + * these bits separate, per GET and SET. GET is much easier to "unlock". + */ +#define ETHTOOL_OP_NEEDS_RTNL_LINKSETTINGS BIT(0) +#define ETHTOOL_OP_NEEDS_RTNL_GPAUSEPARAM BIT(1) + /** * struct ethtool_ops - optional netdev operations * @supported_input_xfrm: supported types of input xfrm from %RXH_XFRM_*. @@ -956,6 +963,14 @@ struct kernel_ethtool_ts_info { * @supported_coalesce_params: supported types of interrupt coalescing. * @supported_ring_params: supported ring params. * @supported_hwtstamp_qualifiers: bitfield of supported hwtstamp qualifier. + * @op_needs_rtnl: mask of %ETHTOOL_OP_NEEDS_RTNL_* bits. + * For use with ops-locked drivers (ignored otherwise). Selects which + * ethtool callbacks driver needs to still be executed under rtnl_lock + * (in addition to the netdev instance lock). + * The following commonly used core APIs currently require rtnl_lock + * (this list may not be exhaustive): + * - phylink helpers (note that phydev is currently unsupported!) + * * @get_drvinfo: Report driver/device information. Modern drivers no * longer have to implement this callback. Most fields are * correctly filled in by the core using system information, or @@ -1155,7 +1170,7 @@ struct kernel_ethtool_ts_info { * * All operations are optional (i.e. the function pointer may be set * to %NULL) and callers must take this into account. Callers must - * hold the RTNL lock. + * hold the RTNL lock or netdev instance lock (see @op_needs_rtnl). * * See the structures used by these operations for further documentation. * Note that for all operations using a structure ending with a zero- @@ -1178,6 +1193,7 @@ struct ethtool_ops { u32 supported_coalesce_params; u32 supported_ring_params; u32 supported_hwtstamp_qualifiers; + u32 op_needs_rtnl; void (*get_drvinfo)(struct net_device *, struct ethtool_drvinfo *); int (*get_regs_len)(struct net_device *); void (*get_regs)(struct net_device *, struct ethtool_regs *, void *); -- cgit v1.2.3 From f9a3e05114b85d63452e7f9c172b53d6a1736fe0 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Thu, 4 Jun 2026 17:29:05 -0700 Subject: net: ethtool: optionally skip rtnl_lock on Netlink path for SET ops Make ethtool not take rtnl_lock for SET commands when operation is performed on an ops-locked driver. cfg/cfg_pending are now ops-locked, since only ethtool modifies them. Some SET driver callbacks will still need rtnl_lock, most notably those which may end up calling netdev_update_features() or the qdisc layer (via netif_set_real_num_tx_queues()). Let drivers selectively opt back into the rtnl_lock with a new bitfield in ops. We need two helpers since Netlink and ioctl cmds have different values. Keep the helpers side by side in common.h to make sure they get updated together, even tho they will only get called from ioctl.c and netlink.c. SET commands which don't use ethnl_default_set_doit() are converted by subsequent commits. Reviewed-by: Eric Dumazet Acked-by: Stanislav Fomichev Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260605002912.3456868-6-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/ethtool.h | 10 +++++++++- include/linux/netdevice.h | 2 +- 2 files changed, 10 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index 1da49161d36f..74c8109b0cf3 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -935,7 +935,13 @@ struct kernel_ethtool_ts_info { * these bits separate, per GET and SET. GET is much easier to "unlock". */ #define ETHTOOL_OP_NEEDS_RTNL_LINKSETTINGS BIT(0) -#define ETHTOOL_OP_NEEDS_RTNL_GPAUSEPARAM BIT(1) +#define ETHTOOL_OP_NEEDS_RTNL_SPFLAGS BIT(1) +#define ETHTOOL_OP_NEEDS_RTNL_SRINGPARAM BIT(2) +#define ETHTOOL_OP_NEEDS_RTNL_SCHANNELS BIT(3) +#define ETHTOOL_OP_NEEDS_RTNL_SCOALESCE BIT(4) +#define ETHTOOL_OP_NEEDS_RTNL_GPAUSEPARAM BIT(5) +#define ETHTOOL_OP_NEEDS_RTNL_SPAUSEPARAM BIT(6) +#define ETHTOOL_OP_NEEDS_RTNL_RSS BIT(7) /** * struct ethtool_ops - optional netdev operations @@ -970,6 +976,8 @@ struct kernel_ethtool_ts_info { * The following commonly used core APIs currently require rtnl_lock * (this list may not be exhaustive): * - phylink helpers (note that phydev is currently unsupported!) + * - netdev_update_features() + * - netif_set_real_num_tx_queues() * * @get_drvinfo: Report driver/device information. Modern drivers no * longer have to implement this callback. Most fields are diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index a8709d0cc8d4..403b6d1c67f8 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -2584,7 +2584,7 @@ struct net_device { * @up, @moving_ns, @nd_net, @xdp_features * * Ops protects: - * @hwprov + * @cfg, @cfg_pending, @hwprov * * Double ops protects: * @real_num_rx_queues, @real_num_tx_queues -- cgit v1.2.3 From 2526717624ab477fb7df2bf1af6e1f257c72ee0f Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Thu, 4 Jun 2026 17:29:08 -0700 Subject: net: ethtool: optionally skip rtnl_lock in ethnl_act_module_fw_flash() Module firmware flashing reads SFF-8024 identifier bytes via .get_module_eeprom_by_page(). Other than that it modifies a bit in the netdev->ethtool struct. Both should be ops-locked at this point. Reviewed-by: Eric Dumazet Acked-by: Stanislav Fomichev Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260605002912.3456868-9-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 403b6d1c67f8..9b876cd930d7 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -2584,7 +2584,7 @@ struct net_device { * @up, @moving_ns, @nd_net, @xdp_features * * Ops protects: - * @cfg, @cfg_pending, @hwprov + * @cfg, @cfg_pending, @ethtool, @hwprov * * Double ops protects: * @real_num_rx_queues, @real_num_tx_queues -- cgit v1.2.3 From f994752b11273ded7ec6b49ae5c1d319eef21743 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Thu, 4 Jun 2026 17:29:11 -0700 Subject: net: ethtool: optionally skip rtnl_lock on IOCTL path Convert the IOCTL path similarly to how we converted Netlink. The device lookup gets a little hairy. We could take rtnl_lock unconditionally and drop it before calling the driver (this would avoid the reference + liveness check). But I think being able to make progress even if rtnl is dead-locked is quite useful. First extra concern is handling features. List all the cmds which modify features and always take rtnl_lock. We could fold this list into ethtool_ioctl_needs_rtnl() but seems cleaner to keep ethtool_ioctl_needs_rtnl() driver-related. If a driver changed features and we were not holding rtnl_lock - warn about it. It can only happen on buggy ops locked drivers (buggy because they should have set appropriate "I need rtnl for op X" bit). Second wrinkle is the PHY ID hack which drops the locks while sleeping. Convert its static "busy" variable which used to be protected by rtnl_lock to a field in struct ethtool_netdev_state. This feature is about identifying an adapter or a port within a system, so being able to blink multiple LEDs at the same time is likely not very useful in practice. But it's the simplest fix, we can add a mutex if someone thinks a system should only be ID'ing one port at a time. Reviewed-by: Eric Dumazet Acked-by: Stanislav Fomichev Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260605002912.3456868-12-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/ethtool.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index 74c8109b0cf3..da29017c757f 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -1375,6 +1375,7 @@ int ethtool_virtdev_set_link_ksettings(struct net_device *dev, * within RTNL. * @rss_indir_user_size: Number of user provided entries for the default * (context 0) indirection table. + * @phys_id_busy: Loop blinking the device LED is running. * @wol_enabled: Wake-on-LAN is enabled * @module_fw_flash_in_progress: Module firmware flashing is in progress. */ @@ -1382,6 +1383,7 @@ struct ethtool_netdev_state { struct xarray rss_ctx; struct mutex rss_lock; u32 rss_indir_user_size; + unsigned phys_id_busy:1; unsigned wol_enabled:1; unsigned module_fw_flash_in_progress:1; }; -- cgit v1.2.3 From b5125db8d0205048a3b9dafec7f8e2b0a702101f Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Thu, 4 Jun 2026 17:29:12 -0700 Subject: docs: net: ethtool: document ops-locked drivers and op_needs_rtnl Catch up various bits of documentation after the locking changes. Reviewed-by: Nicolai Buchwitz Reviewed-by: Eric Dumazet Acked-by: Stanislav Fomichev Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260605002912.3456868-13-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/ethtool.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index da29017c757f..1b834e2a522e 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -1177,8 +1177,14 @@ struct kernel_ethtool_ts_info { * @get_mm_stats: Query the 802.3 MAC Merge layer statistics. * * All operations are optional (i.e. the function pointer may be set - * to %NULL) and callers must take this into account. Callers must - * hold the RTNL lock or netdev instance lock (see @op_needs_rtnl). + * to %NULL) and callers must take this into account. + * + * For traditional drivers callers hold ``rtnl_lock`` across the call. + * For "ops locked" drivers (see Documentation/networking/netdevices.rst) + * callers instead hold the netdev instance lock (``netdev_lock_ops``); + * ``rtnl_lock`` is additionally held only for callbacks for which + * the driver opts in via the matching ``ETHTOOL_OP_NEEDS_RTNL_*`` bit + * in @op_needs_rtnl. * * See the structures used by these operations for further documentation. * Note that for all operations using a structure ending with a zero- -- cgit v1.2.3 From 978cda83de411fcbff22ac5b2b0024cae7df806f Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Sun, 19 Apr 2026 14:53:02 -0400 Subject: NFSD: Add NFSD_CMD_UNLOCK_IP netlink command The existing write_unlock_ip procfs interface releases NLM file locks held by a specific client IP address, but procfs provides no structured way to extend that operation to other scopes such as revoking NFSv4 state. Add NFSD_CMD_UNLOCK_IP as a dedicated netlink command for releasing NLM locks by client address. The command accepts a binary sockaddr_in or sockaddr_in6 in its address attribute. The handler validates the address family and length, then calls nlmsvc_unlock_all_by_ip() to release matching NLM locks. Because lockd is a single global instance, that call operates across all network namespaces regardless of which namespace the caller inhabits. A separate netlink command for filesystem-scoped unlock is added in a subsequent commit. The nfsd_ctl_unlock_ip tracepoint is updated from string-based address logging to __sockaddr, which stores the binary sockaddr and formats it with %pISpc. This affects both the new netlink path and the existing procfs write_unlock_ip path, giving consistent structured output in both cases. Reviewed-by: Jeff Layton Tested-by: Dai Ngo Signed-off-by: Chuck Lever --- include/uapi/linux/nfsd_netlink.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/nfsd_netlink.h b/include/uapi/linux/nfsd_netlink.h index 060c43675599..90ef1e686769 100644 --- a/include/uapi/linux/nfsd_netlink.h +++ b/include/uapi/linux/nfsd_netlink.h @@ -204,6 +204,13 @@ enum { NFSD_A_CACHE_FLUSH_MAX = (__NFSD_A_CACHE_FLUSH_MAX - 1) }; +enum { + NFSD_A_UNLOCK_IP_ADDRESS = 1, + + __NFSD_A_UNLOCK_IP_MAX, + NFSD_A_UNLOCK_IP_MAX = (__NFSD_A_UNLOCK_IP_MAX - 1) +}; + enum { NFSD_CMD_RPC_STATUS_GET = 1, NFSD_CMD_THREADS_SET, @@ -220,6 +227,7 @@ enum { NFSD_CMD_EXPKEY_GET_REQS, NFSD_CMD_EXPKEY_SET_REQS, NFSD_CMD_CACHE_FLUSH, + NFSD_CMD_UNLOCK_IP, __NFSD_CMD_MAX, NFSD_CMD_MAX = (__NFSD_CMD_MAX - 1) -- cgit v1.2.3 From 327c5168eff2e7f1760ca67fcb0f9053019fbfee Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Sun, 19 Apr 2026 14:53:03 -0400 Subject: NFSD: Add NFSD_CMD_UNLOCK_FILESYSTEM netlink command Add NFSD_CMD_UNLOCK_FILESYSTEM as a dedicated netlink command for revoking NFS state under a filesystem path, providing a netlink equivalent of /proc/fs/nfsd/unlock_fs. The command requires a "path" string attribute containing the filesystem path whose state should be released. The handler resolves the path to its superblock, then cancels async copies, releases NLM locks, and revokes NFSv4 state on that superblock. Reviewed-by: Jeff Layton Tested-by: Dai Ngo Signed-off-by: Chuck Lever --- include/uapi/linux/nfsd_netlink.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/nfsd_netlink.h b/include/uapi/linux/nfsd_netlink.h index 90ef1e686769..d01096c06d72 100644 --- a/include/uapi/linux/nfsd_netlink.h +++ b/include/uapi/linux/nfsd_netlink.h @@ -211,6 +211,13 @@ enum { NFSD_A_UNLOCK_IP_MAX = (__NFSD_A_UNLOCK_IP_MAX - 1) }; +enum { + NFSD_A_UNLOCK_FILESYSTEM_PATH = 1, + + __NFSD_A_UNLOCK_FILESYSTEM_MAX, + NFSD_A_UNLOCK_FILESYSTEM_MAX = (__NFSD_A_UNLOCK_FILESYSTEM_MAX - 1) +}; + enum { NFSD_CMD_RPC_STATUS_GET = 1, NFSD_CMD_THREADS_SET, @@ -228,6 +235,7 @@ enum { NFSD_CMD_EXPKEY_SET_REQS, NFSD_CMD_CACHE_FLUSH, NFSD_CMD_UNLOCK_IP, + NFSD_CMD_UNLOCK_FILESYSTEM, __NFSD_CMD_MAX, NFSD_CMD_MAX = (__NFSD_CMD_MAX - 1) -- cgit v1.2.3 From 2eac189bb059d31a29937b29ee0f477394198610 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Sun, 19 Apr 2026 14:53:06 -0400 Subject: NFSD: Add NFSD_CMD_UNLOCK_EXPORT netlink command When a filesystem is exported to NFS clients, NFSv4 state (opens, locks, delegations, layouts) holds references that prevent the underlying filesystem from being unmounted. NFSD_CMD_UNLOCK_FILESYSTEM addresses this at superblock granularity, but administrators unexporting a single path on a shared filesystem (e.g., one of several exports on the same device) need finer control. Add NFSD_CMD_UNLOCK_EXPORT, which revokes NFSv4 state acquired through exports of a specific path. Matching is by path identity (dentry + vfsmount) via the sc_export field on each nfs4_stid, so multiple svc_export objects for the same path -- one per auth_domain -- are handled correctly without requiring the caller to name a specific client. The command takes a single "path" attribute. Userspace (exportfs -u) sends this after removing the last client for a given path, enabling the underlying filesystem to be unmounted. When multiple clients share an export path, individual unexports do not trigger state revocation; only the final one does. Reviewed-by: Jeff Layton Tested-by: Dai Ngo Signed-off-by: Chuck Lever --- include/uapi/linux/nfsd_netlink.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/nfsd_netlink.h b/include/uapi/linux/nfsd_netlink.h index d01096c06d72..f5b75d5caba9 100644 --- a/include/uapi/linux/nfsd_netlink.h +++ b/include/uapi/linux/nfsd_netlink.h @@ -218,6 +218,13 @@ enum { NFSD_A_UNLOCK_FILESYSTEM_MAX = (__NFSD_A_UNLOCK_FILESYSTEM_MAX - 1) }; +enum { + NFSD_A_UNLOCK_EXPORT_PATH = 1, + + __NFSD_A_UNLOCK_EXPORT_MAX, + NFSD_A_UNLOCK_EXPORT_MAX = (__NFSD_A_UNLOCK_EXPORT_MAX - 1) +}; + enum { NFSD_CMD_RPC_STATUS_GET = 1, NFSD_CMD_THREADS_SET, @@ -236,6 +243,7 @@ enum { NFSD_CMD_CACHE_FLUSH, NFSD_CMD_UNLOCK_IP, NFSD_CMD_UNLOCK_FILESYSTEM, + NFSD_CMD_UNLOCK_EXPORT, __NFSD_CMD_MAX, NFSD_CMD_MAX = (__NFSD_CMD_MAX - 1) -- cgit v1.2.3 From e9be933959b581effd426f93b86654f5fbf0c574 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Mon, 27 Apr 2026 09:50:47 -0400 Subject: SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists The crypto/krb5 library accepts data in scatterlist form, but the GSS-API layer presents RPC payloads as struct xdr_buf. Bridge that gap with a pair of helper functions: xdr_buf_to_sg() - populate a caller-supplied scatterlist array from a byte range xdr_buf_to_sg_alloc() - populate a caller-supplied inline scatterlist, chaining to a heap- allocated overflow for large payloads The inline array (typically stack-allocated at eight entries) covers the common case of small RPCs with no heap allocation on the encrypt/decrypt path. Only buffers spanning many pages incur a kmalloc for the chained extension. The segment-walking logic follows the same head, page array, tail traversal as xdr_process_buf(), but populates a scatterlist directly rather than invoking a per-segment callback. sg_next() traversal makes the walker safe for chained scatterlists. Once subsequent patches reroute all per-message crypto operations through crypto/krb5, xdr_process_buf() loses its last callers and is removed. Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Jeff Layton Acked-by: Anna Schumaker Signed-off-by: Chuck Lever --- include/linux/sunrpc/xdr.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'include') diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h index b639a6fafcbc..f82446993fde 100644 --- a/include/linux/sunrpc/xdr.h +++ b/include/linux/sunrpc/xdr.h @@ -140,6 +140,21 @@ int xdr_alloc_bvec(struct xdr_buf *buf, gfp_t gfp); void xdr_free_bvec(struct xdr_buf *buf); unsigned int xdr_buf_to_bvec(struct bio_vec *bvec, unsigned int bvec_size, const struct xdr_buf *xdr); +int xdr_buf_to_sg(const struct xdr_buf *buf, unsigned int offset, + unsigned int len, struct scatterlist *sg, unsigned int nsg); +int xdr_buf_to_sg_alloc(const struct xdr_buf *buf, unsigned int offset, + unsigned int len, struct scatterlist *sg_head, + unsigned int sg_head_nents, + struct scatterlist **sg_overflow, gfp_t gfp); + +/* + * Inline scatterlist entries for xdr_buf_to_sg_alloc(). Sized to cover the + * head kvec, tail kvec, and a few page fragments without any heap allocation. + */ +enum { + XDR_BUF_TO_SG_NENTS = 8, +}; + static inline __be32 *xdr_encode_array(__be32 *p, const void *s, unsigned int len) { -- cgit v1.2.3 From 979accbc6bcb551b095b678a6f0c41899080ccd1 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Mon, 27 Apr 2026 09:50:59 -0400 Subject: SUNRPC: Remove dead code from rpcsec_gss_krb5 With all per-message crypto operations routed through crypto/krb5, a substantial body of code in rpcsec_gss_krb5 has no remaining callers. The internal key derivation functions (krb5_derive_key_v2, krb5_kdf_hmac_sha2, krb5_kdf_feedback_cmac) and the low-level crypto primitives (krb5_encrypt, gss_krb5_checksum, krb5_cbc_cts_ encrypt/decrypt, krb5_etm_checksum) are unreachable because their only call sites were the per-enctype function pointers removed in previous patches. Delete gss_krb5_keys.c entirely and strip the dead functions from gss_krb5_crypto.c. The KUnit test suite in gss_krb5_test.c exercised exactly these internal functions: RFC 3961 n-fold, RFC 3962 key derivation, RFC 6803 Camellia key derivation, and RFC 8009 AES-SHA2 key derivation, plus encryption self-tests that drove the now-removed encrypt routines. The corresponding test coverage is provided by the crypto/krb5 selftests in crypto/krb5/selftest.c. Remove the test file, the RPCSEC_GSS_KRB5_KUNIT_TEST Kconfig symbol, the .kunitconfig, and all VISIBLE_IF_KUNIT / EXPORT_SYMBOL_IF_KUNIT annotations. xdr_process_buf() walked xdr_buf segments through a per-segment callback and existed solely for the crypto routines in gss_krb5_crypto.c. With that file removed, xdr_process_buf() has no remaining callers. Its successor, xdr_buf_to_sg(), populates a scatterlist directly from an xdr_buf byte range and was introduced earlier in this series. With every consumer of struct gss_krb5_enctype removed, replace its remaining uses with the equivalent fields from struct krb5_enctype (key_len). Remove struct gss_krb5_enctype, the supported_gss_krb5_enctypes[] table, gss_krb5_lookup_enctype(), and the gk5e pointer from krb5_ctx. Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Jeff Layton Acked-by: Anna Schumaker Signed-off-by: Chuck Lever --- include/linux/sunrpc/xdr.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h index f82446993fde..31971b01d962 100644 --- a/include/linux/sunrpc/xdr.h +++ b/include/linux/sunrpc/xdr.h @@ -275,7 +275,6 @@ extern void xdr_finish_decode(struct xdr_stream *xdr); extern __be32 *xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes); extern unsigned int xdr_read_pages(struct xdr_stream *xdr, unsigned int len); extern void xdr_enter_page(struct xdr_stream *xdr, unsigned int len); -extern int xdr_process_buf(const struct xdr_buf *buf, unsigned int offset, unsigned int len, int (*actor)(struct scatterlist *, void *), void *data); extern void xdr_set_pagelen(struct xdr_stream *, unsigned int len); extern bool xdr_stream_subsegment(struct xdr_stream *xdr, struct xdr_buf *subbuf, unsigned int len); -- cgit v1.2.3 From 2804a16b9e51f803a32ac2e9a014f5851a7cc3f4 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Mon, 27 Apr 2026 09:51:02 -0400 Subject: SUNRPC: Remove dead rpcsec_gss_krb5 definitions The migration to crypto/krb5 eliminated the per-enctype function dispatch and direct crypto API usage, leaving behind a number of orphaned definitions. Remove the following from gss_krb5.h: - GSS_KRB5_K5CLENGTH, used only by removed key derivation - KG_TOK_MIC_MSG and KG_TOK_WRAP_MSG (Kerberos v1 token types; v1 support was dropped earlier) - KG2_TOK_INITIAL and KG2_TOK_RESPONSE (context establishment token types; no remaining users) - KG2_RESP_FLAG_ERROR and KG2_RESP_FLAG_DELEG_OK - enum sgn_alg and enum seal_alg (v1 algorithm constants) - All CKSUMTYPE_* definitions, now duplicated by KRB5_CKSUMTYPE_* in - The KG_ error constants from gssapi_err_krb5.h, which have no remaining users - The ENCTYPE_* constant block, replaced by KRB5_ENCTYPE_* from - KG_USAGE_SEAL/SIGN/SEQ (3DES usage constants) - KEY_USAGE_SEED_CHECKSUM/ENCRYPTION/INTEGRITY, duplicated by - #include , no longer needed Remove the cksum[] field from struct krb5_ctx in gss_krb5_internal.h; no code reads or writes it after the key derivation removal. Switch gss_krb5_enctypes[] in gss_krb5_mech.c to the canonical KRB5_ENCTYPE_* names from . Remove stale #include directives: - from gss_krb5_wrap.c - and from gss_krb5_seal.c Assisted-by: Claude:claude-opus-4-6 Reviewed-by: Jeff Layton Acked-by: Anna Schumaker Signed-off-by: Chuck Lever --- include/linux/sunrpc/gss_krb5.h | 105 ---------------------------------------- 1 file changed, 105 deletions(-) (limited to 'include') diff --git a/include/linux/sunrpc/gss_krb5.h b/include/linux/sunrpc/gss_krb5.h index 43950b5237c8..1cd452ed1db5 100644 --- a/include/linux/sunrpc/gss_krb5.h +++ b/include/linux/sunrpc/gss_krb5.h @@ -37,13 +37,9 @@ #ifndef _LINUX_SUNRPC_GSS_KRB5_H #define _LINUX_SUNRPC_GSS_KRB5_H -#include #include #include -/* Length of constant used in key derivation */ -#define GSS_KRB5_K5CLENGTH (5) - /* Maximum key length (in bytes) for the supported crypto algorithms */ #define GSS_KRB5_MAX_KEYLEN (32) @@ -56,11 +52,6 @@ /* The length of the Kerberos GSS token header */ #define GSS_KRB5_TOK_HDR_LEN (16) -#define KG_TOK_MIC_MSG 0x0101 -#define KG_TOK_WRAP_MSG 0x0201 - -#define KG2_TOK_INITIAL 0x0101 -#define KG2_TOK_RESPONSE 0x0202 #define KG2_TOK_MIC 0x0404 #define KG2_TOK_WRAP 0x0504 @@ -68,102 +59,6 @@ #define KG2_TOKEN_FLAG_SEALED 0x02 #define KG2_TOKEN_FLAG_ACCEPTORSUBKEY 0x04 -#define KG2_RESP_FLAG_ERROR 0x0001 -#define KG2_RESP_FLAG_DELEG_OK 0x0002 - -enum sgn_alg { - SGN_ALG_DES_MAC_MD5 = 0x0000, - SGN_ALG_MD2_5 = 0x0001, - SGN_ALG_DES_MAC = 0x0002, - SGN_ALG_3 = 0x0003, /* not published */ - SGN_ALG_HMAC_SHA1_DES3_KD = 0x0004 -}; -enum seal_alg { - SEAL_ALG_NONE = 0xffff, - SEAL_ALG_DES = 0x0000, - SEAL_ALG_1 = 0x0001, /* not published */ - SEAL_ALG_DES3KD = 0x0002 -}; - -/* - * These values are assigned by IANA and published via the - * subregistry at the link below: - * - * https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-2 - */ -#define CKSUMTYPE_CRC32 0x0001 -#define CKSUMTYPE_RSA_MD4 0x0002 -#define CKSUMTYPE_RSA_MD4_DES 0x0003 -#define CKSUMTYPE_DESCBC 0x0004 -#define CKSUMTYPE_RSA_MD5 0x0007 -#define CKSUMTYPE_RSA_MD5_DES 0x0008 -#define CKSUMTYPE_NIST_SHA 0x0009 -#define CKSUMTYPE_HMAC_SHA1_DES3 0x000c -#define CKSUMTYPE_HMAC_SHA1_96_AES128 0x000f -#define CKSUMTYPE_HMAC_SHA1_96_AES256 0x0010 -#define CKSUMTYPE_CMAC_CAMELLIA128 0x0011 -#define CKSUMTYPE_CMAC_CAMELLIA256 0x0012 -#define CKSUMTYPE_HMAC_SHA256_128_AES128 0x0013 -#define CKSUMTYPE_HMAC_SHA384_192_AES256 0x0014 -#define CKSUMTYPE_HMAC_MD5_ARCFOUR -138 /* Microsoft md5 hmac cksumtype */ - -/* from gssapi_err_krb5.h */ -#define KG_CCACHE_NOMATCH (39756032L) -#define KG_KEYTAB_NOMATCH (39756033L) -#define KG_TGT_MISSING (39756034L) -#define KG_NO_SUBKEY (39756035L) -#define KG_CONTEXT_ESTABLISHED (39756036L) -#define KG_BAD_SIGN_TYPE (39756037L) -#define KG_BAD_LENGTH (39756038L) -#define KG_CTX_INCOMPLETE (39756039L) -#define KG_CONTEXT (39756040L) -#define KG_CRED (39756041L) -#define KG_ENC_DESC (39756042L) -#define KG_BAD_SEQ (39756043L) -#define KG_EMPTY_CCACHE (39756044L) -#define KG_NO_CTYPES (39756045L) - -/* per Kerberos v5 protocol spec crypto types from the wire. - * these get mapped to linux kernel crypto routines. - * - * These values are assigned by IANA and published via the - * subregistry at the link below: - * - * https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-1 - */ -#define ENCTYPE_NULL 0x0000 -#define ENCTYPE_DES_CBC_CRC 0x0001 /* DES cbc mode with CRC-32 */ -#define ENCTYPE_DES_CBC_MD4 0x0002 /* DES cbc mode with RSA-MD4 */ -#define ENCTYPE_DES_CBC_MD5 0x0003 /* DES cbc mode with RSA-MD5 */ -#define ENCTYPE_DES_CBC_RAW 0x0004 /* DES cbc mode raw */ -/* XXX deprecated? */ -#define ENCTYPE_DES3_CBC_SHA 0x0005 /* DES-3 cbc mode with NIST-SHA */ -#define ENCTYPE_DES3_CBC_RAW 0x0006 /* DES-3 cbc mode raw */ -#define ENCTYPE_DES_HMAC_SHA1 0x0008 -#define ENCTYPE_DES3_CBC_SHA1 0x0010 -#define ENCTYPE_AES128_CTS_HMAC_SHA1_96 0x0011 -#define ENCTYPE_AES256_CTS_HMAC_SHA1_96 0x0012 -#define ENCTYPE_AES128_CTS_HMAC_SHA256_128 0x0013 -#define ENCTYPE_AES256_CTS_HMAC_SHA384_192 0x0014 -#define ENCTYPE_ARCFOUR_HMAC 0x0017 -#define ENCTYPE_ARCFOUR_HMAC_EXP 0x0018 -#define ENCTYPE_CAMELLIA128_CTS_CMAC 0x0019 -#define ENCTYPE_CAMELLIA256_CTS_CMAC 0x001A -#define ENCTYPE_UNKNOWN 0x01ff - -/* - * Constants used for key derivation - */ -/* for 3DES */ -#define KG_USAGE_SEAL (22) -#define KG_USAGE_SIGN (23) -#define KG_USAGE_SEQ (24) - -/* from rfc3961 */ -#define KEY_USAGE_SEED_CHECKSUM (0x99) -#define KEY_USAGE_SEED_ENCRYPTION (0xAA) -#define KEY_USAGE_SEED_INTEGRITY (0x55) - /* from rfc4121 */ #define KG_USAGE_ACCEPTOR_SEAL (22) #define KG_USAGE_ACCEPTOR_SIGN (23) -- cgit v1.2.3 From 9545262f7e58d67de413d5a47ea2a3f2e59ba9f6 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Wed, 6 May 2026 11:26:50 -0400 Subject: svcrdma: Release write chunk resources without re-queuing Each RDMA Send completion triggers a cascade of work items on the svcrdma_wq unbound workqueue: ib_cq_poll_work (on ib_comp_wq, per-CPU) -> svc_rdma_send_ctxt_put -> queue_work [work item 1] -> svc_rdma_write_info_free -> queue_work [work item 2] Every transition through queue_work contends on the unbound pool's spinlock. Profiling an 8KB NFSv3 read/write workload over RDMA shows about 4% of total CPU cycles spent on this lock, with the cascading re-queue of write_info release contributing roughly 1%. The initial queue_work in svc_rdma_send_ctxt_put is needed to move release work off the CQ completion context (which runs on a per-CPU bound workqueue). However, once executing on svcrdma_wq, there is no need to re-queue for each write_info structure. svc_rdma_reply_chunk_release already calls svc_rdma_cc_release inline from the same svcrdma_wq context, and svc_rdma_recv_ctxt_put does the same from nfsd thread context. Release write chunk resources inline in svc_rdma_write_info_free, removing the intermediate svc_rdma_write_info_free_async work item and the wi_work field from struct svc_rdma_write_info. Reviewed-by: Mike Snitzer Tested-by: Jonathan Flynn Signed-off-by: Chuck Lever --- include/linux/sunrpc/svc_rdma.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h index df6e08aaad57..14eb9d52742e 100644 --- a/include/linux/sunrpc/svc_rdma.h +++ b/include/linux/sunrpc/svc_rdma.h @@ -230,7 +230,6 @@ struct svc_rdma_write_info { unsigned int wi_next_off; struct svc_rdma_chunk_ctxt wi_cc; - struct work_struct wi_work; }; struct svc_rdma_send_ctxt { -- cgit v1.2.3 From 58202c29de9360a2b255458892e08a252d4406be Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Wed, 6 May 2026 11:26:51 -0400 Subject: svcrdma: Defer send context release to xpo_release_ctxt Send completion currently queues a work item to an unbound workqueue for each completed send context. Under load, the Send Completion handlers contend for the shared workqueue pool lock. Replace the workqueue with a per-transport lock-free list (llist). The Send completion handler appends the send_ctxt to sc_send_release_list and does no further teardown. The nfsd thread drains the list in xpo_release_ctxt between RPCs, performing DMA unmapping, chunk I/O resource release, and page release in a batch. This eliminates both the workqueue pool lock and the DMA unmap cost from the Send completion path. DMA unmapping can be expensive when an IOMMU is present in strict mode, as each unmap triggers a synchronous hardware IOTLB invalidation. Moving it to the nfsd thread, where that latency is harmless, avoids penalizing completion handler throughput. The nfsd threads absorb the release cost at a point where the client is no longer waiting on a reply, and natural batching amortizes the overhead when completions arrive faster than RPCs complete. A self-enqueue backstops drain on a quiescing transport. When svc_rdma_send_ctxt_put() observes that its llist_add() transitions sc_send_release_list from empty to non-empty, it sets XPT_DATA and calls svc_xprt_enqueue() so that svc_xprt_ready() schedules an nfsd thread. The thread enters svc_rdma_recvfrom(), finds no pending receive, clears XPT_DATA, and returns 0; svc_xprt_release() then runs xpo_release_ctxt and drains the list. Under steady load the foreground drain keeps the list non-empty between adds and no enqueue fires; only the trailing edge of a burst pays for a wakeup. Without this path, a Send completion arriving after the last xpo_release_ctxt on an idle connection would leave the send_ctxt's DMA mappings and reply pages pinned until the next RPC, send-context exhaustion, or transport close. Signed-off-by: Chuck Lever --- include/linux/sunrpc/svc_rdma.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h index 14eb9d52742e..4ba39f07371d 100644 --- a/include/linux/sunrpc/svc_rdma.h +++ b/include/linux/sunrpc/svc_rdma.h @@ -66,7 +66,6 @@ extern unsigned int svcrdma_ord; extern unsigned int svcrdma_max_requests; extern unsigned int svcrdma_max_bc_requests; extern unsigned int svcrdma_max_req_size; -extern struct workqueue_struct *svcrdma_wq; extern struct percpu_counter svcrdma_stat_read; extern struct percpu_counter svcrdma_stat_recv; @@ -117,6 +116,8 @@ struct svcxprt_rdma { struct llist_head sc_recv_ctxts; + struct llist_head sc_send_release_list; + atomic_t sc_completion_ids; }; /* sc_flags */ @@ -235,7 +236,6 @@ struct svc_rdma_write_info { struct svc_rdma_send_ctxt { struct llist_node sc_node; struct rpc_rdma_cid sc_cid; - struct work_struct sc_work; struct svcxprt_rdma *sc_rdma; struct ib_send_wr sc_send_wr; @@ -299,6 +299,7 @@ extern int svc_rdma_process_read_list(struct svcxprt_rdma *rdma, /* svc_rdma_sendto.c */ extern void svc_rdma_send_ctxts_destroy(struct svcxprt_rdma *rdma); +extern void svc_rdma_send_ctxts_drain(struct svcxprt_rdma *rdma); extern struct svc_rdma_send_ctxt * svc_rdma_send_ctxt_get(struct svcxprt_rdma *rdma); extern void svc_rdma_send_ctxt_put(struct svcxprt_rdma *rdma, -- cgit v1.2.3 From 4b386d8ddb3633e300218325e2d81f8cf159fb51 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Tue, 12 May 2026 14:13:41 -0400 Subject: Documentation: Add the RPC language description of NLM version 3 In order to generate source code to encode and decode NLMv3 protocol elements, include a copy of the RPC language description of NLMv3 for xdrgen to process. The language description is derived from the Open Group's XNFS specification: https://pubs.opengroup.org/onlinepubs/9629799/chap10.htm#tagcjh_11_03 The C code committed here was generated from the new nlm3.x file using tools/net/sunrpc/xdrgen/xdrgen. The goals of replacing hand-written XDR functions with ones that are tool-generated are to improve memory safety and make XDR encoding and decoding less brittle to maintain. Parts of the NFSv4 protocol are still being extended actively. Tool-generated XDR code reduces the time it takes to get a working implementation of new protocol elements. The xdrgen utility derives both the type definitions and the encode/decode functions directly from protocol specifications, using names and symbols familiar to anyone who knows those specs. Unlike hand-written code that can inadvertently diverge from the specification, xdrgen guarantees that the generated code matches the specification exactly. We would eventually like xdrgen to generate Rust code as well, making the conversion of the kernel's NFS stacks to use Rust just a little easier for us. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever --- include/linux/sunrpc/xdrgen/nlm3.h | 210 +++++++++++++++++++++++++++++++++++++ 1 file changed, 210 insertions(+) create mode 100644 include/linux/sunrpc/xdrgen/nlm3.h (limited to 'include') diff --git a/include/linux/sunrpc/xdrgen/nlm3.h b/include/linux/sunrpc/xdrgen/nlm3.h new file mode 100644 index 000000000000..897e7d91807c --- /dev/null +++ b/include/linux/sunrpc/xdrgen/nlm3.h @@ -0,0 +1,210 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Generated by xdrgen. Manual edits will be lost. */ +/* XDR specification file: ../../Documentation/sunrpc/xdr/nlm3.x */ +/* XDR specification modification time: Thu Apr 23 10:56:34 2026 */ + +#ifndef _LINUX_XDRGEN_NLM3_DEF_H +#define _LINUX_XDRGEN_NLM3_DEF_H + +#include +#include + +enum { LM_MAXSTRLEN = 1024 }; + +enum { LM_MAXNAMELEN = 1025 }; + +enum { MAXNETOBJ_SZ = 1024 }; + +typedef opaque netobj; + +enum nlm_stats { + LCK_GRANTED = 0, + LCK_DENIED = 1, + LCK_DENIED_NOLOCKS = 2, + LCK_BLOCKED = 3, + LCK_DENIED_GRACE_PERIOD = 4, +}; + +typedef __be32 nlm_stats; + +struct nlm_stat { + nlm_stats stat; +}; + +struct nlm_res { + netobj cookie; + struct nlm_stat stat; +}; + +struct nlm_holder { + bool exclusive; + s32 uppid; + netobj oh; + u32 l_offset; + u32 l_len; +}; + +struct nlm_testrply { + nlm_stats stat; + union { + struct nlm_holder holder; + } u; +}; + +struct nlm_testres { + netobj cookie; + struct nlm_testrply test_stat; +}; + +struct nlm_lock { + string caller_name; + netobj fh; + netobj oh; + s32 uppid; + u32 l_offset; + u32 l_len; +}; + +struct nlm_lockargs { + netobj cookie; + bool block; + bool exclusive; + struct nlm_lock alock; + bool reclaim; + s32 state; +}; + +struct nlm_cancargs { + netobj cookie; + bool block; + bool exclusive; + struct nlm_lock alock; +}; + +struct nlm_testargs { + netobj cookie; + bool exclusive; + struct nlm_lock alock; +}; + +struct nlm_unlockargs { + netobj cookie; + struct nlm_lock alock; +}; + +enum fsh_mode { + fsm_DN = 0, + fsm_DR = 1, + fsm_DW = 2, + fsm_DRW = 3, +}; + +typedef enum fsh_mode fsh_mode; + +enum fsh_access { + fsa_NONE = 0, + fsa_R = 1, + fsa_W = 2, + fsa_RW = 3, +}; + +typedef enum fsh_access fsh_access; + +struct nlm_share { + string caller_name; + netobj fh; + netobj oh; + fsh_mode mode; + fsh_access access; +}; + +struct nlm_shareargs { + netobj cookie; + struct nlm_share share; + bool reclaim; +}; + +struct nlm_shareres { + netobj cookie; + nlm_stats stat; + s32 sequence; +}; + +struct nlm_notify { + string name; + s32 state; +}; + +enum { SM_PRIV_SIZE = 16 }; + +struct nlm_notifyargs { + struct nlm_notify notify; + u8 private[SM_PRIV_SIZE]; +}; + +enum { + NLM_NULL = 0, + NLM_TEST = 1, + NLM_LOCK = 2, + NLM_CANCEL = 3, + NLM_UNLOCK = 4, + NLM_GRANTED = 5, + NLM_TEST_MSG = 6, + NLM_LOCK_MSG = 7, + NLM_CANCEL_MSG = 8, + NLM_UNLOCK_MSG = 9, + NLM_GRANTED_MSG = 10, + NLM_TEST_RES = 11, + NLM_LOCK_RES = 12, + NLM_CANCEL_RES = 13, + NLM_UNLOCK_RES = 14, + NLM_GRANTED_RES = 15, + NLM_SM_NOTIFY = 16, + NLM_SHARE = 20, + NLM_UNSHARE = 21, + NLM_NM_LOCK = 22, + NLM_FREE_ALL = 23, +}; + +#ifndef NLM_PROG +#define NLM_PROG (100021) +#endif + +#define NLM3_netobj_sz (XDR_unsigned_int + XDR_QUADLEN(MAXNETOBJ_SZ)) +#define NLM3_nlm_stats_sz (XDR_int) +#define NLM3_nlm_stat_sz \ + (NLM3_nlm_stats_sz) +#define NLM3_nlm_res_sz \ + (NLM3_netobj_sz + NLM3_nlm_stat_sz) +#define NLM3_nlm_holder_sz \ + (XDR_bool + XDR_int + NLM3_netobj_sz + XDR_unsigned_int + XDR_unsigned_int) +#define NLM3_nlm_testrply_sz \ + (NLM3_nlm_stats_sz + NLM3_nlm_holder_sz) +#define NLM3_nlm_testres_sz \ + (NLM3_netobj_sz + NLM3_nlm_testrply_sz) +#define NLM3_nlm_lock_sz \ + (XDR_unsigned_int + XDR_QUADLEN(LM_MAXSTRLEN) + NLM3_netobj_sz + NLM3_netobj_sz + XDR_int + XDR_unsigned_int + XDR_unsigned_int) +#define NLM3_nlm_lockargs_sz \ + (NLM3_netobj_sz + XDR_bool + XDR_bool + NLM3_nlm_lock_sz + XDR_bool + XDR_int) +#define NLM3_nlm_cancargs_sz \ + (NLM3_netobj_sz + XDR_bool + XDR_bool + NLM3_nlm_lock_sz) +#define NLM3_nlm_testargs_sz \ + (NLM3_netobj_sz + XDR_bool + NLM3_nlm_lock_sz) +#define NLM3_nlm_unlockargs_sz \ + (NLM3_netobj_sz + NLM3_nlm_lock_sz) +#define NLM3_fsh_mode_sz (XDR_int) +#define NLM3_fsh_access_sz (XDR_int) +#define NLM3_nlm_share_sz \ + (XDR_unsigned_int + XDR_QUADLEN(LM_MAXSTRLEN) + NLM3_netobj_sz + NLM3_netobj_sz + NLM3_fsh_mode_sz + NLM3_fsh_access_sz) +#define NLM3_nlm_shareargs_sz \ + (NLM3_netobj_sz + NLM3_nlm_share_sz + XDR_bool) +#define NLM3_nlm_shareres_sz \ + (NLM3_netobj_sz + NLM3_nlm_stats_sz + XDR_int) +#define NLM3_nlm_notify_sz \ + (XDR_unsigned_int + XDR_QUADLEN(LM_MAXNAMELEN) + XDR_long) +#define NLM3_nlm_notifyargs_sz \ + (NLM3_nlm_notify_sz + XDR_QUADLEN(SM_PRIV_SIZE)) +#define NLM3_MAX_ARGS_SZ \ + (NLM3_nlm_lockargs_sz) + +#endif /* _LINUX_XDRGEN_NLM3_DEF_H */ -- cgit v1.2.3 From 18c1cc69886192e33536498289d26dba6894e3d5 Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Tue, 19 May 2026 09:34:22 -0400 Subject: SUNRPC: Return an error from xdr_buf_to_bvec() on overflow xdr_buf_to_bvec() returns a slot count even when the caller's bvec budget is exhausted partway through the xdr_buf. Callers feed that count into iov_iter_bvec() and continue as if the conversion had succeeded, silently sending or writing fewer bytes than the data length declares. For an NFS WRITE the server reports the truncated transfer to the client as full success. The overflow represents an internal invariant violation: a higher layer reserved a bvec budget too small for the xdr_buf it then asked the encoder to convert. That is a server-side fault, not a media I/O failure and not a malformed client argument. Change xdr_buf_to_bvec() to return a signed int and have the overflow label return -ESERVERFAULT. Update the three callers to detect the negative return and fail the request: nfsd_vfs_write() folds the error into host_err, which nfserrno() translates to nfserr_serverfault for the WRITE reply; svc_udp_sendto() and svc_tcp_sendmsg() propagate the error out of the send path. Reported-by: Chris Mason Fixes: 2eb2b9358181 ("SUNRPC: Convert svc_tcp_sendmsg to use bio_vecs directly") Cc: stable@vger.kernel.org Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever --- include/linux/sunrpc/xdr.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h index 31971b01d962..b102b4f21e6b 100644 --- a/include/linux/sunrpc/xdr.h +++ b/include/linux/sunrpc/xdr.h @@ -138,8 +138,8 @@ void xdr_terminate_string(const struct xdr_buf *, const u32); size_t xdr_buf_pagecount(const struct xdr_buf *buf); int xdr_alloc_bvec(struct xdr_buf *buf, gfp_t gfp); void xdr_free_bvec(struct xdr_buf *buf); -unsigned int xdr_buf_to_bvec(struct bio_vec *bvec, unsigned int bvec_size, - const struct xdr_buf *xdr); +int xdr_buf_to_bvec(struct bio_vec *bvec, unsigned int bvec_size, + const struct xdr_buf *xdr); int xdr_buf_to_sg(const struct xdr_buf *buf, unsigned int offset, unsigned int len, struct scatterlist *sg, unsigned int nsg); int xdr_buf_to_sg_alloc(const struct xdr_buf *buf, unsigned int offset, -- cgit v1.2.3 From e5248a7426030db1e126363f72afdb3b71339a5c Mon Sep 17 00:00:00 2001 From: Chuck Lever Date: Fri, 22 May 2026 14:13:57 -0400 Subject: svcrdma: wake sq waiters when the transport closes Threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or sc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state across transport teardown, pinning svc_xprt references and blocking svc_rdma_free(). The close path sets XPT_CLOSE before invoking xpo_detach and both wait_event predicates include an XPT_CLOSE term, but the predicates are re-evaluated only on wakeup. sc_sq_ticket_wait has no completion-driven wake path; it is advanced solely by the chained ticket handoff inside svc_rdma_sq_wait() itself. Without an explicit wake at close, parked threads never observe XPT_CLOSE, hold their svc_xprt_get reference forever, and svc_rdma_free() blocks on xpt_ref dropping to zero. Two close entry points reach this transport. Local teardown runs svc_rdma_detach() from svc_handle_xprt() -> svc_delete_xprt() -> xpo_detach() on a worker thread. A remote disconnect arrives at svc_rdma_cma_handler(), which calls svc_xprt_deferred_close(): that sets XPT_CLOSE and enqueues the transport but does not access either RDMA waitqueue, so a worker already parked in svc_rdma_sq_wait() never re-evaluates its predicate. With every worker parked on this transport, no thread is available to run the local teardown either, and the wake site there is unreachable. Introduce svc_rdma_xprt_deferred_close(), a thin svcrdma wrapper that calls svc_xprt_deferred_close() and then wakes both sc_sq_ticket_wait and sc_send_wait. Convert the svcrdma producers that called svc_xprt_deferred_close() directly: svc_rdma_cma_handler(), qp_event_handler(), svc_rdma_post_send_err(), svc_rdma_wc_send(), the sendto drop path, the rw completion error paths, and the recvfrom flush and read-list error paths. Wake both waitqueues from svc_rdma_detach() as well. The synchronous svc_xprt_close() path (backchannel ENOTCONN, device removal via svc_rdma_xprt_done) reaches detach without flowing through svc_xprt_deferred_close() and therefore does not invoke the new helper. Fixes: ccc89b9d1ed2 ("svcrdma: Add fair queuing for Send Queue access") Cc: stable@vger.kernel.org Assisted-by: kres (claude-opus-4-7) Signed-off-by: Chris Mason [ cel: add svc_rdma_xprt_deferred_close() to complete the fix ] Signed-off-by: Chuck Lever --- include/linux/sunrpc/svc_rdma.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h index 4ba39f07371d..5aadb47b3b0e 100644 --- a/include/linux/sunrpc/svc_rdma.h +++ b/include/linux/sunrpc/svc_rdma.h @@ -328,6 +328,7 @@ extern int svc_rdma_result_payload(struct svc_rqst *rqstp, unsigned int offset, unsigned int length); /* svc_rdma_transport.c */ +extern void svc_rdma_xprt_deferred_close(struct svcxprt_rdma *rdma); extern struct svc_xprt_class svc_rdma_class; #ifdef CONFIG_SUNRPC_BACKCHANNEL extern struct svc_xprt_class svc_rdma_bc_class; -- cgit v1.2.3 From 82508141450d90a6d92a14e93e5a00ffb193f5e0 Mon Sep 17 00:00:00 2001 From: Ferdinand Schwenk Date: Tue, 9 Jun 2026 21:43:11 +0200 Subject: hwmon: Add update_interval_us chip attribute Some hardware monitoring chips support update intervals below one millisecond. The existing update_interval attribute uses millisecond granularity, which causes sub-millisecond steps to round to the same value and become inaccessible from userspace. Introduce update_interval_us, a companion chip-level attribute that expresses the same update interval in microseconds. Drivers implementing this attribute should also implement update_interval for compatibility with millisecond-based userspace interfaces. Signed-off-by: Ferdinand Schwenk Link: https://lore.kernel.org/r/20260609-hwmon-ina238-update-interval-us-v2-v3-2-016b55567950@advastore.com Signed-off-by: Guenter Roeck --- include/linux/hwmon.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h index f5330e7ae247..dd713e193d0c 100644 --- a/include/linux/hwmon.h +++ b/include/linux/hwmon.h @@ -40,6 +40,7 @@ enum hwmon_chip_attributes { hwmon_chip_power_reset_history, hwmon_chip_register_tz, hwmon_chip_update_interval, + hwmon_chip_update_interval_us, hwmon_chip_alarms, hwmon_chip_samples, hwmon_chip_curr_samples, @@ -56,6 +57,7 @@ enum hwmon_chip_attributes { #define HWMON_C_POWER_RESET_HISTORY BIT(hwmon_chip_power_reset_history) #define HWMON_C_REGISTER_TZ BIT(hwmon_chip_register_tz) #define HWMON_C_UPDATE_INTERVAL BIT(hwmon_chip_update_interval) +#define HWMON_C_UPDATE_INTERVAL_US BIT(hwmon_chip_update_interval_us) #define HWMON_C_ALARMS BIT(hwmon_chip_alarms) #define HWMON_C_SAMPLES BIT(hwmon_chip_samples) #define HWMON_C_CURR_SAMPLES BIT(hwmon_chip_curr_samples) -- cgit v1.2.3 From 0ba76b19fd4c7256787eab0283c759b18eb76876 Mon Sep 17 00:00:00 2001 From: Lukas Wunner Date: Thu, 4 Jun 2026 17:12:08 +0200 Subject: PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist The first device on a PCI root bus determines whether the host bridge is whitelisted for P2PDMA. All Intel Xeon chips since Ice Lake (ICX, 2021) expose a device with ID 0x09a2 as first device. It is loosely associated with the IOMMU. All these Xeon chips support P2PDMA, so since the addition of the device with commit feaea1fe8b36 ("PCI/P2PDMA: Add Intel 3rd Gen Intel Xeon Scalable Processors to whitelist"), P2PDMA has been allowed on all new Xeons without the need to amend the whitelist: Xeons with Performance Cores: Sapphire Rapids (SPR, 2023) Emerald Rapids (EMR, 2023) Granite Rapids (GNR, 2024) Diamond Rapids (DMR, 2026) Xeons with Efficiency Cores: Sierra Forest (SRF, 2024) Clearwater Forest (CWF, 2026) However these Xeons also expose accelerators as first device on a root bus of its own: QuickAssist Technology (QAT, crypto & compression accelerator) Data Streaming Accelerator (DSA, dma engine) In-Memory Analytics Accelerator (IAA, compression accelerator) Whitelist them for P2PDMA as well. Move their Device ID macros from the accelerator drivers to for reuse by P2PDMA code. Unfortunately the Device IDs vary across Xeon generations as additional features were added to the accelerators. This currently necessitates an amendment for each new Xeon chip. For future chips, this need shall be avoided by an ongoing effort to extend ACPI HMAT with PCIe P2PDMA characteristics (latency, bandwidth, ordering constraints). The PCI core will be able look up in this BIOS-provided ACPI table whether P2PDMA is supported, instead of relying on a whitelist that needs to be amended continuously. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Acked-by: Vinicius Costa Gomes Acked-by: Giovanni Cabiddu # QAT Cc: stable@vger.kernel.org Link: https://patch.msgid.link/6aac4922b5fe7070b11874427a9285e42ddd05a4.1780585518.git.lukas@wunner.de --- include/linux/pci_ids.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'include') diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h index 24cb42f66e4b..1c9d40e09107 100644 --- a/include/linux/pci_ids.h +++ b/include/linux/pci_ids.h @@ -2732,6 +2732,9 @@ #define PCI_DEVICE_ID_INTEL_82815_MC 0x1130 #define PCI_DEVICE_ID_INTEL_82815_CGC 0x1132 #define PCI_DEVICE_ID_INTEL_SST_TNG 0x119a +#define PCI_DEVICE_ID_INTEL_DSA_GNRD 0x11fb +#define PCI_DEVICE_ID_INTEL_DSA_DMR 0x1212 +#define PCI_DEVICE_ID_INTEL_IAA_DMR 0x1216 #define PCI_DEVICE_ID_INTEL_82092AA_0 0x1221 #define PCI_DEVICE_ID_INTEL_82437 0x122d #define PCI_DEVICE_ID_INTEL_82371FB_0 0x122e @@ -3052,6 +3055,11 @@ #define PCI_DEVICE_ID_INTEL_5400_FBD1 0x4036 #define PCI_DEVICE_ID_INTEL_HDA_TGL_H 0x43c8 #define PCI_DEVICE_ID_INTEL_HDA_DG1 0x490d +#define PCI_DEVICE_ID_INTEL_QAT_4XXX 0x4940 +#define PCI_DEVICE_ID_INTEL_QAT_401XX 0x4942 +#define PCI_DEVICE_ID_INTEL_QAT_402XX 0x4944 +#define PCI_DEVICE_ID_INTEL_QAT_420XX 0x4946 +#define PCI_DEVICE_ID_INTEL_QAT_6XXX 0x4948 #define PCI_DEVICE_ID_INTEL_HDA_EHL_0 0x4b55 #define PCI_DEVICE_ID_INTEL_HDA_EHL_3 0x4b58 #define PCI_DEVICE_ID_INTEL_HDA_WCL 0x4d28 -- cgit v1.2.3 From fe221742e388bea3f5856b5d9b2cb0a037020ea4 Mon Sep 17 00:00:00 2001 From: Dmitry Torokhov Date: Sat, 6 Jun 2026 20:51:29 -0700 Subject: software node: allow passing reference args to PROPERTY_ENTRY_REF() When dynamically creating software nodes and properties for subsequent use with software_node_register() current implementation of PROPERTY_ENTRY_REF() is not suitable because it creates a temporary instance of struct software_node_ref_args on stack which will later disappear, and software_node_register() only does shallow copy of properties. Fix this by allowing to pass address of reference arguments structure directly into PROPERTY_ENTRY_REF(), so that caller can manage lifetime of the object properly. Signed-off-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/aiTo4dvKu8pyimHA@google.com Signed-off-by: Danilo Krummrich --- include/linux/property.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/property.h b/include/linux/property.h index e30ef23a9af3..14c304db4664 100644 --- a/include/linux/property.h +++ b/include/linux/property.h @@ -471,12 +471,18 @@ struct property_entry { #define PROPERTY_ENTRY_STRING(_name_, _val_) \ __PROPERTY_ENTRY_ELEMENT(_name_, str, STRING, _val_) +#define __PROPERTY_ENTRY_REF_ARGS(_ref_, ...) \ + _Generic(_ref_, \ + const struct software_node_ref_args *: _ref_, \ + struct software_node_ref_args *: _ref_, \ + default: &SOFTWARE_NODE_REFERENCE(_ref_, ##__VA_ARGS__)) + #define PROPERTY_ENTRY_REF(_name_, _ref_, ...) \ (struct property_entry) { \ .name = _name_, \ .length = sizeof(struct software_node_ref_args), \ .type = DEV_PROP_REF, \ - { .pointer = &SOFTWARE_NODE_REFERENCE(_ref_, ##__VA_ARGS__), }, \ + { .pointer = __PROPERTY_ENTRY_REF_ARGS(_ref_, ##__VA_ARGS__) }, \ } #define PROPERTY_ENTRY_BOOL(_name_) \ -- cgit v1.2.3 From 5c9a6a124afdb933b3f2c9cd685f729920da0a37 Mon Sep 17 00:00:00 2001 From: Minda Chen Date: Fri, 5 Jun 2026 11:36:07 +0800 Subject: net: ncsi: Set ncsi_stop_dev() to inline while NET_NCSI not enabled While NET_NCSI not enabled, ncsi_stop_dev() is not inline and call with it, casue compile waring: linux/include/net/ncsi.h:63:13: warning: 'ncsi_stop_dev' defined but not used [-Wunused-function] static void ncsi_stop_dev(struct ncsi_dev *nd) Setting ncsi_stop_dev() to inline like other function to remove compile warnings. Signed-off-by: Minda Chen Link: https://patch.msgid.link/20260605033607.37630-1-minda.chen@starfivetech.com Signed-off-by: Jakub Kicinski --- include/net/ncsi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/ncsi.h b/include/net/ncsi.h index 08a50d9acb0a..e886358207aa 100644 --- a/include/net/ncsi.h +++ b/include/net/ncsi.h @@ -60,7 +60,7 @@ static inline int ncsi_start_dev(struct ncsi_dev *nd) return -ENOTTY; } -static void ncsi_stop_dev(struct ncsi_dev *nd) +static inline void ncsi_stop_dev(struct ncsi_dev *nd) { } -- cgit v1.2.3 From fa1a3b7bcd161028e038025c1a4a8963b2f56a95 Mon Sep 17 00:00:00 2001 From: Long Li Date: Thu, 4 Jun 2026 17:57:10 -0700 Subject: net: mana: Create separate EQs for each vPort To prepare for assigning vPorts to dedicated MSI-X vectors, remove EQ sharing among the vPorts and create dedicated EQs for each vPort. Move the EQ definition from struct mana_context to struct mana_port_context and update related support functions. Export mana_create_eq() and mana_destroy_eq() for use by the MANA RDMA driver. RSS QPs now take a vport reference via pd->vport_use_count to ensure EQs outlive all QP consumers. The vport must already be configured by a raw QP before an RSS QP can be created. EQs are only destroyed when the last QP (raw or RSS) on the PD releases its reference. Restrict each vport to a single RSS QP. The hardware only supports one steering configuration (indirection table / hash key) per vport, and mana_disable_vport_rx() on QP destroy disables RX globally for the vport. Previously, creating a second RSS QP would silently overwrite the first QP's steering config and destroy would blackhole all traffic. This is now explicitly rejected with -EBUSY. Existing applications (DPDK being the primary RDMA consumer) always create one RSS QP per vport, so no real-world flows are affected. Reject cross-port PD sharing for both raw and RSS QPs. Since EQs and vport configuration are per-port, a PD is bound to the port used by its first raw QP. Subsequent QPs on the same PD must use the same port or the creation fails with -EINVAL. Previously this was silently broken: with shared EQs it appeared to work, but with per-vPort EQs a cross-port PD would cause wrong-port EQ teardown and corruption. DPDK creates one PD per port so no existing flows are affected. Serialize mana_set_channels() and the async per-port queue reset handler against RDMA vport configuration to prevent RDMA from claiming the vport during the detach/attach window. A channel_changing flag is set under apc->vport_mutex before detach and checked by mana_cfg_vport() when called from the RDMA path, blocking RDMA from grabbing the vport during the entire window. When the port is down and RDMA already holds the vport, the channel change is rejected with -EBUSY. Signed-off-by: Long Li Link: https://patch.msgid.link/20260605005717.2059954-2-longli@microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/mana.h | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h index d9c27310fd04..5a9b94e0ef34 100644 --- a/include/net/mana/mana.h +++ b/include/net/mana/mana.h @@ -480,8 +480,6 @@ struct mana_context { u8 bm_hostmode; struct mana_ethtool_hc_stats hc_stats; - struct mana_eq *eqs; - struct dentry *mana_eqs_debugfs; struct workqueue_struct *per_port_queue_reset_wq; /* Workqueue for querying hardware stats */ struct delayed_work gf_stats_work; @@ -501,6 +499,9 @@ struct mana_port_context { u8 mac_addr[ETH_ALEN]; + struct mana_eq *eqs; + struct dentry *mana_eqs_debugfs; + enum TRI_STATE rss_state; mana_handle_t default_rxobj; @@ -547,6 +548,12 @@ struct mana_port_context { struct mutex vport_mutex; int vport_use_count; + /* Set by mana_set_channels() under vport_mutex to block RDMA + * from grabbing the vport during the detach/attach window. + * Checked by mana_cfg_vport() when called from the RDMA path. + */ + bool channel_changing; + /* Net shaper handle*/ struct net_shaper_handle handle; @@ -1040,8 +1047,10 @@ void mana_destroy_wq_obj(struct mana_port_context *apc, u32 wq_type, mana_handle_t wq_obj); int mana_cfg_vport(struct mana_port_context *apc, u32 protection_dom_id, - u32 doorbell_pg_id); + u32 doorbell_pg_id, bool check_channel_changing); void mana_uncfg_vport(struct mana_port_context *apc); +int mana_create_eq(struct mana_port_context *apc); +void mana_destroy_eq(struct mana_port_context *apc); struct net_device *mana_get_primary_netdev(struct mana_context *ac, u32 port_index, -- cgit v1.2.3 From d7c253d614887f5f006fe868f30b65fb72d3c193 Mon Sep 17 00:00:00 2001 From: Long Li Date: Thu, 4 Jun 2026 17:57:11 -0700 Subject: net: mana: Query device capabilities and configure MSI-X sharing for EQs When querying the device, adjust the max number of queues to allow dedicated MSI-X vectors for each vPort. The per-vPort queue count is clamped towards MANA_DEF_NUM_QUEUES but will not exceed the hardware maximum reported by the device. MSI-X sharing among vPorts is enabled when there are not enough MSI-X vectors for dedicated allocation, or when the platform does not support dynamic MSI-X allocation (in which case all vectors are pre-allocated at probe time and sharing is always used). The msi_sharing flag is reset at the top of mana_gd_query_max_resources() so it is recomputed from current hardware state on each probe or resume cycle. Clamp apc->max_queues to gc->max_num_queues_vport in mana_init_port() so that on resume, if max_num_queues_vport has decreased due to fewer MSI-X vectors, num_queues is reduced accordingly before EQ allocation. A device reporting zero ports now results in a fatal probe error since the per-vPort MSI-X math requires at least one port. Rename mana_query_device_cfg() to mana_gd_query_device_cfg() as it is used at GDMA device probe time for querying device capabilities. Signed-off-by: Long Li Link: https://patch.msgid.link/20260605005717.2059954-3-longli@microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/gdma.h | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h index 70d62bc32837..145cc59dfc19 100644 --- a/include/net/mana/gdma.h +++ b/include/net/mana/gdma.h @@ -399,8 +399,10 @@ struct gdma_context { struct device *dev; struct dentry *mana_pci_debugfs; - /* Per-vPort max number of queues */ + /* Hardware max number of queues */ unsigned int max_num_queues; + /* Per-vPort max number of queues */ + unsigned int max_num_queues_vport; unsigned int max_num_msix; unsigned int num_msix_usable; struct xarray irq_contexts; @@ -447,6 +449,12 @@ struct gdma_context { struct workqueue_struct *service_wq; unsigned long flags; + + /* Indicate if this device is sharing MSI for EQs on MANA */ + bool msi_sharing; + + /* Bitmap tracks where MSI is allocated when it is not shared for EQs */ + unsigned long *msi_bitmap; }; static inline bool mana_gd_is_mana(struct gdma_dev *gd) @@ -1019,4 +1027,7 @@ int mana_gd_resume(struct pci_dev *pdev); bool mana_need_log(struct gdma_context *gc, int err); +int mana_gd_query_device_cfg(struct gdma_context *gc, u32 proto_major_ver, + u32 proto_minor_ver, u32 proto_micro_ver, + u16 *max_num_vports, u8 *bm_hostmode); #endif /* _GDMA_H */ -- cgit v1.2.3 From d478457fc1b7fd80f481c323a8d22567d99d6881 Mon Sep 17 00:00:00 2001 From: Long Li Date: Thu, 4 Jun 2026 17:57:12 -0700 Subject: net: mana: Introduce GIC context with refcounting for interrupt management To allow Ethernet EQs to use dedicated or shared MSI-X vectors and RDMA EQs to share the same MSI-X, introduce a GIC (GDMA IRQ Context) with reference counting. This allows the driver to create an interrupt context on an assigned or unassigned MSI-X vector and share it across multiple EQ consumers. Signed-off-by: Long Li Link: https://patch.msgid.link/20260605005717.2059954-4-longli@microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/gdma.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h index 145cc59dfc19..e3ee85c614ec 100644 --- a/include/net/mana/gdma.h +++ b/include/net/mana/gdma.h @@ -388,6 +388,11 @@ struct gdma_irq_context { spinlock_t lock; struct list_head eq_list; char name[MANA_IRQ_NAME_SZ]; + unsigned int msi; + unsigned int irq; + refcount_t refcount; + unsigned int bitmap_refs; + bool dyn_msix; }; enum gdma_context_flags { @@ -450,6 +455,9 @@ struct gdma_context { unsigned long flags; + /* Protect access to GIC context */ + struct mutex gic_mutex; + /* Indicate if this device is sharing MSI for EQs on MANA */ bool msi_sharing; @@ -1027,6 +1035,10 @@ int mana_gd_resume(struct pci_dev *pdev); bool mana_need_log(struct gdma_context *gc, int err); +struct gdma_irq_context *mana_gd_get_gic(struct gdma_context *gc, + bool use_msi_bitmap, + int *msi_requested); +void mana_gd_put_gic(struct gdma_context *gc, bool use_msi_bitmap, int msi); int mana_gd_query_device_cfg(struct gdma_context *gc, u32 proto_major_ver, u32 proto_minor_ver, u32 proto_micro_ver, u16 *max_num_vports, u8 *bm_hostmode); -- cgit v1.2.3 From 487af6f5391e7461437e0972d15d9bcbcab2ac21 Mon Sep 17 00:00:00 2001 From: Long Li Date: Thu, 4 Jun 2026 17:57:14 -0700 Subject: net: mana: Allocate interrupt context for each EQ when creating vPort Use GIC functions to create a dedicated interrupt context or acquire a shared interrupt context for each EQ when setting up a vPort. The caller now owns the GIC reference across the EQ create/destroy lifecycle: mana_create_eq() calls mana_gd_get_gic() before creating each EQ and mana_destroy_eq() calls mana_gd_put_gic() after destroying it. The msix_index invalidation is moved from mana_gd_deregister_irq() to the mana_gd_create_eq() error path so that mana_destroy_eq() can read the index before teardown. Signed-off-by: Long Li Link: https://patch.msgid.link/20260605005717.2059954-6-longli@microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/gdma.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h index e3ee85c614ec..6a65fedae38f 100644 --- a/include/net/mana/gdma.h +++ b/include/net/mana/gdma.h @@ -342,6 +342,7 @@ struct gdma_queue { void *context; unsigned int msix_index; + unsigned int irq; u32 log2_throttle_limit; } eq; -- cgit v1.2.3 From 062b2b051f14a974b1fbd7b506fb833f5a171fa8 Mon Sep 17 00:00:00 2001 From: Long Li Date: Thu, 4 Jun 2026 17:57:15 -0700 Subject: RDMA/mana_ib: Allocate interrupt contexts on EQs Use the GIC functions to allocate interrupt contexts for RDMA EQs. These interrupt contexts may be shared with Ethernet EQs when MSI-X vectors are limited. The driver now supports allocating dedicated MSI-X for each EQ. Indicate this capability through driver capability bits. The RDMA EQs pass use_msi_bitmap=false to share MSI-X vectors with Ethernet, while the capability flag advertises that the driver supports per-vPort EQ separation when hardware has sufficient vectors. Populate eq.irq on all RDMA EQs for consistency with the Ethernet path. Also relocate the GDMA_DRV_CAP_FLAG_1_HW_VPORT_LINK_AWARE define to its numeric BIT(6) position among the other capability flags. Signed-off-by: Long Li Acked-by: Leon Romanovsky Link: https://patch.msgid.link/20260605005717.2059954-7-longli@microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/gdma.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h index 6a65fedae38f..78afd696b08b 100644 --- a/include/net/mana/gdma.h +++ b/include/net/mana/gdma.h @@ -616,6 +616,7 @@ enum { #define GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECONFIG BIT(3) #define GDMA_DRV_CAP_FLAG_1_GDMA_PAGES_4MB_1GB_2GB BIT(4) #define GDMA_DRV_CAP_FLAG_1_VARIABLE_INDIRECTION_TABLE_SUPPORT BIT(5) +#define GDMA_DRV_CAP_FLAG_1_HW_VPORT_LINK_AWARE BIT(6) /* Driver can handle holes (zeros) in the device list */ #define GDMA_DRV_CAP_FLAG_1_DEV_LIST_HOLES_SUP BIT(11) @@ -632,7 +633,8 @@ enum { /* Driver detects stalled send queues and recovers them */ #define GDMA_DRV_CAP_FLAG_1_HANDLE_STALL_SQ_RECOVERY BIT(18) -#define GDMA_DRV_CAP_FLAG_1_HW_VPORT_LINK_AWARE BIT(6) +/* Driver supports separate EQ/MSIs for each vPort */ +#define GDMA_DRV_CAP_FLAG_1_EQ_MSI_UNSHARE_MULTI_VPORT BIT(19) /* Driver supports linearizing the skb when num_sge exceeds hardware limit */ #define GDMA_DRV_CAP_FLAG_1_SKB_LINEARIZE BIT(20) @@ -660,7 +662,8 @@ enum { GDMA_DRV_CAP_FLAG_1_SKB_LINEARIZE | \ GDMA_DRV_CAP_FLAG_1_PROBE_RECOVERY | \ GDMA_DRV_CAP_FLAG_1_HANDLE_STALL_SQ_RECOVERY | \ - GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECOVERY) + GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECOVERY | \ + GDMA_DRV_CAP_FLAG_1_EQ_MSI_UNSHARE_MULTI_VPORT) #define GDMA_DRV_CAP_FLAGS2 0 -- cgit v1.2.3 From 53a65db20a4f3fe6c01b1f789f9eae6b1244910f Mon Sep 17 00:00:00 2001 From: Haiyang Zhang Date: Fri, 5 Jun 2026 14:22:56 -0700 Subject: net: mana: Add support for PF device 0x00C1 Update the device id table to include the new device id 0x00C1. This device's BAR layout is similar to VF's, update the function, mana_gd_init_registers(), accordingly. Signed-off-by: Haiyang Zhang Link: https://patch.msgid.link/20260605212302.2135499-1-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/gdma.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/net/mana/gdma.h b/include/net/mana/gdma.h index 78afd696b08b..0c395917b214 100644 --- a/include/net/mana/gdma.h +++ b/include/net/mana/gdma.h @@ -426,6 +426,7 @@ struct gdma_context { u32 test_event_eq_id; bool is_pf; + bool is_pf2; phys_addr_t bar0_pa; void __iomem *bar0_va; @@ -588,6 +589,7 @@ struct gdma_eqe { #define GDMA_SRIOV_REG_CFG_BASE_OFF 0x108 #define MANA_PF_DEVICE_ID 0x00B9 +#define MANA_PF2_DEVICE_ID 0x00C1 #define MANA_VF_DEVICE_ID 0x00BA struct gdma_posted_wqe_info { -- cgit v1.2.3 From ea07514700f7a5125db67c9d1cbfb06e65c30a07 Mon Sep 17 00:00:00 2001 From: David Yang Date: Sat, 6 Jun 2026 20:52:44 +0800 Subject: net: mscc: ocelot: validate netdev belongs to switch in .netdev_to_port() The .netdev_to_port() currently takes only a net_device and returns the port index, without verifying the netdev actually belongs to the switch being operated on. This can cause flower rule parsing to silently resolve to a wrong port on the local hardware. Update both implementations felix_netdev_to_port() and ocelot_netdev_to_port() to validate ownership. Also update the callers in ocelot_flower.c to pass through the ocelot context. Signed-off-by: David Yang Link: https://patch.msgid.link/20260606125247.305167-1-mmyangfl@gmail.com Signed-off-by: Jakub Kicinski --- include/soc/mscc/ocelot.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h index 48d6deb3efd7..05a8191b148e 100644 --- a/include/soc/mscc/ocelot.h +++ b/include/soc/mscc/ocelot.h @@ -650,7 +650,7 @@ struct device_node; struct ocelot_ops { struct net_device *(*port_to_netdev)(struct ocelot *ocelot, int port); - int (*netdev_to_port)(struct net_device *dev); + int (*netdev_to_port)(struct ocelot *ocelot, struct net_device *dev); int (*reset)(struct ocelot *ocelot); u16 (*wm_enc)(u16 value); u16 (*wm_dec)(u16 value); -- cgit v1.2.3 From 8e0ffcc926f42103fdded733a28af16438babc0e Mon Sep 17 00:00:00 2001 From: Erni Sri Satya Vennela Date: Sat, 6 Jun 2026 06:32:55 -0700 Subject: net: mana: Cache MANA_QUERY_LINK_CONFIG result to avoid repeated HWC queries mana_query_link_cfg() sends an HWC command to firmware on every call, but the link speed and QoS values it returns only change when the driver explicitly calls mana_set_bw_clamp(). This function is called not only by userspace via ethtool get_link_ksettings, but also periodically by hv_netvsc through netvsc_get_link_ksettings and by the sysfs speed_show attribute via dev_attr_show, resulting in unnecessary HWC traffic every few minutes. Add a link_cfg_error field to mana_port_context to cache the query result. The field uses three states: 1 (not yet queried, initial value set during mana_probe_port), 0 (success, speed/max_speed are valid), or a negative errno for permanent errors like -EOPNOTSUPP when the hardware does not support the command. Transient errors and qos_unconfigured responses are not cached so that subsequent calls will retry. MANA is ops-locked because it implements net_shaper_ops, so the core already takes netdev_lock() around all ethtool_ops and net_shaper_ops entry points. Reuse that lock to serialize mana_query_link_cfg() and mana_set_bw_clamp(). This prevents a concurrent mana_set_bw_clamp() from racing with an in-flight query and publishing stale pre-clamp speed/max_speed. Invalidate the cache inside mana_set_bw_clamp() on success, so all current and future callers that change the link configuration automatically trigger a fresh query on the next mana_query_link_cfg() call. Also reset link_cfg_error during resume in mana_probe() under netdev_lock(), so that any query already in flight cannot later store 0 and silently overwrite the post-resume invalidation. Signed-off-by: Erni Sri Satya Vennela Link: https://patch.msgid.link/20260606133301.2180073-1-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski --- include/net/mana/mana.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h index 5a9b94e0ef34..13c87baf018e 100644 --- a/include/net/mana/mana.h +++ b/include/net/mana/mana.h @@ -562,6 +562,10 @@ struct mana_port_context { u32 speed; /* Maximum speed supported by the SKU (mbps) */ u32 max_speed; + /* 1 = not queried, 0 = cached success, negative = permanent error. + * Protected by the netdev instance lock. + */ + int link_cfg_error; bool port_is_up; bool port_st_save; /* Saved port state */ -- cgit v1.2.3 From d11706b56a3f738a93bb2af8e94d6fab506e81b6 Mon Sep 17 00:00:00 2001 From: Stanislav Fomichev Date: Mon, 8 Jun 2026 08:40:12 -0700 Subject: net: change ndo_set_rx_mode_async return type to int Change the return type of ndo_set_rx_mode_async from void to int to allow drivers to report failures back to the core stack. This is a prerequisite for adding retry logic in the core when drivers fail to program RX filters (e.g. bnxt VF when PF is unavailable). All existing implementations return 0 for now, maintaining current behavior. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260608154014.227538-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 9b876cd930d7..51ec2df02094 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1122,13 +1122,14 @@ struct netdev_net_notifier { * Cannot sleep, called with netif_addr_lock_bh held. * Deprecated in favor of ndo_set_rx_mode_async. * - * void (*ndo_set_rx_mode_async)(struct net_device *dev, - * struct netdev_hw_addr_list *uc, - * struct netdev_hw_addr_list *mc); + * int (*ndo_set_rx_mode_async)(struct net_device *dev, + * struct netdev_hw_addr_list *uc, + * struct netdev_hw_addr_list *mc); * Async version of ndo_set_rx_mode which runs in process context * with rtnl_lock and netdev_lock_ops(dev) held. The uc/mc parameters * are snapshots of the address lists - iterate with - * netdev_hw_addr_list_for_each(ha, uc). + * netdev_hw_addr_list_for_each(ha, uc). Return 0 on success or a + * negative errno to request a retry via the core backoff. * * int (*ndo_set_mac_address)(struct net_device *dev, void *addr); * This function is called when the Media Access Control address @@ -1455,7 +1456,7 @@ struct net_device_ops { void (*ndo_change_rx_flags)(struct net_device *dev, int flags); void (*ndo_set_rx_mode)(struct net_device *dev); - void (*ndo_set_rx_mode_async)( + int (*ndo_set_rx_mode_async)( struct net_device *dev, struct netdev_hw_addr_list *uc, struct netdev_hw_addr_list *mc); -- cgit v1.2.3 From d90b85c23b3d64cc58a2bc59ceda6f6aa4df9ea3 Mon Sep 17 00:00:00 2001 From: Stanislav Fomichev Date: Mon, 8 Jun 2026 08:40:13 -0700 Subject: net: add retry mechanism to ndo_set_rx_mode_async When ndo_set_rx_mode_async returns an error, schedule a retry with exponential backoff (1s, 2s, 4s, 8s -- 15s total). Give up after the 4th retry and log an error via netdev_err(). This moves retry logic from individual drivers into the core stack. Timer callback does not hold a ref on dev. Safe because the timer can only be armed when dev is IFF_UP, and __dev_close_many runs timer_delete_sync before clearing IFF_UP. Unregister always closes IFF_UP devices first, so by the time dev can be freed the timer is dead and cannot be re-armed. Reviewed-by: Jakub Kicinski Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260608154014.227538-3-sdf@fomichev.me Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 51ec2df02094..7f4f0837c09f 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1933,6 +1933,8 @@ enum netdev_reg_state { * @rx_mode_node: List entry for rx_mode work processing * @rx_mode_tracker: Refcount tracker for rx_mode work * @rx_mode_addr_cache: Recycled snapshot entries for rx_mode work + * @rx_mode_retry_timer: Timer that re-queues rx_mode work after failure + * @rx_mode_retry_count: Number of consecutive retries already scheduled * @uc: unicast mac addresses * @mc: multicast mac addresses * @dev_addrs: list of device hw addresses @@ -2326,6 +2328,8 @@ struct net_device { struct list_head rx_mode_node; netdevice_tracker rx_mode_tracker; struct netdev_hw_addr_list rx_mode_addr_cache; + struct timer_list rx_mode_retry_timer; + unsigned int rx_mode_retry_count; #ifdef CONFIG_LOCKDEP unsigned char nested_level; #endif @@ -5152,6 +5156,7 @@ static inline void __dev_mc_unsync(struct net_device *dev, /* Functions used for secondary unicast and multicast support */ void dev_set_rx_mode(struct net_device *dev); +void netif_rx_mode_schedule_retry(struct net_device *dev); int netif_set_promiscuity(struct net_device *dev, int inc); int dev_set_promiscuity(struct net_device *dev, int inc); int netif_set_allmulti(struct net_device *dev, int inc, bool notify); -- cgit v1.2.3 From 1ee90b77b727df903033db873c75caac5c27ec98 Mon Sep 17 00:00:00 2001 From: Kyle Zeng Date: Sat, 6 Jun 2026 19:18:19 -0700 Subject: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET instead of struct sock_exterr_skb. If such an skb is received with timestamping enabled, the generic timestamp cmsg path can read AF_PACKET control-buffer state as sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop counter overlaps opt_stats. An odd drop count makes the path emit SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear skbs this copies past the linear head and can trigger hardened usercopy or disclose adjacent heap contents. Keep skb_is_err_queue() local to net/socket.c, but make it verify that the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal receive ownership and no longer pass as error-queue skbs, while legitimate sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free ownership. Fixes: 8605330aac5a ("tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs") Signed-off-by: Kyle Zeng Reviewed-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20260607021819.49698-1-kylebot@openai.com Signed-off-by: Jakub Kicinski --- include/net/sock.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/sock.h b/include/net/sock.h index dccd3738c368..95e157eee8d9 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1856,6 +1856,7 @@ struct sk_buff *sock_omalloc(struct sock *sk, unsigned long size, gfp_t priority); void skb_orphan_partial(struct sk_buff *skb); void sock_rfree(struct sk_buff *skb); +void sock_rmem_free(struct sk_buff *skb); void sock_efree(struct sk_buff *skb); #ifdef CONFIG_INET void sock_edemux(struct sk_buff *skb); -- cgit v1.2.3 From 94c8d1c21be40a845357854f98ec07e21bb14bc9 Mon Sep 17 00:00:00 2001 From: Justin Suess Date: Tue, 9 Jun 2026 22:25:43 +0200 Subject: bpf: Reject bpf_obj_drop() from tracing progs bpf_obj_drop() runs bpf_obj_free_fields() synchronously for program-allocated objects. When such an object contains NMI unsafe fields, tracing programs that can run from arbitrary instrumented context can reach that destruction from unsafe contexts, including NMI. NMI is likely one instance of this problem, and other instances would include possible unsafe reentrancy. Deferring bpf_obj_drop() is not appealing either: it would add delayed-free machinery to a release operation that otherwise has straightforward synchronous ownership semantics. Reject bpf_obj_drop() and bpf_percpu_obj_drop() from tracing programs that may run from unsafe contexts unless every field in the object's BTF record is explicitly NMI safe. Do not reject sleepable BPF_PROG_TYPE_TRACING programs, since they are not the arbitrary/NMI contexts that motivate the restriction. Note that while bpf_rb_root and bpf_list_head would be NMI safe on their own to free, the objects recursively held by them may not be; be conservative and just mark them as not NMI safe for now. Use a whitelist for the NMI-safe field set instead of listing only known NMI unsafe fields. Locks, async fields, unreferenced kptrs, and refcounts are known to be NMI safe because their destruction is either a no-op, simple state reset, or async cancellation. Referenced kptrs, percpu referenced kptrs, uptrs, graph roots, graph nodes, and any future field type are rejected until audited for arbitrary tracing and NMI contexts. This is less susceptible to future changes in fields that were previously safe by exclusion, and to new fields being added without updating this check. Convert the existing recursive local-object drop success case to a syscall program in the same commit, since this verifier change makes the old tracing program form invalid. The test still exercises bpf_obj_drop() releasing a referenced task kptr from a safe program type. Fixes: ac9f06050a35 ("bpf: Introduce bpf_obj_drop") Signed-off-by: Justin Suess Co-developed-by: Kumar Kartikeya Dwivedi Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260609202548.3571690-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 62bba7a4876f..0654d2ffadc1 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -492,6 +492,35 @@ static inline bool btf_record_has_field(const struct btf_record *rec, enum btf_f return rec->field_mask & type; } +static inline bool btf_field_is_nmi_safe(enum btf_field_type type) +{ + switch (type) { + case BPF_SPIN_LOCK: + case BPF_RES_SPIN_LOCK: + case BPF_TIMER: + case BPF_WORKQUEUE: + case BPF_TASK_WORK: + case BPF_KPTR_UNREF: + case BPF_REFCOUNT: + return true; + default: + return false; + } +} + +static inline bool btf_record_has_nmi_unsafe_fields(const struct btf_record *rec) +{ + int i; + + if (IS_ERR_OR_NULL(rec)) + return false; + for (i = 0; i < rec->cnt; i++) { + if (!btf_field_is_nmi_safe(rec->fields[i].type)) + return true; + } + return false; +} + static inline void bpf_obj_init(const struct btf_record *rec, void *obj) { int i; -- cgit v1.2.3 From a3a81d247651218e47153f2d2afd7aee236726fd Mon Sep 17 00:00:00 2001 From: Justin Suess Date: Tue, 9 Jun 2026 22:25:44 +0200 Subject: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe. Introduce bpf_obj_cancel_fields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and task_work fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead. Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpf_obj_free_fields() for final map destruction and for bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields. This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors. There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqs_disabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again. Fixes: 14a324f6a67e ("bpf: Wire up freeing of referenced kptr") Signed-off-by: Justin Suess Co-developed-by: Kumar Kartikeya Dwivedi Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260609202548.3571690-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 0654d2ffadc1..56f5da2b437f 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2717,6 +2717,7 @@ bool btf_record_equal(const struct btf_record *rec_a, const struct btf_record *r void bpf_obj_free_timer(const struct btf_record *rec, void *obj); void bpf_obj_free_workqueue(const struct btf_record *rec, void *obj); void bpf_obj_free_task_work(const struct btf_record *rec, void *obj); +void bpf_obj_cancel_fields(struct bpf_map *map, void *obj); void bpf_obj_free_fields(const struct btf_record *rec, void *obj); void __bpf_obj_drop_impl(void *p, const struct btf_record *rec, bool percpu); -- cgit v1.2.3 From ac2c52e9f869897b6f4c0a54cf07da380ef2b8d6 Mon Sep 17 00:00:00 2001 From: Christian Fontanez Date: Mon, 18 May 2026 21:33:20 -0400 Subject: virtio: add missing kernel-doc for map and vmap members Commit bee8c7c24b73 ("virtio: introduce map ops in virtio core") and commit b16060c5c7d5 ("virtio: introduce virtio_map container union") added 'map' and 'vmap' members to struct virtio_device but did not update the kernel-doc comment block. This caused 'make htmldocs' to emit warnings: ./include/linux/virtio.h:188 struct member 'map' not described in 'virtio_device' ./include/linux/virtio.h:188 struct member 'vmap' not described in 'virtio_device' Add the missing entries in struct-declaration order to match the existing convention in the file. After this patch, 'make htmldocs' no longer emits these warnings. Fixes: bee8c7c24b73 ("virtio: introduce map ops in virtio core") Fixes: b16060c5c7d5 ("virtio: introduce virtio_map container union") Reported-by: Luis Felipe Hernandez Signed-off-by: Christian Fontanez Signed-off-by: Michael S. Tsirkin Message-ID: <20260519013321.32511-1-christfontanez@gmail.com> --- include/linux/virtio.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/virtio.h b/include/linux/virtio.h index 3bbc4cb6a672..bf089e51970e 100644 --- a/include/linux/virtio.h +++ b/include/linux/virtio.h @@ -157,11 +157,13 @@ struct virtio_admin_cmd { * @id: the device type identification (used to match it with a driver). * @config: the configuration ops for this device. * @vringh_config: configuration ops for host vrings. + * @map: the map operations for mapping virtio device memory. * @vqs: the list of virtqueues for this device. * @features: the 64 lower features supported by both driver and device. * @features_array: the full features space supported by both driver and * device. * @priv: private pointer for the driver's use. + * @vmap: the map container with transport- or device-specific metadata. * @debugfs_dir: debugfs directory entry. * @debugfs_filter_features: features to be filtered set by debugfs. */ -- cgit v1.2.3 From 02687282c751a77b774e4a16d5e937c3ecd1731d Mon Sep 17 00:00:00 2001 From: Ethan Carter Edwards Date: Sat, 18 Apr 2026 20:49:48 -0400 Subject: virtio_console: Fix spelling mistake "colums" -> "columns" There is a spelling mistake in a struct description. Fix it. Signed-off-by: Ethan Carter Edwards Signed-off-by: Michael S. Tsirkin Message-ID: <20260418-virtio-typo-v1-1-0df6f943a79d@ethancedwards.com> --- include/uapi/linux/virtio_console.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/virtio_console.h b/include/uapi/linux/virtio_console.h index 7e6ec2ff0560..0506539e6553 100644 --- a/include/uapi/linux/virtio_console.h +++ b/include/uapi/linux/virtio_console.h @@ -44,7 +44,7 @@ #define VIRTIO_CONSOLE_BAD_ID (~(__u32)0) struct virtio_console_config { - /* colums of the screens */ + /* columns of the screens */ __virtio16 cols; /* rows of the screens */ __virtio16 rows; -- cgit v1.2.3 From 083082a4e6d8311c91ac7e1d59426514c5e1c04b Mon Sep 17 00:00:00 2001 From: Matias Ezequiel Vara Larsen Date: Tue, 26 May 2026 18:42:23 +0200 Subject: can: virtio: Add virtio CAN driver Add virtio CAN driver based on Virtio 1.4 specification (see https://github.com/oasis-tcs/virtio-spec/tree/virtio-1.4). The driver implements a complete CAN bus interface over Virtio transport, supporting both CAN Classic and CAN-FD Ids. In term of frames, it supports classic and CAN FD. RTR frames are only supported with classic CAN. Usage: - "ip link set up can0" - start controller - "ip link set down can0" - stop controller - "candump can0" - receive frames - "cansend can0 123#DEADBEEF" - send frames Signed-off-by: Harald Mommer Co-developed-by: Harald Mommer Signed-off-by: Mikhail Golubev-Ciuchea Co-developed-by: Marc Kleine-Budde Signed-off-by: Marc Kleine-Budde Cc: Damir Shaikhutdinov Reviewed-by: Francesco Valla Tested-by: Francesco Valla Signed-off-by: Matias Ezequiel Vara Larsen Signed-off-by: Michael S. Tsirkin Message-ID: --- include/uapi/linux/virtio_can.h | 78 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 include/uapi/linux/virtio_can.h (limited to 'include') diff --git a/include/uapi/linux/virtio_can.h b/include/uapi/linux/virtio_can.h new file mode 100644 index 000000000000..08d7e3e78776 --- /dev/null +++ b/include/uapi/linux/virtio_can.h @@ -0,0 +1,78 @@ +/* SPDX-License-Identifier: BSD-3-Clause */ +/* + * Copyright (C) 2021-2023 OpenSynergy GmbH + * Copyright Red Hat, Inc. 2025 + */ +#ifndef _LINUX_VIRTIO_VIRTIO_CAN_H +#define _LINUX_VIRTIO_VIRTIO_CAN_H + +#include +#include +#include +#include + +/* Feature bit numbers */ +#define VIRTIO_CAN_F_CAN_CLASSIC 0 +#define VIRTIO_CAN_F_CAN_FD 1 +#define VIRTIO_CAN_F_RTR_FRAMES 2 +#define VIRTIO_CAN_F_LATE_TX_ACK 3 + +/* CAN Result Types */ +#define VIRTIO_CAN_RESULT_OK 0 +#define VIRTIO_CAN_RESULT_NOT_OK 1 + +/* CAN flags to determine type of CAN Id */ +#define VIRTIO_CAN_FLAGS_EXTENDED 0x8000 +#define VIRTIO_CAN_FLAGS_FD 0x4000 +#define VIRTIO_CAN_FLAGS_RTR 0x2000 + +#define VIRTIO_CAN_MAX_DLEN 64 // this is like CANFD_MAX_DLEN + +struct virtio_can_config { +#define VIRTIO_CAN_S_CTRL_BUSOFF (1u << 0) /* Controller BusOff */ + /* CAN controller status */ + __le16 status; +}; + +/* TX queue message types */ +struct virtio_can_tx_out { +#define VIRTIO_CAN_TX 0x0001 + __le16 msg_type; + __le16 length; /* 0..8 CC, 0..64 CAN-FD, 0..2048 CAN-XL, 12 bits */ + __u8 reserved_classic_dlc; /* If CAN classic length = 8 then DLC can be 8..15 */ + __u8 padding; + __le16 reserved_xl_priority; /* May be needed for CAN XL priority */ + __le32 flags; + __le32 can_id; + __u8 sdu[] __counted_by_le(length); +}; + +struct virtio_can_tx_in { + __u8 result; +}; + +/* RX queue message types */ +struct virtio_can_rx { +#define VIRTIO_CAN_RX 0x0101 + __le16 msg_type; + __le16 length; /* 0..8 CC, 0..64 CAN-FD, 0..2048 CAN-XL, 12 bits */ + __u8 reserved_classic_dlc; /* If CAN classic length = 8 then DLC can be 8..15 */ + __u8 padding; + __le16 reserved_xl_priority; /* May be needed for CAN XL priority */ + __le32 flags; + __le32 can_id; + __u8 sdu[] __counted_by_le(length); +}; + +/* Control queue message types */ +struct virtio_can_control_out { +#define VIRTIO_CAN_SET_CTRL_MODE_START 0x0201 +#define VIRTIO_CAN_SET_CTRL_MODE_STOP 0x0202 + __le16 msg_type; +}; + +struct virtio_can_control_in { + __u8 result; +}; + +#endif /* #ifndef _LINUX_VIRTIO_VIRTIO_CAN_H */ -- cgit v1.2.3 From 8cb2c9285e4ce9154f45fb15633ebd45dfd8d9cf Mon Sep 17 00:00:00 2001 From: Nathan Chancellor Date: Thu, 4 Jun 2026 15:57:15 -0700 Subject: can: virtio: Fix comment in UAPI header When compile testing the UAPI headers with clang, there is an warning turned error for using a C++ style ('//') comment, which is explicitly forbidden for UAPI headers. In file included from :1: ./usr/include/linux/virtio_can.h:29:35: error: // comments are not allowed in this language [-Werror,-Wcomment] 29 | #define VIRTIO_CAN_MAX_DLEN 64 // this is like CANFD_MAX_DLEN | ^ 1 error generated. Switch to a standard C style comment. Fixes: 2b6b4bb7d96f ("can: virtio: Add virtio CAN driver") Signed-off-by: Nathan Chancellor Signed-off-by: Michael S. Tsirkin Message-ID: <20260604-virtio_can-fix-uapi-comment-v1-1-199fa96ec5f0@kernel.org> --- include/uapi/linux/virtio_can.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/virtio_can.h b/include/uapi/linux/virtio_can.h index 08d7e3e78776..e054d5099241 100644 --- a/include/uapi/linux/virtio_can.h +++ b/include/uapi/linux/virtio_can.h @@ -26,7 +26,7 @@ #define VIRTIO_CAN_FLAGS_FD 0x4000 #define VIRTIO_CAN_FLAGS_RTR 0x2000 -#define VIRTIO_CAN_MAX_DLEN 64 // this is like CANFD_MAX_DLEN +#define VIRTIO_CAN_MAX_DLEN 64 /* this is like CANFD_MAX_DLEN */ struct virtio_can_config { #define VIRTIO_CAN_S_CTRL_BUSOFF (1u << 0) /* Controller BusOff */ -- cgit v1.2.3 From ccd0db6671d2cae986b2daa1c538b6d541a9d62c Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Tue, 9 Jun 2026 13:50:53 +0200 Subject: ALSA: timer: Manage timer object with kref So far we've tried to address UAFs in ALSA timer code by applying the locks at various places, but the fundamental problem is that the timer object may be released while the belonging timer instance objects are still present and accessing to it. This patch is a more proper fix to address that issue, namely, by refcounting and keeping the timer object. The basic implementation is to use kref for the refcount of the timer object, and take/release the reference at assigning/releasing the instance, as well as at referring from ioctls or ALSA sequencer code. The reference from ioctl or ALSA sequencer is abstracted with snd_timeri_timer auto-cleanup. Note that this change assumes that the code already took the fix commit da3039e91d1f ("ALSA: timer: Forcibly close timer instances at closing"); otherwise the refcount may be unbalanced when the timer is freed while slave instances are still present. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260609115100.806869-2-tiwai@suse.de --- include/sound/timer.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/sound/timer.h b/include/sound/timer.h index 83bafe70cf33..e549eab7145b 100644 --- a/include/sound/timer.h +++ b/include/sound/timer.h @@ -75,6 +75,7 @@ struct snd_timer { struct list_head ack_list_head; struct list_head sack_list_head; /* slow ack list head */ struct work_struct task_work; + struct kref kref; int max_instances; /* upper limit of timer instances */ int num_instances; /* current number of timer instances */ }; @@ -131,4 +132,9 @@ int snd_timer_pause(struct snd_timer_instance *timeri); void snd_timer_interrupt(struct snd_timer *timer, unsigned long ticks_left); +struct snd_timer *snd_timeri_timer_get(struct snd_timer_instance *timeri); +void snd_timeri_timer_put(struct snd_timer *timer); + +DEFINE_FREE(snd_timeri_timer, struct snd_timer *, if (_T) snd_timeri_timer_put(_T)) + #endif /* __SOUND_TIMER_H */ -- cgit v1.2.3 From 82c6dd20479bb6a9625e1d63a650c3be8865e2db Mon Sep 17 00:00:00 2001 From: AnonymeMeow Date: Sun, 7 Jun 2026 08:33:43 +0800 Subject: fanotify: allow reporting pidfds for reaped tasks Fanotify used to refuse to report pidfds for reaped tasks by applying a pid_has_task() check before calling pidfd_prepare(). This prevented userspace from obtaining information about the task. Register the event pid with pidfs when creating the fanotify event if pidfd reporting was requested, so pidfd_prepare() can later create a pidfd for the reaped task. Suggested-by: Christian Brauner Link: https://lore.kernel.org/linux-fsdevel/20260528-schmuckvoll-heilen-garen-be77b4208671@brauner/ Signed-off-by: AnonymeMeow Signed-off-by: Christian Brauner (Amutable) Link: https://patch.msgid.link/20260607003343.425939-3-anonymemeow@gmail.com Signed-off-by: Jan Kara --- include/linux/pidfs.h | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/pidfs.h b/include/linux/pidfs.h index 416bdff4d6ce..0abf7da9ab23 100644 --- a/include/linux/pidfs.h +++ b/include/linux/pidfs.h @@ -2,6 +2,8 @@ #ifndef _LINUX_PID_FS_H #define _LINUX_PID_FS_H +#include + struct coredump_params; struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags); @@ -14,7 +16,21 @@ void pidfs_exit(struct task_struct *tsk); void pidfs_coredump(const struct coredump_params *cprm); #endif extern const struct dentry_operations pidfs_dentry_operations; -int pidfs_register_pid(struct pid *pid); +int pidfs_register_pid_gfp(struct pid *pid, gfp_t gfp); + +/** + * pidfs_register_pid - register a struct pid in pidfs + * @pid: pid to pin + * + * Register a struct pid in pidfs. + * + * Return: On success zero, on error a negative error code is returned. + */ +static inline int pidfs_register_pid(struct pid *pid) +{ + return pidfs_register_pid_gfp(pid, GFP_KERNEL); +} + void pidfs_free_pid(struct pid *pid); #endif /* _LINUX_PID_FS_H */ -- cgit v1.2.3 From e480228cf65583040c894bb9cc02e1d5b328cee0 Mon Sep 17 00:00:00 2001 From: Alex Hung Date: Tue, 9 Jun 2026 12:20:18 +0200 Subject: drm/colorop: Remove read-only comments from interpolation fields The lut1d_interpolation and lut3d_interpolation fields and their associated properties were marked as read-only, but userspace can set them via drm_atomic_colorop_set_property(). Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Reviewed-by: Chaitanya Kumar Borah Signed-off-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-2-mwen@igalia.com --- include/drm/drm_colorop.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h index bd082854ca74..61cc8206b4c4 100644 --- a/include/drm/drm_colorop.h +++ b/include/drm/drm_colorop.h @@ -309,7 +309,6 @@ struct drm_colorop { /** * @lut1d_interpolation: * - * Read-only * Interpolation for DRM_COLOROP_1D_LUT */ enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; @@ -317,7 +316,6 @@ struct drm_colorop { /** * @lut3d_interpolation: * - * Read-only * Interpolation for DRM_COLOROP_3D_LUT */ enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; @@ -325,7 +323,7 @@ struct drm_colorop { /** * @lut1d_interpolation_property: * - * Read-only property for DRM_COLOROP_1D_LUT interpolation + * Property for DRM_COLOROP_1D_LUT interpolation */ struct drm_property *lut1d_interpolation_property; @@ -353,7 +351,7 @@ struct drm_colorop { /** * @lut3d_interpolation_property: * - * Read-only property for DRM_COLOROP_3D_LUT interpolation + * Property for DRM_COLOROP_3D_LUT interpolation */ struct drm_property *lut3d_interpolation_property; -- cgit v1.2.3 From 94ff735296d371045fce163451a3d65e44ac4729 Mon Sep 17 00:00:00 2001 From: Melissa Wen Date: Tue, 9 Jun 2026 12:20:19 +0200 Subject: drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable As interpolation props are actually mutable props, any changes should be handled by drm_colorop_state. Move their enum and make it correctly behaves as mutable. Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Reviewed-by: Chaitanya Kumar Borah Reviewed-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-3-mwen@igalia.com --- include/drm/drm_colorop.h | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) (limited to 'include') diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h index 61cc8206b4c4..d5b45339333f 100644 --- a/include/drm/drm_colorop.h +++ b/include/drm/drm_colorop.h @@ -183,6 +183,20 @@ struct drm_colorop_state { */ struct drm_property_blob *data; + /** + * @lut1d_interpolation: + * + * Interpolation for DRM_COLOROP_1D_LUT + */ + enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; + + /** + * @lut3d_interpolation: + * + * Interpolation for DRM_COLOROP_3D_LUT + */ + enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; + /** @state: backpointer to global drm_atomic_state */ struct drm_atomic_state *state; }; @@ -306,20 +320,6 @@ struct drm_colorop { */ uint32_t size; - /** - * @lut1d_interpolation: - * - * Interpolation for DRM_COLOROP_1D_LUT - */ - enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; - - /** - * @lut3d_interpolation: - * - * Interpolation for DRM_COLOROP_3D_LUT - */ - enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; - /** * @lut1d_interpolation_property: * -- cgit v1.2.3 From 2e235e2a2784b12b735321e5b42240ca51c49b0f Mon Sep 17 00:00:00 2001 From: Melissa Wen Date: Tue, 9 Jun 2026 12:20:20 +0200 Subject: drm/atomic: track individual colorop updates As we do for CRTC color mgmt properties, use color_mgmt_changed flag to track any value changes in the color pipeline of a given plane, so that drivers can update color blocks as soon as plane color pipeline or individual colorop values change. Since we're here, only announce and track changes to plane COLOR_PIPELINE prop if its value is actually changing. Fixes: 8c5ea1745f4c ("drm/colorop: Add BYPASS property") Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: 41651f9d42eb ("drm/colorop: Add 1D Curve subtype") Fixes: 3410108037d5 ("drm/colorop: Add multiplier type") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Fixes: e5719e7f1900 ("drm/colorop: Add 3x4 CTM type") Fixes: 99a4e4f08abe ("drm/colorop: Add 1D Curve Custom LUT type") Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property") Reviewed-by: Harry Wentland #v1 Reviewed-by: Chaitanya Kumar Borah Reviewed-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-4-mwen@igalia.com --- include/drm/drm_atomic_uapi.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/drm/drm_atomic_uapi.h b/include/drm/drm_atomic_uapi.h index 436315523326..4e7e78f711e2 100644 --- a/include/drm/drm_atomic_uapi.h +++ b/include/drm/drm_atomic_uapi.h @@ -29,6 +29,8 @@ #ifndef DRM_ATOMIC_UAPI_H_ #define DRM_ATOMIC_UAPI_H_ +#include + struct drm_crtc_state; struct drm_display_mode; struct drm_property_blob; @@ -50,7 +52,7 @@ drm_atomic_set_crtc_for_plane(struct drm_plane_state *plane_state, struct drm_crtc *crtc); void drm_atomic_set_fb_for_plane(struct drm_plane_state *plane_state, struct drm_framebuffer *fb); -void drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, +bool drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, struct drm_colorop *colorop); int __must_check drm_atomic_set_crtc_for_connector(struct drm_connector_state *conn_state, -- cgit v1.2.3 From fc83c6a271c199f76781da3314bc34868b4bc9a8 Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Wed, 10 Jun 2026 00:48:31 +0000 Subject: sh: roll back Ecovec24/7724se Sound support Due to a communication miss, the Ecovec24/7724se Sound support were removed. We need to keep them for a while, until they will support "DT-style". Roll back Ecovec24/7724se "platform data style", and its necessary header. Fixes: deadb855b694d ("sh: 7724se: remove FSI/AK4642/Simple-Audio-Card support") Fixes: 9cc93ebc85e71 ("sh: ecovec24: remove FSI/DA7210/Simple-Audio-Card support") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87v7br43vk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/simple_card.h | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 include/sound/simple_card.h (limited to 'include') diff --git a/include/sound/simple_card.h b/include/sound/simple_card.h new file mode 100644 index 000000000000..2e999916dbd7 --- /dev/null +++ b/include/sound/simple_card.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 + * + * ASoC simple sound card support + * + * Copyright (C) 2012 Renesas Solutions Corp. + * Kuninori Morimoto + */ + +#ifndef __SIMPLE_CARD_H +#define __SIMPLE_CARD_H + +#include +#include + +struct simple_util_info { + const char *name; + const char *card; + const char *codec; + const char *platform; + + unsigned int daifmt; + struct simple_util_dai cpu_dai; + struct simple_util_dai codec_dai; +}; + +#endif /* __SIMPLE_CARD_H */ -- cgit v1.2.3 From 8fec6e55859e31b354207a46c16de3e12116d32f Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Tue, 2 Jun 2026 02:55:31 +0000 Subject: ASoC: soc-component: remove CONFIG_DEBUG_FS for debugfs_prefix Both (A) and (B) have debugfs_prefix, but (B) is using CONFIG_DEBUG_FS (C) (A) struct snd_soc_component { ... const char *debugfs_prefix; }; (B) struct snd_soc_component_driver { ... (C) ifdef CONFIG_DEBUG_FS const char *debugfs_prefix; endif }; Remove (C) which makes code cleanup difficult. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87jyshk5wc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/soc-component.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/sound/soc-component.h b/include/sound/soc-component.h index 7e158d27ae8d..337b7ef4156c 100644 --- a/include/sound/soc-component.h +++ b/include/sound/soc-component.h @@ -199,9 +199,7 @@ struct snd_soc_component_driver { bool use_dai_pcm_id; /* use DAI link PCM ID as PCM device number */ int be_pcm_base; /* base device ID for all BE PCMs */ -#ifdef CONFIG_DEBUG_FS const char *debugfs_prefix; -#endif }; struct snd_soc_component { -- cgit v1.2.3 From cd849a5fcac849a2c9d9391a2676bf3d0b4443dd Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Tue, 2 Jun 2026 02:56:00 +0000 Subject: ASoC: soc-component: remove .debugfs_prefix from Component All drivers are now setting .debugfs_prefix via Component driver. Remove it from Component. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87cxy9k5vj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/soc-component.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/sound/soc-component.h b/include/sound/soc-component.h index 337b7ef4156c..11bc9527653f 100644 --- a/include/sound/soc-component.h +++ b/include/sound/soc-component.h @@ -248,7 +248,6 @@ struct snd_soc_component { void *mark_pm; struct dentry *debugfs_root; - const char *debugfs_prefix; }; #define for_each_component_dais(component, dai)\ -- cgit v1.2.3 From bbe9015f23432bd4f5b8590eb178b3b5b7c29f02 Mon Sep 17 00:00:00 2001 From: "Matthew Wilcox (Oracle)" Date: Thu, 28 May 2026 18:14:11 +0100 Subject: jbd2: remove special jbd2 slabs When jbd2 was originally written, kmalloc() would not guarantee memory alignment for the requested objects. Since commit 59bb47985c1d in 2019, kmalloc has guaranteed natural alignment for power-of-two allocations. We can now remove the jbd2 special slabs and just use kmalloc() directly. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Jan Kara Acked-by: Mike Rapoport (Microsoft) Acked-by: Vlastimil Babka (SUSE) Reviewed-by: Tal Zussman Link: https://patch.msgid.link/20260528171413.1088143-1-willy@infradead.org Signed-off-by: Theodore Ts'o --- include/linux/jbd2.h | 3 --- 1 file changed, 3 deletions(-) (limited to 'include') diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h index 7e785aa6d35d..b68561187e90 100644 --- a/include/linux/jbd2.h +++ b/include/linux/jbd2.h @@ -63,9 +63,6 @@ void __jbd2_debug(int level, const char *file, const char *func, #define jbd2_debug(n, fmt, a...) no_printk(fmt, ##a) #endif -extern void *jbd2_alloc(size_t size, gfp_t flags); -extern void jbd2_free(void *ptr, size_t size); - #define JBD2_MIN_JOURNAL_BLOCKS 1024 #define JBD2_DEFAULT_FAST_COMMIT_BLOCKS 256 -- cgit v1.2.3 From 32b0b8953343eaceaa816a9ead3b6bb66355c64e Mon Sep 17 00:00:00 2001 From: Louis Scalbert Date: Wed, 3 Jun 2026 17:03:28 +0200 Subject: bonding: 3ad: add lacp_strict configuration knob When an 802.3ad (LACP) bonding interface has no slaves in the collecting/distributing state, the bonding master still reports carrier as up as long as at least 'min_links' slaves have carrier. In this situation, only one slave is effectively used for TX/RX, while traffic received on other slaves is dropped. Upper-layer daemons therefore consider the interface operational, even though traffic may be blackholed if the lack of LACP negotiation means the partner is not ready to deal with traffic. Introduce a configuration knob to control this behavior. It allows the bonding master to assert carrier only when at least 'min_links' slaves are in Collecting_Distributing state. The default mode preserves the existing behavior. This patch only introduces the knob; its behavior is implemented in the subsequent commit. Fixes: 655f8919d549 ("bonding: add min links parameter to 802.3ad") Signed-off-by: Louis Scalbert Acked-by: Jay Vosburgh Link: https://patch.msgid.link/20260603150331.1919611-4-louis.scalbert@6wind.com Signed-off-by: Jakub Kicinski --- include/net/bond_options.h | 1 + include/net/bonding.h | 1 + include/uapi/linux/if_link.h | 1 + 3 files changed, 3 insertions(+) (limited to 'include') diff --git a/include/net/bond_options.h b/include/net/bond_options.h index e6eedf23aea1..52b966e92793 100644 --- a/include/net/bond_options.h +++ b/include/net/bond_options.h @@ -79,6 +79,7 @@ enum { BOND_OPT_COUPLED_CONTROL, BOND_OPT_BROADCAST_NEIGH, BOND_OPT_ACTOR_PORT_PRIO, + BOND_OPT_LACP_STRICT, BOND_OPT_LAST }; diff --git a/include/net/bonding.h b/include/net/bonding.h index edd1942dcd73..2c54a36a8477 100644 --- a/include/net/bonding.h +++ b/include/net/bonding.h @@ -129,6 +129,7 @@ struct bond_params { int peer_notif_delay; int lacp_active; int lacp_fast; + int lacp_strict; unsigned int min_links; int ad_select; char primary[IFNAMSIZ]; diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 363526549a01..43cecca49f01 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -1603,6 +1603,7 @@ enum { IFLA_BOND_NS_IP6_TARGET, IFLA_BOND_COUPLED_CONTROL, IFLA_BOND_BROADCAST_NEIGH, + IFLA_BOND_LACP_STRICT, __IFLA_BOND_MAX, }; -- cgit v1.2.3 From c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 Mon Sep 17 00:00:00 2001 From: Weiming Shi Date: Wed, 3 Jun 2026 00:38:17 -0700 Subject: netfilter: nf_conntrack: destroy stale expectfn expectations on unregister NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text. When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops. Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") Reported-by: Xiang Mei Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_helper.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index de2f956abf34..24cf3d2d9745 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -155,6 +155,7 @@ void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct, void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n); void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n); +void nf_ct_helper_expectfn_destroy(const struct nf_ct_helper_expectfn *n); struct nf_ct_helper_expectfn * nf_ct_helper_expectfn_find_by_name(const char *name); struct nf_ct_helper_expectfn * -- cgit v1.2.3 From 5f1d444e084ce3e4619e38c45a8cc29e6fffb2bf Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 31 May 2026 12:17:37 -0700 Subject: crypto: xilinx-trng - Replace crypto_drbg_ctr_df() with HMAC-SHA512 This code is just trying to condition 48 bytes of random data. This can be done easily using HKDF-SHA512-Extract, saving 300 lines of code. This commit also fixes forward security (in this particular case) by clearing the entropy from memory after it's used. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- include/crypto/df_sp80090a.h | 53 -------------------------------------------- 1 file changed, 53 deletions(-) delete mode 100644 include/crypto/df_sp80090a.h (limited to 'include') diff --git a/include/crypto/df_sp80090a.h b/include/crypto/df_sp80090a.h deleted file mode 100644 index e594fb718eb8..000000000000 --- a/include/crypto/df_sp80090a.h +++ /dev/null @@ -1,53 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ - -/* - * Copyright Stephan Mueller , 2014 - */ - -#ifndef _CRYPTO_DF80090A_H -#define _CRYPTO_DF80090A_H - -#include -#include -#include - -/* - * Concatenation Helper and string operation helper - * - * SP800-90A requires the concatenation of different data. To avoid copying - * buffers around or allocate additional memory, the following data structure - * is used to point to the original memory with its size. In addition, it - * is used to build a linked list. The linked list defines the concatenation - * of individual buffers. The order of memory block referenced in that - * linked list determines the order of concatenation. - */ -struct drbg_string { - const unsigned char *buf; - size_t len; - struct list_head list; -}; - -static inline void drbg_string_fill(struct drbg_string *string, - const unsigned char *buf, size_t len) -{ - string->buf = buf; - string->len = len; - INIT_LIST_HEAD(&string->list); -} - -static inline int crypto_drbg_ctr_df_datalen(u8 statelen, u8 blocklen) -{ - return statelen + /* df_data */ - blocklen + /* pad */ - blocklen + /* iv */ - statelen + blocklen; /* temp */ -} - -int crypto_drbg_ctr_df(struct aes_enckey *aes, - unsigned char *df_data, - size_t bytes_to_return, - struct list_head *seedlist, - u8 blocklen_bytes, - u8 statelen); - -#endif /* _CRYPTO_DF80090A_H */ -- cgit v1.2.3 From ac0ffe7cf1221182f4068d8aaf825b01655c7ca9 Mon Sep 17 00:00:00 2001 From: Vladimir Oltean Date: Wed, 10 Jun 2026 18:19:39 +0300 Subject: phy: lynx-28g: move lane mode helpers to new core module Do some preparation work for the introduction of the lynx-10g driver, which will share a common backbone with the 28G Lynx SerDes. This is just trivial stuff which can be moved without any surgery, and is easy to follow but otherwise pollutes more serious changes. The lane modes themselves are exported to a public header, because on the 10G Lynx, the hardware requires implementing a procedure called "RCW override". This requires coordination with drivers/soc/fsl/guts.c to tell it that a SerDes lane needs to be switched to a different protocol (enum lynx_lane_mode). Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260610151952.2141019-4-vladimir.oltean@nxp.com Signed-off-by: Vinod Koul --- include/soc/fsl/phy-fsl-lynx.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 include/soc/fsl/phy-fsl-lynx.h (limited to 'include') diff --git a/include/soc/fsl/phy-fsl-lynx.h b/include/soc/fsl/phy-fsl-lynx.h new file mode 100644 index 000000000000..92e8272d5ae1 --- /dev/null +++ b/include/soc/fsl/phy-fsl-lynx.h @@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* Copyright 2023-2026 NXP */ + +#ifndef __PHY_FSL_LYNX_H_ +#define __PHY_FSL_LYNX_H_ + +enum lynx_lane_mode { + LANE_MODE_UNKNOWN, + LANE_MODE_1000BASEX_SGMII, + LANE_MODE_10GBASER, + LANE_MODE_USXGMII, + LANE_MODE_25GBASER, + LANE_MODE_MAX, +}; + +#endif /* __PHY_FSL_LYNX_H_ */ -- cgit v1.2.3 From 6dc92ba487a21b923eb409357ffe966a6e9d2343 Mon Sep 17 00:00:00 2001 From: Vladimir Oltean Date: Wed, 10 Jun 2026 18:19:51 +0300 Subject: phy: lynx-10g: new driver Introduce a driver for the networking lanes of the 10G Lynx SerDes block, present on the majority of Layerscape and QorIQ (Freescale/NXP) SoCs. As with the 28G Lynx, the SerDes lanes come pre-initialized out of reset and the consumers use them that way outside the Generic PHY framework (for networking, the static configuration remains for the entire SoC lifetime, whereas for SATA and PCIe, the hardware reconfigures itself automatically for other link speeds). The need for the Generic PHY framework comes specifically for networking use cases where a static lane configuration is not sufficient. For example a network MAC is connected to an SFP cage, where various SFP or SFP+ modules can be connected. Each of them may require a different SerDes protocol (SGMII, 1000Base-X, 10GBase-R), which phylink + sfp-bus are responsible of figuring out. The phylink drivers are: - enetc - felix - dpaa_eth (fman_memac) - dpaa2-eth - dpaa2-switch and they all need to reconfigure the SerDes for the requested link mode, using phy_set_mode_ext() (and phy_validate() to see if it is supported in the first place). Note that SerDes 2 on LS1088A is exclusively non-networking, so there is currently no need for this driver. Therefore we skip matching on its compatible string and do not probe on that device. Co-developed-by: Ioana Ciornei Signed-off-by: Ioana Ciornei Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20260610151952.2141019-16-vladimir.oltean@nxp.com Signed-off-by: Vinod Koul --- include/soc/fsl/phy-fsl-lynx.h | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'include') diff --git a/include/soc/fsl/phy-fsl-lynx.h b/include/soc/fsl/phy-fsl-lynx.h index 92e8272d5ae1..ff5a7d1835b5 100644 --- a/include/soc/fsl/phy-fsl-lynx.h +++ b/include/soc/fsl/phy-fsl-lynx.h @@ -7,10 +7,37 @@ enum lynx_lane_mode { LANE_MODE_UNKNOWN, LANE_MODE_1000BASEX_SGMII, + LANE_MODE_2500BASEX, + LANE_MODE_QSGMII, + LANE_MODE_10G_QXGMII, LANE_MODE_10GBASER, LANE_MODE_USXGMII, LANE_MODE_25GBASER, LANE_MODE_MAX, }; +static inline bool lynx_lane_mode_uses_gmii_mac(enum lynx_lane_mode mode) +{ + switch (mode) { + case LANE_MODE_1000BASEX_SGMII: + case LANE_MODE_2500BASEX: + case LANE_MODE_QSGMII: + case LANE_MODE_10G_QXGMII: + return true; + default: + return false; + } +} + +static inline bool lynx_lane_mode_uses_xgmii_mac(enum lynx_lane_mode mode) +{ + switch (mode) { + case LANE_MODE_10GBASER: + case LANE_MODE_USXGMII: + return true; + default: + return false; + } +} + #endif /* __PHY_FSL_LYNX_H_ */ -- cgit v1.2.3 From dcca9b6064c33c84fbeb9f09814178a206321249 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 10 Jun 2026 17:45:31 +0200 Subject: ALSA: Add simple refcount helper functions There are many open-code to manage the same pattern for refcount + wakeup sync at closing. Let's provide the common helper functions to replace the open-code. - The recount is kept in struct snd_refcount, where it's initialized by snd_refcount_init(). - The user can simply reference or unreference via snd_refcount_get() and snd_refcount_put() functions - The user can wait for the all usages gone by snd_refcount_sync() Note that here we use atomic_t instead of refcount_t since the current users allow reusing the refcount after sync again. The design of refcount_t prevents exactly this behavior, so it doesn't fit. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260610154538.51076-2-tiwai@suse.de --- include/sound/core.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'include') diff --git a/include/sound/core.h b/include/sound/core.h index 8b2ca95d13f7..a3f10294e834 100644 --- a/include/sound/core.h +++ b/include/sound/core.h @@ -75,6 +75,27 @@ struct snd_device { #define snd_device(n) list_entry(n, struct snd_device, list) +/* + * A simple reference counter with a wait queue; + * typically used for usage counts, and you can synchronize at finishing + * via snd_refcount_sync(), which is woken up when the refcount reaches to + * zero again. + */ +struct snd_refcount { + atomic_t count; + wait_queue_head_t waiter; +}; + +void snd_refcount_init(struct snd_refcount *ref); + +static inline void snd_refcount_get(struct snd_refcount *ref) +{ + atomic_inc(&ref->count); +} + +void snd_refcount_put(struct snd_refcount *ref); +void snd_refcount_sync(struct snd_refcount *ref); + /* main structure for soundcard */ struct snd_card { -- cgit v1.2.3 From 2fa8d8b6c18b3443b65d42ced33bc9e36683e886 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 10 Jun 2026 17:45:32 +0200 Subject: ALSA: core: Use the new helper for the power refcount Replace the open code for managing the power refcount in the snd_card object with the new helper functions. Only a code cleanup, no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260610154538.51076-3-tiwai@suse.de --- include/sound/core.h | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/sound/core.h b/include/sound/core.h index a3f10294e834..404785b7d885 100644 --- a/include/sound/core.h +++ b/include/sound/core.h @@ -160,9 +160,8 @@ struct snd_card { #ifdef CONFIG_PM unsigned int power_state; /* power state */ - atomic_t power_ref; wait_queue_head_t power_sleep; - wait_queue_head_t power_ref_sleep; + struct snd_refcount power_ref; #endif #if IS_ENABLED(CONFIG_SND_MIXER_OSS) @@ -197,7 +196,7 @@ static inline void snd_power_change_state(struct snd_card *card, unsigned int st */ static inline void snd_power_ref(struct snd_card *card) { - atomic_inc(&card->power_ref); + snd_refcount_get(&card->power_ref); } /** @@ -206,8 +205,7 @@ static inline void snd_power_ref(struct snd_card *card) */ static inline void snd_power_unref(struct snd_card *card) { - if (atomic_dec_and_test(&card->power_ref)) - wake_up(&card->power_ref_sleep); + snd_refcount_put(&card->power_ref); } /** @@ -219,7 +217,7 @@ static inline void snd_power_unref(struct snd_card *card) */ static inline void snd_power_sync_ref(struct snd_card *card) { - wait_event(card->power_ref_sleep, !atomic_read(&card->power_ref)); + snd_refcount_sync(&card->power_ref); } /* init.c */ -- cgit v1.2.3 From 53af356c45b22c2410b08ad947e62105a137f680 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Wed, 10 Jun 2026 17:45:33 +0200 Subject: ALSA: hda: Use the new helper for PCM instance refcount HD-audio core driver has some open-code for managing the refcount for PCM instances, and it can be replaced gracefully with the new helpers. Only a code cleanup, no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20260610154538.51076-4-tiwai@suse.de --- include/sound/hda_codec.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h index 1a1fe7a904c3..17945ab5e6e2 100644 --- a/include/sound/hda_codec.h +++ b/include/sound/hda_codec.h @@ -188,8 +188,7 @@ struct hda_codec { /* PCM to create, set by hda_codec_ops.build_pcms callback */ struct list_head pcm_list_head; - refcount_t pcm_ref; - wait_queue_head_t remove_sleep; + struct snd_refcount pcm_ref; /* codec specific info */ void *spec; @@ -439,9 +438,12 @@ void snd_hda_codec_cleanup_for_unbind(struct hda_codec *codec); static inline void snd_hda_codec_pcm_get(struct hda_pcm *pcm) { - refcount_inc(&pcm->codec->pcm_ref); + snd_refcount_get(&pcm->codec->pcm_ref); +} +static inline void snd_hda_codec_pcm_put(struct hda_pcm *pcm) +{ + snd_refcount_put(&pcm->codec->pcm_ref); } -void snd_hda_codec_pcm_put(struct hda_pcm *pcm); int snd_hda_codec_prepare(struct hda_codec *codec, struct hda_pcm_stream *hinfo, -- cgit v1.2.3 From f953585dafd71ecb0897f9def9c0a3702afc1bf8 Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Wed, 10 Jun 2026 13:50:07 -0700 Subject: gpio: nomadik: remove dead DB8540 code from DB8540 support was removed in commit b6d09f780761 ("pinctrl: nomadik: Drop U8540/9540 support"), but a couple small pieces of related code remained in . Remove them. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260610205007.44881-1-enelsonmoore@gmail.com Signed-off-by: Bartosz Golaszewski --- include/linux/gpio/gpio-nomadik.h | 16 ---------------- 1 file changed, 16 deletions(-) (limited to 'include') diff --git a/include/linux/gpio/gpio-nomadik.h b/include/linux/gpio/gpio-nomadik.h index 8061b9826361..44c47645649c 100644 --- a/include/linux/gpio/gpio-nomadik.h +++ b/include/linux/gpio/gpio-nomadik.h @@ -32,9 +32,6 @@ struct fwnode_handle; #define NMK_GPIO_RWIMSC 0x50 #define NMK_GPIO_FWIMSC 0x54 #define NMK_GPIO_WKS 0x58 -/* These appear in DB8540 and later ASICs */ -#define NMK_GPIO_EDGELEVEL 0x5C -#define NMK_GPIO_LEVEL 0x60 /* Pull up/down values */ enum nmk_gpio_pull { @@ -236,19 +233,6 @@ nmk_pinctrl_db8500_init(const struct nmk_pinctrl_soc_data **soc) #endif -#ifdef CONFIG_PINCTRL_DB8540 - -void nmk_pinctrl_db8540_init(const struct nmk_pinctrl_soc_data **soc); - -#else - -static inline void -nmk_pinctrl_db8540_init(const struct nmk_pinctrl_soc_data **soc) -{ -} - -#endif - struct platform_device; #ifdef CONFIG_DEBUG_FS -- cgit v1.2.3 From a7b8dac8881dc6853afc46964e014a39d5cecad3 Mon Sep 17 00:00:00 2001 From: Maher Sanalla Date: Sun, 24 May 2026 18:38:02 +0300 Subject: net/mlx5: Add UD and UC packet pacing caps Add the needed capabilities in mlx5_ifc to support packet pacing for UC and UD QPs. Signed-off-by: Maher Sanalla Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260524-packet-pacing-v1-1-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky --- include/linux/mlx5/mlx5_ifc.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h index 49f3ad4b1a7c..f56de77cde3a 100644 --- a/include/linux/mlx5/mlx5_ifc.h +++ b/include/linux/mlx5/mlx5_ifc.h @@ -1116,7 +1116,10 @@ struct mlx5_ifc_qos_cap_bits { u8 log_esw_max_sched_depth[0x4]; u8 reserved_at_10[0x10]; - u8 reserved_at_20[0x9]; + u8 reserved_at_20[0x2]; + u8 packet_pacing_req_ud[0x1]; + u8 packet_pacing_req_uc[0x1]; + u8 reserved_at_24[0x5]; u8 esw_cross_esw_sched[0x1]; u8 reserved_at_2a[0x1]; u8 log_max_qos_nic_queue_group[0x5]; @@ -3707,7 +3710,8 @@ struct mlx5_ifc_qpc_bits { u8 cur_retry_count[0x3]; u8 reserved_at_39b[0x5]; - u8 reserved_at_3a0[0x20]; + u8 reserved_at_3a0[0x10]; + u8 packet_pacing_rate_limit_index[0x10]; u8 reserved_at_3c0[0x8]; u8 next_send_psn[0x18]; -- cgit v1.2.3 From 29e0a014ddfbdbd6b02684304dddbcf9161034ae Mon Sep 17 00:00:00 2001 From: Maher Sanalla Date: Sun, 24 May 2026 18:38:04 +0300 Subject: RDMA/mlx5: Add support for rate limit in UD and UC QPs Rate limiting is currently supported only for raw packet QPs, where the packet pacing index is programmed into the SQC during SQ modify. Extend rate limit support to UD and UC QPs by setting the pacing index in the QPC during RTR2RTS and RTS2RTS transitions. Signed-off-by: Maher Sanalla Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260524-packet-pacing-v1-3-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky --- include/linux/mlx5/qp.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h index d67aedc6ea68..40f889403b07 100644 --- a/include/linux/mlx5/qp.h +++ b/include/linux/mlx5/qp.h @@ -72,6 +72,7 @@ enum mlx5_qp_optpar { MLX5_QP_OPTPAR_CQN_RCV = 1 << 19, MLX5_QP_OPTPAR_DC_HS = 1 << 20, MLX5_QP_OPTPAR_DC_KEY = 1 << 21, + MLX5_QP_OPTPAR_PP_INDEX = 1 << 22, MLX5_QP_OPTPAR_COUNTER_SET_ID = 1 << 25, }; -- cgit v1.2.3 From 76080d81e511f66eeb094b204e1e217bff674922 Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Thu, 4 Jun 2026 07:15:05 +0000 Subject: tracing/lock: Remove unnecessary linux/sched.h include None of the trace events in lock.h reference anything from linux/sched.h. Remove the unnecessary include. Signed-off-by: Dmitry Ilvokhin Signed-off-by: Peter Zijlstra (Intel) Acked-by: Usama Arif Link: https://patch.msgid.link/85e14a0685c1d46c3e80de2dc01358a48169b263.1780506267.git.d@ilvokhin.com --- include/trace/events/lock.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/trace/events/lock.h b/include/trace/events/lock.h index 8e89baa3775f..da978f2afb45 100644 --- a/include/trace/events/lock.h +++ b/include/trace/events/lock.h @@ -5,7 +5,6 @@ #if !defined(_TRACE_LOCK_H) || defined(TRACE_HEADER_MULTI_READ) #define _TRACE_LOCK_H -#include #include /* flags for lock:contention_begin */ -- cgit v1.2.3 From 7cfa62cf9432df67b1c95a59984a03a3bc023f98 Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Thu, 4 Jun 2026 07:15:06 +0000 Subject: locking/percpu-rwsem: Extract __percpu_up_read() Move the percpu_up_read() slowpath out of the inline function into a new __percpu_up_read() to avoid binary size increase from adding a tracepoint to an inlined function. Signed-off-by: Dmitry Ilvokhin Signed-off-by: Peter Zijlstra (Intel) Acked-by: Usama Arif Link: https://patch.msgid.link/3dd2a1b9ab4f469e1892766cb63f41d6b0f53d29.1780506267.git.d@ilvokhin.com --- include/linux/percpu-rwsem.h | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) (limited to 'include') diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h index c8cb010d655e..39d5bf8e6562 100644 --- a/include/linux/percpu-rwsem.h +++ b/include/linux/percpu-rwsem.h @@ -107,6 +107,8 @@ static inline bool percpu_down_read_trylock(struct percpu_rw_semaphore *sem) return ret; } +extern void __percpu_up_read(struct percpu_rw_semaphore *sem); + static inline void percpu_up_read(struct percpu_rw_semaphore *sem) { rwsem_release(&sem->dep_map, _RET_IP_); @@ -118,18 +120,7 @@ static inline void percpu_up_read(struct percpu_rw_semaphore *sem) if (likely(rcu_sync_is_idle(&sem->rss))) { this_cpu_dec(*sem->read_count); } else { - /* - * slowpath; reader will only ever wake a single blocked - * writer. - */ - smp_mb(); /* B matches C */ - /* - * In other words, if they see our decrement (presumably to - * aggregate zero, as that is the only time it matters) they - * will also see our critical section. - */ - this_cpu_dec(*sem->read_count); - rcuwait_wake_up(&sem->writer); + __percpu_up_read(sem); } preempt_enable(); } -- cgit v1.2.3 From 4f070ccb4dc4692e3b6757819fb80655f58b4f12 Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Thu, 4 Jun 2026 07:15:07 +0000 Subject: locking: Add contended_release tracepoint to sleepable locks Add the contended_release trace event. This tracepoint fires on the holder side when a contended lock is released, complementing the existing contention_begin/contention_end tracepoints which fire on the waiter side. This enables correlating lock hold time under contention with waiter events by lock address. Add trace_contended_release()/trace_call__contended_release() calls to the slowpath unlock paths of sleepable locks: mutex, rtmutex, semaphore, rwsem, percpu-rwsem, and RT-specific rwbase locks. Where possible, trace_contended_release() fires before the lock is released and before the waiter is woken. For some lock types, the tracepoint fires after the release but before the wake. Making the placement consistent across all lock types is not worth the added complexity. For reader/writer locks, the tracepoint fires for every reader releasing while a writer is waiting, not only for the last reader. Signed-off-by: Dmitry Ilvokhin Signed-off-by: Peter Zijlstra (Intel) Acked-by: Paul E. McKenney Acked-by: Usama Arif Link: https://patch.msgid.link/02f4f6c5ce6761e7f6587cf0ff2289d962ecddd4.1780506267.git.d@ilvokhin.com --- include/trace/events/lock.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'include') diff --git a/include/trace/events/lock.h b/include/trace/events/lock.h index da978f2afb45..1ded869cd619 100644 --- a/include/trace/events/lock.h +++ b/include/trace/events/lock.h @@ -137,6 +137,23 @@ TRACE_EVENT(contention_end, TP_printk("%p (ret=%d)", __entry->lock_addr, __entry->ret) ); +TRACE_EVENT(contended_release, + + TP_PROTO(void *lock), + + TP_ARGS(lock), + + TP_STRUCT__entry( + __field(void *, lock_addr) + ), + + TP_fast_assign( + __entry->lock_addr = lock; + ), + + TP_printk("%p", __entry->lock_addr) +); + #endif /* _TRACE_LOCK_H */ /* This part must be outside protection */ -- cgit v1.2.3 From 711104ab5ed500f155e4a53c56571b9b24a9a9b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dariusz=20Figza=C5=82?= Date: Wed, 10 Jun 2026 18:49:42 +0200 Subject: platform/x86: asus-wmi: add keystone dongle support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ASUS Keystone is a physical NFC-like dongle that slots into supported ASUS laptops. The EC fires WMI notify code 0xB4 on insert/remove events. Expose the current insert state via a sysfs attribute by querying WMI device ID 0x00120091 (DSTS). This devid does not follow the standard DSTS convention: PRESENCE_BIT (0x00010000) encodes the insert state rather than feature presence, and STATUS_BIT is never set. Presence of a keystone slot is detected by a successful DSTS call. Reviewed-by: Denis Benato Signed-off-by: Dariusz Figzał Link: https://patch.msgid.link/20260610164942.74956-1-dariuszfigzal@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen --- include/linux/platform_data/x86/asus-wmi.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h index 554f41b827e1..c29962d5baac 100644 --- a/include/linux/platform_data/x86/asus-wmi.h +++ b/include/linux/platform_data/x86/asus-wmi.h @@ -147,6 +147,13 @@ #define ASUS_WMI_DEVID_GPU_MUX 0x00090016 #define ASUS_WMI_DEVID_GPU_MUX_VIVO 0x00090026 +/* Keystone dongle insert/remove state. + * PRESENCE_BIT (0x00010000) encodes insert state: + * 0x00010000 = inserted, 0x00000000 = absent. STATUS_BIT is never set. + * 0xFFFFFFFE means no keystone slot on this machine. + */ +#define ASUS_WMI_DEVID_KEYSTONE 0x00120091 + /* TUF laptop RGB modes/colours */ #define ASUS_WMI_DEVID_TUF_RGB_MODE 0x00100056 #define ASUS_WMI_DEVID_TUF_RGB_MODE2 0x0010005A -- cgit v1.2.3 From e98a9c61721c14bcd29f11f4802e52e908701f7a Mon Sep 17 00:00:00 2001 From: Tarun Sahu Date: Thu, 11 Jun 2026 09:30:40 +0000 Subject: liveupdate: Document that retrieve failure is permanent Signed-off-by: Tarun Sahu Reviewed-by: Pratyush Yadav (Google) Link: https://patch.msgid.link/faec5df2a3e90240cde5897bae2250cd7d44aeac.1781170056.git.tarunsahu@google.com Signed-off-by: Mike Rapoport (Microsoft) --- include/uapi/linux/liveupdate.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/liveupdate.h b/include/uapi/linux/liveupdate.h index 3a9ff53b02e0..4043d4038712 100644 --- a/include/uapi/linux/liveupdate.h +++ b/include/uapi/linux/liveupdate.h @@ -169,7 +169,9 @@ struct liveupdate_session_preserve_fd { * associated with the token and populates the @fd field with a new file * descriptor referencing the restored resource in the current (new) kernel. * This operation must be performed *before* signaling completion via - * %LIVEUPDATE_IOCTL_FINISH. + * %LIVEUPDATE_IOCTL_FINISH. If a retrieve of a token fails, subsequent + * attempts to retrieve the token fail with the same error code. Failed + * retrieves are not retried. * * Return: 0 on success, negative error code on failure (e.g., invalid token). */ -- cgit v1.2.3 From eb87bf6fcae6a2dc25d7f2c977d2cbca2113fb1e Mon Sep 17 00:00:00 2001 From: Luiz Augusto von Dentz Date: Tue, 26 May 2026 12:43:42 -0400 Subject: Bluetooth: hci_sync: Add support for HCI_LE_Set_Host_Feature [v2] This adds support for using HCI_LE_Set_Host_Feature [v2] instead of v1 if LL Extented Features is supported and the controller supports the command. Signed-off-by: Luiz Augusto von Dentz --- include/net/bluetooth/hci.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index 572b1c620c5d..5462f14ea0c6 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -2486,6 +2486,12 @@ struct hci_rp_le_cs_test { #define HCI_OP_LE_CS_TEST_END 0x2096 +#define HCI_OP_LE_SET_HOST_FEATURE_V2 0x2097 +struct hci_cp_le_set_host_feature_v2 { + __le16 bit_number; + __u8 bit_value; +} __packed; + /* ---- HCI Events ---- */ struct hci_ev_status { __u8 status; -- cgit v1.2.3 From bea06c7c1b83bcd0519b91141999369eae6925bd Mon Sep 17 00:00:00 2001 From: Tim Bird Date: Thu, 4 Jun 2026 11:06:33 -0600 Subject: Bluetooth: Add SPDX id lines to some source files Many bluetooth source files are missing SPDX-License-Identifier lines. Add appropriate IDs to these files, and remove other license lines from the headers. Leave the warranty disclaimer in files where the license ID is GPL-2.0 but the wording of the disclaimer is slightly different from that of the GPL v2 disclaimer. It is not different enough to cause licensing conflicts, but is kept to honor the original contributors' legal intent. Signed-off-by: Tim Bird Signed-off-by: Luiz Augusto von Dentz --- include/net/bluetooth/bluetooth.h | 5 +---- include/net/bluetooth/hci.h | 5 +---- include/net/bluetooth/hci_core.h | 5 +---- include/net/bluetooth/hci_mon.h | 5 +---- include/net/bluetooth/hci_sock.h | 5 +---- include/net/bluetooth/l2cap.h | 5 +---- include/net/bluetooth/mgmt.h | 5 +---- include/net/bluetooth/rfcomm.h | 5 +---- include/net/bluetooth/sco.h | 5 +---- 9 files changed, 9 insertions(+), 36 deletions(-) (limited to 'include') diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h index 3faea66b1979..b624da5026f5 100644 --- a/include/net/bluetooth/bluetooth.h +++ b/include/net/bluetooth/bluetooth.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2000-2001 Qualcomm Incorporated @@ -5,10 +6,6 @@ Written 2000,2001 by Maxim Krasnyansky - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index 5462f14ea0c6..38186a245f14 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2000-2001 Qualcomm Incorporated @@ -5,10 +6,6 @@ Written 2000,2001 by Maxim Krasnyansky - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index aa600fbf9a53..7e15da47fe3a 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* BlueZ - Bluetooth protocol stack for Linux Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. @@ -5,10 +6,6 @@ Written 2000,2001 by Maxim Krasnyansky - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. diff --git a/include/net/bluetooth/hci_mon.h b/include/net/bluetooth/hci_mon.h index bbd752494ef9..4b2a0af4ed58 100644 --- a/include/net/bluetooth/hci_mon.h +++ b/include/net/bluetooth/hci_mon.h @@ -1,12 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2011-2012 Intel Corporation - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. diff --git a/include/net/bluetooth/hci_sock.h b/include/net/bluetooth/hci_sock.h index 13e8cd4414a1..16f150b861be 100644 --- a/include/net/bluetooth/hci_sock.h +++ b/include/net/bluetooth/hci_sock.h @@ -1,13 +1,10 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2000-2001 Qualcomm Incorporated Written 2000,2001 by Maxim Krasnyansky - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h index e0a1f2293679..790935950a0c 100644 --- a/include/net/bluetooth/l2cap.h +++ b/include/net/bluetooth/l2cap.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2000-2001 Qualcomm Incorporated @@ -6,10 +7,6 @@ Written 2000,2001 by Maxim Krasnyansky - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h index 8234915854b6..08daed7a96d5 100644 --- a/include/net/bluetooth/mgmt.h +++ b/include/net/bluetooth/mgmt.h @@ -1,13 +1,10 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2010 Nokia Corporation Copyright (C) 2011-2012 Intel Corporation - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h index c05882476900..feb6b3ae5e69 100644 --- a/include/net/bluetooth/rfcomm.h +++ b/include/net/bluetooth/rfcomm.h @@ -1,12 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* RFCOMM implementation for Linux Bluetooth stack (BlueZ) Copyright (C) 2002 Maxim Krasnyansky Copyright (C) 2002 Marcel Holtmann - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. diff --git a/include/net/bluetooth/sco.h b/include/net/bluetooth/sco.h index f40ddb4264fc..214409527b35 100644 --- a/include/net/bluetooth/sco.h +++ b/include/net/bluetooth/sco.h @@ -1,13 +1,10 @@ +/* SPDX-License-Identifier: GPL-2.0 */ /* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2000-2001 Qualcomm Incorporated Written 2000,2001 by Maxim Krasnyansky - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License version 2 as - published by the Free Software Foundation; - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. -- cgit v1.2.3 From b66774b48dd98f07254951f74ea6f513efe7ff8b Mon Sep 17 00:00:00 2001 From: Marco Elver Date: Fri, 5 Jun 2026 16:23:35 +0200 Subject: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If the connection is torn down while the timer is running or pending, chan->conn can be freed, leading to a use-after-free when the timer worker attempts to lock conn->lock: | BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] | BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline] | BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] | BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318 | Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83 | | CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full) | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 | Workqueue: events l2cap_chan_timeout | Call Trace: | | instrument_atomic_read_write include/linux/instrumented.h:112 [inline] | atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline] | __mutex_trylock_fast kernel/locking/mutex.c:161 [inline] | mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318 | l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422 | process_one_work kernel/workqueue.c:3326 [inline] | process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409 | worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490 | kthread+0x346/0x430 kernel/kthread.c:436 | ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158 | ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 | | | Allocated by task 320: | l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075 | l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452 | hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline] | hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760 | hci_event_func net/bluetooth/hci_event.c:7796 [inline] | hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847 | hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040 | process_one_work kernel/workqueue.c:3326 [inline] | process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409 | worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490 | kthread+0x346/0x430 kernel/kthread.c:436 | ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158 | ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 | | Freed by task 322: | hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline] | hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736 | hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405 | hci_dev_do_close net/bluetooth/hci_core.c:502 [inline] | hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679 | vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690 | __fput+0x369/0x890 fs/file_table.c:510 | task_work_run+0x160/0x1d0 kernel/task_work.c:233 | get_signal+0xf5b/0x1120 kernel/signal.c:2810 | arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337 | __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] | exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98 | do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100 | entry_SYSCALL_64_after_hwframe+0x77/0x7f | | The buggy address belongs to the object at ffff8881298d9400 | which belongs to the cache kmalloc-512 of size 512 | The buggy address is located 336 bytes inside of | freed 512-byte region [ffff8881298d9400, ffff8881298d9600) Fix it by having chan->conn hold a reference to l2cap_conn (via l2cap_conn_get) when the channel is added to the connection, and releasing it in the channel destructor. This ensures the l2cap_conn remains alive as long as the channel exists. A new FLAG_DEL channel flag is introduced to indicate that the channel has been deleted from its connection. l2cap_chan_del() atomically sets this flag using test_and_set_bit() instead of setting chan->conn to NULL. All asynchronous workers (l2cap_chan_timeout, l2cap_ack_timeout, l2cap_monitor_timeout, l2cap_retrans_timeout) and l2cap_chan_send() check FLAG_DEL to determine whether the channel has been torn down, rather than testing chan->conn for NULL. Fixes: 8c8e620467a7 ("Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()") Cc: Cc: Siwei Zhang Cc: Luiz Augusto von Dentz Assisted-by: Gemini:gemini-3.1-pro-preview Reported-by: https://sashiko.dev/#/patchset/20260521021249.3258069-1-oss%40fourdim.xyz Signed-off-by: Marco Elver Signed-off-by: Luiz Augusto von Dentz --- include/net/bluetooth/l2cap.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h index 790935950a0c..1640cc9bf83a 100644 --- a/include/net/bluetooth/l2cap.h +++ b/include/net/bluetooth/l2cap.h @@ -745,6 +745,7 @@ enum { FLAG_ECRED_CONN_REQ_SENT, FLAG_PENDING_SECURITY, FLAG_HOLD_HCI_CONN, + FLAG_DEL, }; /* Lock nesting levels for L2CAP channels. We need these because lockdep -- cgit v1.2.3 From 8c76126b866649d8e8acc09a06f2b03b6ff88900 Mon Sep 17 00:00:00 2001 From: Michael Guralnik Date: Wed, 10 Jun 2026 03:01:43 +0300 Subject: RDMA/core: Fix FRMR handle leak on push failure Failure to push a handle to the pool, caused by ENOMEM on queue page allocation, will trigger missing in_use counter update, skewing pool state indefinitely. Fix that by moving the handling of handle destruction in such case into the FRMR code, ensuring the handle is either pushed to the pool or destroyed inside the same function. Adjust mlx5_ib call site accordingly. Fixes: ce5df0b891ed ("IB/core: Introduce FRMR pools") Link: https://patch.msgid.link/r/20260610000145.820592-8-michaelgur@nvidia.com Signed-off-by: Michael Guralnik Signed-off-by: Jason Gunthorpe --- include/rdma/frmr_pools.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/rdma/frmr_pools.h b/include/rdma/frmr_pools.h index af1b88801fa4..5b57bafa3636 100644 --- a/include/rdma/frmr_pools.h +++ b/include/rdma/frmr_pools.h @@ -34,6 +34,6 @@ int ib_frmr_pools_init(struct ib_device *device, const struct ib_frmr_pool_ops *pool_ops); void ib_frmr_pools_cleanup(struct ib_device *device); int ib_frmr_pool_pop(struct ib_device *device, struct ib_mr *mr); -int ib_frmr_pool_push(struct ib_device *device, struct ib_mr *mr); +void ib_frmr_pool_push(struct ib_device *device, struct ib_mr *mr); #endif /* FRMR_POOLS_H */ -- cgit v1.2.3 From ddbc251be18fb82884ee6e9af634cc9f1171a4d6 Mon Sep 17 00:00:00 2001 From: Michael Guralnik Date: Wed, 10 Jun 2026 03:01:44 +0300 Subject: RDMA/core: Add ib_frmr_pool_drop for unrecoverable handles A driver that has popped a handle from an FRMR pool can hit failures that leave the handle in a state where it can't safely be returned for reuse. The driver destroys the handle itself, but the pool has no way to learn about it, so the in_use counter drifts upward. Add ib_frmr_pool_drop to balance the pool's accounting in this case. Every pop is now balanced by exactly one push or drop. Fixes: 36680ef7bceb ("RDMA/mlx5: Switch from MR cache to FRMR pools") Link: https://patch.msgid.link/r/20260610000145.820592-9-michaelgur@nvidia.com Signed-off-by: Michael Guralnik Signed-off-by: Jason Gunthorpe --- include/rdma/frmr_pools.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/rdma/frmr_pools.h b/include/rdma/frmr_pools.h index 5b57bafa3636..aed4d69d3841 100644 --- a/include/rdma/frmr_pools.h +++ b/include/rdma/frmr_pools.h @@ -35,5 +35,6 @@ int ib_frmr_pools_init(struct ib_device *device, void ib_frmr_pools_cleanup(struct ib_device *device); int ib_frmr_pool_pop(struct ib_device *device, struct ib_mr *mr); void ib_frmr_pool_push(struct ib_device *device, struct ib_mr *mr); +void ib_frmr_pool_drop(struct ib_mr *mr); #endif /* FRMR_POOLS_H */ -- cgit v1.2.3 From 06b693d2eb6651a63ad85bad8673de3b7d4edd6d Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Wed, 10 Jun 2026 06:17:18 +0000 Subject: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). syzbot reported use-after-free in nsim_fib4_prepare_event(). [0] The problem is that the following functions call fib_info_hold() / refcount_inc() while dumping fib_info under RCU, which is unsafe. * mlxsw_sp_router_fib4_event() * rocker_router_fib_event() * nsim_fib4_prepare_event() refcount_inc_not_zero() must be used, but it would be too late there. Let's guarantee the lifetime of fib_info in fib_leaf_notify(). Note that IPv6 does not need the corresponding change since fib6_table_dump() holds fib6_table.tb6_lock. [0]: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420 Modules linked in: CPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25 Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a <67> 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f RSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293 RAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0 RBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000 R13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000 FS: 0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0 Call Trace: __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] fib_info_hold include/net/ip_fib.h:629 [inline] nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline] nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline] nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043 call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25 call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline] fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline] fib_table_notify net/ipv4/fib_trie.c:2194 [inline] fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217 fib_net_dump net/core/fib_notifier.c:70 [inline] register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108 nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596 nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline] nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058 devlink_reload+0x501/0x8d0 net/devlink/dev.c:475 devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0x940 net/core/net_namespace.c:234 cleanup_net+0x56e/0x800 net/core/net_namespace.c:702 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Fixes: 0ae3eb7b4611 ("netdevsim: fib: Perform the route programming in a non-atomic context") Fixes: c3852ef7f2f8 ("ipv4: fib: Replay events when registering FIB notifier") Reported-by: syzbot+cb2aa2390ac024e25f5c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a290011.39669fcc.33b062.00b1.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20260610061744.2030996-2-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/ip_fib.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h index 318593743b6e..541da2dde626 100644 --- a/include/net/ip_fib.h +++ b/include/net/ip_fib.h @@ -629,6 +629,11 @@ static inline void fib_info_hold(struct fib_info *fi) refcount_inc(&fi->fib_clntref); } +static inline bool fib_info_hold_safe(struct fib_info *fi) +{ + return refcount_inc_not_zero(&fi->fib_clntref); +} + static inline void fib_info_put(struct fib_info *fi) { if (refcount_dec_and_test(&fi->fib_clntref)) -- cgit v1.2.3 From 2821e85c058f81c9948a2fb1a634f7b47457d51c Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Wed, 10 Jun 2026 06:17:19 +0000 Subject: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). rocker_router_fib_event() calls fib_rule_get() during RCU dump. If the fib_rule is dying, refcount_inc() will complain about it. Let's call refcount_inc_not_zero() in fib_rules_dump(). Fixes: 5d7bfd141924 ("ipv4: fib_rules: Dump FIB rules when registering FIB notifier") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20260610061744.2030996-3-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/fib_rules.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h index 6e68e359ad18..7dee0ae616e3 100644 --- a/include/net/fib_rules.h +++ b/include/net/fib_rules.h @@ -111,6 +111,11 @@ static inline void fib_rule_get(struct fib_rule *rule) refcount_inc(&rule->refcnt); } +static inline bool fib_rule_get_safe(struct fib_rule *rule) +{ + return refcount_inc_not_zero(&rule->refcnt); +} + static inline void fib_rule_put(struct fib_rule *rule) { if (refcount_dec_and_test(&rule->refcnt)) -- cgit v1.2.3 From 65440a8ce42d89caaee26f70bd0ee09b92ec2c03 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Tue, 9 Jun 2026 22:20:04 +0000 Subject: ipmr: Convert mr_table.cache_resolve_queue_len to u32. mr_table.cache_resolve_queue_len is always updated under spin_lock_bh(&mfc_unres_lock). Let's convert it to u32. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260609222013.1550355-1-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/linux/mroute_base.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/mroute_base.h b/include/linux/mroute_base.h index 5d75cc5b057e..4d55827e9705 100644 --- a/include/linux/mroute_base.h +++ b/include/linux/mroute_base.h @@ -256,7 +256,7 @@ struct mr_table { struct rhltable mfc_hash; struct list_head mfc_cache_list; int maxvif; - atomic_t cache_resolve_queue_len; + u32 cache_resolve_queue_len; bool mroute_do_assert; bool mroute_do_pim; bool mroute_do_wrvifwhole; -- cgit v1.2.3 From 1c3e7e0439773357e25d13d9cd56e5138593e5bd Mon Sep 17 00:00:00 2001 From: "Matthieu Baerts (NGI0)" Date: Fri, 5 Jun 2026 19:21:49 +1000 Subject: tcp: allow mptcp to drop TS for some packets With TCP-timestamps (padded) taking 12 bytes and ADD_ADDR IPv6 + port taking 30 bytes, the 40-byte limit for the TCP options is reached. In this case, it is then not possible to send the address signal. The idea is to let MPTCP dropping the TCP-timestamps option for some specific packets, to be able to send some specific pure ACK carrying >28 bytes of MPTCP options, like with this specific ADD_ADDR. A new parameter is passed from tcp_established_options to the MPTCP side to indicate if the TCP TS option is used, and if it should be dropped. The next commit implements the part on MPTCP side, but split into two patches to help TCP maintainers to identify the modifications on TCP side. This feature will be controlled by a new add_addr_v6_port_drop_ts MPTCP sysctl knob. It is important to keep in mind that dropping the TCP timestamps option for one packet of the connection could eventually disrupt some middleboxes: even if it should be unlikely, they could drop the packet or even block the connection. That's why this new feature will be controlled by a sysctl knob. Note that it would be technically possible to squeeze both options into the header if the ADD_ADDR is first written, and then the TCP timestamps without the NOPs preceding it. But this means more modifications on TCP side, plus some middleboxes could still be disrupted by that. In this implementation, an unused bit is used in mptcp_out_options structure to avoid passing an address to a local variable. Reading and setting it needs CONFIG_MPTCP, so the whole block now has this #if condition: mptcp_established_options() is then no longer used without CONFIG_MPTCP. About alternatives, instead of passing a new boolean (has_ts), another option would be to pass the whole option structure (opts), but 'struct tcp_out_options' is currently defined in tcp_output.c, and it would need to be exported. Plus that means the removal of the TCP TS option would be done on the MPTCP side, and not here on the TCP side. It feels clearer to remove other TCP options from the TCP side, than hiding that from the MPTCP side. Yet an other alternative would be to pass the size already taken by the other TCP options, and have a way to drop them all when needed. But this feels better to target only the timestamps option where dropping it should be safe, even if it is currently the only option that would be set before MPTCP, when MPTCP is used. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260605-net-next-mptcp-add-addr6-port-ts-v2-5-758e7ca73f4d@kernel.org Signed-off-by: Jakub Kicinski --- include/net/mptcp.h | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/net/mptcp.h b/include/net/mptcp.h index 24d1016a4664..71b9fc5a5796 100644 --- a/include/net/mptcp.h +++ b/include/net/mptcp.h @@ -72,7 +72,8 @@ struct mptcp_out_options { u8 reset_reason:4, reset_transient:1, csum_reqd:1, - allow_join_id0:1; + allow_join_id0:1, + drop_ts:1; union { struct { u64 sndr_key; @@ -153,7 +154,7 @@ bool mptcp_syn_options(struct sock *sk, const struct sk_buff *skb, bool mptcp_synack_options(const struct request_sock *req, unsigned int *size, struct mptcp_out_options *opts); int mptcp_established_options(struct sock *sk, struct sk_buff *skb, - unsigned int remaining, + unsigned int remaining, bool has_ts, struct mptcp_out_options *opts); bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb); @@ -269,14 +270,6 @@ static inline bool mptcp_synack_options(const struct request_sock *req, return false; } -static inline int mptcp_established_options(struct sock *sk, - struct sk_buff *skb, - unsigned int remaining, - struct mptcp_out_options *opts) -{ - return -1; -} - static inline bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) { -- cgit v1.2.3 From 13655144ddcad532c4e9338788041654a54e5c2f Mon Sep 17 00:00:00 2001 From: Fidelio Lawson Date: Tue, 9 Jun 2026 18:19:56 +0200 Subject: net: ethtool: add KSZ87xx low-loss cable PHY tunables Introduce vendor-specific PHY tunable identifiers to control the KSZ87xx low-loss cable erratum handling through the ethtool PHY tunable interface. The following tunables are added: - a boolean "short-cable" tunable, applying a documented and conservative preset intended for short or low-loss Ethernet cables; - an integer LPF bandwidth tunable, allowing advanced adjustment of the receiver low-pass filter bandwidth; - an integer DSP EQ initial value tunable, allowing advanced tuning of the PHY equalizer initialization. The actual behavior is implemented by the corresponding PHY and switch drivers. Reviewed-by: Marek Vasut Reviewed-by: Nicolai Buchwitz Signed-off-by: Fidelio Lawson Link: https://patch.msgid.link/20260609-ksz87xx_errata_low_loss_connections-v10-2-9ba4418cf3db@exotec.com Signed-off-by: Jakub Kicinski --- include/uapi/linux/ethtool.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h index 1cdfb8341df2..a2091d4e00f3 100644 --- a/include/uapi/linux/ethtool.h +++ b/include/uapi/linux/ethtool.h @@ -291,6 +291,9 @@ enum phy_tunable_id { ETHTOOL_PHY_DOWNSHIFT, ETHTOOL_PHY_FAST_LINK_DOWN, ETHTOOL_PHY_EDPD, + ETHTOOL_PHY_SHORT_CABLE_PRESET, + ETHTOOL_PHY_LPF_BW, + ETHTOOL_PHY_DSP_EQ_INIT_VALUE, /* * Add your fresh new phy tunable attribute above and remember to update * phy_tunable_strings[] in net/ethtool/common.c -- cgit v1.2.3 From c0a5405ec38b95c7fd503fd2e73b6f3119423cab Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Fri, 12 Jun 2026 10:58:07 +0200 Subject: spi: spi-mem: Fix spi_controller_mem_ops kdoc The secondary_op_tmpl kdoc line has been removed accidentally, add it back. Reported-by: Michael Walle Closes: https://lore.kernel.org/linux-mtd/DJ56CDMRVFQ6.FOZRIQTF3VDW@kernel.org/T/#u Fixes: 38fbe4b3f66e ("spi: spi-mem: Add a no_cs_assertion capability") Signed-off-by: Miquel Raynal Link: https://patch.msgid.link/20260612-perso-fix-no-cs-assertion-kdoc-v1-1-626b2d6d0d9b@bootlin.com Signed-off-by: Mark Brown --- include/linux/spi/spi-mem.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h index 722abd9aee3c..f660bb2e9f85 100644 --- a/include/linux/spi/spi-mem.h +++ b/include/linux/spi/spi-mem.h @@ -385,6 +385,7 @@ struct spi_controller_mem_ops { * @swap16: Supports swapping bytes on a 16 bit boundary when configured in * Octal DTR * @per_op_freq: Supports per operation frequency switching + * @secondary_op_tmpl: Supports leveraging a secondary memory operation template * @no_cs_assertion: The controller may automatically deassert the CS if there * is a pause in the transfer (eg. internal bus contention or * DMA arbitration on an interconnect). Features such as NAND -- cgit v1.2.3 From 298ab7e6f1637cec44163f52e84e2030ec16ed9d Mon Sep 17 00:00:00 2001 From: Alex Mastro Date: Wed, 10 Jun 2026 13:44:41 -0700 Subject: iommufd: Clarify IOAS_MAP_FILE dma-buf support IOMMU_IOAS_MAP_FILE is documented as mapping a memfd, but the implementation first tries to resolve the fd as a dma-buf and has a special path for supported dma-buf exporters. In particular, VFIO PCI dma-bufs exported through VFIO_DEVICE_FEATURE_DMA_BUF can be mapped when they describe a single DMA range. Update the UAPI comment so userspace understands that certain kinds of dma-buf are supported in addition to memfd. Fixes: 44ebaa1744fd ("iommufd: Accept a DMABUF through IOMMU_IOAS_MAP_FILE") Link: https://patch.msgid.link/r/20260610-tmp-v1-1-b8ccbf557391@fb.com Signed-off-by: Alex Mastro Assisted-by: Codex:gpt-5.5-high Signed-off-by: Jason Gunthorpe --- include/uapi/linux/iommufd.h | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/iommufd.h b/include/uapi/linux/iommufd.h index e998dfbd6960..0425d452d41e 100644 --- a/include/uapi/linux/iommufd.h +++ b/include/uapi/linux/iommufd.h @@ -224,13 +224,17 @@ struct iommu_ioas_map { * @size: sizeof(struct iommu_ioas_map_file) * @flags: same as for iommu_ioas_map * @ioas_id: same as for iommu_ioas_map - * @fd: the memfd to map - * @start: byte offset from start of file to map from + * @fd: the memfd or supported dma-buf file to map + * @start: byte offset from start of the file to map from * @length: same as for iommu_ioas_map * @iova: same as for iommu_ioas_map * - * Set an IOVA mapping from a memfd file. All other arguments and semantics - * match those of IOMMU_IOAS_MAP. + * Set an IOVA mapping from a memfd file. On kernels with dma-buf support, + * supported dma-buf files may also be accepted. This is not a generic + * dma-buf import path; currently supported dma-bufs include single-range + * VFIO PCI dma-bufs exported through VFIO_DEVICE_FEATURE_DMA_BUF, and + * other dma-bufs may be rejected. All other arguments and semantics match + * those of IOMMU_IOAS_MAP. */ struct iommu_ioas_map_file { __u32 size; -- cgit v1.2.3 From e28bee5b445178390d63f7a93a5a219063c6434e Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Wed, 3 Jun 2026 14:26:55 -0700 Subject: iommu: Avoid copying the user array twice in the full-array copy helper iommu_copy_struct_from_full_user_array() copies a whole user array into a kernel buffer. In the common case, where user entry_len equals destination entry size, it takes a fast path and copies the whole array with a single copy_from_user(). That fast path does not return, so it falls through into the item-by-item copy_struct_from_user() loop and copies every entry a second time. For an equal entry_len that loop is just a copy_from_user() of the same bytes, so the whole array is copied twice for no benefit. Return right after the bulk copy. The per-item loop then runs only on the slow path, where entry_len differs and each entry needs size adaption. Fixes: 4f2e59ccb698 ("iommu: Add iommu_copy_struct_from_full_user_array helper") Link: https://patch.msgid.link/r/6c9eca4ff584cb977661e97799ac6fe934e7f51c.1780521606.git.nicolinc@nvidia.com Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe --- include/linux/iommu.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/iommu.h b/include/linux/iommu.h index e587d4ac4d33..695714426379 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -547,6 +547,7 @@ iommu_copy_struct_from_full_user_array(void *kdst, size_t kdst_entry_size, user_array->entry_num * user_array->entry_len)) return -EFAULT; + return 0; } /* Copy item by item */ -- cgit v1.2.3 From d4b52f83f198310c871aa71816a26152eb3898c2 Mon Sep 17 00:00:00 2001 From: Robin Murphy Date: Wed, 3 Jun 2026 12:43:12 +0530 Subject: of: Add convenience wrappers for of_map_id() Since we now have quite a few users parsing "iommu-map" and "msi-map" properties, give them some wrappers to conveniently encapsulate the appropriate sets of property names. This will also make it easier to then change of_map_id() to correctly account for specifier cells. Reviewed-by: Rob Herring (Arm) Reviewed-by: Frank Li Acked-by: Marc Zyngier Acked-by: Bjorn Helgaas Signed-off-by: Robin Murphy Signed-off-by: Vijayanand Jitta Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-1-dc509dacb19a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) --- include/linux/of.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'include') diff --git a/include/linux/of.h b/include/linux/of.h index 959786f8f196..721525334b4b 100644 --- a/include/linux/of.h +++ b/include/linux/of.h @@ -468,6 +468,12 @@ int of_map_id(const struct device_node *np, u32 id, const char *map_name, const char *map_mask_name, struct device_node **target, u32 *id_out); +int of_map_iommu_id(const struct device_node *np, u32 id, + struct device_node **target, u32 *id_out); + +int of_map_msi_id(const struct device_node *np, u32 id, + struct device_node **target, u32 *id_out); + phys_addr_t of_dma_get_max_cpu_address(struct device_node *np); struct kimage; @@ -948,6 +954,18 @@ static inline int of_map_id(const struct device_node *np, u32 id, return -EINVAL; } +static inline int of_map_iommu_id(const struct device_node *np, u32 id, + struct device_node **target, u32 *id_out) +{ + return -EINVAL; +} + +static inline int of_map_msi_id(const struct device_node *np, u32 id, + struct device_node **target, u32 *id_out) +{ + return -EINVAL; +} + static inline phys_addr_t of_dma_get_max_cpu_address(struct device_node *np) { return PHYS_ADDR_MAX; -- cgit v1.2.3 From f71f07bee9b56b94f7828cf3082ea19ec590de36 Mon Sep 17 00:00:00 2001 From: Charan Teja Kalla Date: Wed, 3 Jun 2026 12:43:13 +0530 Subject: of: Factor arguments passed to of_map_id() into a struct Change of_map_id() to take a pointer to struct of_phandle_args instead of passing target device node and translated IDs separately. Update all callers accordingly. Add an explicit filter_np parameter to of_map_id() and of_map_msi_id() to separate the filter input from the output. Previously, the target parameter served dual purpose: as an input filter (if non-NULL, only match entries targeting that node) and as an output (receiving the matched node with a reference held). Now filter_np is the explicit input filter and arg->np is the pure output. Previously, of_map_id() would call of_node_put() on the matched node when a filter was provided, making reference ownership inconsistent. Remove this internal of_node_put() call so that of_map_id() now always transfers ownership of the matched node reference to the caller via arg->np. Callers are now consistently responsible for releasing this reference with of_node_put(arg->np) when done. Acked-by: Frank Li Suggested-by: Rob Herring (Arm) Suggested-by: Dmitry Baryshkov Signed-off-by: Charan Teja Kalla Signed-off-by: Vijayanand Jitta Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-2-dc509dacb19a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) --- include/linux/of.h | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/of.h b/include/linux/of.h index 721525334b4b..ea50b45d9ff7 100644 --- a/include/linux/of.h +++ b/include/linux/of.h @@ -466,13 +466,15 @@ bool of_console_check(const struct device_node *dn, char *name, int index); int of_map_id(const struct device_node *np, u32 id, const char *map_name, const char *map_mask_name, - struct device_node **target, u32 *id_out); + struct device_node * const *filter_np, + struct of_phandle_args *arg); int of_map_iommu_id(const struct device_node *np, u32 id, - struct device_node **target, u32 *id_out); + struct of_phandle_args *arg); int of_map_msi_id(const struct device_node *np, u32 id, - struct device_node **target, u32 *id_out); + struct device_node * const *filter_np, + struct of_phandle_args *arg); phys_addr_t of_dma_get_max_cpu_address(struct device_node *np); @@ -949,19 +951,21 @@ static inline void of_property_clear_flag(struct property *p, unsigned long flag static inline int of_map_id(const struct device_node *np, u32 id, const char *map_name, const char *map_mask_name, - struct device_node **target, u32 *id_out) + struct device_node * const *filter_np, + struct of_phandle_args *arg) { return -EINVAL; } static inline int of_map_iommu_id(const struct device_node *np, u32 id, - struct device_node **target, u32 *id_out) + struct of_phandle_args *arg) { return -EINVAL; } static inline int of_map_msi_id(const struct device_node *np, u32 id, - struct device_node **target, u32 *id_out) + struct device_node * const *filter_np, + struct of_phandle_args *arg) { return -EINVAL; } -- cgit v1.2.3 From ccb2fd725d411265df8f7ce12a66c226b16014e6 Mon Sep 17 00:00:00 2001 From: Robin Murphy Date: Wed, 3 Jun 2026 12:43:14 +0530 Subject: of: Respect #{iommu,msi}-cells in maps So far our parsing of {iommu,msi}-map properties has always blindly assumed that the output specifiers will always have exactly 1 cell. This typically does happen to be the case, but is not actually enforced (and the PCI msi-map binding even explicitly states support for 0 or 1 cells) - as a result we've now ended up with dodgy DTs out in the field which depend on this behaviour to map a 1-cell specifier for a 2-cell provider, despite that being bogus per the bindings themselves. Since there is some potential use in being able to map at least single input IDs to multi-cell output specifiers (and properly support 0-cell outputs as well), add support for properly parsing and using the target nodes' #cells values, albeit with the unfortunate complication of still having to work around expectations of the old behaviour too. Since there are multi-cell output specifiers, the callers of of_map_id() may need to get the exact cell output value for further processing. Update of_map_id() to set args_count in the output to reflect the actual number of output specifier cells. Signed-off-by: Robin Murphy Signed-off-by: Charan Teja Kalla Signed-off-by: Vijayanand Jitta Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-3-dc509dacb19a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) --- include/linux/of.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/of.h b/include/linux/of.h index ea50b45d9ff7..374b249766a2 100644 --- a/include/linux/of.h +++ b/include/linux/of.h @@ -465,7 +465,8 @@ const char *of_prop_next_string(const struct property *prop, const char *cur); bool of_console_check(const struct device_node *dn, char *name, int index); int of_map_id(const struct device_node *np, u32 id, - const char *map_name, const char *map_mask_name, + const char *map_name, const char *cells_name, + const char *map_mask_name, struct device_node * const *filter_np, struct of_phandle_args *arg); @@ -950,7 +951,8 @@ static inline void of_property_clear_flag(struct property *p, unsigned long flag } static inline int of_map_id(const struct device_node *np, u32 id, - const char *map_name, const char *map_mask_name, + const char *map_name, const char *cells_name, + const char *map_mask_name, struct device_node * const *filter_np, struct of_phandle_args *arg) { -- cgit v1.2.3 From e8dcf2d142bd720c8334233ad6cfdf00f0e76b7f Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Thu, 11 Jun 2026 16:06:47 +0200 Subject: block: add configurable error injection Add a new block error injection interface that allows to inject specific status code for specific ranges. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Md Haris Iqbal Link: https://patch.msgid.link/20260611140703.2401204-5-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/blkdev.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 57e84d59a642..5070851cf924 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -176,6 +176,7 @@ struct gendisk { #define GD_SUPPRESS_PART_SCAN 5 #define GD_OWNS_QUEUE 6 #define GD_ZONE_APPEND_USED 7 +#define GD_ERROR_INJECT 8 struct mutex open_mutex; /* open/close mutex */ unsigned open_partitions; /* number of open partitions */ @@ -227,6 +228,11 @@ struct gendisk { */ struct blk_independent_access_ranges *ia_ranges; +#ifdef CONFIG_BLK_ERROR_INJECTION + struct mutex error_injection_lock; + struct list_head error_injection_list; +#endif + struct mutex rqos_state_mutex; /* rqos state change mutex */ }; -- cgit v1.2.3 From 04c93ea9ce1421a6778bcda21856599f4821e737 Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Tue, 9 Jun 2026 00:22:50 +0000 Subject: ASoC: remove SND_SOC_POSSIBLE_xBx_xFx Clock provider / consumer selection is based on board, we can't select automatically from software. Let's remove SND_SOC_POSSIBLE_xBx_xFx. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87tsrc36li.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/soc-dai.h | 8 -------- 1 file changed, 8 deletions(-) (limited to 'include') diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h index df010a91b350..c40823ba5456 100644 --- a/include/sound/soc-dai.h +++ b/include/sound/soc-dai.h @@ -140,14 +140,6 @@ struct clk; #define SND_SOC_DAIFMT_BP_FC SND_SOC_DAIFMT_CBP_CFC #define SND_SOC_DAIFMT_BC_FC SND_SOC_DAIFMT_CBC_CFC -/* Describes the possible PCM format */ -#define SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT 48 -#define SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_MASK (0xFFFFULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT) -#define SND_SOC_POSSIBLE_DAIFMT_CBP_CFP (0x1ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT) -#define SND_SOC_POSSIBLE_DAIFMT_CBC_CFP (0x2ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT) -#define SND_SOC_POSSIBLE_DAIFMT_CBP_CFC (0x4ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT) -#define SND_SOC_POSSIBLE_DAIFMT_CBC_CFC (0x8ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_PROVIDER_SHIFT) - #define SND_SOC_DAIFMT_FORMAT_MASK 0x000f #define SND_SOC_DAIFMT_CLOCK_MASK 0x00f0 #define SND_SOC_DAIFMT_INV_MASK 0x0f00 -- cgit v1.2.3 From c6b09cda390496bcc7bbbc4ec7eec26cf43d3f97 Mon Sep 17 00:00:00 2001 From: Kuninori Morimoto Date: Tue, 9 Jun 2026 00:23:35 +0000 Subject: ASoC: update auto format selection method Current DAI supports auto format selection. It allow to have array like below. (X) static u64 xxx_auto_formats[] = { (A) /* First Priority */ SND_SOC_POSSIBLE_DAIFMT_I2S | SND_SOC_POSSIBLE_DAIFMT_LEFT_J, /* Second Priority */ (B) SND_SOC_POSSIBLE_DAIFMT_DSP_A | SND_SOC_POSSIBLE_DAIFMT_DSP_B, }; It try to find available format from I2S/LEFT_J first (A). Then, try to find from I2S/LEFT_J/DSP_A/DSP_B if couldn't find (A)+(B). (OR:ed) In this method, it can't handle if there is format combination. For example, some driver has pattern. Pattern1 I2S/RIFHT_J/LEFT_J (FORMAT) and NB_NF/IB_IF/IB_NF/NB_IF (INV)_ Pattern2 DSP_A/DSP_B (FORMAT) and NB_NF/ IB_NF Because it will try to OR Pattern1 and Pattern2, un-supported pattern might be selected. This patch update method not to use OR, and assumes full format array. Above sample (X) need to be static u64 xxx_auto_formats[] = { /* First Priority */ SND_SOC_POSSIBLE_DAIFMT_I2S | SND_SOC_POSSIBLE_DAIFMT_LEFT_J, /* Second Priority */ SND_SOC_POSSIBLE_DAIFMT_I2S | SND_SOC_POSSIBLE_DAIFMT_LEFT_J | SND_SOC_POSSIBLE_DAIFMT_DSP_A | SND_SOC_POSSIBLE_DAIFMT_DSP_B, }; Note: It doesn't support Multi CPU/Codec for now Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87jys836k8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown --- include/sound/soc-dai.h | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h index c40823ba5456..ba3ae56c6b06 100644 --- a/include/sound/soc-dai.h +++ b/include/sound/soc-dai.h @@ -81,10 +81,10 @@ struct clk; /* * define GATED -> CONT. GATED will be selected if both are selected. * see - * snd_soc_runtime_get_dai_fmt() + * soc_dai_convert_possiblefmt_to_daifmt() */ #define SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT 16 -#define SND_SOC_POSSIBLE_DAIFMT_CLOCK_MASK (0xFFFF << SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT) +#define SND_SOC_POSSIBLE_DAIFMT_CLOCK_MASK (0xFFFFULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT) #define SND_SOC_POSSIBLE_DAIFMT_GATED (0x1ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT) #define SND_SOC_POSSIBLE_DAIFMT_CONT (0x2ULL << SND_SOC_POSSIBLE_DAIFMT_CLOCK_SHIFT) @@ -184,8 +184,7 @@ int snd_soc_dai_set_bclk_ratio(struct snd_soc_dai *dai, unsigned int ratio); void snd_soc_dai_set_bclk_clk(struct snd_soc_dai *dai, struct clk *bclk); /* Digital Audio interface formatting */ -int snd_soc_dai_get_fmt_max_priority(const struct snd_soc_pcm_runtime *rtd); -u64 snd_soc_dai_get_fmt(const struct snd_soc_dai *dai, int priority); +unsigned int snd_soc_dai_auto_select_format(const struct snd_soc_pcm_runtime *rtd); int snd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt); int snd_soc_dai_set_tdm_slot(struct snd_soc_dai *dai, -- cgit v1.2.3 From d8dcb0b74b045e36d627935a959c3cf4c8cb2f7c Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Tue, 19 May 2026 14:01:58 -0700 Subject: cxl/region: Introduce devm_cxl_probe_mem() To date, platform firmware maps accelerator memory and accelerator drivers simply want an address range that they can map themselves. This typically results in a single region being auto-assembled upon registration of a memory device. Use the @attach mechanism of devm_cxl_add_memdev() parameter to retrieve that region while also adhering to CXL subsystem locking and lifetime rules. As part of adhering to current object lifetime rules, if the region or the CXL port topology is invalidated, the CXL core arranges for the accelertor driver to be detached as well. The locking and lifetime rules were validated with Dave's work-in-progress cxl-type-2 support for cxl_test. devm_cxl_add_classdev() supports the general memory expansion flow where region assembly is optional, dynamic, and user controlled. Cc: Alejandro Lucero Signed-off-by: Dan Williams Reviewed-by: Alejandro Lucero Tested-by: Alejandro Lucero Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260519210158.1499795-6-djbw@kernel.org Signed-off-by: Dave Jiang --- include/cxl/cxl.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h index fa7269154620..016c74fb747c 100644 --- a/include/cxl/cxl.h +++ b/include/cxl/cxl.h @@ -223,4 +223,7 @@ struct cxl_dev_state *_devm_cxl_dev_state_create(struct device *dev, (drv_struct *)_devm_cxl_dev_state_create(parent, type, serial, dvsec, \ sizeof(drv_struct), mbox); \ }) + +struct cxl_memdev *devm_cxl_probe_mem(struct cxl_dev_state *cxlds, + struct range *range); #endif /* __CXL_CXL_H__ */ -- cgit v1.2.3 From 990348e5bb457697c2f1f7f7b65154a3334d9d2b Mon Sep 17 00:00:00 2001 From: Sechang Lim Date: Thu, 11 Jun 2026 09:29:18 +0000 Subject: tcp: clear sock_ops cb flags before force-closing a child socket A child socket inherits the listener's bpf_sock_ops_cb_flags via sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() / tcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where inet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs without it. If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state() calls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me(): WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550 RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799 Call Trace: tcp_done+0xba/0x250 net/ipv4/tcp.c:5095 tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787 tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926 tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164 The child is freed before it is ever established, so it should run no sock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(), the common point for the IPv4, IPv6 and chtls forced-close paths and for the MPTCP ->syn_recv_sock() failure path (dispose_child), which reaches tcp_done() on a child that was never established too. Suggested-by: Jiayuan Chen Fixes: d44874910a26 ("bpf: Add BPF_SOCK_OPS_STATE_CB") Signed-off-by: Sechang Lim Reviewed-by: Jiayuan Chen Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260611092923.1895982-1-rhkrqnwk98@gmail.com Signed-off-by: Jakub Kicinski --- include/net/tcp.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include') diff --git a/include/net/tcp.h b/include/net/tcp.h index 98848db62894..607298501e12 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -2942,6 +2942,11 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2, return tcp_call_bpf(sk, op, 3, args); } +static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk) +{ + tcp_sk(sk)->bpf_sock_ops_cb_flags = 0; +} + #else static inline int tcp_call_bpf(struct sock *sk, int op, u32 nargs, u32 *args) { @@ -2959,6 +2964,10 @@ static inline int tcp_call_bpf_3arg(struct sock *sk, int op, u32 arg1, u32 arg2, return -EPERM; } +static inline void tcp_clear_sock_ops_cb_flags(struct sock *sk) +{ +} + #endif static inline u32 tcp_timeout_init(struct sock *sk) -- cgit v1.2.3 From cdae65fc43f28b6508d85fa242264f3bc5c9a5c7 Mon Sep 17 00:00:00 2001 From: Sabrina Dubroca Date: Thu, 11 Jun 2026 12:21:33 +0200 Subject: tls: remove tls_toe and the related driver The tls_toe feature and its single user (chelsio chtls) have been unmaintained for multiple years. It also hooks into the core of the TCP implementation, and bypasses most of the networking stack. Signed-off-by: Sabrina Dubroca Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/1f30e73275c07bf879f547589872d0916025a52e.1781165969.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski --- include/linux/netdev_features.h | 3 +- include/net/tls.h | 1 - include/net/tls_toe.h | 77 ----------------------------------------- include/uapi/linux/tls.h | 2 +- 4 files changed, 2 insertions(+), 81 deletions(-) delete mode 100644 include/net/tls_toe.h (limited to 'include') diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h index 93e4da7046a1..8eb6b8033606 100644 --- a/include/linux/netdev_features.h +++ b/include/linux/netdev_features.h @@ -79,7 +79,7 @@ enum { NETIF_F_HW_TLS_RX_BIT, /* Hardware TLS RX offload */ NETIF_F_GRO_HW_BIT, /* Hardware Generic receive offload */ - NETIF_F_HW_TLS_RECORD_BIT, /* Offload TLS record */ + __UNUSED_NETIF_F_56, NETIF_F_GRO_FRAGLIST_BIT, /* Fraglist GRO */ NETIF_F_HW_MACSEC_BIT, /* Offload MACsec operations */ @@ -153,7 +153,6 @@ enum { #define NETIF_F_HW_ESP __NETIF_F(HW_ESP) #define NETIF_F_HW_ESP_TX_CSUM __NETIF_F(HW_ESP_TX_CSUM) #define NETIF_F_RX_UDP_TUNNEL_PORT __NETIF_F(RX_UDP_TUNNEL_PORT) -#define NETIF_F_HW_TLS_RECORD __NETIF_F(HW_TLS_RECORD) #define NETIF_F_GSO_UDP_L4 __NETIF_F(GSO_UDP_L4) #define NETIF_F_HW_TLS_TX __NETIF_F(HW_TLS_TX) #define NETIF_F_HW_TLS_RX __NETIF_F(HW_TLS_RX) diff --git a/include/net/tls.h b/include/net/tls.h index 3811943288b3..e57bef58851e 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -85,7 +85,6 @@ enum { TLS_BASE, TLS_SW, TLS_HW, - TLS_HW_RECORD, TLS_NUM_CONFIG, }; diff --git a/include/net/tls_toe.h b/include/net/tls_toe.h deleted file mode 100644 index b3aa7593ce2c..000000000000 --- a/include/net/tls_toe.h +++ /dev/null @@ -1,77 +0,0 @@ -/* - * Copyright (c) 2016-2017, Mellanox Technologies. All rights reserved. - * Copyright (c) 2016-2017, Dave Watson . All rights reserved. - * - * This software is available to you under a choice of one of two - * licenses. You may choose to be licensed under the terms of the GNU - * General Public License (GPL) Version 2, available from the file - * COPYING in the main directory of this source tree, or the - * OpenIB.org BSD license below: - * - * Redistribution and use in source and binary forms, with or - * without modification, are permitted provided that the following - * conditions are met: - * - * - Redistributions of source code must retain the above - * copyright notice, this list of conditions and the following - * disclaimer. - * - * - Redistributions in binary form must reproduce the above - * copyright notice, this list of conditions and the following - * disclaimer in the documentation and/or other materials - * provided with the distribution. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF - * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND - * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS - * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN - * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ - -#include -#include - -struct sock; - -#define TLS_TOE_DEVICE_NAME_MAX 32 - -/* - * This structure defines the routines for Inline TLS driver. - * The following routines are optional and filled with a - * null pointer if not defined. - * - * @name: Its the name of registered Inline tls device - * @dev_list: Inline tls device list - * int (*feature)(struct tls_toe_device *device); - * Called to return Inline TLS driver capability - * - * int (*hash)(struct tls_toe_device *device, struct sock *sk); - * This function sets Inline driver for listen and program - * device specific functioanlity as required - * - * void (*unhash)(struct tls_toe_device *device, struct sock *sk); - * This function cleans listen state set by Inline TLS driver - * - * void (*release)(struct kref *kref); - * Release the registered device and allocated resources - * @kref: Number of reference to tls_toe_device - */ -struct tls_toe_device { - char name[TLS_TOE_DEVICE_NAME_MAX]; - struct list_head dev_list; - int (*feature)(struct tls_toe_device *device); - int (*hash)(struct tls_toe_device *device, struct sock *sk); - void (*unhash)(struct tls_toe_device *device, struct sock *sk); - void (*release)(struct kref *kref); - struct kref kref; -}; - -int tls_toe_bypass(struct sock *sk); -int tls_toe_hash(struct sock *sk); -void tls_toe_unhash(struct sock *sk); - -void tls_toe_register_device(struct tls_toe_device *device); -void tls_toe_unregister_device(struct tls_toe_device *device); diff --git a/include/uapi/linux/tls.h b/include/uapi/linux/tls.h index b8b9c42f848c..1245ab38afc1 100644 --- a/include/uapi/linux/tls.h +++ b/include/uapi/linux/tls.h @@ -203,6 +203,6 @@ enum { #define TLS_CONF_BASE 1 #define TLS_CONF_SW 2 #define TLS_CONF_HW 3 -#define TLS_CONF_HW_RECORD 4 +#define TLS_CONF_HW_RECORD 4 /* unused */ #endif /* _UAPI_LINUX_TLS_H */ -- cgit v1.2.3 From 8eed5519e496b7a07f441a0f579cb228a33189f7 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 11 Jun 2026 15:27:37 +0000 Subject: net: watchdog: fix refcount tracking races Blamed commit converted the untracked dev_hold()/dev_put() calls in the watchdog code to use the tracked dev_hold_track()/dev_put_track() (which were later renamed/interfaced to netdev_hold() and netdev_put()). By introducing dev->watchdog_dev_tracker to store the reference tracking information without adding synchronization between netdev_watchdog_up() and dev_watchdog(), it enabled the race condition where this pointer could be overwritten or freed concurrently, leading to the list corruption crash syzbot reported: list_del corruption, ffff888114a18c00->next is NULL kernel BUG at lib/list_debug.c:52 ! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 91 Comm: kworker/u8:5 Not tainted syzkaller #0 PREEMPT(lazy) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Workqueue: events_unbound linkwatch_event RIP: 0010:__list_del_entry_valid_or_report.cold+0x22/0x2a lib/list_debug.c:52 Call Trace: __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:246 [inline] list_move_tail include/linux/list.h:341 [inline] ref_tracker_free+0x1a7/0x6c0 lib/ref_tracker.c:329 netdev_tracker_free include/linux/netdevice.h:4491 [inline] netdev_put include/linux/netdevice.h:4508 [inline] netdev_put include/linux/netdevice.h:4504 [inline] netdev_watchdog_down net/sched/sch_generic.c:600 [inline] dev_deactivate_many+0x28c/0xfe0 net/sched/sch_generic.c:1363 dev_deactivate+0x109/0x1d0 net/sched/sch_generic.c:1397 linkwatch_do_dev net/core/link_watch.c:184 [inline] linkwatch_do_dev+0xd3/0x120 net/core/link_watch.c:166 __linkwatch_run_queue+0x3a5/0x810 net/core/link_watch.c:240 linkwatch_event+0x8f/0xc0 net/core/link_watch.c:314 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314 process_scheduled_works kernel/workqueue.c:3397 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 This patch has three coordinated parts: 1) Add dev->watchdog_lock and dev->watchdog_ref_held to serialize watchdog operations. 2) Remove netdev_watchdog_up() call from netif_carrier_on(): This ensures netdev_watchdog_up() is only called from process/BH context (via linkwatch workqueue dev_activate()), allowing us to use spin_lock_bh() for synchronization. 3) Synchronize watchdog up and watchdog timer: Protect netdev_watchdog_up() with tx_global_lock and watchdog_lock. Only allocate a new tracker in netdev_watchdog_up() if one is not already present. In dev_watchdog(), ensure we don't release the tracker if the timer was rescheduled either by dev_watchdog() itself or concurrently by netdev_watchdog_up(). Fixes: f12bf6f3f942 ("net: watchdog: add net device refcount tracker") Reported-by: syzbot+381d82bbf0253710b35d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a26b751.c25708ab.1b19ef.0013.GAE@google.com/T/#u Tested-by: syzbot+3479efbc2821cb2a79f2@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20260611152737.2580480-1-edumazet@google.com Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 0e1e581efc5a..4a0e83709f29 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1980,6 +1980,8 @@ enum netdev_reg_state { * @qdisc_hash: qdisc hash table * @watchdog_timeo: Represents the timeout that is used by * the watchdog (see dev_watchdog()) + * @watchdog_lock: protect watchdog_ref_held + * @watchdog_ref_held: True if the watchdog device ref is taken. * @watchdog_timer: List of timers * * @proto_down_reason: reason a netdev interface is held down @@ -2392,6 +2394,8 @@ struct net_device { /* These may be needed for future network-power-down code. */ struct timer_list watchdog_timer; int watchdog_timeo; + spinlock_t watchdog_lock; + bool watchdog_ref_held; u32 proto_down_reason; -- cgit v1.2.3 From 06c2dce2d0f69727144443664182052f56d1da35 Mon Sep 17 00:00:00 2001 From: Wei Wang Date: Mon, 8 Jun 2026 16:31:10 -0700 Subject: psp: add new netlink cmd for dev-assoc and dev-disassoc The main purpose of this cmd is to be able to associate a non-psp-capable device (e.g. veth or netkit) with a psp device. One use case is if we create a pair of veth/netkit, and assign 1 end inside a netns, while leaving the other end within the default netns, with a real PSP device, e.g. netdevsim or a physical PSP-capable NIC. With this command, we could associate the veth/netkit inside the netns with PSP device, so the virtual device could act as PSP-capable device to initiate PSP connections, and performs PSP encryption/decryption on the real PSP device. Signed-off-by: Wei Wang Reviewed-by: Daniel Zahka Link: https://patch.msgid.link/20260608233118.2694144-3-weibunny.kernel@gmail.com Signed-off-by: Jakub Kicinski --- include/net/psp/types.h | 23 +++++++++++++++++++++++ include/uapi/linux/psp.h | 13 +++++++++++++ 2 files changed, 36 insertions(+) (limited to 'include') diff --git a/include/net/psp/types.h b/include/net/psp/types.h index 25a9096d4e7d..87991a1ea02d 100644 --- a/include/net/psp/types.h +++ b/include/net/psp/types.h @@ -5,6 +5,7 @@ #include #include +#include struct netlink_ext_ack; @@ -43,9 +44,29 @@ struct psp_dev_config { u32 versions; }; +/* Max number of devices that can be associated with a single PSP device. + * Each entry consumes ~24 bytes in the netlink dev-get response, and the + * response must fit in GENLMSG_DEFAULT_SIZE (~3.7KB). + */ +#define PSP_ASSOC_DEV_MAX 128 + +/** + * struct psp_assoc_dev - wrapper for associated net_device + * @dev_list: list node for psp_dev::assoc_dev_list + * @assoc_dev: the associated net_device + * @dev_tracker: tracker for the net_device reference + */ +struct psp_assoc_dev { + struct list_head dev_list; + struct net_device *assoc_dev; + netdevice_tracker dev_tracker; +}; + /** * struct psp_dev - PSP device struct * @main_netdev: original netdevice of this PSP device + * @assoc_dev_list: list of psp_assoc_dev entries associated with this PSP device + * @assoc_dev_cnt: number of entries in @assoc_dev_list * @ops: driver callbacks * @caps: device capabilities * @drv_priv: driver priv pointer @@ -67,6 +88,8 @@ struct psp_dev_config { */ struct psp_dev { struct net_device *main_netdev; + struct list_head assoc_dev_list; + int assoc_dev_cnt; struct psp_dev_ops *ops; struct psp_dev_caps *caps; diff --git a/include/uapi/linux/psp.h b/include/uapi/linux/psp.h index a3a336488dc3..1c8899cd4da5 100644 --- a/include/uapi/linux/psp.h +++ b/include/uapi/linux/psp.h @@ -17,11 +17,22 @@ enum psp_version { PSP_VERSION_HDR0_AES_GMAC_256, }; +enum { + PSP_A_ASSOC_DEV_INFO_IFINDEX = 1, + PSP_A_ASSOC_DEV_INFO_NSID, + + __PSP_A_ASSOC_DEV_INFO_MAX, + PSP_A_ASSOC_DEV_INFO_MAX = (__PSP_A_ASSOC_DEV_INFO_MAX - 1) +}; + enum { PSP_A_DEV_ID = 1, PSP_A_DEV_IFINDEX, PSP_A_DEV_PSP_VERSIONS_CAP, PSP_A_DEV_PSP_VERSIONS_ENA, + PSP_A_DEV_ASSOC_LIST, + PSP_A_DEV_NSID, + PSP_A_DEV_BY_ASSOCIATION, __PSP_A_DEV_MAX, PSP_A_DEV_MAX = (__PSP_A_DEV_MAX - 1) @@ -74,6 +85,8 @@ enum { PSP_CMD_RX_ASSOC, PSP_CMD_TX_ASSOC, PSP_CMD_GET_STATS, + PSP_CMD_DEV_ASSOC, + PSP_CMD_DEV_DISASSOC, __PSP_CMD_MAX, PSP_CMD_MAX = (__PSP_CMD_MAX - 1) -- cgit v1.2.3 From 4c71303c837449158815c521fcee4ec3b8721dbd Mon Sep 17 00:00:00 2001 From: Xu Kuohai Date: Wed, 10 Jun 2026 20:17:23 +0000 Subject: bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno When a cgroup BPF program exits with 0, bpf_prog_run_array_cg() sets the hook return value to -EPERM if it is not a valid errno. This is correct for errno-based hooks, which return 0 on success and negative errno on failure, but wrong for boolean and void LSM hooks. Boolean LSM hooks should only return true or false, and void LSM hooks have no return value at all. Fix it by skipping setting -EPERM for hooks not returning errno. Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor") Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260610201724.733943-2-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_lsm.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h index 643809cc78c3..143775a27a2a 100644 --- a/include/linux/bpf_lsm.h +++ b/include/linux/bpf_lsm.h @@ -52,6 +52,7 @@ int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str, const struct bpf_dynptr *value_p, int flags); int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str); bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog); +bool bpf_lsm_hook_returns_errno(u32 btf_id); #else /* !CONFIG_BPF_LSM */ @@ -104,6 +105,11 @@ static inline bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog) { return false; } + +static inline bool bpf_lsm_hook_returns_errno(u32 btf_id) +{ + return true; +} #endif /* CONFIG_BPF_LSM */ #endif /* _LINUX_BPF_LSM_H */ -- cgit v1.2.3 From b48bd16eb9fc57a463a337ca148516cdf3212d61 Mon Sep 17 00:00:00 2001 From: Gabriele Monaco Date: Wed, 10 Jun 2026 11:04:29 +0200 Subject: rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule raw_res_spin_unlock_irqrestore() calls raw_res_spin_unlock() and then restores interrupts, this means preemption is enabled when interrupts are still disabled (as part of raw_res_spin_unlock()) so this cannot trigger an actual preemption. This is inconsistent with other spinlock implementations (raw_spin_unlock_irqrestore() and bpf_res_spin_unlock_irqrestore() itself). Adjust the macro to ensure interrupts are enabled before enabling preemption, allowing to schedule at that point. Make the same modification in the error path of raw_res_spin_lock_irqsave(). Fixes: 101acd2e78b1 ("rqspinlock: Add macros for rqspinlock usage") Cc: stable@vger.kernel.org Acked-by: Arnd Bergmann # asm-generic Acked-by: Waiman Long Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Gabriele Monaco Link: https://lore.kernel.org/r/20260610090431.32427-1-gmonaco@redhat.com Signed-off-by: Alexei Starovoitov --- include/asm-generic/rqspinlock.h | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/asm-generic/rqspinlock.h b/include/asm-generic/rqspinlock.h index 151d267a496b..4d46643f46cb 100644 --- a/include/asm-generic/rqspinlock.h +++ b/include/asm-generic/rqspinlock.h @@ -243,12 +243,20 @@ static __always_inline void res_spin_unlock(rqspinlock_t *lock) ({ \ int __ret; \ local_irq_save(flags); \ - __ret = raw_res_spin_lock(lock); \ - if (__ret) \ + preempt_disable(); \ + __ret = res_spin_lock(lock); \ + if (__ret) { \ local_irq_restore(flags); \ + preempt_enable(); \ + } \ __ret; \ }) -#define raw_res_spin_unlock_irqrestore(lock, flags) ({ raw_res_spin_unlock(lock); local_irq_restore(flags); }) +#define raw_res_spin_unlock_irqrestore(lock, flags) \ + ({ \ + res_spin_unlock(lock); \ + local_irq_restore(flags); \ + preempt_enable(); \ + }) #endif /* __ASM_GENERIC_RQSPINLOCK_H */ -- cgit v1.2.3 From 50cb44bd0d5f243919a06b17b1d979fdcd72cb2b Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Wed, 10 Jun 2026 15:19:15 -0600 Subject: io_uring/mpscq: add lockless multi-producer, single-consumer FIFO queue Local task_work is currently using llists for managing the work, but that's a LIFO type of list. This means that running this task_work needs to reverse the list first, to ensure fairness in running the queued items. Add a lockless FIFO queued, based on Dmitry Vyukov's intrusive MPSC node-based queue algorithm, modified with an externally held consumer cursor and conditional stub reinsertion. See comments in the header. Producers are wait-free: a push is a single xchg() on the queue tail, which serializes concurrent producers and defines the FIFO order, plus a store linking the node to its predecessor. There are no cmpxchg retry loops, and pushing is safe from any context, including hardirq. The cost of linked list FIFO ordering is that a push publishes the node in two steps - the xchg() makes it visible as the new tail before the subsequent store links it into the chain that is reachable from the head. A consumer hitting that window gets a NULL from mpscq_pop() while mpscq_empty() reports false, and must retry later rather than treat the queue as empty. The window is two instructions wide, but a producer can get preempted inside it, so the consumer must not busy wait on it. The consumer side supports a single consumer at a time, with callers providing their own serialization. A stub node, which also defines the empty state (tail == stub), allows the consumer to detach the final node without racing against producer link stores: that node is only handed out once the stub has been cmpxchg'ed back in as the tail. This also guarantees that the previous tail returned by mpscq_push() cannot get freed before that push has linked it, making it always valid for comparisons. The consumer cursor is deliberately not part of the queue struct - the caller owns it and passes it to mpscq_pop(). This is done to separate the consumer and producers cacheline. The cursor is written for every popped entry, and keeping it on the same cacheline as ->tail would have the consumer invalidating the line that producers need for every push. Keeping it external lets the caller place it with its own consumer side data instead. Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index aa4d5477f859..85e12b4884a5 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -55,6 +55,18 @@ struct io_wq_work_list { struct io_wq_work_node *last; }; +/* + * Lockless multi-producer, single-consumer FIFO queue, see + * io_uring/mpscq.h for the implementation and rules. Defined here so + * that it can be embedded in io_ring_ctx. This is the producer side + * only - the consumer cursor is kept separately, on a cacheline that + * isn't dirtied by the producers. + */ +struct mpscq { + struct llist_node *tail; /* producers */ + struct llist_node stub; +}; + struct io_wq_work { struct io_wq_work_node list; atomic_t flags; -- cgit v1.2.3 From d46ab2c98ababa19b41a5709b6921d7b1add7f74 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Wed, 10 Jun 2026 15:19:35 -0600 Subject: io_uring: switch local task_work to a mpscq The local (DEFER_TASKRUN) task_work list is an llist, which is LIFO ordered, and hence __io_run_local_work() has to restore the right running order with an O(n) llist_reverse_order() pass first. On top of that, a batch that gets capped by max_events needs the leftover entries parked on a separate ->retry_llist, as they can't be pushed back to the shared list. Switch it to the FIFO mpscq. Adds are wait-free instead of a cmpxchg retry loop, entries are popped in queue order with no reversal pass, capping a run simply leaves the remainder on the queue, and ->retry_llist goes away entirely. The consumer cursor, ->work_head, lives with the rest of the ->uring_lock protected state rather than next to the queue, so that popping entries doesn't dirty the producer side cacheline. For low amounts of task_work, this ends up being a bit more efficient than the existing scheme. As an example of that, doing multishot receives for 8 clients has the following task_work overhead: 1.02% sock-test [kernel.kallsyms] [k] io_req_local_work_add 0.88% sock-test [kernel.kallsyms] [k] __io_run_local_work_loop 0.60% sock-test [kernel.kallsyms] [k] llist_reverse_order 0.14% sock-test [kernel.kallsyms] [k] __io_run_local_work 2.64% at ~46Gb/sec and after this change: 1.08% sock-test [kernel.kallsyms] [k] io_req_local_work_add 1.03% sock-test [kernel.kallsyms] [k] __io_run_local_work 2.11% at ~53Gb/sec which has less overhead even though that test run was faster. For a case of having 1024 clients on a single ring: 2.22% sock-test [kernel.kallsyms] [k] llist_reverse_order 0.84% sock-test [kernel.kallsyms] [k] __io_run_local_work_loop 0.42% sock-test [kernel.kallsyms] [k] io_req_local_work_add 0.02% sock-test [kernel.kallsyms] [k] __io_run_local_work 3.50% at ~24Gb/sec we start to see the llist reversing taking a considerable amount of time, and the total add+run task_work overhead is around 3.5%. After the change: 0.90% sock-test [kernel.kallsyms] [k] __io_run_local_work 0.42% sock-test [kernel.kallsyms] [k] io_req_local_work_add 1.32% at ~26Gb/sec most of that overhead is gone, and performance is better as well. Caleb Sander Mateos reports that it improves the performance of a ublk 4kb workload by 4% [1], while testing v1 of this patchset. [1] https://lore.kernel.org/io-uring/CADUfDZr-MMYBaP-e+y9+xuRhuiunO2sBTUCmwZyd7AgT8sVtiQ@mail.gmail.com/ Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index 85e12b4884a5..3e07c7059d7b 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -360,6 +360,14 @@ struct io_ring_ctx { bool poll_multi_queue; struct list_head iopoll_list; + /* + * Consumer cursor for ->work_list, protected by ->uring_lock. + * Deliberately kept away from the producer side of the queue, + * as it's written for every popped entry, and the producer + * cacheline is contended enough as it is. + */ + struct llist_node *work_head; + struct io_file_table file_table; struct io_rsrc_data buf_table; struct io_alloc_cache node_cache; @@ -417,8 +425,7 @@ struct io_ring_ctx { */ struct { struct io_rings __rcu *rings_rcu; - struct llist_head work_llist; - struct llist_head retry_llist; + struct mpscq work_list; unsigned long check_cq; atomic_t cq_wait_nr; atomic_t cq_timeouts; @@ -742,8 +749,6 @@ struct io_kiocb { */ u16 buf_index; - unsigned nr_tw; - /* REQ_F_* flags */ io_req_flags_t flags; -- cgit v1.2.3 From de7341ffe49ed30a1d75b254ac8c731b057247bf Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Thu, 11 Jun 2026 10:13:22 -0600 Subject: io_uring: switch normal task_work to a mpscq Like the local task_work list, the normal (tctx) task_work list is an llist, and hence needs the O(n) llist_reverse_order() pass before running entries in queue order. On top of that, capped runs - sqpoll processing IORING_TW_CAP_ENTRIES_VALUE entries at a time - need the claimed-but-unprocessed leftovers carried in a separate retry_list, as they can't be pushed back to the shared list. Switch tctx->task_list to a mpscq, like what was done for the DEFER_TASKRUN paths as well. Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index 3e07c7059d7b..f511e96865b6 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -131,6 +131,11 @@ struct io_uring_task { const struct io_ring_ctx *last; struct task_struct *task; struct io_wq *io_wq; + /* + * Consumer cursor for ->task_list. Only popped by the task itself, + * or by ->fallback_work once the task can no longer run task_work. + */ + struct llist_node *task_head; struct file *registered_rings[IO_RINGFD_REG_MAX]; struct xarray xa; @@ -139,8 +144,13 @@ struct io_uring_task { atomic_t inflight_tracked; struct percpu_counter inflight; + /* drains ->task_list once the task can no longer run task_work */ + struct work_struct fallback_work; + struct { /* task_work */ - struct llist_head task_list; + struct mpscq task_list; + /* BIT(0) guards adding tw only once */ + unsigned long tw_pending; struct callback_head task_work; } ____cacheline_aligned_in_smp; }; -- cgit v1.2.3 From 576cce91480a949f5b83578300f37023b933e0a2 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Thu, 11 Jun 2026 11:44:47 -0600 Subject: io_uring: remove the per-ctx fallback task_work machinery With the tctx fallback running its entries directly, the per-ctx fallback work has a single user left: moving local (DEFER_TASKRUN) task_work entries out of a ring that is going away. Both of its call sites are process context and don't hold ->uring_lock, the same conditions the deferred fallback work itself ran under - so run the entries in cancel mode right there instead, and rename the helper to io_cancel_local_task_work() to match what it now does. With that, ->fallback_llist, ->fallback_work, io_fallback_req_func() and __io_fallback_tw() can all go away, along with the fallback work flushing in the ring exit and cancel paths. Requests that get orphaned by an exiting task now run via the tctx fallback work, which the ring exit side implicitly waits on through the ctx refs those requests hold. Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index f511e96865b6..6415a3353ee0 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -498,8 +498,6 @@ struct io_ring_ctx { struct mutex tctx_lock; /* ctx exit and cancelation */ - struct llist_head fallback_llist; - struct delayed_work fallback_work; struct work_struct exit_work; struct completion ref_comp; -- cgit v1.2.3 From 77eee189397df7ef8a19cf279db6845ab839662e Mon Sep 17 00:00:00 2001 From: Raf Dickson Date: Fri, 12 Jun 2026 04:52:13 +0000 Subject: vsock: introduce vsock_pending_to_accept() helper Add vsock_pending_to_accept() to move a socket directly from the pending list to the accept queue in a single operation, avoiding the sock_put/sock_hold dance and the sk_acceptq_removed()/ sk_acceptq_added() pair that would otherwise be needed when calling vsock_remove_pending() followed by vsock_enqueue_accept(). Use it in vmci_transport_recv_connecting_server() where a completed handshake transitions the socket from pending to accept queue. Suggested-by: Stefano Garzarella Signed-off-by: Raf Dickson Reviewed-by: Stefano Garzarella Reviewed-by: Luigi Leonardi Reviewed-by: Bobby Eshleman Link: https://patch.msgid.link/20260612045216.105796-2-rafdog35@gmail.com Signed-off-by: Jakub Kicinski --- include/net/af_vsock.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 4e40063adab4..30046a3c20f7 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -220,6 +220,7 @@ static inline bool __vsock_in_connected_table(struct vsock_sock *vsk) void vsock_add_pending(struct sock *listener, struct sock *pending); void vsock_remove_pending(struct sock *listener, struct sock *pending); void vsock_enqueue_accept(struct sock *listener, struct sock *connected); +void vsock_pending_to_accept(struct sock *listener, struct sock *pending); void vsock_insert_connected(struct vsock_sock *vsk); void vsock_remove_bound(struct vsock_sock *vsk); void vsock_remove_connected(struct vsock_sock *vsk); -- cgit v1.2.3 From 9375487c0c78817b3651e2621d648c6198757c41 Mon Sep 17 00:00:00 2001 From: Grzegorz Nitka Date: Sun, 7 Jun 2026 20:30:33 +0200 Subject: dpll: add generic DPLL type Add DPLL_TYPE_GENERIC to represent DPLL devices which do not fit the existing PPS or EEC classes. The UAPI type is intentionally generic. During netdev discussion, maintainers pointed out that introducing identifiers tied to a specific placement or single design does not scale across ASICs and vendors. The role of a DPLL is already inferable from the spawning driver, bus device, and pin topology, without encoding additional purpose-specific taxonomy in the type name. Using a generic type keeps the UAPI extensible and avoids premature naming that may become incorrect as new hardware topologies are exposed through the DPLL subsystem. Expose the new type through UAPI and netlink specification as "generic". Reviewed-by: Aleksandr Loktionov Reviewed-by: Jiri Pirko Signed-off-by: Grzegorz Nitka Link: https://patch.msgid.link/20260607183045.1213735-2-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski --- include/uapi/linux/dpll.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/dpll.h b/include/uapi/linux/dpll.h index cb363cccf2e2..55eaa82f5f98 100644 --- a/include/uapi/linux/dpll.h +++ b/include/uapi/linux/dpll.h @@ -109,10 +109,12 @@ enum dpll_clock_quality_level { * enum dpll_type - type of dpll, valid values for DPLL_A_TYPE attribute * @DPLL_TYPE_PPS: dpll produces Pulse-Per-Second signal * @DPLL_TYPE_EEC: dpll drives the Ethernet Equipment Clock + * @DPLL_TYPE_GENERIC: generic dpll type for devices outside PPS/EEC classes */ enum dpll_type { DPLL_TYPE_PPS = 1, DPLL_TYPE_EEC, + DPLL_TYPE_GENERIC, /* private: */ __DPLL_TYPE_MAX, -- cgit v1.2.3 From 0bf47f722fa9e4ecdab7497afc1af64330540bed Mon Sep 17 00:00:00 2001 From: Grzegorz Nitka Date: Sun, 7 Jun 2026 20:30:40 +0200 Subject: dpll: extend pin notifier with notification source ID Extend the DPLL pin notification API to include a source identifier indicating where the notification originates. This allows notifier consumers to distinguish between notifications coming from an associated DPLL instance, a parent pin, or the pin itself. A new field, src_clock_id, is added to struct dpll_pin_notifier_info and is passed through all pin-related notification paths. Callers of dpll_pin_notify() are updated to provide a meaningful source identifier based on their context: - pin registration/unregistration uses the DPLL's clock_id, - pin-on-pin operations use the parent pin's clock_id, - pin changes use the pin's own clock_id. As introduced in the commit ("dpll: allow registering FW-identified pin with a different DPLL"), it is possible to share the same physical pin via firmware description (fwnode) with DPLL objects from different kernel modules. This means that a given pin can be registered multiple times. Driver such as ICE (E825 devices) rely on this mechanism when listening for the event where a shared-fwnode pin appears, while avoiding reacting to events triggered by their own registration logic. This change only extends the notification metadata and does not alter existing semantics for drivers that do not use the new field. Reviewed-by: Arkadiusz Kubalewski Reviewed-by: Aleksandr Loktionov Reviewed-by: Jiri Pirko Signed-off-by: Grzegorz Nitka Link: https://patch.msgid.link/20260607183045.1213735-9-grzegorz.nitka@intel.com Signed-off-by: Jakub Kicinski --- include/linux/dpll.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/dpll.h b/include/linux/dpll.h index 03a538167691..7a6f8796cda2 100644 --- a/include/linux/dpll.h +++ b/include/linux/dpll.h @@ -233,6 +233,7 @@ struct dpll_pin_notifier_info { u64 clock_id; const struct fwnode_handle *fwnode; const struct dpll_pin_properties *prop; + u64 src_clock_id; }; #if IS_ENABLED(CONFIG_DPLL) -- cgit v1.2.3 From 9a8ed15ce22472fe0363e33738b4317d06b13c3a Mon Sep 17 00:00:00 2001 From: Matthieu Buffet Date: Thu, 11 Jun 2026 18:21:01 +0200 Subject: landlock: Add UDP bind() access control MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add support for a first fine-grained UDP access right. LANDLOCK_ACCESS_NET_BIND_UDP controls the ability to set the local port of a UDP socket (via bind()). It will be useful for servers (to start receiving datagrams), and for some clients that need to use a specific source port (e.g. mDNS requires to use port 5353) For obvious performance concerns, access control is only enforced when configuring sockets, not when using them for common send/recv operations. Bump ABI to allow userspace to detect and use this new right. Signed-off-by: Matthieu Buffet Link: https://patch.msgid.link/20260611162107.49278-2-matthieu@buffet.re [mic: Fix comment formatting] Signed-off-by: Mickaël Salaün --- include/uapi/linux/landlock.h | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h index 10a346e55e95..f2927681e92d 100644 --- a/include/uapi/linux/landlock.h +++ b/include/uapi/linux/landlock.h @@ -200,10 +200,10 @@ struct landlock_net_port_attr { * (also used for IPv6), and within that range, on a per-socket basis * with ``setsockopt(IP_LOCAL_PORT_RANGE)``. * - * A Landlock rule with port 0 and the %LANDLOCK_ACCESS_NET_BIND_TCP - * right means that requesting to bind on port 0 is allowed and it will - * automatically translate to binding on a kernel-assigned ephemeral - * port. + * A Landlock rule with port 0 and the %LANDLOCK_ACCESS_NET_BIND_TCP or + * %LANDLOCK_ACCESS_NET_BIND_UDP right means that requesting to bind on + * port 0 is allowed and it will automatically translate to binding on a + * kernel-assigned ephemeral port. */ __u64 port; }; @@ -373,10 +373,16 @@ struct landlock_net_port_attr { * port. Support added in Landlock ABI version 4. * - %LANDLOCK_ACCESS_NET_CONNECT_TCP: Connect TCP sockets to the given * remote port. Support added in Landlock ABI version 4. + * + * And similarly for UDP port numbers: + * + * - %LANDLOCK_ACCESS_NET_BIND_UDP: Bind UDP sockets to the given local + * port. Support added in Landlock ABI version 10. */ /* clang-format off */ #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) +#define LANDLOCK_ACCESS_NET_BIND_UDP (1ULL << 2) /* clang-format on */ /** -- cgit v1.2.3 From e61247a2e694d17236149135b2d22f0f7d19578c Mon Sep 17 00:00:00 2001 From: Matthieu Buffet Date: Thu, 11 Jun 2026 18:21:02 +0200 Subject: landlock: Add UDP send+connect access control MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add support for a second fine-grained UDP access right. LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP controls the ability to set the remote port of a socket (via connect()) and to specify an explicit destination when sending a datagram, to override any remote peer set on a UDP socket (e.g. in sendto() or sendmsg()). It will be useful for applications that send datagrams, and for some servers too (those creating per-client sockets, which want to receive traffic only from a specific address). Similarly as for bind(), this access control is performed when configuring sockets, not in hot code paths. Add detection of when autobind is about to be required, and deny the operation if the process would not be allowed to call bind(0) explicitly. Autobind can only be performed in udp_lib_get_port() from code paths already controlled by LSM hooks: when connect()ing, sending a first datagram, and in some splice() EOF edge case which, afaiu, can only happen after a remote peer has been set. This invariant needs to be preserved to keep bind policies actually enforced. Signed-off-by: Matthieu Buffet Link: https://patch.msgid.link/20260611162107.49278-3-matthieu@buffet.re [mic: Add quick return for non-sandboxed tasks, fix sa_family dereferencing, fix comment formatting] Signed-off-by: Mickaël Salaün --- include/uapi/linux/landlock.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h index f2927681e92d..811ec77f9105 100644 --- a/include/uapi/linux/landlock.h +++ b/include/uapi/linux/landlock.h @@ -378,11 +378,34 @@ struct landlock_net_port_attr { * * - %LANDLOCK_ACCESS_NET_BIND_UDP: Bind UDP sockets to the given local * port. Support added in Landlock ABI version 10. + * - %LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP: Set the remote port of UDP + * sockets to the given port, or send datagrams to the given remote port + * ignoring any destination pre-set on a socket. Support added in + * Landlock ABI version 10. + * + * .. note:: Setting a remote address or sending a first datagram + * auto-binds UDP sockets to an ephemeral local source port if not + * already bound. To allow this if both %LANDLOCK_ACCESS_NET_BIND_UDP + * and %LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP are handled, you need to + * either: + * + * - use a socket already bound to a port before the ruleset started + * being enforced; + * - or grant %LANDLOCK_ACCESS_NET_BIND_UDP on port 0, meaning "any + * port in the ephemeral port range"; + * - or grant %LANDLOCK_ACCESS_NET_BIND_UDP on a specific port, and + * call :manpage:`bind(2)` on that port before trying to + * :manpage:`connect(2)` or send datagrams. + * + * .. note:: Sending datagrams to an ``AF_UNSPEC`` destination address + * family is not supported for IPv6 UDP sockets: you will need to use a + * ``NULL`` address instead. */ /* clang-format off */ #define LANDLOCK_ACCESS_NET_BIND_TCP (1ULL << 0) #define LANDLOCK_ACCESS_NET_CONNECT_TCP (1ULL << 1) #define LANDLOCK_ACCESS_NET_BIND_UDP (1ULL << 2) +#define LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP (1ULL << 3) /* clang-format on */ /** -- cgit v1.2.3 From eb7b4d458e0d6833ffbb717edf4282f5ca6a7b57 Mon Sep 17 00:00:00 2001 From: Saeed Mahameed Date: Tue, 9 Jun 2026 09:34:48 +0530 Subject: devlink: Implement devlink param multi attribute nested data values Devlink param value attribute is not defined since devlink is handling the value validating and parsing internally, this allows us to implement multi attribute values without breaking any policies. Devlink param multi-attribute values are considered to be dynamically sized arrays of u64 values, by introducing a new devlink param type DEVLINK_PARAM_TYPE_U64_ARRAY, driver and user space can set a variable count of u64 values into the DEVLINK_ATTR_PARAM_VALUE_DATA attribute. Implement get/set parsing and add to the internal value structure passed to drivers. This is useful for devices that need to configure a list of values for a specific configuration. example: $ devlink dev param show pci/... name multi-value-param name multi-value-param type driver-specific values: cmode permanent value: 0,1,2,3,4,5,6,7 $ devlink dev param set pci/... name multi-value-param \ value 4,5,6,7,0,1,2,3 cmode permanent Signed-off-by: Saeed Mahameed Signed-off-by: Ratheesh Kannoth Link: https://patch.msgid.link/20260609040453.711932-5-rkannoth@marvell.com Signed-off-by: Jakub Kicinski --- include/net/devlink.h | 8 ++++++++ include/uapi/linux/devlink.h | 1 + 2 files changed, 9 insertions(+) (limited to 'include') diff --git a/include/net/devlink.h b/include/net/devlink.h index 5f4083dc4345..dd546dbd57cf 100644 --- a/include/net/devlink.h +++ b/include/net/devlink.h @@ -433,6 +433,13 @@ enum devlink_param_type { DEVLINK_PARAM_TYPE_U64 = DEVLINK_VAR_ATTR_TYPE_U64, DEVLINK_PARAM_TYPE_STRING = DEVLINK_VAR_ATTR_TYPE_STRING, DEVLINK_PARAM_TYPE_BOOL = DEVLINK_VAR_ATTR_TYPE_FLAG, + DEVLINK_PARAM_TYPE_U64_ARRAY = DEVLINK_VAR_ATTR_TYPE_U64_ARRAY, +}; + +#define __DEVLINK_PARAM_MAX_ARRAY_SIZE 32 +struct devlink_param_u64_array { + u64 size; + u64 val[__DEVLINK_PARAM_MAX_ARRAY_SIZE]; }; union devlink_param_value { @@ -442,6 +449,7 @@ union devlink_param_value { u64 vu64; char vstr[__DEVLINK_PARAM_MAX_STRING_VALUE]; bool vbool; + struct devlink_param_u64_array u64arr; }; struct devlink_param_gset_ctx { diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h index 0b165eac7619..ca713bcc47b9 100644 --- a/include/uapi/linux/devlink.h +++ b/include/uapi/linux/devlink.h @@ -406,6 +406,7 @@ enum devlink_var_attr_type { DEVLINK_VAR_ATTR_TYPE_BINARY, __DEVLINK_VAR_ATTR_TYPE_CUSTOM_BASE = 0x80, /* Any possible custom types, unrelated to NLA_* values go below */ + DEVLINK_VAR_ATTR_TYPE_U64_ARRAY, }; enum devlink_attr { -- cgit v1.2.3 From e3cd138e560764299965fba5ec5240281a7faca2 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 8 Jun 2026 18:14:36 +0200 Subject: netfilter: conntrack: check NULL when retrieving ct extension nf_ct_ext_find() might return NULL if ct extension is not found. Add also the null checks to: - nfct_help() - nfct_help_data() - nfct_seqadj() - nfct_nat() This is defensive, for safety reasons. nf_ct_ext_find() used to return NULL if the extension is stale for unconfirmed conntracks if the genid validation fails. Skip NULL check in nf_nat_inet_fn() given this is valid to be NULL for non-initialized ct nat extensions. While at it, fetch ct helper area in nf_ct_expect_related_report() only once and pass it on to other ancilliary functions. Replace WARN_ON() by WARN_ON_ONCE() in nf_ct_unlink_expect_report(). Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_helper.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index ed93a5a1adc8..93207de4f2c8 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -136,6 +136,8 @@ static inline void *nfct_help_data(const struct nf_conn *ct) struct nf_conn_help *help; help = nf_ct_ext_find(ct, NF_CT_EXT_HELPER); + if (!help) + return NULL; return (void *)help->data; } -- cgit v1.2.3 From 2354e975932dabb06fad239f07a3b68fd1809737 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 10 Jun 2026 00:03:19 +0200 Subject: netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them Update nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers. This patch also disables BH when transmitting the skb to address a possible migration to different CPU leading to imbalanced decrementation of the recursion counters. This is modeled after Florian Westphal's dev_xmit_recursion*() API available since commit 97cdcf37b57e ("net: place xmit recursion in softnet data") according to its current state in the tree. Fixes: 1d47b55b36d2 ("netfilter: nft_fwd_netdev: use recursion counter in neigh egress path") Fixes: f37ad9127039 ("netfilter: nf_dup_netdev: Move the recursion counter struct netdev_xmit") Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_dup_netdev.h | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h index 609bcf422a9b..f6b05bd80c3f 100644 --- a/include/net/netfilter/nf_dup_netdev.h +++ b/include/net/netfilter/nf_dup_netdev.h @@ -11,15 +11,39 @@ void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif); #define NF_RECURSION_LIMIT 2 -static inline u8 *nf_get_nf_dup_skb_recursion(void) -{ #ifndef CONFIG_PREEMPT_RT - return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion); +static inline bool nf_dev_xmit_recursion(void) +{ + return unlikely(__this_cpu_read(softnet_data.xmit.nf_dup_skb_recursion) > + NF_RECURSION_LIMIT); +} + +static inline void nf_dev_xmit_recursion_inc(void) +{ + __this_cpu_inc(softnet_data.xmit.nf_dup_skb_recursion); +} + +static inline void nf_dev_xmit_recursion_dec(void) +{ + __this_cpu_dec(softnet_data.xmit.nf_dup_skb_recursion); +} #else - return ¤t->net_xmit.nf_dup_skb_recursion; -#endif +static inline bool nf_dev_xmit_recursion(void) +{ + return unlikely(current->net_xmit.nf_dup_skb_recursion > NF_RECURSION_LIMIT); +} + +static inline void nf_dev_xmit_recursion_inc(void) +{ + current->net_xmit.nf_dup_skb_recursion++; } +static inline void nf_dev_xmit_recursion_dec(void) +{ + current->net_xmit.nf_dup_skb_recursion--; +} +#endif + struct nft_offload_ctx; struct nft_flow_rule; -- cgit v1.2.3 From 29752205db5ff1793437b352c9e343b8e41fb184 Mon Sep 17 00:00:00 2001 From: Tingmao Wang Date: Fri, 12 Jun 2026 02:48:48 +0100 Subject: landlock: Add API support and docs for the quiet flags MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds the UAPI for the quiet flags feature (but not the implementation yet). Even though currently LANDLOCK_ADD_RULE_QUIET only affects audit logging, in the future this can also be used as part of a supervisor mechanism, where it will also suppress denial notifications on a per-object basis. Thus the name is deliberately generic, as opposed to e.g. LANDLOCK_ADD_RULE_LOG_QUIET. According to pahole, even after adding the struct access_masks quiet_masks in struct landlock_hierarchy, the u32 log_* bitfield still only has a size of 2 bytes, so there's minimal wasted space. Assisted-by: GitHub-Copilot:claude-opus-4.8 Signed-off-by: Tingmao Wang [mic: Update date, fix comment formatting] Link: https://patch.msgid.link/031184748a8e74c0bb02f1fa13d7a3f10918c627.1781228815.git.m@maowtm.org Signed-off-by: Mickaël Salaün --- include/uapi/linux/landlock.h | 60 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h index 811ec77f9105..7ffe2ef127ee 100644 --- a/include/uapi/linux/landlock.h +++ b/include/uapi/linux/landlock.h @@ -32,6 +32,19 @@ * *handle* a wide range or all access rights that they know about at build time * (and that they have tested with a kernel that supported them all). * + * @quiet_access_fs and @quiet_access_net are bitmasks of actions for which a + * denial by this layer will not trigger a log if the corresponding object (or + * its children, for filesystem rules) is marked with the "quiet" bit via + * %LANDLOCK_ADD_RULE_QUIET, even if logging would normally take place per + * landlock_restrict_self() flags. @quiet_scoped is similar, except that it + * does not require marking any objects as quiet - if the ruleset is created + * with any bits set in @quiet_scoped, then denial of such scoped resources will + * not trigger any log. These 3 fields are available since Landlock ABI version + * 10. + * + * @quiet_access_fs, @quiet_access_net and @quiet_scoped must be a subset of + * @handled_access_fs, @handled_access_net and @scoped respectively. + * * This structure can grow in future Landlock versions. */ struct landlock_ruleset_attr { @@ -51,6 +64,20 @@ struct landlock_ruleset_attr { * resources (e.g. IPCs). */ __u64 scoped; + /** + * @quiet_access_fs: Bitmask of filesystem actions which should not be + * logged if per-object quiet flag is set. + */ + __u64 quiet_access_fs; + /** + * @quiet_access_net: Bitmask of network actions which should not be + * logged if per-object quiet flag is set. + */ + __u64 quiet_access_net; + /** + * @quiet_scoped: Bitmask of scoped actions which should not be logged. + */ + __u64 quiet_scoped; }; /** @@ -69,6 +96,39 @@ struct landlock_ruleset_attr { #define LANDLOCK_CREATE_RULESET_ERRATA (1U << 1) /* clang-format on */ +/** + * DOC: landlock_add_rule_flags + * + * **Flags** + * + * %LANDLOCK_ADD_RULE_QUIET + * Together with the quiet_* fields in struct landlock_ruleset_attr, + * this flag controls whether Landlock will log audit messages when + * access to the objects covered by this rule is denied by this layer. + * + * If logging is enabled, when Landlock denies an access, it will + * suppress the log if all of the following are true: + * + * - this layer is the innermost layer that denied the access; + * - all accesses denied by this layer are part of the quiet_* fields + * in the related struct landlock_ruleset_attr; + * - the object (or one of its parents, for filesystem rules) is + * marked as "quiet" via %LANDLOCK_ADD_RULE_QUIET. + * + * Because logging is only suppressed by a layer if the layer denies + * access, a sandboxed program cannot use this flag to "hide" access + * denials, without denying itself the access in the first place. + * + * The effect of this flag does not depend on the value of + * allowed_access in the passed in rule_attr. When this flag is + * present, the caller is also allowed to pass in an empty + * allowed_access. + */ + +/* clang-format off */ +#define LANDLOCK_ADD_RULE_QUIET (1U << 0) +/* clang-format on */ + /** * DOC: landlock_restrict_self_flags * -- cgit v1.2.3 From 527756cb9ebb277dca12fff00af9fbb3b9ec8cc8 Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Mon, 8 Jun 2026 08:43:05 +0300 Subject: i3c: master: Make hot-join workqueue freezable to block hot-join during suspend The I3C master workqueue (master->wq) is used to defer work that needs thread context and the bus maintenance lock, most notably Hot Join processing (which calls i3c_master_do_daa() to assign dynamic addresses to newly joined devices). Currently the workqueue keeps running across system suspend, which can race with the suspend path: - do_daa() may execute after the controller has been suspended, issuing bus transactions on a powered-down or otherwise unusable controller. - New I3C devices can be enumerated and added to the bus mid-suspend, registering driver model objects at a point where the I3C subsystem and its consumers are not prepared to handle them. Mark the workqueue WQ_FREEZABLE so its workers are frozen for the duration of system suspend/hibernate and resumed afterwards. This naturally defers any pending or newly queued Hot Join work until the system (and the controller) is fully resumed, closing both races without adding explicit suspend/resume synchronization in the master drivers. Update the kerneldoc for struct i3c_master_controller::wq to reflect that the workqueue is freezable. Fixes: 3a379bbcea0af ("i3c: Add core I3C infrastructure") Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260608054312.10604-2-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni --- include/linux/i3c/master.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h index 592b646f6134..e6112e5f6608 100644 --- a/include/linux/i3c/master.h +++ b/include/linux/i3c/master.h @@ -515,7 +515,7 @@ struct i3c_master_controller_ops { * @boardinfo.i2c: list of I2C boardinfo objects * @boardinfo: board-level information attached to devices connected on the bus * @bus: I3C bus exposed by this master - * @wq: workqueue which can be used by master + * @wq: freezable workqueue which can be used by master * drivers if they need to postpone operations that need to take place * in a thread context. Typical examples are Hot Join processing which * requires taking the bus lock in maintenance, which in turn, can only -- cgit v1.2.3 From 828c6130235db8144f4810b329b61390dc82719b Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Mon, 8 Jun 2026 08:43:07 +0300 Subject: i3c: master: Consolidate Hot-Join DAA work in the core Three master drivers (dw-i3c-master, i3c-master-cdns, svc-i3c-master) each carry an essentially identical Hot-Join handler: a struct work_struct embedded in their private state, a work function that just calls i3c_master_do_daa() on the embedded i3c_master_controller, plus matching INIT_WORK()/cancel_work_sync() boilerplate in probe/remove (and shutdown for dw-i3c). The IBI/ISR paths then queue that work onto master->wq, which already lives in the core. Move this pattern into the I3C core: - Add struct work_struct hj_work to struct i3c_master_controller and initialise it in i3c_master_register() with a core-provided handler i3c_master_hj_work_fn() that performs i3c_master_do_daa(). - Cancel the work in i3c_master_unregister() so all controllers get correct teardown ordering against the workqueue for free. - Export i3c_master_queue_hotjoin() as the single entry point drivers call from their Hot-Join IBI handler. Convert the three existing users to the new API: drop their private hj_work fields, work functions, INIT_WORK() and cancel_work_sync() calls, and replace the queue_work(master->wq, &drv->hj_work) call sites with i3c_master_queue_hotjoin(&drv->base). The dw-i3c shutdown path still needs to flush pending Hot-Join work before tearing down the hardware, so it is updated to cancel master->base.hj_work directly. No functional change intended: the work is still queued on the same master->wq, runs the same i3c_master_do_daa(), and is cancelled at controller teardown. Future Hot-Join improvements now only need to be made in one place. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260608054312.10604-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni --- include/linux/i3c/master.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h index e6112e5f6608..eb5c51608bd7 100644 --- a/include/linux/i3c/master.h +++ b/include/linux/i3c/master.h @@ -520,6 +520,8 @@ struct i3c_master_controller_ops { * in a thread context. Typical examples are Hot Join processing which * requires taking the bus lock in maintenance, which in turn, can only * be done from a sleep-able context + * @hj_work: work item used to run DAA after a Hot-Join event is detected. + * Queued to @wq by i3c_master_queue_hotjoin() * @dev_nack_retry_count: retry count when slave device nack * * A &struct i3c_master_controller has to be registered to the I3C subsystem @@ -543,6 +545,7 @@ struct i3c_master_controller { } boardinfo; struct i3c_bus bus; struct workqueue_struct *wq; + struct work_struct hj_work; unsigned int dev_nack_retry_count; }; @@ -623,6 +626,7 @@ int i3c_master_register(struct i3c_master_controller *master, void i3c_master_unregister(struct i3c_master_controller *master); int i3c_master_enable_hotjoin(struct i3c_master_controller *master); int i3c_master_disable_hotjoin(struct i3c_master_controller *master); +void i3c_master_queue_hotjoin(struct i3c_master_controller *master); /** * i3c_dev_get_master_data() - get master private data attached to an I3C -- cgit v1.2.3 From 8323e783dc3904839e64cb08cfcc7571ef9212c4 Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Mon, 8 Jun 2026 08:43:08 +0300 Subject: i3c: master: Ensure Hot-Join operations are stopped on shutdown System shutdown invokes each device's bus shutdown callback to quiesce hardware, but the I3C bus type does not currently implement one. As a result, on shutdown the controller's Hot-Join work and any in-flight i3c_master_do_daa() can keep running (or be newly triggered) while the rest of the system is being torn down. A similar window exists at i3c_master_unregister() time: cancel_work_sync() on hj_work prevents queued work from completing, but does not stop a fresh Hot-Join IBI from re-queueing the worker, nor a concurrent sysfs writer from toggling Hot-Join via i3c_set_hotjoin(). Introduce a single "shutting down" gate in the I3C core, set under the bus maintenance lock so it is observed by any in-progress DAA path before pending work is cancelled. Install an i3c_bus_type shutdown callback that engages this gate for master devices during system shutdown, and use the same gate in i3c_master_unregister() so both paths get identical guarantees. Once the gate is engaged, the Hot-Join worker, i3c_master_do_daa_ext() and i3c_set_hotjoin() all bail out cleanly, so Hot-Join IBIs that race with shutdown become no-ops, direct DAA callers see -ENODEV, and sysfs writers can no longer re-enable Hot-Join through ops->enable_hotjoin() while the controller is going away. No functional change for the steady-state runtime path; the new checks only take effect once the controller has been marked as shutting down. Note, this patch depends on patch "i3c: master: Consolidate Hot-Join DAA work in the core". Fixes: 3a379bbcea0af ("i3c: Add core I3C infrastructure") Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260608054312.10604-5-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni --- include/linux/i3c/master.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h index eb5c51608bd7..77e63082b06e 100644 --- a/include/linux/i3c/master.h +++ b/include/linux/i3c/master.h @@ -511,6 +511,7 @@ struct i3c_master_controller_ops { * @hotjoin: true if the master support hotjoin * @rpm_allowed: true if Runtime PM allowed * @rpm_ibi_allowed: true if IBI and Hot-Join allowed while runtime suspended + * @shutting_down: set to true when master begins shutdown or unregister * @boardinfo.i3c: list of I3C boardinfo objects * @boardinfo.i2c: list of I2C boardinfo objects * @boardinfo: board-level information attached to devices connected on the bus @@ -539,6 +540,7 @@ struct i3c_master_controller { unsigned int hotjoin: 1; unsigned int rpm_allowed: 1; unsigned int rpm_ibi_allowed: 1; + bool shutting_down; struct { struct list_head i3c; struct list_head i2c; -- cgit v1.2.3 From 3f79dac3ea1c30516fcc791770af034387c7f917 Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Mon, 8 Jun 2026 08:43:10 +0300 Subject: i3c: master: Defer new-device registration out of DAA caller context Master drivers may invoke i3c_master_do_daa_ext() during resume to re-run Dynamic Address Assignment. As well as assigning addresses to any newly arrived devices, this restores the dynamic address of devices that lost it across system suspend, so it has to run as part of the controller's resume path. A side effect of i3c_master_do_daa_ext() today is that it also registers any newly discovered I3C devices with the driver model inline, via i3c_master_register_new_i3c_devs(). Doing that from the resume path is problematic: a hot-join-capable device may join the bus during this same DAA, and registering it immediately would push driver model work (probing, sysfs, etc.) into the controller's resume context, where the rest of the system is not yet fully resumed and the controller driver is still partway through its own resume sequence. Decouple discovery from registration: add a reg_work work item to struct i3c_master_controller and have i3c_master_do_daa_ext() queue it on master->wq (the freezable workqueue) instead of calling i3c_master_register_new_i3c_devs() directly. The worker performs the registration only when the controller is not shutting_down, and is cancelled alongside hj_work in i3c_master_shutdown(). Because wq is freezable, any newly observed devices end up being registered after the system has finished resuming. i3c_master_register() also routes its initial post-bus-init registration through reg_work, using flush_work() to keep probe-time behavior synchronous. This keeps a single registration code path and ensures the worker is the only writer of desc->dev. Fixes: 3a379bbcea0af ("i3c: Add core I3C infrastructure") Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260608054312.10604-7-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni --- include/linux/i3c/master.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'include') diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h index 77e63082b06e..8cdd7be505d3 100644 --- a/include/linux/i3c/master.h +++ b/include/linux/i3c/master.h @@ -523,6 +523,11 @@ struct i3c_master_controller_ops { * be done from a sleep-able context * @hj_work: work item used to run DAA after a Hot-Join event is detected. * Queued to @wq by i3c_master_queue_hotjoin() + * @reg_work: work item used to register newly discovered I3C devices with + * the driver model. Queued to @wq by i3c_master_do_daa_ext() so + * that device registration is deferred out of the DAA caller's + * context (notably the resume path), and is skipped if the + * controller is shutting down * @dev_nack_retry_count: retry count when slave device nack * * A &struct i3c_master_controller has to be registered to the I3C subsystem @@ -548,6 +553,7 @@ struct i3c_master_controller { struct i3c_bus bus; struct workqueue_struct *wq; struct work_struct hj_work; + struct work_struct reg_work; unsigned int dev_nack_retry_count; }; -- cgit v1.2.3 From 4bfba7b360da70ed209969848bbe6e750254a759 Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Mon, 8 Jun 2026 08:43:11 +0300 Subject: i3c: master: Export i3c_master_enec_disec_locked() The existing i3c_master_enec_locked() wrapper always treats a NACKed ENEC CCC as a failure (M2 error). However, broadcasting ENEC to enable Hot-Join is legitimately useful even when no I3C devices are currently present on the bus, in which case the broadcast will be NACKed and should not be reported as an error. The underlying helper i3c_master_enec_disec_locked() already accepts a suppress_m2 flag that lets callers ignore such NACKs. Expose it so that a subsequent patch enabling Hot-Join events can issue ENEC with M2 suppression. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260608054312.10604-8-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni --- include/linux/i3c/master.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h index 8cdd7be505d3..e2c831fb5354 100644 --- a/include/linux/i3c/master.h +++ b/include/linux/i3c/master.h @@ -607,6 +607,8 @@ int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr, u8 evts); int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr, u8 evts); +int i3c_master_enec_disec_locked(struct i3c_master_controller *master, u8 addr, + bool enable, u8 evts, bool suppress_m2); int i3c_master_entdaa_locked(struct i3c_master_controller *master); int i3c_master_defslvs_locked(struct i3c_master_controller *master); -- cgit v1.2.3 From 689d0bd8f4ada0834bd198d8af8e519683ae81d1 Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Fri, 12 Jun 2026 11:01:05 +0300 Subject: i3c: master: Make i3c_master_add_i3c_dev_locked() return void The return value of i3c_master_add_i3c_dev_locked() is not used by any caller, and callers are not in a position to recover from failures in this path. Change the function to return void. Amend the kernel-doc accordingly, fix some grammar and remove a stale paragraph. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260612080107.11606-6-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni --- include/linux/i3c/master.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h index e2c831fb5354..f73cede87d36 100644 --- a/include/linux/i3c/master.h +++ b/include/linux/i3c/master.h @@ -615,8 +615,7 @@ int i3c_master_defslvs_locked(struct i3c_master_controller *master); int i3c_master_get_free_addr(struct i3c_master_controller *master, u8 start_addr); -int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master, - u8 addr); +void i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master, u8 addr); int i3c_master_do_daa(struct i3c_master_controller *master); int i3c_master_do_daa_ext(struct i3c_master_controller *master, bool rstdaa); struct i3c_dma *i3c_master_dma_map_single(struct device *dev, void *ptr, -- cgit v1.2.3 From 2148794eeaf2a898adc791e9472eb80ea55984da Mon Sep 17 00:00:00 2001 From: Alexei Starovoitov Date: Sat, 13 Jun 2026 11:07:55 -0700 Subject: bpf: Raise maximum call chain depth to 16 frames Bump MAX_CALL_FRAMES from 8 to 16 to allow deeper call chains that Rust-BPF requires and update selftests. Link: https://lore.kernel.org/r/20260613180755.29671-1-alexei.starovoitov@gmail.com Signed-off-by: Alexei Starovoitov --- include/linux/bpf_verifier.h | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h index d57b339a8cb8..39a851e690ec 100644 --- a/include/linux/bpf_verifier.h +++ b/include/linux/bpf_verifier.h @@ -404,7 +404,7 @@ struct bpf_func_state { struct bpf_reg_state *stack_arg_regs; /* Outgoing on-stack arguments */ }; -#define MAX_CALL_FRAMES 8 +#define MAX_CALL_FRAMES 16 /* instruction history flags, used in bpf_jmp_history_entry.flags field. * Frame number and SPI are stored in dedicated fields of bpf_jmp_history_entry. @@ -421,20 +421,21 @@ enum { struct bpf_jmp_history_entry { /* insn idx can't be bigger than 1 million */ u32 idx : 20; - u32 frame : 3; /* stack access frame number */ + u32 frame : 4; /* stack access frame number */ u32 spi : 6; /* stack slot index (0..63) */ - u32 : 3; + u32 : 2; u32 prev_idx : 20; /* special INSN_F_xxx flags */ u32 flags : 4; u32 : 8; - /* additional registers that need precision tracking when this - * jump is backtracked, vector of six 10-bit records + /* + * additional registers that need precision tracking when this + * jump is backtracked, vector of five 11-bit records */ u64 linked_regs; }; -static_assert(MAX_CALL_FRAMES <= (1 << 3)); +static_assert(MAX_CALL_FRAMES <= (1 << 4)); static_assert(MAX_BPF_STACK / 8 <= (1 << 6)); /* Maximum number of bpf_reg_state objects that can exist at once */ -- cgit v1.2.3 From 13793c7f9e9ff30042a54bb680662b5cfa0f58fa Mon Sep 17 00:00:00 2001 From: "David E. Box" Date: Fri, 12 Jun 2026 14:01:47 -0700 Subject: platform/x86/intel/pmt: Unify header fetch and add ACPI source MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Allow the PMT class to read discovery headers from either PCI MMIO or ACPI-provided entries, depending on the discovery source. The new source-aware fetch helper caches the canonical discovery header for both paths, capping PCI MMIO reads to the mapped resource size, while keeping the mapped PCI discovery table available for users such as crashlog. Split intel_pmt_populate_entry() into source-specific resolvers: - pmt_resolve_access_pci(): handles both ACCESS_LOCAL and ACCESS_BARID for PCI-backed devices and sets entry->pcidev. Same existing functionality. - pmt_resolve_access_acpi(): handles only ACCESS_BARID for ACPI-backed devices, rejecting ACCESS_LOCAL which has no valid semantics without a physical discovery resource. This maintains existing PCI behavior and makes no functional changes for PCI devices. Assisted-by: GitHub-Copilot:claude-opus-4.7 Signed-off-by: David E. Box Link: https://patch.msgid.link/4b33b04ffaf0943b67d330f48b5d1dfcb6d1be5d.1781294741.git.david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen --- include/linux/intel_vsec.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/intel_vsec.h b/include/linux/intel_vsec.h index 07ea563f524e..843cda8f8644 100644 --- a/include/linux/intel_vsec.h +++ b/include/linux/intel_vsec.h @@ -28,6 +28,7 @@ #define INTEL_DVSEC_TABLE_BAR(x) ((x) & GENMASK(2, 0)) #define INTEL_DVSEC_TABLE_OFFSET(x) ((x) & GENMASK(31, 3)) #define TABLE_OFFSET_SHIFT 3 +#define PMT_DISC_DWORDS 4 struct device; struct pci_dev; @@ -122,7 +123,7 @@ struct intel_vsec_platform_info { struct device *parent; struct intel_vsec_header **headers; const struct vsec_feature_dependency *deps; - u32 (*acpi_disc)[4]; + u32 (*acpi_disc)[PMT_DISC_DWORDS]; enum intel_vsec_disc_source src; void *priv_data; unsigned long caps; @@ -153,7 +154,7 @@ struct intel_vsec_platform_info { struct intel_vsec_device { struct auxiliary_device auxdev; struct device *dev; - u32 (*acpi_disc)[4]; + u32 (*acpi_disc)[PMT_DISC_DWORDS]; enum intel_vsec_disc_source src; struct ida *ida; int num_resources; -- cgit v1.2.3 From 26330a9226417c9a3395db9fdb403f7d7371e6b7 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Thu, 11 Jun 2026 13:42:26 +0200 Subject: bpf: Add support to specify uprobe_multi target via file descriptor Allow uprobe_multi link to identify the target binary by an already opened file descriptor. Adding new BPF_F_UPROBE_MULTI_PATH_FD flag and the path_fd field for the attr.link_create.uprobe_multi struct. When the flag is set, we resolve the target from path_fd, without the flag, we keep the existing string path behavior. I don't see a use case for supporting O_PATH file descriptors, because we need to read the binary first to get probes offsets, so I'm using the CLASS(fd, f), which fails for O_PATH fds. Assisted-by: Codex:GPT-5.4 Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260611114230.950379-4-jolsa@kernel.org Signed-off-by: Alexei Starovoitov --- include/uapi/linux/bpf.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 11dd610fa5fa..89b36de5fdbb 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1327,7 +1327,11 @@ enum { * BPF_TRACE_UPROBE_MULTI attach type to create return probe. */ enum { - BPF_F_UPROBE_MULTI_RETURN = (1U << 0) + /* Get return uprobe. */ + BPF_F_UPROBE_MULTI_RETURN = (1U << 0), + + /* Get path from provided path_fd. */ + BPF_F_UPROBE_MULTI_PATH_FD = (1U << 1), }; /* link_create.netfilter.flags used in LINK_CREATE command for @@ -1864,6 +1868,7 @@ union bpf_attr { __u32 cnt; __u32 flags; __u32 pid; + __u32 path_fd; } uprobe_multi; struct { union { -- cgit v1.2.3 From 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Wed, 10 Jun 2026 17:15:49 +0300 Subject: drm/displayid: fix Tiled Display Topology ID size The Tiled Display Topology ID of a DisplayID Tiled Display Topology Data Block consists of three fields: - Tiled Display Manufacturer/Vendor ID Field (3 bytes) - Tiled Display Product ID Code Field (2 bytes) - Tiled Display Serial Number Field (4 bytes) i.e. a total of 9 bytes, not 8. The DisplayID Tiled Display Topology ID is used as the tile group identifier. Update both struct displayid_tiled_block topology_id member and struct drm_tile_group group_data member to full 9 bytes. The group data was missing the last byte of the serial number. I don't know whether there are known bug reports that might be linked to this, but it's plausible the last byte could be the differentiating part for the tile groups, and fewer tile groups might have been created than intended. Fixes: b49b55bd4fba ("drm/displayid: add displayid defines and edid extension (v2)") Fixes: 138f9ebb9755 ("drm: add tile_group support. (v3)") Cc: Dave Airlie Cc: stable@vger.kernel.org # v3.19+ Reviewed-by: Dave Airlie Link: https://patch.msgid.link/20260610141549.555605-1-jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/drm_connector.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index f83f28cae207..877b5ca87e95 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -2608,13 +2608,13 @@ struct drm_tile_group { struct kref refcount; struct drm_device *dev; int id; - u8 group_data[8]; + u8 group_data[9]; }; struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, - const char topology[8]); + const char topology_id[9]); struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev, - const char topology[8]); + const char topology_id[9]); void drm_mode_put_tile_group(struct drm_device *dev, struct drm_tile_group *tg); -- cgit v1.2.3 From 6dbded46e447113da97bed4a68b02b8aaaffa995 Mon Sep 17 00:00:00 2001 From: "Vlastimil Babka (SUSE)" Date: Wed, 10 Jun 2026 17:40:15 +0200 Subject: mm/slab: allow __GFP_NOMEMALLOC and __GFP_NOWARN for kmalloc_nolock() The two flags are added internally so there's no point for warning if they are passed by the caller as well, so allow them. This will allow simplifying obj_ext allocation under kmalloc_nolock(). Also it's not necessary to have the extra alloc_gfp variable for adding the two flags. The original gfp_flags parameter is not used anywhere except for the warning. So remove alloc_gfp and directly modify and use gfp_flags everywhere. Link: https://patch.msgid.link/20260610-slab_alloc_flags-v2-13-7190909db118@kernel.org Reviewed-by: Hao Li Reviewed-by: Suren Baghdasaryan Reviewed-by: Harry Yoo (Oracle) Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/slab.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/slab.h b/include/linux/slab.h index ce1c867dc0ba..b955f3cbb732 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -1040,7 +1040,8 @@ void *_kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags, in * kmalloc_nolock - Allocate an object of given size from any context. * @size: size to allocate * @gfp_flags: GFP flags. Only __GFP_ACCOUNT, __GFP_ZERO, __GFP_NO_OBJ_EXT - * allowed. + * allowed. Also __GFP_NOWARN and __GFP_NOMEMALLOC are allowed but added + * internally thus not necessary. * @node: node number of the target node. * * Return: pointer to the new object or NULL in case of error. -- cgit v1.2.3 From 2b31e94bef30f8f2e8856bd9a2e36347908bf59c Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Mon, 15 Jun 2026 13:41:05 +0200 Subject: Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface" This reverts commit 47d7bca76dd4f36ba0525d761f247c76ec9e4b17, which was merged by accident. Signed-off-by: Arnd Bergmann --- include/linux/firmware/xlnx-zynqmp.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h index a4b293eb96ce..d70dcd462b44 100644 --- a/include/linux/firmware/xlnx-zynqmp.h +++ b/include/linux/firmware/xlnx-zynqmp.h @@ -3,7 +3,7 @@ * Xilinx Zynq MPSoC Firmware layer * * Copyright (C) 2014-2021 Xilinx - * Copyright (C) 2022 - 2026 Advanced Micro Devices, Inc. + * Copyright (C) 2022 - 2025 Advanced Micro Devices, Inc. * * Michal Simek * Davorin Mista @@ -262,8 +262,6 @@ enum pm_query_id { PM_QID_CLOCK_GET_NUM_CLOCKS = 12, PM_QID_CLOCK_GET_MAX_DIVISOR = 13, PM_QID_PINCTRL_GET_ATTRIBUTES = 15, - PM_QID_GET_NODE_NAME = 16, - PM_QID_GET_NODE_COUNT = 17, }; enum rpu_oper_mode { -- cgit v1.2.3 From 2b0408d0284f4ff376cf5610fa8c9905e93c2541 Mon Sep 17 00:00:00 2001 From: Cheng Ding Date: Mon, 20 Apr 2026 16:39:34 +0800 Subject: fuse: invalidate page cache after DIO and async DIO writes This fixe does page cache invalidation after DIO and async DIO writes for both O_DIRECT and FOPEN_DIRECT_IO cases. Commit b359af8275a9 ("fuse: Invalidate the page cache after FOPEN_DIRECT_IO write") fixed xfstests generic/209 for DIO writes in the FOPEN_DIRECT_IO path. DIO writes without FOPEN_DIRECT_IO are already handled by generic_file_direct_write(). However, async DIO writes (xfstests generic/451) remain unhandled. After this fix: - Async write with FUSE_ASYNC_DIO: invalidate in fuse_aio_invalidate_worker() - Otherwise (Sync or async write without FUSE_ASYNC_DIO): - With FOPEN_DIRECT_IO: invalidate in fuse_direct_write_iter() - Without FOPEN_DIRECT_IO: invalidate in generic_file_direct_write() Workqueue is required for async write invalidation to prevent deadlock: calling it directly in the I/O end routine (which is in fuse worker thread context) can block on a folio lock held by a buffered I/O thread waiting for the same fuse worker thread. Co-developed-by: Jingbo Xu Signed-off-by: Jingbo Xu Signed-off-by: Cheng Ding Reviewed-by: Jingbo Xu Signed-off-by: Miklos Szeredi --- include/linux/fs/super.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/fs/super.h b/include/linux/fs/super.h index f21ffbb6dea5..405612678115 100644 --- a/include/linux/fs/super.h +++ b/include/linux/fs/super.h @@ -235,4 +235,6 @@ int freeze_super(struct super_block *super, enum freeze_holder who, int thaw_super(struct super_block *super, enum freeze_holder who, const void *freeze_owner); +int sb_init_dio_done_wq(struct super_block *sb); + #endif /* _LINUX_FS_SUPER_H */ -- cgit v1.2.3 From 4d05e948cebe03974ab9927daee55273207fdc22 Mon Sep 17 00:00:00 2001 From: Jarkko Sakkinen Date: Thu, 9 Apr 2026 19:07:51 +0300 Subject: KEYS: trusted: Debugging as a feature TPM_DEBUG, and other similar flags, are a non-standard way to specify a feature in Linux kernel. Introduce CONFIG_TRUSTED_KEYS_DEBUG for trusted keys, and use it to replace these ad-hoc feature flags. Given that trusted keys debug dumps can contain sensitive data, harden the feature as follows: 1. In the Kconfig description postulate that pr_debug() statements must be used. 2. Use pr_debug() statements in TPM 1.x driver to print the protocol dump. 3. Require trusted.debug=1 on the kernel command line (default: 0) to activate dumps at runtime, even when CONFIG_TRUSTED_KEYS_DEBUG=y. Traces, when actually needed, can be easily enabled by providing trusted.dyndbg='+p' and trusted.debug=1 in the kernel command-line. Reported-by: Nayna Jain Closes: https://lore.kernel.org/all/7f8b8478-5cd8-4d97-bfd0-341fd5cf10f9@linux.ibm.com/ Reviewed-by: Nayna Jain Tested-by: Srish Srinivasan Signed-off-by: Jarkko Sakkinen --- include/keys/trusted-type.h | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) (limited to 'include') diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h index 03527162613f..9f9940482da4 100644 --- a/include/keys/trusted-type.h +++ b/include/keys/trusted-type.h @@ -83,18 +83,21 @@ struct trusted_key_source { extern struct key_type key_type_trusted; -#define TRUSTED_DEBUG 0 +#ifdef CONFIG_TRUSTED_KEYS_DEBUG +extern bool trusted_debug; -#if TRUSTED_DEBUG static inline void dump_payload(struct trusted_key_payload *p) { - pr_info("key_len %d\n", p->key_len); - print_hex_dump(KERN_INFO, "key ", DUMP_PREFIX_NONE, - 16, 1, p->key, p->key_len, 0); - pr_info("bloblen %d\n", p->blob_len); - print_hex_dump(KERN_INFO, "blob ", DUMP_PREFIX_NONE, - 16, 1, p->blob, p->blob_len, 0); - pr_info("migratable %d\n", p->migratable); + if (!trusted_debug) + return; + + pr_debug("key_len %d\n", p->key_len); + print_hex_dump_debug("key ", DUMP_PREFIX_NONE, + 16, 1, p->key, p->key_len, 0); + pr_debug("bloblen %d\n", p->blob_len); + print_hex_dump_debug("blob ", DUMP_PREFIX_NONE, + 16, 1, p->blob, p->blob_len, 0); + pr_debug("migratable %d\n", p->migratable); } #else static inline void dump_payload(struct trusted_key_payload *p) -- cgit v1.2.3 From fd15b457a86939c38aa12116adabd8ff686c5e51 Mon Sep 17 00:00:00 2001 From: Shaomin Chen Date: Wed, 10 Jun 2026 13:10:05 +0300 Subject: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy user payload sleep on #PF helper completed detach and free rka destroy auth key wake up use rka->target_key **USE-AFTER-FREE** Give request_key_auth payloads a refcount. Take a payload reference while authkey->sem stabilizes the payload and revocation state. Hold that reference across the instantiate and reject paths. Drop the auth key owning reference from revoke and destroy. [jarkko: Replaced the first two paragraphs of text with an actual concurrency scenario.] Cc: stable@vger.kernel.org # v5.10+ Fixes: b5f545c880a2 ("[PATCH] keys: Permit running process to instantiate keys") Reported-by: Shaomin Chen Closes: https://lore.kernel.org/r/20260519144403.436694-1-eeesssooo020@gmail.com Signed-off-by: Shaomin Chen Signed-off-by: Jarkko Sakkinen --- include/keys/request_key_auth-type.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/keys/request_key_auth-type.h b/include/keys/request_key_auth-type.h index 36b89a933310..01e42ee5f409 100644 --- a/include/keys/request_key_auth-type.h +++ b/include/keys/request_key_auth-type.h @@ -9,12 +9,14 @@ #define _KEYS_REQUEST_KEY_AUTH_TYPE_H #include +#include /* * Authorisation record for request_key(). */ struct request_key_auth { struct rcu_head rcu; + refcount_t usage; struct key *target_key; struct key *dest_keyring; const struct cred *cred; -- cgit v1.2.3 From 670e057744e0cc8047bf96d15d18c46e16ae2e93 Mon Sep 17 00:00:00 2001 From: Heiko Carstens Date: Wed, 13 May 2026 16:01:28 +0200 Subject: s390/idle: Provide arch specific kcpustat_field_idle()/kcpustat_field_iowait() The former s390 specific arch_cpu_idle_time() implementation was removed, since its implementation was racy and reported idle time could go backwards [1]. However this removal was not necessary, since independently of the s390 architecture specific races there exists the iowait counter update race, which can also lead to reported idle time going backwards [2]. With Frederic Weisbecker's recent cpu idle time accounting refactoring kernel_cpustat got a sequence counter. Use this to implement s390 specific variants of kcpustat_field_idle() and kcpustat_field_iowait(). This is logically a revert of [1] and moves cpu idle time accounting back into s390 architecture code, which is also more precise than the dyntick idle time accounting by nohz/scheduler. For comparing cross cpu time stamps it is necessary to use the stcke instead of the stckf instruction in irq entry path. Furthermore this open-codes a sequence lock in assembler and C code, which is required to update the irq entry time stamp to the per cpu idle_data structure in a race free manner. [1] commit be76ea614460 ("s390/idle: remove arch_cpu_idle_time() and corresponding code") [2] commit ead70b752373 ("timers/nohz: Add a comment about broken iowait counter update race") Signed-off-by: Heiko Carstens Acked-by: Frederic Weisbecker Signed-off-by: Alexander Gordeev --- include/linux/kernel_stat.h | 27 +++++++++++++++++++++++++++ include/linux/vtime.h | 6 ++++++ 2 files changed, 33 insertions(+) (limited to 'include') diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h index fce1392e2140..9ca6c2259dfe 100644 --- a/include/linux/kernel_stat.h +++ b/include/linux/kernel_stat.h @@ -107,6 +107,30 @@ static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu) } #ifdef CONFIG_NO_HZ_COMMON + +#ifdef CONFIG_HAVE_VIRT_CPU_ACCOUNTING_IDLE + +static inline void kcpustat_dyntick_start(u64 now) { } +static inline void kcpustat_dyntick_stop(u64 now) { } +static inline void kcpustat_irq_enter(u64 now) { } +static inline void kcpustat_irq_exit(u64 now) { } +static inline bool kcpustat_idle_dyntick(void) { return false; } + +extern u64 arch_kcpustat_field_idle(int cpu); +extern u64 arch_kcpustat_field_iowait(int cpu); + +static inline u64 kcpustat_field_idle(int cpu) +{ + return arch_kcpustat_field_idle(cpu); +} + +static inline u64 kcpustat_field_iowait(int cpu) +{ + return arch_kcpustat_field_iowait(cpu); +} + +#else /* !CONFIG_HAVE_VIRT_CPU_ACCOUNTING_IDLE */ + extern void kcpustat_dyntick_start(u64 now); extern void kcpustat_dyntick_stop(u64 now); extern void kcpustat_irq_enter(u64 now); @@ -118,6 +142,9 @@ static inline bool kcpustat_idle_dyntick(void) { return __this_cpu_read(kernel_cpustat.idle_dyntick); } + +#endif /* !CONFIG_HAVE_VIRT_CPU_ACCOUNTING_IDLE */ + #else static inline u64 kcpustat_field_idle(int cpu) { diff --git a/include/linux/vtime.h b/include/linux/vtime.h index 9dc25b04a119..82825e775499 100644 --- a/include/linux/vtime.h +++ b/include/linux/vtime.h @@ -42,9 +42,15 @@ extern void vtime_account_irq(struct task_struct *tsk, unsigned int offset); extern void vtime_account_softirq(struct task_struct *tsk); extern void vtime_account_hardirq(struct task_struct *tsk); extern void vtime_flush(struct task_struct *tsk); +#ifdef CONFIG_HAVE_VIRT_CPU_ACCOUNTING_IDLE +static inline void vtime_reset(void) { } +static inline void vtime_dyntick_start(void) { } +static inline void vtime_dyntick_stop(void) { } +#else extern void vtime_reset(void); extern void vtime_dyntick_start(void); extern void vtime_dyntick_stop(void); +#endif #else /* !CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */ static inline void vtime_account_irq(struct task_struct *tsk, unsigned int offset) { } static inline void vtime_account_softirq(struct task_struct *tsk) { } -- cgit v1.2.3 From 5c4adb7fb46fac348197c5a15c676a066dd1f88e Mon Sep 17 00:00:00 2001 From: Dragos Tatulea Date: Sat, 13 Jun 2026 00:17:03 +0300 Subject: netdev: expose io_uring rx_page_order order via netlink This adds observability for the io_uring zcrx rx-buf-len configuration. Signed-off-by: Dragos Tatulea Reviewed-by: Yael Chemla Reviewed-by: Tariq Toukan Acked-by: Pavel Begunkov Link: https://patch.msgid.link/20260612211709.1456966-3-dtatulea@nvidia.com Signed-off-by: Jakub Kicinski --- include/uapi/linux/netdev.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/uapi/linux/netdev.h b/include/uapi/linux/netdev.h index 7df1056a35fd..2f3ab75e8cc0 100644 --- a/include/uapi/linux/netdev.h +++ b/include/uapi/linux/netdev.h @@ -97,6 +97,8 @@ enum { }; enum { + NETDEV_A_IO_URING_PROVIDER_INFO_RX_BUF_LEN = 1, + __NETDEV_A_IO_URING_PROVIDER_INFO_MAX, NETDEV_A_IO_URING_PROVIDER_INFO_MAX = (__NETDEV_A_IO_URING_PROVIDER_INFO_MAX - 1) }; -- cgit v1.2.3 From ca394837dfddba669e0021b8be7f1e68affb206b Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Thu, 11 Jun 2026 10:14:50 +0800 Subject: net: enetc: add interfaces to manage dynamic FDB entries Add three interfaces to manage dynamic entries in the FDB table: ntmp_fdbt_update_activity_element(): Update the activity element of all dynamic FDB entries. For each entry, if its activity flag is not set, which means no packet has matched this entry since the last update, the activity counter is incremented. Otherwise, both the activity flag and activity counter are reset. The activity counter is used to track how long an FDB entry has been inactive, which is useful for implementing an ageing mechanism. ntmp_fdbt_delete_ageing_entries(): Delete all dynamic FDB entries whose activity flag is not set and whose activity counter is greater than or equal to the specified threshold. This is used to remove stale entries that have been inactive for too long. ntmp_fdbt_delete_port_dynamic_entries(): Delete all dynamic FDB entries associated with the specified switch port. This is typically called when a port goes down or is removed from a bridge. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260611021458.2629145-2-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski --- include/linux/fsl/ntmp.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 88166f9ad3a2..5db078e1caa0 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -263,6 +263,9 @@ int ntmp_fdbt_delete_entry(struct ntmp_user *user, u32 entry_id); int ntmp_fdbt_search_port_entry(struct ntmp_user *user, int port, u32 *resume_entry_id, struct fdbt_entry_data *entry); +int ntmp_fdbt_update_activity_element(struct ntmp_user *user); +int ntmp_fdbt_delete_ageing_entries(struct ntmp_user *user, u8 act_cnt); +int ntmp_fdbt_delete_port_dynamic_entries(struct ntmp_user *user, int port); int ntmp_vft_add_entry(struct ntmp_user *user, u16 vid, const struct vft_cfge_data *cfge); int ntmp_bpt_update_entry(struct ntmp_user *user, u32 entry_id, -- cgit v1.2.3 From c52b6702a9481dd7f05fb5f484cb6639f5ce57ee Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Thu, 11 Jun 2026 10:14:51 +0800 Subject: net: enetc: add "Update" and "Delete" operations to VLAN filter table Add two interfaces to manage entries in the VLAN filter table: ntmp_vft_update_entry(): Update the configuration element data of the specified VLAN filter entry based on the given VLAN ID. It uses the exact key access method to locate the entry. ntmp_vft_delete_entry(): Delete the VLAN filter entry corresponding to the specified VLAN ID. It also uses the exact key access method to identify the target entry. In addition, introduce struct vft_req_qd to describe the request data buffer format for Query and Delete actions of the VLAN filter table, which contains a common request data header and a VLAN access key. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260611021458.2629145-3-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski --- include/linux/fsl/ntmp.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 5db078e1caa0..36a9089526ad 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -268,6 +268,9 @@ int ntmp_fdbt_delete_ageing_entries(struct ntmp_user *user, u8 act_cnt); int ntmp_fdbt_delete_port_dynamic_entries(struct ntmp_user *user, int port); int ntmp_vft_add_entry(struct ntmp_user *user, u16 vid, const struct vft_cfge_data *cfge); +int ntmp_vft_update_entry(struct ntmp_user *user, u16 vid, + const struct vft_cfge_data *cfge); +int ntmp_vft_delete_entry(struct ntmp_user *user, u16 vid); int ntmp_bpt_update_entry(struct ntmp_user *user, u32 entry_id, const struct bpt_cfge_data *cfge); #else -- cgit v1.2.3 From 3cc291a35939a3d59e50a1b2cc4845abd6bb1208 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Thu, 11 Jun 2026 10:14:52 +0800 Subject: net: enetc: add interfaces to manage egress treatment table Each entry in the egress treatment table contains the egress packet processing actions to be applied to a grouping or scope of packets exiting on a particular egress port of the switch. A scope of packets, for example, could be the packets exiting a particular VLAN, matching a particular 802.1Q bridge forwarding entry or belonging to a stream identified at ingress. The egress treatment table is implemented as a linear array of entries accessed using an index (0,1, 2, ..., n) that uniquely identifies an entry within the array. The egress treatment table only supports access vid entry ID, which is assigned by the software. It supports Add, Update, Delete and Query operations. Note that only Query operation is not supported yet. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260611021458.2629145-4-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski --- include/linux/fsl/ntmp.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 36a9089526ad..0c951e1c763d 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -36,6 +36,7 @@ struct netc_tbl_vers { u8 vft_ver; u8 bpt_ver; u8 ipft_ver; + u8 ett_ver; }; struct netc_swcbd { @@ -214,6 +215,23 @@ struct vft_cfge_data { __le32 et_eid; }; +struct ett_cfge_data { + __le16 efm_cfg; +#define ETT_EFM_MODE GENMASK(1, 0) +#define ETT_ESQA GENMASK(5, 4) +#define ETT_ECA GENMASK(8, 6) +#define ETT_ECA_INC 1 +#define ETT_EFM_LEN_CHANGE GENMASK(15, 9) +#define ETT_FRM_LEN_DEL_VLAN 0x7c +#define ETT_FRM_LEN_DEL_RTAG 0x7a +#define ETT_FRM_LEN_DEL_VLAN_RTAG 0x76 + __le16 efm_data_len; +#define ETT_EFM_DATA_LEN GENMASK(10, 0) + __le32 efm_eid; + __le32 ec_eid; + __le32 esqa_tgt_eid; +}; + struct bpt_bpse_data { __le32 amount_used; __le32 amount_used_hwm; @@ -271,6 +289,11 @@ int ntmp_vft_add_entry(struct ntmp_user *user, u16 vid, int ntmp_vft_update_entry(struct ntmp_user *user, u16 vid, const struct vft_cfge_data *cfge); int ntmp_vft_delete_entry(struct ntmp_user *user, u16 vid); +int ntmp_ett_add_entry(struct ntmp_user *user, u32 entry_id, + const struct ett_cfge_data *cfge); +int ntmp_ett_update_entry(struct ntmp_user *user, u32 entry_id, + const struct ett_cfge_data *cfge); +int ntmp_ett_delete_entry(struct ntmp_user *user, u32 entry_id); int ntmp_bpt_update_entry(struct ntmp_user *user, u32 entry_id, const struct bpt_cfge_data *cfge); #else -- cgit v1.2.3 From d51f238a154aeb6cb76c70a0b0cb72ea99319870 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Thu, 11 Jun 2026 10:14:53 +0800 Subject: net: enetc: add "Update" operation to the egress count table The egress count table is a static bounded index table, egress related statistics are maintained in this table. The table is implemented as a linear array of entries accessed using an index (0, 1, 2, ..., n) that uniquely identifies an entry within the array. Egress Counter Entry ID (EC_EID) is used as an index to an entry in this table. The EC_EID is specified in the egress treatment table. Egress count table entries are always present and enabled. The table only supports access via entry ID, which is assigned by the software. And it supports Update, Query and Query followed by Update operations. Currently, only Update operation is supported. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260611021458.2629145-5-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski --- include/linux/fsl/ntmp.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 0c951e1c763d..1222901f48a7 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -37,6 +37,7 @@ struct netc_tbl_vers { u8 bpt_ver; u8 ipft_ver; u8 ett_ver; + u8 ect_ver; }; struct netc_swcbd { @@ -294,6 +295,7 @@ int ntmp_ett_add_entry(struct ntmp_user *user, u32 entry_id, int ntmp_ett_update_entry(struct ntmp_user *user, u32 entry_id, const struct ett_cfge_data *cfge); int ntmp_ett_delete_entry(struct ntmp_user *user, u32 entry_id); +int ntmp_ect_update_entry(struct ntmp_user *user, u32 entry_id); int ntmp_bpt_update_entry(struct ntmp_user *user, u32 entry_id, const struct bpt_cfge_data *cfge); #else -- cgit v1.2.3 From 1a58ae73dd743bba2895431ee99471d784175244 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Thu, 11 Jun 2026 10:14:54 +0800 Subject: net: dsa: netc: initialize the group bitmap of ETT and ECT The Egress Treatment Table (ETT) and Egress Count Table (ECT) are both index tables whose entry IDs are allocated by software. Every num_ports entries form a group, where each entry in the group corresponds to one port. To facilitate group allocation and management, initialize the group index bitmaps for both tables based on hardware capabilities reported by ETTCAPR and ECTCAPR registers. The bitmap size per table is calculated as the total number of hardware entries divided by the number of available ports, which gives the number of groups available for software allocation. A set bit in the bitmap represents a group index that has been allocated. These bitmaps will be used by subsequent patches that add VLAN support. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260611021458.2629145-6-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski --- include/linux/fsl/ntmp.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 1222901f48a7..e8b1bd802f19 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -3,6 +3,7 @@ #ifndef __NETC_NTMP_H #define __NETC_NTMP_H +#include #include #include @@ -70,6 +71,12 @@ struct ntmp_user { struct device *dev; struct netc_cbdr *ring; struct netc_tbl_vers tbl; + + /* NTMP table bitmaps for resource management */ + u32 ett_bitmap_size; + u32 ect_bitmap_size; + unsigned long *ett_gid_bitmap; /* only valid for switch */ + unsigned long *ect_gid_bitmap; /* only valid for switch */ }; struct maft_entry_data { -- cgit v1.2.3 From 8469b17310d1814b8e7d6fe2b4cc77a05a9da4f1 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Thu, 11 Jun 2026 10:14:55 +0800 Subject: net: enetc: add helpers to set/clear table bitmap NTMP index tables require software to allocate and manage entry IDs. Add two bitmap helper functions to facilitate this management: ntmp_lookup_free_eid(): finds the first zero bit in the given bitmap, sets it to mark the entry as in-use, and returns the corresponding entry ID. Returns NTMP_NULL_ENTRY_ID if no free entry is available. ntmp_clear_eid_bitmap(): clears the bit associated with the given entry ID in the bitmap to mark the entry as free. It is a no-op if the entry ID is NTMP_NULL_ENTRY_ID. Both functions are exported for use by other modules, such as the NETC switch driver which needs to manage group index bitmaps for the Egress Treatment Table (ETT) and Egress Count Table (ECT). Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260611021458.2629145-7-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski --- include/linux/fsl/ntmp.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index e8b1bd802f19..4d329488763d 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -266,6 +266,8 @@ struct bpt_cfge_data { int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, const struct netc_cbdr_regs *regs); void ntmp_free_cbdr(struct netc_cbdr *cbdr); +u32 ntmp_lookup_free_eid(unsigned long *bitmap, u32 size); +void ntmp_clear_eid_bitmap(unsigned long *bitmap, u32 entry_id); /* NTMP APIs */ int ntmp_maft_add_entry(struct ntmp_user *user, u32 entry_id, -- cgit v1.2.3 From 84b4a3b30abd226ec528985d7c3cb63a3376d098 Mon Sep 17 00:00:00 2001 From: Wei Fang Date: Thu, 11 Jun 2026 10:14:56 +0800 Subject: net: dsa: netc: add VLAN filter table and egress treatment management Implement the DSA .port_vlan_add and .port_vlan_del operations to enable VLAN-aware bridge offloading on the NETC switch. VLAN membership is maintained in the VLAN Filter Table (VFT). Adding the first port to a VLAN creates a new VFT entry with hardware MAC learning and flood-on-miss forwarding; subsequent ports update the existing entry's membership bitmap. Removing the last port deletes the entry. Egress tagging is handled through the Egress Treatment Table (ETT). Each VLAN is allocated a group of ETT entries, one per available port. Ports are assigned a sequential ett_offset during initialisation, used to address each port's entry within the group. Untagged ports configure the ETT to strip the outer VLAN tag; tagged ports pass frames through unmodified. Each ETT group is optionally paired with an Egress Counter Table (ECT) group for per-port frame counting, allocated on a best-effort basis. When the egress rule of an ETT entry changes, the counter of the corresponding ECT entry will be recounted to track the number of frames that match the new egress rule. A software shadow list serialised by vft_lock tracks active VLAN state across both port membership and egress tagging. VID 0 is used for single port mode and is ignored by both callbacks. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20260611021458.2629145-8-wei.fang@oss.nxp.com Signed-off-by: Jakub Kicinski --- include/linux/fsl/ntmp.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'include') diff --git a/include/linux/fsl/ntmp.h b/include/linux/fsl/ntmp.h index 4d329488763d..d3b6c476b91a 100644 --- a/include/linux/fsl/ntmp.h +++ b/include/linux/fsl/ntmp.h @@ -262,6 +262,21 @@ struct bpt_cfge_data { __le32 fc_ports; }; +union ntmp_fmt_eid { + __le32 index; +#define FMTEID_INDEX GENMASK(12, 0) + __le32 vuda_sqta; +#define FMTEID_VUDA GENMASK(1, 0) +#define FMTEID_VUDA_DEL_OTAG 2 +#define FMTEID_SQTA GENMASK(4, 2) +#define FMTEID_SQTA_DEL 2 +#define FMTEID_VUDA_SQTA BIT(13) + __le32 vara_vid; +#define FMTEID_VID GENMASK(11, 0) +#define FMTEID_VARA GENMASK(13, 12) +#define FMTEID_VARA_VID BIT(14) +}; + #if IS_ENABLED(CONFIG_NXP_NETC_LIB) int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev, const struct netc_cbdr_regs *regs); -- cgit v1.2.3 From ef057cbf825e03b63f6edf5980f96abf3c53089d Mon Sep 17 00:00:00 2001 From: Sean Christopherson Date: Wed, 29 Apr 2026 09:34:01 -0700 Subject: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, *before* querying the max mapping level given the shadow page's gfn. Failure to pre-check the validity of the gfn can lead to an out-of-bounds access to the slot's lpage_info (which typically manifests as a host #PF because the lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its PTEs) that extends "below" the bounds of a memslot. When faulting in memory for a guest, and the size of the guest mapping is greater than KVM's (current) max mapping, then KVM will create a "direct" shadow page (direct in that there are no gPTEs to shadow, and so the target gfn is a direct calculation given the base gfn of the shadow page). The hugepage recovery flow looks for such direct shadow pages, as forcing 4KiB mappings when dirty logging generates the guest > host mapping size case. When the 4KiB restriction is lifted, then KVM can replace the shadow page with a hugepage. But if KVM originally used a smaller mapping than the guest because the range of memory covered by the guest hugepage exceeds the bounds of a memslot, then KVM will link a direct shadow page with a gfn that is outside the bounds of the memslot being used to fault in memory. The rmap entry added for the leaf mapping is correct and within bounds, but the gfn of the leaf SPTE's parent shadow page will be out of bounds. BUG: unable to handle page fault for address: ffffc90000806ffc #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 1002a7067 PMD 10612f067 PTE 0 Oops: Oops: 0000 [#1] SMP CPU: 13 UID: 1000 PID: 757 Comm: mmu_stress_test Not tainted 7.1.0-rc1-48ce1e26eace-x86_pir_to_irr_comments-vm #341 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_mmu_max_mapping_level+0x79/0x2b0 [kvm] Call Trace: kvm_mmu_recover_huge_pages+0x21b/0x320 [kvm] kvm_set_memslot+0x1ee/0x590 [kvm] kvm_set_memory_region.part.0+0x3a1/0x4d0 [kvm] kvm_vm_ioctl+0x9bf/0x15d0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb7/0xbb0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f21c0f1a9bf Don't bother pre-checking the bounds of the potential hugepage, i.e. don't check that e.g. sp->gfn + KVM_PAGES_PER_HPAGE(sp->role.level + 1) is also within the memslot, as the checks performed by kvm_mmu_max_mapping_level() are a superset of the basic bounds checks. I.e. pre-checking the full range would be a dubious micro-optimization. Fixes: 9eba50f8d7fc ("KVM: x86/mmu: Consult max mapping level when zapping collapsible SPTEs") Cc: stable@vger.kernel.org Cc: David Matlack Cc: James Houghton Cc: Alexander Bulekov Cc: Fred Griffoul Cc: Alexander Graf Cc: David Woodhouse Cc: Filippo Sironi Cc: Ivan Orlov Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini --- include/linux/kvm_host.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 27498e990dff..ab8cfaec82d3 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -1815,6 +1815,11 @@ void kvm_unregister_irq_ack_notifier(struct kvm *kvm, struct kvm_irq_ack_notifier *kian); bool kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args); +static inline bool is_gfn_in_memslot(const struct kvm_memory_slot *slot, gfn_t gfn) +{ + return gfn >= slot->base_gfn && gfn < slot->base_gfn + slot->npages; +} + /* * Returns a pointer to the memslot if it contains gfn. * Otherwise returns NULL. @@ -1825,7 +1830,7 @@ try_get_memslot(struct kvm_memory_slot *slot, gfn_t gfn) if (!slot) return NULL; - if (gfn >= slot->base_gfn && gfn < slot->base_gfn + slot->npages) + if (is_gfn_in_memslot(slot, gfn)) return slot; else return NULL; -- cgit v1.2.3 From eb82367bca5656c99d98bba65f101776e2c2dc36 Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Sat, 13 Jun 2026 16:37:25 -0700 Subject: sctp: correct CONFIG_SCTP_DBG_OBJCNT macro name in comment A comment in incorrectly refers to CONFIG_SCTP_DBG_OBJCOUNT instead of CONFIG_SCTP_DBG_OBJCNT. Correct it. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore Link: https://patch.msgid.link/20260613233725.162470-1-enelsonmoore@gmail.com Signed-off-by: Jakub Kicinski --- include/net/sctp/sctp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h index 58242b37b47a..60b073fd3ed8 100644 --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h @@ -303,7 +303,7 @@ void sctp_dbg_objcnt_init(struct net *); static inline void sctp_dbg_objcnt_init(struct net *net) { return; } -#endif /* CONFIG_SCTP_DBG_OBJCOUNT */ +#endif /* CONFIG_SCTP_DBG_OBJCNT */ #if defined CONFIG_SYSCTL void sctp_sysctl_register(void); -- cgit v1.2.3 From 658eb696544cc0e39ef1d60795546e64f542604a Mon Sep 17 00:00:00 2001 From: Neil Spring Date: Sun, 14 Jun 2026 21:21:57 -0700 Subject: tcp: rehash onto different local ECMP path on retransmit timeout Currently sk_rethink_txhash() re-rolls the socket's txhash on RTO, PLB, and spurious-retransmission events, but the cached route is reused and the new hash is not propagated into the ECMP path selection logic. Two changes are needed to make rehash select a different local ECMP path: 1. Add __sk_dst_reset() alongside sk_rethink_txhash() in tcp_write_timeout(), tcp_rcv_spurious_retrans(), and tcp_plb_check_rehash() so the cached dst is invalidated and the next transmit triggers a fresh route lookup. 2. Set fl6->mp_hash from sk_txhash (or tcp_rsk(req)->txhash for SYN/ACK retransmits and syncookies) in tcp_v6_connect(), inet6_sk_rebuild_header(), inet6_csk_route_req(), inet6_csk_route_socket(), tcp_v6_send_response(), and cookie_v6_check() so fib6_select_path() picks a path based on the new hash. The mp_hash override only applies to fib_multipath_hash_policy 0 (the default L3 policy). Its hash includes the flow label, but that is 0 by default -- np->flow_label is unset, and auto_flowlabels only computes the on-wire label later, per packet -- so flows to the same peer share one local path. Keying the hash on sk_txhash makes the local path per-connection and lets a rehash re-select it. Policies 1-3 are left unchanged. The mp_hash assignment is factored into a small helper, ip6_ecmp_set_mp_hash(), shared by inet6_csk_route_req(), inet6_csk_route_socket(), tcp_v6_connect(), inet6_sk_rebuild_header(), tcp_v6_send_response(), and cookie_v6_check(). It applies (txhash >> 1) ?: 1 for policy 0 (the >> 1 keeps mp_hash in the 31-bit range; ?: 1 keeps it non-zero, since 0 would fall back to rt6_multipath_hash()). inet6_csk_route_socket() calls it only for sk_protocol == IPPROTO_TCP so that non-TCP callers (e.g., L2TP via inet6_csk_xmit) fall through to rt6_multipath_hash() and retain their existing flow-key-based ECMP behavior. tcp_v6_send_response() also sets mp_hash from the response txhash so that a control packet (a RST from the full socket, or an ACK from a time-wait socket) selects the same local ECMP nexthop as the connection's txhash rather than falling back to the flow hash. The time-wait socket's tw_txhash is copied from sk_txhash when the connection enters TIME_WAIT, so it reflects any rehash that occurred. Setting mp_hash explicitly is necessary because the default ECMP hash derives from fl6->flowlabel via np->flow_label, which is not updated from sk_txhash (REPFLOW is off by default). ip6_make_flowlabel() cannot help either, as it runs after the route lookup. As a consequence, for policy 0 the local ECMP path of an IPv6 TCP flow follows sk_txhash even when fl6->flowlabel is non-zero, e.g. a reflected (REPFLOW) or explicitly set (IPV6_FLOWLABEL_MGR) flow label. This is intentional: only local path selection changes, so rehash can recover from a failed path; the on-wire flow label is unchanged. sk_set_txhash() is moved before ip6_dst_lookup_flow() in tcp_v6_connect() so the initial ECMP path is selected by the same txhash that subsequent route rebuilds will use. This avoids unintended path changes when the cached dst is naturally invalidated (e.g., by PMTU discovery or route changes). The rehash sites (tcp_write_timeout(), tcp_plb_check_rehash(), and tcp_rcv_spurious_retrans()) call __sk_rethink_txhash_reset_dst(), which re-rolls the txhash and, when it changed, drops the cached dst so the next transmit re-runs route selection. The dst reset is guarded by sk->sk_family == AF_INET6 since IPv4 ECMP does not currently use sk_txhash for path selection. For IPv4-mapped IPv6 sockets this produces a redundant dst reset on a cold path (RTO/PLB); the subsequent IPv4 route lookup returns the same result. The helper is deliberately separate from sk_rethink_txhash() itself: dst_negative_advice() calls sk_rethink_txhash() before its own dst op, so resetting the dst inside sk_rethink_txhash() would skip that op (e.g. rt6_remove_exception_rt()). For syncookies, cookie_init_sequence() computes the cookie value before route_req() and sets txhash so the SYN-ACK selects the same ECMP path that cookie_v6_check() will use when the full socket is created. cookie_tcp_reqsk_init() derives txhash from the cookie so the full socket's ECMP path matches the SYN-ACK. Both the SYN-ACK assignment in tcp_conn_request() and the full-socket assignment in cookie_tcp_reqsk_init() set txhash from the cookie for IPv4 and IPv6 alike. On IPv6 this drives ECMP path selection; on IPv4, which does not use sk_txhash for ECMP, it only affects TX-queue selection. That selection scales the hash by its high bits (reciprocal_scale()), which are uniform in the keyed secure_tcp_syn_cookie() output -- the MSS index only perturbs the low bits -- so the queue distribution matches net_tx_rndhash(). cookie_init_sequence() is split from the former version that also called tcp_synq_overflow() and incremented SYNCOOKIESSENT; those side effects are now in cookie_record_sent(), called after route_req() succeeds so they are not bumped when route_req() fails. cookie_record_sent() is guarded by CONFIG_SYN_COOKIES to match the guard on tcp_synq_overflow(). route_req() receives 0 as tw_isn for the syncookie path so that tcp_v6_init_req() still saves ireq->pktopts for REPFLOW flowlabel reflection and IPv6 cmsg options. The ecn_ok clear for syncookies without timestamps stays after tcp_ecn_create_request() so it takes precedence. Signed-off-by: Neil Spring Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260615042158.1600746-2-ntspring@meta.com Signed-off-by: Jakub Kicinski --- include/net/ipv6.h | 12 ++++++++++++ include/net/sock.h | 14 ++++++++++++++ include/net/tcp.h | 20 ++++++++++++++------ 3 files changed, 40 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 1dec81faff28..3de07e738538 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -955,6 +955,18 @@ static inline u32 ip6_multipath_hash_fields(const struct net *net) } #endif +/* Derive the IPv6 ECMP hash from txhash so a rehash may pick a different path; + * policy 0 only, and only when txhash is set. >> 1 clears the top bit + * (fib6_select_path() uses mp_hash as a signed 31-bit value); ?: 1 keeps the + * result non-zero, since mp_hash 0 falls back to rt6_multipath_hash(). + */ +static inline void ip6_ecmp_set_mp_hash(const struct net *net, + struct flowi6 *fl6, u32 txhash) +{ + if (ip6_multipath_hash_policy(net) == 0 && txhash) + fl6->mp_hash = (txhash >> 1) ?: 1; +} + /* * Header manipulation */ diff --git a/include/net/sock.h b/include/net/sock.h index 91ddc1a6fd60..51185222aac2 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2262,6 +2262,20 @@ sk_dst_reset(struct sock *sk) sk_dst_set(sk, NULL); } +/* Re-roll the socket txhash. On a rehash, IPv6 also drops the cached route + * so the next transmit re-selects an ECMP path; IPv4 keeps its route, since + * IPv4 ECMP path selection does not use sk_txhash. + */ +static inline bool __sk_rethink_txhash_reset_dst(struct sock *sk) +{ + if (sk_rethink_txhash(sk)) { + if (sk->sk_family == AF_INET6) + __sk_dst_reset(sk); + return true; + } + return false; +} + struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie); struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie); diff --git a/include/net/tcp.h b/include/net/tcp.h index f063eccbbba3..0632cf39d20a 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -2540,22 +2540,30 @@ extern const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops; #ifdef CONFIG_SYN_COOKIES static inline __u32 cookie_init_sequence(const struct tcp_request_sock_ops *ops, - const struct sock *sk, struct sk_buff *skb, - __u16 *mss) + struct sk_buff *skb, __u16 *mss) { - tcp_synq_overflow(sk); - __NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT); return ops->cookie_init_seq(skb, mss); } #else static inline __u32 cookie_init_sequence(const struct tcp_request_sock_ops *ops, - const struct sock *sk, struct sk_buff *skb, - __u16 *mss) + struct sk_buff *skb, __u16 *mss) { return 0; } #endif +#ifdef CONFIG_SYN_COOKIES +static inline void cookie_record_sent(const struct sock *sk) +{ + tcp_synq_overflow(sk); + __NET_INC_STATS(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT); +} +#else +static inline void cookie_record_sent(const struct sock *sk) +{ +} +#endif + struct tcp_key { union { struct { -- cgit v1.2.3 From 8d8afa428318a623aa674c3f90550475ad3e6ccd Mon Sep 17 00:00:00 2001 From: Aman Kumar Pandey Date: Fri, 12 Jun 2026 16:48:09 +0530 Subject: i3c: master: Expose the APIs to support I3C hub Change the below internal static functions to APIs to allow new I3C hub driver to use them 1) i3c_dev_enable_ibi_locked() 2) i3c_dev_disable_ibi_locked() 3) i3c_dev_request_ibi_locked() 4) i3c_dev_free_ibi_locked() 5) i3c_master_reattach_i3c_dev_locked() Signed-off-by: Aman Kumar Pandey Signed-off-by: Lakshay Piplani Reviewed-by: Frank Li Link: https://patch.msgid.link/20260612111816.3688240-3-lakshay.piplani@nxp.com Signed-off-by: Alexandre Belloni --- include/linux/i3c/master.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h index f73cede87d36..27eeb598b3c5 100644 --- a/include/linux/i3c/master.h +++ b/include/linux/i3c/master.h @@ -625,6 +625,8 @@ void i3c_master_dma_unmap_single(struct i3c_dma *dma_xfer); DEFINE_FREE(i3c_master_dma_unmap_single, void *, if (_T) i3c_master_dma_unmap_single(_T)) +int i3c_master_reattach_i3c_dev_locked(struct i3c_dev_desc *dev, + u8 old_dyn_addr); int i3c_master_set_info(struct i3c_master_controller *master, const struct i3c_device_info *info); -- cgit v1.2.3 From ca4aa97194ae353c2882d7cb4ed123a544892bcf Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Mon, 15 Jun 2026 13:43:16 -0600 Subject: io_uring: get rid of tw_pending for !DEFER task work The normal task_work path used a tw_pending bit to ensure the callback was only added once: the mpscq drains incrementally, so a single tctx_task_work() run can take the queue through empty -> non-empty several times, and each transition would otherwise re-add the already pending callback_head. This corrupts the task_work list, and is what tw_pending protects again. This can go away, if we stop running the task_work as soon as the queue empties. Suggested-by: Caleb Sander Mateos Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index 6415a3353ee0..87151a5b62c1 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -149,8 +149,6 @@ struct io_uring_task { struct { /* task_work */ struct mpscq task_list; - /* BIT(0) guards adding tw only once */ - unsigned long tw_pending; struct callback_head task_work; } ____cacheline_aligned_in_smp; }; -- cgit v1.2.3 From b20aa9eded107bc78b7e54e64ccf79fbaeda9ecd Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 12:44:09 -0700 Subject: atm: remove the unused send_oam / push_oam callbacks The atmdev_ops::send_oam device operation and the atm_vcc::push_oam callback were the kernel's interface for raw F4/F5 OAM cell exchange. Nothing assigns them a non-NULL value and nothing ever invokes them: the core only ever initialises push_oam to NULL (in vcc_create() and the AAL init helpers) and the Solos driver only lists send_oam = NULL for documentation. The drivers that actually drove OAM through these hooks were removed along with the legacy ATM adapters. Drop both callbacks and the NULL initialisers. Link: https://patch.msgid.link/20260615194416.752559-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atmdev.h | 8 -------- 1 file changed, 8 deletions(-) (limited to 'include') diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h index 82a32526df64..71c5bf6950e3 100644 --- a/include/linux/atmdev.h +++ b/include/linux/atmdev.h @@ -104,7 +104,6 @@ struct atm_vcc { void (*release_cb)(struct atm_vcc *vcc); /* release_sock callback */ void (*push)(struct atm_vcc *vcc,struct sk_buff *skb); void (*pop)(struct atm_vcc *vcc,struct sk_buff *skb); /* optional */ - int (*push_oam)(struct atm_vcc *vcc,void *cell); int (*send)(struct atm_vcc *vcc,struct sk_buff *skb); void *dev_data; /* per-device data */ void *proto_data; /* per-protocol data */ @@ -170,12 +169,6 @@ struct atm_dev { struct list_head dev_list; /* linkage */ }; - -/* OF: send_Oam Flags */ - -#define ATM_OF_IMMED 1 /* Attempt immediate delivery */ -#define ATM_OF_INRATE 2 /* Attempt in-rate delivery */ - struct atmdev_ops { /* only send is required */ void (*dev_close)(struct atm_dev *dev); int (*open)(struct atm_vcc *vcc); @@ -188,7 +181,6 @@ struct atmdev_ops { /* only send is required */ int (*pre_send)(struct atm_vcc *vcc, struct sk_buff *skb); int (*send)(struct atm_vcc *vcc,struct sk_buff *skb); int (*send_bh)(struct atm_vcc *vcc, struct sk_buff *skb); - int (*send_oam)(struct atm_vcc *vcc,void *cell,int flags); void (*phy_put)(struct atm_dev *dev,unsigned char value, unsigned long addr); unsigned char (*phy_get)(struct atm_dev *dev,unsigned long addr); -- cgit v1.2.3 From a5a12d76d2cb23b3f2150ed3a5d674b0eba6a8b7 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 12:44:11 -0700 Subject: atm: remove the local ATM (NSAP) address registry net/atm/addr.c maintained the per-device lists of local NSAP addresses (dev->local) and ILMI-learned LECS addresses (dev->lecs). These exist solely to serve SVC signaling: the lists are populated through the ATM_{ADD,DEL,RST}ADDR / ATM_{ADD,DEL,GET}LECSADDR ioctls used by the atmsigd / ILMI daemons, and consumed when registering addresses with the signaling daemon. The LECS list belonged to LAN Emulation, which has been removed. With no SVC users in a DSL-only configuration these lists are always empty, so drop the registry entirely: - remove the ADDR/LECSADDR/RSTADDR ioctls - drop the now-always-empty "atmaddress" sysfs attribute - remove the dev->local / dev->lecs lists, structs and enums - delete net/atm/addr.c and net/atm/addr.h The device ESI ("MAC" address) and its ATM_{G,S}ETESI ioctls and "address" sysfs attribute are retained - the USB DSL modems populate the ESI. Link: https://patch.msgid.link/20260615194416.752559-5-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atmdev.h | 9 --------- 1 file changed, 9 deletions(-) (limited to 'include') diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h index 71c5bf6950e3..7abbd23fada6 100644 --- a/include/linux/atmdev.h +++ b/include/linux/atmdev.h @@ -136,13 +136,6 @@ static inline struct sock *sk_atm(struct atm_vcc *vcc) return (struct sock *)vcc; } -struct atm_dev_addr { - struct sockaddr_atmsvc addr; /* ATM address */ - struct list_head entry; /* next address */ -}; - -enum atm_addr_type_t { ATM_ADDR_LOCAL, ATM_ADDR_LECS }; - struct atm_dev { const struct atmdev_ops *ops; /* device operations; NULL if unused */ const struct atmphy_ops *phy; /* PHY operations, may be undefined */ @@ -152,8 +145,6 @@ struct atm_dev { void *dev_data; /* per-device data */ void *phy_data; /* private PHY data */ unsigned long flags; /* device flags (ATM_DF_*) */ - struct list_head local; /* local ATM addresses */ - struct list_head lecs; /* LECS ATM addresses learned via ILMI */ unsigned char esi[ESI_LEN]; /* ESI ("MAC" addr) */ struct atm_cirange ci_range; /* VPI/VCI range */ struct k_atm_dev_stats stats; /* statistics */ -- cgit v1.2.3 From aa582dc25ace8951ad595c71fb93d21ed2ec4624 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 12:44:12 -0700 Subject: atm: remove SVC socket support and the signaling daemon interface ATM switched virtual circuits (SVCs) are set up and torn down by a user-space signaling daemon (atmsigd) which the kernel talks to over a dedicated "sigd" socket: the kernel marshals Q.2931-style requests (as_connect, as_listen, as_accept, as_close, ...) to the daemon and applies the results to PF_ATMSVC sockets. This is the machinery behind classical SVC use and was the foundation for LANE / MPOA, all of which have been removed. DSL deployments do not use any of this. PPPoATM and BR2684 run over permanent virtual circuits (PF_ATMPVC) with a statically configured VPI/VCI; no atmsigd, no Q.2931. Neither remaining ATM driver (solos-pci, the USB DSL modems) is reachable through the SVC path. Remove the SVC socket family and the signaling interface: - delete net/atm/svc.c, net/atm/signaling.c and signaling.h - drop atmsvc_init()/atmsvc_exit() and the PF_ATMSVC registration and module alias - drop the ATMSIGD_CTRL ioctl (sigd_attach) and the /proc/net/atm/svc file - fold the SVC branch out of atm_change_qos(); all sockets are PVCs now The obsolete ATM_SETSC ioctl stub is left in place (it already just warns and returns 0), as is the struct atm_vcc SVC bookkeeping shared with the queueing layer. Link: https://patch.msgid.link/20260615194416.752559-6-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atmdev.h | 38 +++----------------------------------- 1 file changed, 3 insertions(+), 35 deletions(-) (limited to 'include') diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h index 7abbd23fada6..59477676063c 100644 --- a/include/linux/atmdev.h +++ b/include/linux/atmdev.h @@ -51,33 +51,11 @@ enum { driver, cleared by anybody. */ ATM_VF_PARTIAL, /* resources are bound to PVC (partial PVC setup), controlled by socket layer */ - ATM_VF_REGIS, /* registered with demon, controlled by SVC - socket layer */ - ATM_VF_BOUND, /* local SAP is set, controlled by SVC socket - layer */ - ATM_VF_RELEASED, /* demon has indicated/requested release, - controlled by SVC socket layer */ ATM_VF_HASQOS, /* QOS parameters have been set */ - ATM_VF_LISTEN, /* socket is used for listening */ - ATM_VF_META, /* SVC socket isn't used for normal data - traffic and doesn't depend on signaling - to be available */ - ATM_VF_SESSION, /* VCC is p2mp session control descriptor */ - ATM_VF_HASSAP, /* SAP has been set */ - ATM_VF_CLOSE, /* asynchronous close - treat like VF_RELEASED*/ - ATM_VF_WAITING, /* waiting for reply from sigd */ - ATM_VF_IS_CLIP, /* in use by CLIP protocol */ + ATM_VF_CLOSE, /* asynchronous close - VC is being torn down */ }; -#define ATM_VF2VS(flags) \ - (test_bit(ATM_VF_READY,&(flags)) ? ATM_VS_CONNECTED : \ - test_bit(ATM_VF_RELEASED,&(flags)) ? ATM_VS_CLOSING : \ - test_bit(ATM_VF_LISTEN,&(flags)) ? ATM_VS_LISTEN : \ - test_bit(ATM_VF_REGIS,&(flags)) ? ATM_VS_INUSE : \ - test_bit(ATM_VF_BOUND,&(flags)) ? ATM_VS_BOUND : ATM_VS_IDLE) - - enum { ATM_DF_REMOVED, /* device was removed from atm_devs list */ }; @@ -100,7 +78,6 @@ struct atm_vcc { unsigned long atm_options; /* ATM layer options */ struct atm_dev *dev; /* device back pointer */ struct atm_qos qos; /* QOS */ - struct atm_sap sap; /* SAP */ void (*release_cb)(struct atm_vcc *vcc); /* release_sock callback */ void (*push)(struct atm_vcc *vcc,struct sk_buff *skb); void (*pop)(struct atm_vcc *vcc,struct sk_buff *skb); /* optional */ @@ -109,16 +86,8 @@ struct atm_vcc { void *proto_data; /* per-protocol data */ struct k_atm_aal_stats *stats; /* pointer to AAL stats group */ struct module *owner; /* owner of ->push function */ - /* SVC part --- may move later ------------------------------------- */ - short itf; /* interface number */ - struct sockaddr_atmsvc local; - struct sockaddr_atmsvc remote; - /* Multipoint part ------------------------------------------------- */ - struct atm_vcc *session; /* session VCC descriptor */ - /* Other stuff ----------------------------------------------------- */ - void *user_back; /* user backlink - not touched by */ - /* native ATM stack. Currently used */ - /* by CLIP and sch_atm. */ + void *user_back; /* user backlink - not touched by the */ + /* native ATM stack, used by sch_atm */ }; static inline struct atm_vcc *atm_sk(struct sock *sk) @@ -151,7 +120,6 @@ struct atm_dev { char signal; /* signal status (ATM_PHY_SIG_*) */ int link_rate; /* link rate (default: OC3) */ refcount_t refcnt; /* reference count */ - spinlock_t lock; /* protect internal members */ #ifdef CONFIG_PROC_FS struct proc_dir_entry *proc_entry; /* proc entry */ char *proc_name; /* proc entry name */ -- cgit v1.2.3 From 6719d57ee047cba211e8684eef46d5486a3295bb Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 12:44:13 -0700 Subject: atm: remove the unused change_qos device operation atmdev_ops::change_qos() was the hook for renegotiating the traffic parameters of an already-connected VCC, driven from SO_ATMQOS on a connected socket (and previously from the SVC as_modify path, now gone). None of the ATM drivers left in tree implement it - solos-pci only listed change_qos = NULL - so atm_change_qos() always returned -EOPNOTSUPP. Drop the operation and return -EOPNOTSUPP directly. Link: https://patch.msgid.link/20260615194416.752559-7-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atmdev.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h index 59477676063c..218c05f2ec54 100644 --- a/include/linux/atmdev.h +++ b/include/linux/atmdev.h @@ -143,7 +143,6 @@ struct atmdev_ops { /* only send is required */ void (*phy_put)(struct atm_dev *dev,unsigned char value, unsigned long addr); unsigned char (*phy_get)(struct atm_dev *dev,unsigned long addr); - int (*change_qos)(struct atm_vcc *vcc,struct atm_qos *qos,int flags); int (*proc_read)(struct atm_dev *dev,loff_t *pos,char *page); struct module *owner; }; -- cgit v1.2.3 From ae6e653514d156f0cc2327fe9e7db731ecb35a76 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 12:44:14 -0700 Subject: atm: remove the unused pre_send and send_bh device operations atmdev_ops::pre_send (a TX pre-processing hook) and ::send_bh (a bottom-half capable send variant) have no implementation behind them: no remaining ATM driver sets either, so vcc_sendmsg() always skipped pre_send and the raw AAL0/AAL5 paths always fell back to ->send(). The drivers that used these hooks were removed with the legacy ATM adapters. Drop both operations and the dead branches that tested for them. Link: https://patch.msgid.link/20260615194416.752559-8-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atmdev.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h index 218c05f2ec54..96ce36e02247 100644 --- a/include/linux/atmdev.h +++ b/include/linux/atmdev.h @@ -137,9 +137,7 @@ struct atmdev_ops { /* only send is required */ int (*compat_ioctl)(struct atm_dev *dev,unsigned int cmd, void __user *arg); #endif - int (*pre_send)(struct atm_vcc *vcc, struct sk_buff *skb); int (*send)(struct atm_vcc *vcc,struct sk_buff *skb); - int (*send_bh)(struct atm_vcc *vcc, struct sk_buff *skb); void (*phy_put)(struct atm_dev *dev,unsigned char value, unsigned long addr); unsigned char (*phy_get)(struct atm_dev *dev,unsigned long addr); -- cgit v1.2.3 From e44e224e2f44c9ad3ab422b513d5ee2f0f45e416 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 12:44:15 -0700 Subject: atm: remove unused ATM PHY operations The PHY operations are vestiges of the SAR/framer split used by the removed PCI/SBUS ATM adapters: - atmdev_ops::phy_put / ::phy_get (register accessors) are never called by the core and solos-pci only listed them as NULL - struct atmphy_ops and atm_dev::phy have no users at all - nothing assigns or dereferences them Remove all of them. atm_dev::phy_data is kept: solos-pci repurposes it to stash its per-port channel index. Link: https://patch.msgid.link/20260615194416.752559-9-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atmdev.h | 12 ------------ 1 file changed, 12 deletions(-) (limited to 'include') diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h index 96ce36e02247..fe21d2f547b5 100644 --- a/include/linux/atmdev.h +++ b/include/linux/atmdev.h @@ -107,8 +107,6 @@ static inline struct sock *sk_atm(struct atm_vcc *vcc) struct atm_dev { const struct atmdev_ops *ops; /* device operations; NULL if unused */ - const struct atmphy_ops *phy; /* PHY operations, may be undefined */ - /* (NULL) */ const char *type; /* device type name */ int number; /* device index */ void *dev_data; /* per-device data */ @@ -138,20 +136,10 @@ struct atmdev_ops { /* only send is required */ void __user *arg); #endif int (*send)(struct atm_vcc *vcc,struct sk_buff *skb); - void (*phy_put)(struct atm_dev *dev,unsigned char value, - unsigned long addr); - unsigned char (*phy_get)(struct atm_dev *dev,unsigned long addr); int (*proc_read)(struct atm_dev *dev,loff_t *pos,char *page); struct module *owner; }; -struct atmphy_ops { - int (*start)(struct atm_dev *dev); - int (*ioctl)(struct atm_dev *dev,unsigned int cmd,void __user *arg); - void (*interrupt)(struct atm_dev *dev); - int (*stop)(struct atm_dev *dev); -}; - struct atm_skb_data { struct atm_vcc *vcc; /* ATM VCC */ unsigned long atm_options; /* ATM layer options */ -- cgit v1.2.3 From 8f9616500c59bb85a06a9d1c52e59d1bf4a194c2 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 12:44:16 -0700 Subject: atm: remove orphaned uAPI for deleted drivers, protocols and SVCs ATM removals have left a number of uAPI headers and ioctl definitions with no in-kernel implementation behind them: - device headers for adapters deleted with the legacy PCI/SBUS drivers: atm_eni.h, atm_he.h, atm_idt77105.h, atm_nicstar.h, atm_zatm.h and the atmtcp pair atm_tcp.h / - protocol headers for the removed CLIP, LANE and MPOA stacks: atmarp.h, atmclip.h, atmlec.h, atmmpc.h - atmsvc.h and the SVC / p2mp / local-address ioctls in atmdev.h (ATM_{GET,RST,ADD,DEL}ADDR, ATM_{ADD,DEL,GET}LECSADDR, ATM_{ADD,DROP}PARTY) left behind by the SVC and address-registry removals None of these are referenced by any remaining in-tree code. Let's try to delete all this. Chances are nobody cares about these headers any more. I'm keeping this separate from the kernel side code changes for ease of revert, in case I am proven wrong... Link: https://patch.msgid.link/20260615194416.752559-10-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atm_tcp.h | 24 ------- include/uapi/linux/atm_eni.h | 24 ------- include/uapi/linux/atm_he.h | 21 ------- include/uapi/linux/atm_idt77105.h | 29 --------- include/uapi/linux/atm_nicstar.h | 54 ---------------- include/uapi/linux/atm_tcp.h | 62 ------------------- include/uapi/linux/atm_zatm.h | 47 -------------- include/uapi/linux/atmarp.h | 42 ------------- include/uapi/linux/atmclip.h | 22 ------- include/uapi/linux/atmdev.h | 18 ------ include/uapi/linux/atmlec.h | 92 --------------------------- include/uapi/linux/atmmpc.h | 127 -------------------------------------- include/uapi/linux/atmsvc.h | 56 ----------------- 13 files changed, 618 deletions(-) delete mode 100644 include/linux/atm_tcp.h delete mode 100644 include/uapi/linux/atm_eni.h delete mode 100644 include/uapi/linux/atm_he.h delete mode 100644 include/uapi/linux/atm_idt77105.h delete mode 100644 include/uapi/linux/atm_nicstar.h delete mode 100644 include/uapi/linux/atm_tcp.h delete mode 100644 include/uapi/linux/atm_zatm.h delete mode 100644 include/uapi/linux/atmarp.h delete mode 100644 include/uapi/linux/atmclip.h delete mode 100644 include/uapi/linux/atmlec.h delete mode 100644 include/uapi/linux/atmmpc.h delete mode 100644 include/uapi/linux/atmsvc.h (limited to 'include') diff --git a/include/linux/atm_tcp.h b/include/linux/atm_tcp.h deleted file mode 100644 index 2558439d849b..000000000000 --- a/include/linux/atm_tcp.h +++ /dev/null @@ -1,24 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* atm_tcp.h - Driver-specific declarations of the ATMTCP driver (for use by - driver-specific utilities) */ - -/* Written 1997-2000 by Werner Almesberger, EPFL LRC/ICA */ - -#ifndef LINUX_ATM_TCP_H -#define LINUX_ATM_TCP_H - -#include - -struct atm_vcc; -struct module; - -struct atm_tcp_ops { - int (*attach)(struct atm_vcc *vcc,int itf); - int (*create_persistent)(int itf); - int (*remove_persistent)(int itf); - struct module *owner; -}; - -extern struct atm_tcp_ops atm_tcp_ops; - -#endif diff --git a/include/uapi/linux/atm_eni.h b/include/uapi/linux/atm_eni.h deleted file mode 100644 index cf5bfd1a2691..000000000000 --- a/include/uapi/linux/atm_eni.h +++ /dev/null @@ -1,24 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* atm_eni.h - Driver-specific declarations of the ENI driver (for use by - driver-specific utilities) */ - -/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */ - - -#ifndef LINUX_ATM_ENI_H -#define LINUX_ATM_ENI_H - -#include - - -struct eni_multipliers { - int tx,rx; /* values are in percent and must be > 100 */ -}; - - -#define ENI_MEMDUMP _IOW('a',ATMIOC_SARPRV,struct atmif_sioc) - /* printk memory map */ -#define ENI_SETMULT _IOW('a',ATMIOC_SARPRV+7,struct atmif_sioc) - /* set buffer multipliers */ - -#endif diff --git a/include/uapi/linux/atm_he.h b/include/uapi/linux/atm_he.h deleted file mode 100644 index 9f4b43293988..000000000000 --- a/include/uapi/linux/atm_he.h +++ /dev/null @@ -1,21 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* atm_he.h */ - -#ifndef LINUX_ATM_HE_H -#define LINUX_ATM_HE_H - -#include - -#define HE_GET_REG _IOW('a', ATMIOC_SARPRV, struct atmif_sioc) - -#define HE_REGTYPE_PCI 1 -#define HE_REGTYPE_RCM 2 -#define HE_REGTYPE_TCM 3 -#define HE_REGTYPE_MBOX 4 - -struct he_ioctl_reg { - unsigned addr, val; - char type; -}; - -#endif /* LINUX_ATM_HE_H */ diff --git a/include/uapi/linux/atm_idt77105.h b/include/uapi/linux/atm_idt77105.h deleted file mode 100644 index f0fd6912a14b..000000000000 --- a/include/uapi/linux/atm_idt77105.h +++ /dev/null @@ -1,29 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* atm_idt77105.h - Driver-specific declarations of the IDT77105 driver (for - * use by driver-specific utilities) */ - -/* Written 1999 by Greg Banks . Copied from atm_suni.h. */ - - -#ifndef LINUX_ATM_IDT77105_H -#define LINUX_ATM_IDT77105_H - -#include -#include -#include - -/* - * Structure for IDT77105_GETSTAT and IDT77105_GETSTATZ ioctls. - * Pointed to by `arg' in atmif_sioc. - */ -struct idt77105_stats { - __u32 symbol_errors; /* wire symbol errors */ - __u32 tx_cells; /* cells transmitted */ - __u32 rx_cells; /* cells received */ - __u32 rx_hec_errors; /* Header Error Check errors on receive */ -}; - -#define IDT77105_GETSTAT _IOW('a',ATMIOC_PHYPRV+2,struct atmif_sioc) /* get stats */ -#define IDT77105_GETSTATZ _IOW('a',ATMIOC_PHYPRV+3,struct atmif_sioc) /* get stats and zero */ - -#endif diff --git a/include/uapi/linux/atm_nicstar.h b/include/uapi/linux/atm_nicstar.h deleted file mode 100644 index 880d368b5b9a..000000000000 --- a/include/uapi/linux/atm_nicstar.h +++ /dev/null @@ -1,54 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/****************************************************************************** - * - * atm_nicstar.h - * - * Driver-specific declarations for use by NICSTAR driver specific utils. - * - * Author: Rui Prior - * - * (C) INESC 1998 - * - ******************************************************************************/ - - -#ifndef LINUX_ATM_NICSTAR_H -#define LINUX_ATM_NICSTAR_H - -/* Note: non-kernel programs including this file must also include - * sys/types.h for struct timeval - */ - -#include -#include - -#define NS_GETPSTAT _IOWR('a',ATMIOC_SARPRV+1,struct atmif_sioc) - /* get pool statistics */ -#define NS_SETBUFLEV _IOW('a',ATMIOC_SARPRV+2,struct atmif_sioc) - /* set buffer level markers */ -#define NS_ADJBUFLEV _IO('a',ATMIOC_SARPRV+3) - /* adjust buffer level */ - -typedef struct buf_nr -{ - unsigned min; - unsigned init; - unsigned max; -}buf_nr; - - -typedef struct pool_levels -{ - int buftype; - int count; /* (At least for now) only used in NS_GETPSTAT */ - buf_nr level; -} pool_levels; - -/* type must be one of the following: */ -#define NS_BUFTYPE_SMALL 1 -#define NS_BUFTYPE_LARGE 2 -#define NS_BUFTYPE_HUGE 3 -#define NS_BUFTYPE_IOVEC 4 - - -#endif /* LINUX_ATM_NICSTAR_H */ diff --git a/include/uapi/linux/atm_tcp.h b/include/uapi/linux/atm_tcp.h deleted file mode 100644 index 7309e1bc8867..000000000000 --- a/include/uapi/linux/atm_tcp.h +++ /dev/null @@ -1,62 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* atm_tcp.h - Driver-specific declarations of the ATMTCP driver (for use by - driver-specific utilities) */ - -/* Written 1997-2000 by Werner Almesberger, EPFL LRC/ICA */ - - -#ifndef _UAPILINUX_ATM_TCP_H -#define _UAPILINUX_ATM_TCP_H - -#include -#include -#include -#include - - -/* - * All values in struct atmtcp_hdr are in network byte order - */ - -struct atmtcp_hdr { - __u16 vpi; - __u16 vci; - __u32 length; /* ... of data part */ -}; - -/* - * All values in struct atmtcp_command are in host byte order - */ - -#define ATMTCP_HDR_MAGIC (~0) /* this length indicates a command */ -#define ATMTCP_CTRL_OPEN 1 /* request/reply */ -#define ATMTCP_CTRL_CLOSE 2 /* request/reply */ - -struct atmtcp_control { - struct atmtcp_hdr hdr; /* must be first */ - int type; /* message type; both directions */ - atm_kptr_t vcc; /* both directions */ - struct sockaddr_atmpvc addr; /* suggested value from kernel */ - struct atm_qos qos; /* both directions */ - int result; /* to kernel only */ -} __ATM_API_ALIGN; - -/* - * Field usage: - * Messge type dir. hdr.v?i type addr qos vcc result - * ----------- ---- ------- ---- ---- --- --- ------ - * OPEN K->D Y Y Y Y Y 0 - * OPEN D->K - Y Y Y Y Y - * CLOSE K->D - - Y - Y 0 - * CLOSE D->K - - - - Y Y - */ - -#define SIOCSIFATMTCP _IO('a',ATMIOC_ITF) /* set ATMTCP mode */ -#define ATMTCP_CREATE _IO('a',ATMIOC_ITF+14) /* create persistent ATMTCP - interface */ -#define ATMTCP_REMOVE _IO('a',ATMIOC_ITF+15) /* destroy persistent ATMTCP - interface */ - - - -#endif /* _UAPILINUX_ATM_TCP_H */ diff --git a/include/uapi/linux/atm_zatm.h b/include/uapi/linux/atm_zatm.h deleted file mode 100644 index 5135027b93c1..000000000000 --- a/include/uapi/linux/atm_zatm.h +++ /dev/null @@ -1,47 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* atm_zatm.h - Driver-specific declarations of the ZATM driver (for use by - driver-specific utilities) */ - -/* Written 1995-1999 by Werner Almesberger, EPFL LRC/ICA */ - - -#ifndef LINUX_ATM_ZATM_H -#define LINUX_ATM_ZATM_H - -/* - * Note: non-kernel programs including this file must also include - * sys/types.h for struct timeval - */ - -#include -#include - -#define ZATM_GETPOOL _IOW('a',ATMIOC_SARPRV+1,struct atmif_sioc) - /* get pool statistics */ -#define ZATM_GETPOOLZ _IOW('a',ATMIOC_SARPRV+2,struct atmif_sioc) - /* get statistics and zero */ -#define ZATM_SETPOOL _IOW('a',ATMIOC_SARPRV+3,struct atmif_sioc) - /* set pool parameters */ - -struct zatm_pool_info { - int ref_count; /* free buffer pool usage counters */ - int low_water,high_water; /* refill parameters */ - int rqa_count,rqu_count; /* queue condition counters */ - int offset,next_off; /* alignment optimizations: offset */ - int next_cnt,next_thres; /* repetition counter and threshold */ -}; - -struct zatm_pool_req { - int pool_num; /* pool number */ - struct zatm_pool_info info; /* actual information */ -}; - -#define ZATM_OAM_POOL 0 /* free buffer pool for OAM cells */ -#define ZATM_AAL0_POOL 1 /* free buffer pool for AAL0 cells */ -#define ZATM_AAL5_POOL_BASE 2 /* first AAL5 free buffer pool */ -#define ZATM_LAST_POOL ZATM_AAL5_POOL_BASE+10 /* max. 64 kB */ - -#define ZATM_TIMER_HISTORY_SIZE 16 /* number of timer adjustments to - record; must be 2^n */ - -#endif diff --git a/include/uapi/linux/atmarp.h b/include/uapi/linux/atmarp.h deleted file mode 100644 index 8e44d121fde1..000000000000 --- a/include/uapi/linux/atmarp.h +++ /dev/null @@ -1,42 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* atmarp.h - ATM ARP protocol and kernel-demon interface definitions */ - -/* Written 1995-1999 by Werner Almesberger, EPFL LRC/ICA */ - - -#ifndef _LINUX_ATMARP_H -#define _LINUX_ATMARP_H - -#include -#include -#include - - -#define ATMARP_RETRY_DELAY 30 /* request next resolution or forget - NAK after 30 sec - should go into - atmclip.h */ -#define ATMARP_MAX_UNRES_PACKETS 5 /* queue that many packets while - waiting for the resolver */ - - -#define ATMARPD_CTRL _IO('a',ATMIOC_CLIP+1) /* become atmarpd ctrl sock */ -#define ATMARP_MKIP _IO('a',ATMIOC_CLIP+2) /* attach socket to IP */ -#define ATMARP_SETENTRY _IO('a',ATMIOC_CLIP+3) /* fill or hide ARP entry */ -#define ATMARP_ENCAP _IO('a',ATMIOC_CLIP+5) /* change encapsulation */ - - -enum atmarp_ctrl_type { - act_invalid, /* catch uninitialized structures */ - act_need, /* need address resolution */ - act_up, /* interface is coming up */ - act_down, /* interface is going down */ - act_change /* interface configuration has changed */ -}; - -struct atmarp_ctrl { - enum atmarp_ctrl_type type; /* message type */ - int itf_num;/* interface number (if present) */ - __be32 ip; /* IP address (act_need only) */ -}; - -#endif diff --git a/include/uapi/linux/atmclip.h b/include/uapi/linux/atmclip.h deleted file mode 100644 index c818bb82b4e6..000000000000 --- a/include/uapi/linux/atmclip.h +++ /dev/null @@ -1,22 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* atmclip.h - Classical IP over ATM */ - -/* Written 1995-1998 by Werner Almesberger, EPFL LRC/ICA */ - - -#ifndef LINUX_ATMCLIP_H -#define LINUX_ATMCLIP_H - -#include -#include - - -#define RFC1483LLC_LEN 8 /* LLC+OUI+PID = 8 */ -#define RFC1626_MTU 9180 /* RFC1626 default MTU */ - -#define CLIP_DEFAULT_IDLETIMER 1200 /* 20 minutes, see RFC1755 */ -#define CLIP_CHECK_INTERVAL 10 /* check every ten seconds */ - -#define SIOCMKCLIP _IO('a',ATMIOC_CLIP) /* create IP interface */ - -#endif diff --git a/include/uapi/linux/atmdev.h b/include/uapi/linux/atmdev.h index 20b0215084fc..a94e7b8360ee 100644 --- a/include/uapi/linux/atmdev.h +++ b/include/uapi/linux/atmdev.h @@ -60,14 +60,6 @@ struct atm_dev_stats { /* get interface type name */ #define ATM_GETESI _IOW('a',ATMIOC_ITF+5,struct atmif_sioc) /* get interface ESI */ -#define ATM_GETADDR _IOW('a',ATMIOC_ITF+6,struct atmif_sioc) - /* get itf's local ATM addr. list */ -#define ATM_RSTADDR _IOW('a',ATMIOC_ITF+7,struct atmif_sioc) - /* reset itf's ATM address list */ -#define ATM_ADDADDR _IOW('a',ATMIOC_ITF+8,struct atmif_sioc) - /* add a local ATM address */ -#define ATM_DELADDR _IOW('a',ATMIOC_ITF+9,struct atmif_sioc) - /* remove a local ATM address */ #define ATM_GETCIRANGE _IOW('a',ATMIOC_ITF+10,struct atmif_sioc) /* get connection identifier range */ #define ATM_SETCIRANGE _IOW('a',ATMIOC_ITF+11,struct atmif_sioc) @@ -76,12 +68,6 @@ struct atm_dev_stats { /* set interface ESI */ #define ATM_SETESIF _IOW('a',ATMIOC_ITF+13,struct atmif_sioc) /* force interface ESI */ -#define ATM_ADDLECSADDR _IOW('a', ATMIOC_ITF+14, struct atmif_sioc) - /* register a LECS address */ -#define ATM_DELLECSADDR _IOW('a', ATMIOC_ITF+15, struct atmif_sioc) - /* unregister a LECS address */ -#define ATM_GETLECSADDR _IOW('a', ATMIOC_ITF+16, struct atmif_sioc) - /* retrieve LECS address(es) */ #define ATM_GETSTAT _IOW('a',ATMIOC_SARCOM+0,struct atmif_sioc) /* get AAL layer statistics */ @@ -99,10 +85,6 @@ struct atm_dev_stats { /* set backend handler */ #define ATM_NEWBACKENDIF _IOW('a',ATMIOC_SPECIAL+3,atm_backend_t) /* use backend to make new if */ -#define ATM_ADDPARTY _IOW('a', ATMIOC_SPECIAL+4,struct atm_iobuf) - /* add party to p2mp call */ -#define ATM_DROPPARTY _IOW('a', ATMIOC_SPECIAL+5,int) - /* drop party from p2mp call */ /* * These are backend handkers that can be set via the ATM_SETBACKEND call diff --git a/include/uapi/linux/atmlec.h b/include/uapi/linux/atmlec.h deleted file mode 100644 index c68346bb40e6..000000000000 --- a/include/uapi/linux/atmlec.h +++ /dev/null @@ -1,92 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* - * ATM Lan Emulation Daemon driver interface - * - * Marko Kiiskila - */ - -#ifndef _ATMLEC_H_ -#define _ATMLEC_H_ - -#include -#include -#include -#include -#include - -/* ATM lec daemon control socket */ -#define ATMLEC_CTRL _IO('a', ATMIOC_LANE) -#define ATMLEC_DATA _IO('a', ATMIOC_LANE+1) -#define ATMLEC_MCAST _IO('a', ATMIOC_LANE+2) - -/* Maximum number of LEC interfaces (tweakable) */ -#define MAX_LEC_ITF 48 - -typedef enum { - l_set_mac_addr, - l_del_mac_addr, - l_svc_setup, - l_addr_delete, - l_topology_change, - l_flush_complete, - l_arp_update, - l_narp_req, /* LANE2 mandates the use of this */ - l_config, - l_flush_tran_id, - l_set_lecid, - l_arp_xmt, - l_rdesc_arp_xmt, - l_associate_req, - l_should_bridge /* should we bridge this MAC? */ -} atmlec_msg_type; - -#define ATMLEC_MSG_TYPE_MAX l_should_bridge - -struct atmlec_config_msg { - unsigned int maximum_unknown_frame_count; - unsigned int max_unknown_frame_time; - unsigned short max_retry_count; - unsigned int aging_time; - unsigned int forward_delay_time; - unsigned int arp_response_time; - unsigned int flush_timeout; - unsigned int path_switching_delay; - unsigned int lane_version; /* LANE2: 1 for LANEv1, 2 for LANEv2 */ - int mtu; - int is_proxy; -}; - -struct atmlec_msg { - atmlec_msg_type type; - int sizeoftlvs; /* LANE2: if != 0, tlvs follow */ - union { - struct { - unsigned char mac_addr[ETH_ALEN]; - unsigned char atm_addr[ATM_ESA_LEN]; - unsigned int flag; /* - * Topology_change flag, - * remoteflag, permanent flag, - * lecid, transaction id - */ - unsigned int targetless_le_arp; /* LANE2 */ - unsigned int no_source_le_narp; /* LANE2 */ - } normal; - struct atmlec_config_msg config; - struct { - __u16 lec_id; /* requestor lec_id */ - __u32 tran_id; /* transaction id */ - unsigned char mac_addr[ETH_ALEN]; /* dst mac addr */ - unsigned char atm_addr[ATM_ESA_LEN]; /* reqestor ATM addr */ - } proxy; /* - * For mapping LE_ARP requests to responses. Filled by - * zeppelin, returned by kernel. Used only when proxying - */ - } content; -} __ATM_API_ALIGN; - -struct atmlec_ioc { - int dev_num; - unsigned char atm_addr[ATM_ESA_LEN]; - unsigned char receive; /* 1= receive vcc, 0 = send vcc */ -}; -#endif /* _ATMLEC_H_ */ diff --git a/include/uapi/linux/atmmpc.h b/include/uapi/linux/atmmpc.h deleted file mode 100644 index cc17f4304839..000000000000 --- a/include/uapi/linux/atmmpc.h +++ /dev/null @@ -1,127 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -#ifndef _ATMMPC_H_ -#define _ATMMPC_H_ - -#include -#include -#include -#include - -#define ATMMPC_CTRL _IO('a', ATMIOC_MPOA) -#define ATMMPC_DATA _IO('a', ATMIOC_MPOA+1) - -#define MPC_SOCKET_INGRESS 1 -#define MPC_SOCKET_EGRESS 2 - -struct atmmpc_ioc { - int dev_num; - __be32 ipaddr; /* the IP address of the shortcut */ - int type; /* ingress or egress */ -}; - -typedef struct in_ctrl_info { - __u8 Last_NHRP_CIE_code; - __u8 Last_Q2931_cause_value; - __u8 eg_MPC_ATM_addr[ATM_ESA_LEN]; - __be32 tag; - __be32 in_dst_ip; /* IP address this ingress MPC sends packets to */ - __u16 holding_time; - __u32 request_id; -} in_ctrl_info; - -typedef struct eg_ctrl_info { - __u8 DLL_header[256]; - __u8 DH_length; - __be32 cache_id; - __be32 tag; - __be32 mps_ip; - __be32 eg_dst_ip; /* IP address to which ingress MPC sends packets */ - __u8 in_MPC_data_ATM_addr[ATM_ESA_LEN]; - __u16 holding_time; -} eg_ctrl_info; - -struct mpc_parameters { - __u16 mpc_p1; /* Shortcut-Setup Frame Count */ - __u16 mpc_p2; /* Shortcut-Setup Frame Time */ - __u8 mpc_p3[8]; /* Flow-detection Protocols */ - __u16 mpc_p4; /* MPC Initial Retry Time */ - __u16 mpc_p5; /* MPC Retry Time Maximum */ - __u16 mpc_p6; /* Hold Down Time */ -} ; - -struct k_message { - __u16 type; - __be32 ip_mask; - __u8 MPS_ctrl[ATM_ESA_LEN]; - union { - in_ctrl_info in_info; - eg_ctrl_info eg_info; - struct mpc_parameters params; - } content; - struct atm_qos qos; -} __ATM_API_ALIGN; - -struct llc_snap_hdr { - /* RFC 1483 LLC/SNAP encapsulation for routed IP PDUs */ - __u8 dsap; /* Destination Service Access Point (0xAA) */ - __u8 ssap; /* Source Service Access Point (0xAA) */ - __u8 ui; /* Unnumbered Information (0x03) */ - __u8 org[3]; /* Organizational identification (0x000000) */ - __u8 type[2]; /* Ether type (for IP) (0x0800) */ -}; - -/* TLVs this MPC recognizes */ -#define TLV_MPOA_DEVICE_TYPE 0x00a03e2a - -/* MPOA device types in MPOA Device Type TLV */ -#define NON_MPOA 0 -#define MPS 1 -#define MPC 2 -#define MPS_AND_MPC 3 - - -/* MPC parameter defaults */ - -#define MPC_P1 10 /* Shortcut-Setup Frame Count */ -#define MPC_P2 1 /* Shortcut-Setup Frame Time */ -#define MPC_P3 0 /* Flow-detection Protocols */ -#define MPC_P4 5 /* MPC Initial Retry Time */ -#define MPC_P5 40 /* MPC Retry Time Maximum */ -#define MPC_P6 160 /* Hold Down Time */ -#define HOLDING_TIME_DEFAULT 1200 /* same as MPS-p7 */ - -/* MPC constants */ - -#define MPC_C1 2 /* Retry Time Multiplier */ -#define MPC_C2 60 /* Initial Keep-Alive Lifetime */ - -/* Message types - to MPOA daemon */ - -#define SND_MPOA_RES_RQST 201 -#define SET_MPS_CTRL_ADDR 202 -#define SND_MPOA_RES_RTRY 203 /* Different type in a retry due to req id */ -#define STOP_KEEP_ALIVE_SM 204 -#define EGRESS_ENTRY_REMOVED 205 -#define SND_EGRESS_PURGE 206 -#define DIE 207 /* tell the daemon to exit() */ -#define DATA_PLANE_PURGE 208 /* Data plane purge because of egress cache hit miss or dead MPS */ -#define OPEN_INGRESS_SVC 209 - -/* Message types - from MPOA daemon */ - -#define MPOA_TRIGGER_RCVD 101 -#define MPOA_RES_REPLY_RCVD 102 -#define INGRESS_PURGE_RCVD 103 -#define EGRESS_PURGE_RCVD 104 -#define MPS_DEATH 105 -#define CACHE_IMPOS_RCVD 106 -#define SET_MPC_CTRL_ADDR 107 /* Our MPC's control ATM address */ -#define SET_MPS_MAC_ADDR 108 -#define CLEAN_UP_AND_EXIT 109 -#define SET_MPC_PARAMS 110 /* MPC configuration parameters */ - -/* Message types - bidirectional */ - -#define RELOAD 301 /* kill -HUP the daemon for reload */ - -#endif /* _ATMMPC_H_ */ diff --git a/include/uapi/linux/atmsvc.h b/include/uapi/linux/atmsvc.h deleted file mode 100644 index 137b5f853449..000000000000 --- a/include/uapi/linux/atmsvc.h +++ /dev/null @@ -1,56 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -/* atmsvc.h - ATM signaling kernel-demon interface definitions */ - -/* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */ - - -#ifndef _LINUX_ATMSVC_H -#define _LINUX_ATMSVC_H - -#include -#include -#include - - -#define ATMSIGD_CTRL _IO('a',ATMIOC_SPECIAL) - /* become ATM signaling demon control socket */ - -enum atmsvc_msg_type { as_catch_null, as_bind, as_connect, as_accept, as_reject, - as_listen, as_okay, as_error, as_indicate, as_close, - as_itf_notify, as_modify, as_identify, as_terminate, - as_addparty, as_dropparty }; - -struct atmsvc_msg { - enum atmsvc_msg_type type; - atm_kptr_t vcc; - atm_kptr_t listen_vcc; /* indicate */ - int reply; /* for okay and close: */ - /* < 0: error before active */ - /* (sigd has discarded ctx) */ - /* ==0: success */ - /* > 0: error when active (still */ - /* need to close) */ - struct sockaddr_atmpvc pvc; /* indicate, okay (connect) */ - struct sockaddr_atmsvc local; /* local SVC address */ - struct atm_qos qos; /* QOS parameters */ - struct atm_sap sap; /* SAP */ - unsigned int session; /* for p2pm */ - struct sockaddr_atmsvc svc; /* SVC address */ -} __ATM_API_ALIGN; - -/* - * Message contents: see ftp://icaftp.epfl.ch/pub/linux/atm/docs/isp-*.tar.gz - */ - -/* - * Some policy stuff for atmsigd and for net/atm/svc.c. Both have to agree on - * what PCR is used to request bandwidth from the device driver. net/atm/svc.c - * tries to do better than that, but only if there's no routing decision (i.e. - * if signaling only uses one ATM interface). - */ - -#define SELECT_TOP_PCR(tp) ((tp).pcr ? (tp).pcr : \ - (tp).max_pcr && (tp).max_pcr != ATM_MAX_PCR ? (tp).max_pcr : \ - (tp).min_pcr ? (tp).min_pcr : ATM_MAX_PCR) - -#endif -- cgit v1.2.3 From 79511603a65b990bed675eb4bcfd85305d3ff42a Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Sat, 13 Jun 2026 18:40:57 -0700 Subject: tls: remove dead sockmap (psock) handling from the SW path TLS and sockmap are now mutually exclusive. Try to delete the code from sendmsg and recvmsg path which is now obviously dead. The main goal is to delete enough code for AI security scanners to no longer bother us with sockmap related bugs. At the same time retain the code in case someone has the cycles to fix all of this and make the integration work, again. If the integration does not get restored we can wipe the rest of the skmsg code from TLS in two or three releases. The changes on the Tx side are deeper since that's where most of the bugs are, Rx side simply takes the data from sockmap and gives it to the user. On Tx split record handling and rolling back the iterator were the two problem areas. Reviewed-by: Jakub Sitnicki Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20260614014102.461064-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/skmsg.h | 9 --------- 1 file changed, 9 deletions(-) (limited to 'include') diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h index 19f4f253b4f9..ca0ec9c8608e 100644 --- a/include/linux/skmsg.h +++ b/include/linux/skmsg.h @@ -544,15 +544,6 @@ static inline void psock_progs_drop(struct sk_psock_progs *progs) psock_set_prog(&progs->skb_verdict, NULL); } -int sk_psock_tls_strp_read(struct sk_psock *psock, struct sk_buff *skb); - -static inline bool sk_psock_strp_enabled(struct sk_psock *psock) -{ - if (!psock) - return false; - return !!psock->saved_data_ready; -} - /* for tcp only, sk is locked */ static inline ssize_t sk_psock_msg_inq(struct sock *sk) { -- cgit v1.2.3 From fad156c2af227f42ca796cbb20ddc354a6dd9932 Mon Sep 17 00:00:00 2001 From: Usama Arif Date: Tue, 16 Jun 2026 07:15:18 -0700 Subject: block: invalidate cached plug timestamp after task switch blk_time_get_ns() caches ktime_get_ns() in current->plug->cur_ktime and marks the task with PF_BLOCK_TS. That cache is only valid while the task keeps running; if the task is switched out, wall-clock time advances and the cached value must not be reused when the task runs again. The existing invalidation covers explicit plug flushes through __blk_flush_plug(), and the schedule() / rtmutex paths through sched_update_worker(). It does not cover in-kernel preemption paths such as preempt_schedule(), preempt_schedule_notrace(), and preempt_schedule_irq(), which enter __schedule(SM_PREEMPT) directly and return without calling sched_update_worker(). As a result, a task preempted while holding a plug with PF_BLOCK_TS set can reuse a stale plug->cur_ktime after it is scheduled back in. blk-iocost then consumes that stale timestamp through ioc_now(), producing stale vnow values for throttle decisions, and through ioc_rqos_done(), inflating on-queue time and feeding false missed-QoS samples into vrate adjustment. Move the schedule-side invalidation to finish_task_switch(), which runs for the scheduled-in task after every actual context switch regardless of which schedule entry point was used. Keep __blk_flush_plug() as the explicit flush/finish-plug invalidation path, and remove only the PF_BLOCK_TS handling from sched_update_worker(). Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption") Cc: stable@vger.kernel.org Signed-off-by: Usama Arif Link: https://patch.msgid.link/20260616141604.328820-3-usama.arif@linux.dev Signed-off-by: Jens Axboe --- include/linux/blkdev.h | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 5070851cf924..9213a5716f95 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -1222,16 +1222,12 @@ static inline void blk_flush_plug(struct blk_plug *plug, bool async) __blk_flush_plug(plug, async); } -/* - * tsk == current here - */ -static inline void blk_plug_invalidate_ts(struct task_struct *tsk) +static __always_inline void blk_plug_invalidate_ts(void) { - struct blk_plug *plug = tsk->plug; - - if (plug) - plug->cur_ktime = 0; - current->flags &= ~PF_BLOCK_TS; + if (unlikely(current->flags & PF_BLOCK_TS)) { + current->plug->cur_ktime = 0; + current->flags &= ~PF_BLOCK_TS; + } } int blkdev_issue_flush(struct block_device *bdev); @@ -1257,7 +1253,7 @@ static inline void blk_flush_plug(struct blk_plug *plug, bool async) { } -static inline void blk_plug_invalidate_ts(struct task_struct *tsk) +static inline void blk_plug_invalidate_ts(void) { } -- cgit v1.2.3 From 225b76e2a711dc061ec337befba49dd3ee75e534 Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Tue, 16 Jun 2026 14:37:52 +0300 Subject: i3c: master: Use unsigned int for dev_nack_retry_count consistently Use unsigned int for dev_nack_retry_count across the core and controller drivers to match the type of master->dev_nack_retry_count. Update the sysfs store path to use kstrtouint() and adjust the ->set_dev_nack_retry() callback prototype and callers accordingly. Signed-off-by: Adrian Hunter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260616113752.196140-4-adrian.hunter@intel.com Signed-off-by: Alexandre Belloni --- include/linux/i3c/master.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/i3c/master.h b/include/linux/i3c/master.h index 27eeb598b3c5..4d2a68793324 100644 --- a/include/linux/i3c/master.h +++ b/include/linux/i3c/master.h @@ -494,7 +494,7 @@ struct i3c_master_controller_ops { int (*disable_hotjoin)(struct i3c_master_controller *master); int (*set_speed)(struct i3c_master_controller *master, enum i3c_open_drain_speed speed); int (*set_dev_nack_retry)(struct i3c_master_controller *master, - unsigned long dev_nack_retry_cnt); + unsigned int dev_nack_retry_cnt); }; /** -- cgit v1.2.3 From 023f9b0f2f4ffbf78ce9dfb8fbacb767c8e97162 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 15:29:34 -0700 Subject: appletalk: stop storing per-interface state in struct net_device AppleTalk keeps its per-interface control block (struct atalk_iface) directly in struct netdevice (dev->atalk_ptr). This is the only thing tying the protocol into the core net_device layout and is the sole blocker to moving AppleTalk out of tree. Replace dev->atalk_ptr with a small ifindex-keyed hashtable internal to ddp.c. The existing atalk_interfaces list stays the owner of the iface objects; the hashtable is purely a fast dev->iface index and reuses the same atalk_interfaces_lock. AFAICT this patch does not make this code any more racy than it already is, I'm sure Sashiko will point out some basically existing bugs. AFAICT atalk_interfaces_lock is the innermost lock already. Acked-by: Stephen Hemminger Link: https://patch.msgid.link/20260615222935.947233-2-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atalk.h | 8 ++------ include/linux/netdevice.h | 4 ---- 2 files changed, 2 insertions(+), 10 deletions(-) (limited to 'include') diff --git a/include/linux/atalk.h b/include/linux/atalk.h index a55bfc6567d0..ce7e6bfa9e2a 100644 --- a/include/linux/atalk.h +++ b/include/linux/atalk.h @@ -30,6 +30,7 @@ struct atalk_iface { #define ATIF_PROBE_FAIL 2 /* Probe collided */ struct atalk_netrange nets; struct atalk_iface *next; + struct hlist_node hash_node; /* keyed on dev->ifindex */ }; struct atalk_sock { @@ -113,12 +114,7 @@ extern int aarp_proto_init(void); /* Inter module exports */ /* Give a device find its atif control structure */ -#if IS_ENABLED(CONFIG_ATALK) -static inline struct atalk_iface *atalk_find_dev(struct net_device *dev) -{ - return dev->atalk_ptr; -} -#endif +extern struct atalk_iface *atalk_find_dev(struct net_device *dev); extern struct atalk_addr *atalk_find_dev_addr(struct net_device *dev); extern struct net_device *atrtr_get_dev(struct atalk_addr *sa); diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 7f4f0837c09f..655564621f28 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1947,7 +1947,6 @@ enum netdev_reg_state { * @vlan_info: VLAN info * @dsa_ptr: dsa specific data * @tipc_ptr: TIPC specific data - * @atalk_ptr: AppleTalk link * @ip_ptr: IPv4 specific data * @ip6_ptr: IPv6 specific data * @ieee80211_ptr: IEEE 802.11 specific data, assign before registering @@ -2349,9 +2348,6 @@ struct net_device { #if IS_ENABLED(CONFIG_TIPC) struct tipc_bearer __rcu *tipc_ptr; #endif -#if IS_ENABLED(CONFIG_ATALK) - void *atalk_ptr; -#endif #if IS_ENABLED(CONFIG_CFG80211) struct wireless_dev *ieee80211_ptr; #endif -- cgit v1.2.3 From 8a398a0c189ead8bbce98f5be70b8ea0e30b21f8 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Mon, 15 Jun 2026 15:29:35 -0700 Subject: appletalk: move the protocol out of tree AppleTalk has been removed in MacOS X 10.6 (Snow Leopard), in 2009, according to Wikipedia. We recently got a burst of AI generated fixes to this protocol which nobody is reviewing. Let AppleTalk follow AX.25 and hamradio out of the Linux tree. We we will maintain the code at: github.com/linux-netdev/mod-orphan for anyone interested in playing with it. Retain the uAPI for now. No strong reason, simply because I suspect keeping it will be less controversial. Acked-by: Stephen Hemminger Link: https://patch.msgid.link/20260615222935.947233-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/atalk.h | 182 -------------------------------------------------- 1 file changed, 182 deletions(-) delete mode 100644 include/linux/atalk.h (limited to 'include') diff --git a/include/linux/atalk.h b/include/linux/atalk.h deleted file mode 100644 index ce7e6bfa9e2a..000000000000 --- a/include/linux/atalk.h +++ /dev/null @@ -1,182 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef __LINUX_ATALK_H__ -#define __LINUX_ATALK_H__ - - -#include -#include - -struct atalk_route { - struct net_device *dev; - struct atalk_addr target; - struct atalk_addr gateway; - int flags; - struct atalk_route *next; -}; - -/** - * struct atalk_iface - AppleTalk Interface - * @dev - Network device associated with this interface - * @address - Our address - * @status - What are we doing? - * @nets - Associated direct netrange - * @next - next element in the list of interfaces - */ -struct atalk_iface { - struct net_device *dev; - struct atalk_addr address; - int status; -#define ATIF_PROBE 1 /* Probing for an address */ -#define ATIF_PROBE_FAIL 2 /* Probe collided */ - struct atalk_netrange nets; - struct atalk_iface *next; - struct hlist_node hash_node; /* keyed on dev->ifindex */ -}; - -struct atalk_sock { - /* struct sock has to be the first member of atalk_sock */ - struct sock sk; - __be16 dest_net; - __be16 src_net; - unsigned char dest_node; - unsigned char src_node; - unsigned char dest_port; - unsigned char src_port; -}; - -static inline struct atalk_sock *at_sk(struct sock *sk) -{ - return (struct atalk_sock *)sk; -} - -struct ddpehdr { - __be16 deh_len_hops; /* lower 10 bits are length, next 4 - hops */ - __be16 deh_sum; - __be16 deh_dnet; - __be16 deh_snet; - __u8 deh_dnode; - __u8 deh_snode; - __u8 deh_dport; - __u8 deh_sport; - /* And netatalk apps expect to stick the type in themselves */ -}; - -static __inline__ struct ddpehdr *ddp_hdr(struct sk_buff *skb) -{ - return (struct ddpehdr *)skb_transport_header(skb); -} - -/* AppleTalk AARP headers */ -struct elapaarp { - __be16 hw_type; -#define AARP_HW_TYPE_ETHERNET 1 -#define AARP_HW_TYPE_TOKENRING 2 - __be16 pa_type; - __u8 hw_len; - __u8 pa_len; -#define AARP_PA_ALEN 4 - __be16 function; -#define AARP_REQUEST 1 -#define AARP_REPLY 2 -#define AARP_PROBE 3 - __u8 hw_src[ETH_ALEN]; - __u8 pa_src_zero; - __be16 pa_src_net; - __u8 pa_src_node; - __u8 hw_dst[ETH_ALEN]; - __u8 pa_dst_zero; - __be16 pa_dst_net; - __u8 pa_dst_node; -} __attribute__ ((packed)); - -static __inline__ struct elapaarp *aarp_hdr(struct sk_buff *skb) -{ - return (struct elapaarp *)skb_transport_header(skb); -} - -/* Not specified - how long till we drop a resolved entry */ -#define AARP_EXPIRY_TIME (5 * 60 * HZ) -/* Size of hash table */ -#define AARP_HASH_SIZE 16 -/* Fast retransmission timer when resolving */ -#define AARP_TICK_TIME (HZ / 5) -/* Send 10 requests then give up (2 seconds) */ -#define AARP_RETRANSMIT_LIMIT 10 -/* - * Some value bigger than total retransmit time + a bit for last reply to - * appear and to stop continual requests - */ -#define AARP_RESOLVE_TIME (10 * HZ) - -extern struct datalink_proto *ddp_dl, *aarp_dl; -extern int aarp_proto_init(void); - -/* Inter module exports */ - -/* Give a device find its atif control structure */ -extern struct atalk_iface *atalk_find_dev(struct net_device *dev); - -extern struct atalk_addr *atalk_find_dev_addr(struct net_device *dev); -extern struct net_device *atrtr_get_dev(struct atalk_addr *sa); -extern int aarp_send_ddp(struct net_device *dev, - struct sk_buff *skb, - struct atalk_addr *sa, void *hwaddr); -extern void aarp_device_down(struct net_device *dev); -extern void aarp_probe_network(struct atalk_iface *atif); -extern int aarp_proxy_probe_network(struct atalk_iface *atif, - struct atalk_addr *sa); -extern void aarp_proxy_remove(struct net_device *dev, - struct atalk_addr *sa); - -extern void aarp_cleanup_module(void); - -extern struct hlist_head atalk_sockets; -extern rwlock_t atalk_sockets_lock; - -extern struct atalk_route *atalk_routes; -extern rwlock_t atalk_routes_lock; - -extern struct atalk_iface *atalk_interfaces; -extern rwlock_t atalk_interfaces_lock; - -extern struct atalk_route atrtr_default; - -struct aarp_iter_state { - int bucket; - struct aarp_entry **table; -}; - -extern const struct seq_operations aarp_seq_ops; - -extern int sysctl_aarp_expiry_time; -extern int sysctl_aarp_tick_time; -extern int sysctl_aarp_retransmit_limit; -extern int sysctl_aarp_resolve_time; - -#ifdef CONFIG_SYSCTL -extern int atalk_register_sysctl(void); -extern void atalk_unregister_sysctl(void); -#else -static inline int atalk_register_sysctl(void) -{ - return 0; -} -static inline void atalk_unregister_sysctl(void) -{ -} -#endif - -#ifdef CONFIG_PROC_FS -extern int atalk_proc_init(void); -extern void atalk_proc_exit(void); -#else -static inline int atalk_proc_init(void) -{ - return 0; -} -static inline void atalk_proc_exit(void) -{ -} -#endif /* CONFIG_PROC_FS */ - -#endif /* __LINUX_ATALK_H__ */ -- cgit v1.2.3 From 406e8a651a7b854c41fecd5117bb282b3a6c2c6b Mon Sep 17 00:00:00 2001 From: Yiming Qian Date: Wed, 10 Jun 2026 06:21:36 +0000 Subject: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages. Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache. Keep sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting. Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling") Cc: stable@vger.kernel.org Reported-by: Yiming Qian Reported-by: Keenan Dong Signed-off-by: Yiming Qian Link: https://patch.msgid.link/20260610062137.49075-1-yimingqian591@gmail.com Signed-off-by: Jakub Kicinski --- include/linux/skmsg.h | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h index 19f4f253b4f9..937823856de5 100644 --- a/include/linux/skmsg.h +++ b/include/linux/skmsg.h @@ -4,6 +4,7 @@ #ifndef _LINUX_SKMSG_H #define _LINUX_SKMSG_H +#include #include #include #include @@ -199,11 +200,14 @@ static inline void sk_msg_xfer(struct sk_msg *dst, struct sk_msg *src, int which, u32 size) { dst->sg.data[which] = src->sg.data[which]; + __assign_bit(which, dst->sg.copy, test_bit(which, src->sg.copy)); dst->sg.data[which].length = size; dst->sg.size += size; src->sg.size -= size; src->sg.data[which].length -= size; src->sg.data[which].offset += size; + if (!src->sg.data[which].length) + __clear_bit(which, src->sg.copy); } static inline void sk_msg_xfer_full(struct sk_msg *dst, struct sk_msg *src) @@ -273,16 +277,19 @@ static inline void sk_msg_page_add(struct sk_msg *msg, struct page *page, static inline void sk_msg_sg_copy(struct sk_msg *msg, u32 i, bool copy_state) { do { - if (copy_state) - __set_bit(i, msg->sg.copy); - else - __clear_bit(i, msg->sg.copy); + __assign_bit(i, msg->sg.copy, copy_state); sk_msg_iter_var_next(i); if (i == msg->sg.end) break; } while (1); } +static inline void sk_msg_sg_copy_assign(struct sk_msg *dst, u32 dst_i, + const struct sk_msg *src, u32 src_i) +{ + __assign_bit(dst_i, dst->sg.copy, test_bit(src_i, src->sg.copy)); +} + static inline void sk_msg_sg_copy_set(struct sk_msg *msg, u32 start) { sk_msg_sg_copy(msg, start, true); -- cgit v1.2.3 From 1e696bc33c30acda698e5e921adcc7f7e61976f7 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Thu, 11 Jun 2026 23:55:02 +0200 Subject: i2c: atr: annotate i2c_atr_adap_desc->aliases with __counted_by_ptr Add the __counted_by_ptr() compiler attribute to ->aliases to improve bounds checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Signed-off-by: Thorsten Blum Reviewed-by: Luca Ceresoli Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20260611215501.464405-3-thorsten.blum@linux.dev --- include/linux/i2c-atr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/i2c-atr.h b/include/linux/i2c-atr.h index 2bb54dc87c8e..b52a7b9ec536 100644 --- a/include/linux/i2c-atr.h +++ b/include/linux/i2c-atr.h @@ -71,7 +71,7 @@ struct i2c_atr_adap_desc { struct device *parent; struct fwnode_handle *bus_handle; size_t num_aliases; - u16 *aliases; + u16 *aliases __counted_by_ptr(num_aliases); }; /** -- cgit v1.2.3 From 68de007d5ac9df0e3f4f187a179c5c842bb5a2be Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Fri, 12 Jun 2026 05:56:34 +0000 Subject: xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] KCSAN reported a data race involving net->xfrm.policy_count access. Add missing READ_ONCE()/WRITE_ONCE() annotations on xfrm_policy_count and xfrm_policy_default. Fixes: 2518c7c2b3d7 ("[XFRM]: Hash policies when non-prefixed.") Reported-by: syzbot+d85ba1c732720b9a4097@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a2b9e96.99669fcc.12a77b.0006.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 874409127e29..35a743129329 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1250,8 +1250,8 @@ int __xfrm_policy_check(struct sock *, int dir, struct sk_buff *skb, static inline bool __xfrm_check_nopolicy(struct net *net, struct sk_buff *skb, int dir) { - if (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) - return net->xfrm.policy_default[dir] == XFRM_USERPOLICY_ACCEPT; + if (!READ_ONCE(net->xfrm.policy_count[dir]) && !secpath_exists(skb)) + return READ_ONCE(net->xfrm.policy_default[dir]) == XFRM_USERPOLICY_ACCEPT; return false; } @@ -1351,8 +1351,8 @@ static inline int xfrm_route_forward(struct sk_buff *skb, unsigned short family) { struct net *net = dev_net(skb->dev); - if (!net->xfrm.policy_count[XFRM_POLICY_OUT] && - net->xfrm.policy_default[XFRM_POLICY_OUT] == XFRM_USERPOLICY_ACCEPT) + if (!READ_ONCE(net->xfrm.policy_count[XFRM_POLICY_OUT]) && + READ_ONCE(net->xfrm.policy_default[XFRM_POLICY_OUT]) == XFRM_USERPOLICY_ACCEPT) return true; return (skb_dst(skb)->flags & DST_NOXFRM) || -- cgit v1.2.3 From 40f0b1047918539f0b0f795ac65e35336b4c2c78 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Mon, 15 Jun 2026 09:02:37 +0000 Subject: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set). Fix this by: - Rejecting mismatched families in xfrm_selector_match. - Returning false in addr4_match if prefixlen > 32. - Returning false in addr_match if prefixlen > 128 (prevents overflow). Fixes: 3f0ab59e6537 ("xfrm: validate new SA's prefixlen using SA family when sel.family is unset") Reported-by: syzbot+9383b1ff0df4b29ca5e6@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a2fbe35.be3f099c.2836ae.0018.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 35a743129329..f8c909b0f0c3 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -943,6 +943,9 @@ static inline bool addr_match(const void *token1, const void *token2, unsigned int pdw; unsigned int pbi; + if (prefixlen > 128) + return false; + pdw = prefixlen >> 5; /* num of whole u32 in prefix */ pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */ @@ -967,6 +970,10 @@ static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen) /* C99 6.5.7 (3): u32 << 32 is undefined behaviour */ if (sizeof(long) == 4 && prefixlen == 0) return true; + + if (prefixlen > 32) + return false; + return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen))); } -- cgit v1.2.3 From e491ebea157ff3ba18483ea0f82a9536dc393dec Mon Sep 17 00:00:00 2001 From: Kaustabh Chakraborty Date: Sat, 16 May 2026 03:08:36 +0530 Subject: mfd: sec: Add support for S2MU005 PMIC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Samsung's S2MU005 PMIC includes subdevices for a charger, an MUIC (Micro USB Interface Controller), and flash and RGB LED controllers. S2MU005's interrupt registers divided into three domains, each for the charger, flash LEDs, and the MUIC, packed into a single regmap IRQ chip construct. In devices other than S2MPG1X, the revision can be retrieved from the first register of the PMIC regmap. In S2MU005 however, the location is in offset 0x73. Introduce a switch-case block to allow selecting the REG_ID register. S2MU005 also has a field mask for the revision. Apply it using FIELD_GET() and get the extracted value. Add initial support for S2MU005 in the PMIC driver, along with its three interrupt chips, and support for allowing to fetch revision based on the device variant. Co-developed-by: Łukasz Lebiedziński Signed-off-by: Łukasz Lebiedziński Signed-off-by: Kaustabh Chakraborty Link: https://patch.msgid.link/20260516-s2mu005-pmic-v7-4-73f9702fb461@disroot.org Signed-off-by: Lee Jones --- include/linux/mfd/samsung/core.h | 1 + include/linux/mfd/samsung/irq.h | 66 +++++++ include/linux/mfd/samsung/s2mu005.h | 332 ++++++++++++++++++++++++++++++++++++ 3 files changed, 399 insertions(+) create mode 100644 include/linux/mfd/samsung/s2mu005.h (limited to 'include') diff --git a/include/linux/mfd/samsung/core.h b/include/linux/mfd/samsung/core.h index 4480c631110a..6191f409de94 100644 --- a/include/linux/mfd/samsung/core.h +++ b/include/linux/mfd/samsung/core.h @@ -47,6 +47,7 @@ enum sec_device_type { S2MPS15X, S2MPU02, S2MPU05, + S2MU005, }; /** diff --git a/include/linux/mfd/samsung/irq.h b/include/linux/mfd/samsung/irq.h index 6eab95de6fa8..19d0f0e12944 100644 --- a/include/linux/mfd/samsung/irq.h +++ b/include/linux/mfd/samsung/irq.h @@ -408,6 +408,72 @@ enum s2mpu05_irq { #define S2MPU05_IRQ_INT140C_MASK BIT(1) #define S2MPU05_IRQ_TSD_MASK BIT(2) +enum s2mu005_irq { + S2MU005_IRQ_CHGR_DETBAT, + S2MU005_IRQ_CHGR_BAT, + S2MU005_IRQ_CHGR_IVR, + S2MU005_IRQ_CHGR_EVENT, + S2MU005_IRQ_CHGR_CHG, + S2MU005_IRQ_CHGR_VMID, + S2MU005_IRQ_CHGR_WCIN, + S2MU005_IRQ_CHGR_VBUS, + + S2MU005_IRQ_FLED_LBPROT, + S2MU005_IRQ_FLED_OPENCH2, + S2MU005_IRQ_FLED_OPENCH1, + S2MU005_IRQ_FLED_SHORTCH2, + S2MU005_IRQ_FLED_SHORTCH1, + + S2MU005_IRQ_MUIC_ATTACH, + S2MU005_IRQ_MUIC_DETACH, + S2MU005_IRQ_MUIC_KP, + S2MU005_IRQ_MUIC_LKP, + S2MU005_IRQ_MUIC_LKR, + S2MU005_IRQ_MUIC_RIDCHG, + + S2MU005_IRQ_MUIC_VBUSON, + S2MU005_IRQ_MUIC_RSVD, + S2MU005_IRQ_MUIC_ADC, + S2MU005_IRQ_MUIC_STUCK, + S2MU005_IRQ_MUIC_STUCKRCV, + S2MU005_IRQ_MUIC_MHDL, + S2MU005_IRQ_MUIC_AVCHG, + S2MU005_IRQ_MUIC_VBUSOFF, + + S2MU005_IRQ_NR, +}; + +#define S2MU005_IRQ_CHGR_DETBAT_MASK BIT(0) +#define S2MU005_IRQ_CHGR_BAT_MASK BIT(1) +#define S2MU005_IRQ_CHGR_IVR_MASK BIT(2) +#define S2MU005_IRQ_CHGR_EVENT_MASK BIT(3) +#define S2MU005_IRQ_CHGR_CHG_MASK BIT(4) +#define S2MU005_IRQ_CHGR_VMID_MASK BIT(5) +#define S2MU005_IRQ_CHGR_WCIN_MASK BIT(6) +#define S2MU005_IRQ_CHGR_VBUS_MASK BIT(7) + +#define S2MU005_IRQ_FLED_LBPROT_MASK BIT(2) +#define S2MU005_IRQ_FLED_OPENCH2_MASK BIT(4) +#define S2MU005_IRQ_FLED_OPENCH1_MASK BIT(5) +#define S2MU005_IRQ_FLED_SHORTCH2_MASK BIT(6) +#define S2MU005_IRQ_FLED_SHORTCH1_MASK BIT(7) + +#define S2MU005_IRQ_MUIC_ATTACH_MASK BIT(0) +#define S2MU005_IRQ_MUIC_DETACH_MASK BIT(1) +#define S2MU005_IRQ_MUIC_KP_MASK BIT(2) +#define S2MU005_IRQ_MUIC_LKP_MASK BIT(3) +#define S2MU005_IRQ_MUIC_LKR_MASK BIT(4) +#define S2MU005_IRQ_MUIC_RIDCHG_MASK BIT(5) + +#define S2MU005_IRQ_MUIC_VBUSON_MASK BIT(0) +#define S2MU005_IRQ_MUIC_RSVD_MASK BIT(1) +#define S2MU005_IRQ_MUIC_ADC_MASK BIT(2) +#define S2MU005_IRQ_MUIC_STUCK_MASK BIT(3) +#define S2MU005_IRQ_MUIC_STUCKRCV_MASK BIT(4) +#define S2MU005_IRQ_MUIC_MHDL_MASK BIT(5) +#define S2MU005_IRQ_MUIC_AVCHG_MASK BIT(6) +#define S2MU005_IRQ_MUIC_VBUSOFF_MASK BIT(7) + enum s5m8767_irq { S5M8767_IRQ_PWRR, S5M8767_IRQ_PWRF, diff --git a/include/linux/mfd/samsung/s2mu005.h b/include/linux/mfd/samsung/s2mu005.h new file mode 100644 index 000000000000..46e7759545af --- /dev/null +++ b/include/linux/mfd/samsung/s2mu005.h @@ -0,0 +1,332 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright (c) 2015 Samsung Electronics Co., Ltd + * Copyright (c) 2026 Kaustabh Chakraborty + * Copyright (c) 2026 Łukasz Lebiedziński + */ + +#ifndef __LINUX_MFD_S2MU005_H +#define __LINUX_MFD_S2MU005_H + +#include +#include + +/* S2MU005 registers */ +enum s2mu005_reg { + S2MU005_REG_CHGR_INT1, + S2MU005_REG_CHGR_INT1M, + + S2MU005_REG_FLED_INT1, + S2MU005_REG_FLED_INT1M, + + S2MU005_REG_MUIC_INT1, + S2MU005_REG_MUIC_INT2, + S2MU005_REG_MUIC_INT1M, + S2MU005_REG_MUIC_INT2M, + + S2MU005_REG_CHGR_STATUS0, + S2MU005_REG_CHGR_STATUS1, + S2MU005_REG_CHGR_STATUS2, + S2MU005_REG_CHGR_STATUS3, + S2MU005_REG_CHGR_STATUS4, + S2MU005_REG_CHGR_STATUS5, + S2MU005_REG_CHGR_CTRL0, + S2MU005_REG_CHGR_CTRL1, + S2MU005_REG_CHGR_CTRL2, + S2MU005_REG_CHGR_CTRL3, + S2MU005_REG_CHGR_CTRL4, + S2MU005_REG_CHGR_CTRL5, + S2MU005_REG_CHGR_CTRL6, + S2MU005_REG_CHGR_CTRL7, + S2MU005_REG_CHGR_CTRL8, + S2MU005_REG_CHGR_CTRL9, + S2MU005_REG_CHGR_CTRL10, + S2MU005_REG_CHGR_CTRL11, + S2MU005_REG_CHGR_CTRL12, + S2MU005_REG_CHGR_CTRL13, + S2MU005_REG_CHGR_CTRL14, + S2MU005_REG_CHGR_CTRL15, + S2MU005_REG_CHGR_CTRL16, + S2MU005_REG_CHGR_CTRL17, + S2MU005_REG_CHGR_CTRL18, + S2MU005_REG_CHGR_CTRL19, + S2MU005_REG_CHGR_TEST0, + S2MU005_REG_CHGR_TEST1, + S2MU005_REG_CHGR_TEST2, + S2MU005_REG_CHGR_TEST3, + S2MU005_REG_CHGR_TEST4, + S2MU005_REG_CHGR_TEST5, + S2MU005_REG_CHGR_TEST6, + S2MU005_REG_CHGR_TEST7, + S2MU005_REG_CHGR_TEST8, + S2MU005_REG_CHGR_TEST9, + S2MU005_REG_CHGR_TEST10, + + S2MU005_REG_FLED_STATUS, + S2MU005_REG_FLED_CH0_CTRL0, + S2MU005_REG_FLED_CH0_CTRL1, + S2MU005_REG_FLED_CH0_CTRL2, + S2MU005_REG_FLED_CH0_CTRL3, + S2MU005_REG_FLED_CH1_CTRL0, + S2MU005_REG_FLED_CH1_CTRL1, + S2MU005_REG_FLED_CH1_CTRL2, + S2MU005_REG_FLED_CH1_CTRL3, + S2MU005_REG_FLED_CTRL0, + S2MU005_REG_FLED_CTRL1, + S2MU005_REG_FLED_CTRL2, + S2MU005_REG_FLED_CTRL3, + S2MU005_REG_FLED_CTRL4, + S2MU005_REG_FLED_CTRL5, + S2MU005_REG_FLED_CTRL6, + + S2MU005_REG_RGB_EN, + S2MU005_REG_RGB_CH0_CTRL, + S2MU005_REG_RGB_CH1_CTRL, + S2MU005_REG_RGB_CH2_CTRL, + S2MU005_REG_RGB_CH0_RAMP, + S2MU005_REG_RGB_CH0_STAY, + S2MU005_REG_RGB_CH1_RAMP, + S2MU005_REG_RGB_CH1_STAY, + S2MU005_REG_RGB_CH2_RAMP, + S2MU005_REG_RGB_CH2_STAY, + S2MU005_REG_RGB_TEST0, + S2MU005_REG_RGB_CTRL0, + + S2MU005_REG_MUIC_ADC, + S2MU005_REG_MUIC_DEV1, + S2MU005_REG_MUIC_DEV2, + S2MU005_REG_MUIC_DEV3, + S2MU005_REG_MUIC_BUTTON1, + S2MU005_REG_MUIC_BUTTON2, + S2MU005_REG_MUIC_RESET, + S2MU005_REG_MUIC_CHGTYPE, + S2MU005_REG_MUIC_DEVAPPLE, + S2MU005_REG_MUIC_BCDRESCAN, + S2MU005_REG_MUIC_TEST1, + S2MU005_REG_MUIC_TEST2, + S2MU005_REG_MUIC_TEST3, + + S2MU005_REG_ID = 0x73, + + S2MU005_REG_MUIC_CTRL1 = 0xb2, + S2MU005_REG_MUIC_TIMERSET1, + S2MU005_REG_MUIC_TIMERSET2, + S2MU005_REG_MUIC_SWCTRL, + S2MU005_REG_MUIC_TIMERSET3, + S2MU005_REG_MUIC_CTRL2, + S2MU005_REG_MUIC_CTRL3, + + S2MU005_REG_MUIC_LDOADC_L = 0xbf, + S2MU005_REG_MUIC_LDOADC_H, +}; + +#define S2MU005_REG_FLED_CH_CTRL0(x) (S2MU005_REG_FLED_CH0_CTRL0 + 4 * (x)) +#define S2MU005_REG_FLED_CH_CTRL1(x) (S2MU005_REG_FLED_CH0_CTRL1 + 4 * (x)) +#define S2MU005_REG_FLED_CH_CTRL2(x) (S2MU005_REG_FLED_CH0_CTRL2 + 4 * (x)) +#define S2MU005_REG_FLED_CH_CTRL3(x) (S2MU005_REG_FLED_CH0_CTRL3 + 4 * (x)) + +#define S2MU005_REG_RGB_CH_CTRL(x) (S2MU005_REG_RGB_CH0_CTRL + 1 * (x)) +#define S2MU005_REG_RGB_CH_RAMP(x) (S2MU005_REG_RGB_CH0_RAMP + 2 * (x)) +#define S2MU005_REG_RGB_CH_STAY(x) (S2MU005_REG_RGB_CH0_STAY + 2 * (x)) + +/* S2MU005_REG_CHGR_STATUS0 */ +#define S2MU005_CHGR_VBUS BIT(7) +#define S2MU005_CHGR_WCIN BIT(6) +#define S2MU005_CHGR_VMID BIT(5) +#define S2MU005_CHGR_CHG BIT(4) +#define S2MU005_CHGR_STAT GENMASK(3, 0) + +#define S2MU005_CHGR_STAT_DONE 8 +#define S2MU005_CHGR_STAT_TOPOFF 7 +#define S2MU005_CHGR_STAT_DONE_FLAG 6 +#define S2MU005_CHGR_STAT_CV 5 +#define S2MU005_CHGR_STAT_CC 4 +#define S2MU005_CHGR_STAT_COOL_CHG 3 +#define S2MU005_CHGR_STAT_PRE_CHG 2 + +/* S2MU005_REG_CHGR_STATUS1 */ +#define S2MU005_CHGR_DETBAT BIT(7) +#define S2MU005_CHGR_VBUS_OVP GENMASK(6, 4) + +#define S2MU005_CHGR_VBUS_OVP_OVERVOLT 2 + +/* S2MU005_REG_CHGR_STATUS2 */ +#define S2MU005_CHGR_BAT GENMASK(6, 4) + +#define S2MU005_CHGR_BAT_VOLT_DET 7 +#define S2MU005_CHGR_BAT_FAST_CHG_DET 6 +#define S2MU005_CHGR_BAT_COOL_CHG_DET 5 +#define S2MU005_CHGR_BAT_LOW_CHG 2 +#define S2MU005_CHGR_BAT_SELF_DISCHG 1 +#define S2MU005_CHGR_BAT_OVP_DET 0 + +/* S2MU005_REG_CHGR_STATUS3 */ +#define S2MU005_CHGR_EVT GENMASK(3, 0) + +#define S2MU005_CHGR_EVT_WDT_RST 6 +#define S2MU005_CHGR_EVT_WDT_SUSP 5 +#define S2MU005_CHGR_EVT_VSYS_VUVLO 4 +#define S2MU005_CHGR_EVT_VSYS_VOVP 3 +#define S2MU005_CHGR_EVT_THERM_FOLDBACK 2 +#define S2MU005_CHGR_EVT_THERM_SHUTDOWN 1 + +/* S2MU005_REG_CHGR_CTRL0 */ +#define S2MU005_CHGR_CHG_EN BIT(4) +#define S2MU005_CHGR_OP_MODE GENMASK(2, 0) + +#define S2MU005_CHGR_OP_MODE_OTG BIT(2) +#define S2MU005_CHGR_OP_MODE_CHG BIT(1) + +/* S2MU005_REG_CHGR_CTRL1 */ +#define S2MU005_CHGR_VIN_DROP GENMASK(6, 4) + +/* S2MU005_REG_CHGR_CTRL2 */ +#define S2MU005_CHGR_IN_CURR_LIM GENMASK(5, 0) + +/* S2MU005_REG_CHGR_CTRL4 */ +#define S2MU005_CHGR_OTG_OCP_ON BIT(5) +#define S2MU005_CHGR_OTG_OCP_OFF BIT(4) +#define S2MU005_CHGR_OTG_OCP GENMASK(3, 2) +#define S2MU005_CHGR_OTG_OCP_1P5A 0x3 + +/* S2MU005_REG_CHGR_CTRL5 */ +#define S2MU005_CHGR_VMID_BOOST GENMASK(4, 0) +#define S2MU005_CHGR_VMID_BOOST_5P1V 0x16 + +/* S2MU005_REG_CHGR_CTRL6 */ +#define S2MU005_CHGR_COOL_CHG_CURR GENMASK(5, 0) + +/* S2MU005_REG_CHGR_CTRL7 */ +#define S2MU005_CHGR_FAST_CHG_CURR GENMASK(5, 0) + +/* S2MU005_REG_CHGR_CTRL8 */ +#define S2MU005_CHGR_VF_VBAT GENMASK(6, 1) + +/* S2MU005_REG_CHGR_CTRL10 */ +#define S2MU005_CHGR_TOPOFF_CURR(x) (GENMASK(3, 0) << 4 * (x)) + +/* S2MU005_REG_CHGR_CTRL11 */ +#define S2MU005_CHGR_OSC_BOOST GENMASK(6, 5) +#define S2MU005_CHGR_OSC_BUCK GENMASK(4, 3) +#define S2MU005_CHGR_OSC_BOOST_2MHZ 0x3 + +/* S2MU005_REG_CHGR_CTRL12 */ +#define S2MU005_CHGR_WDT GENMASK(2, 0) + +#define S2MU005_CHGR_WDT_ON BIT(2) +#define S2MU005_CHGR_WDT_OFF BIT(1) + +/* S2MU005_REG_CHGR_CTRL15 */ +#define S2MU005_CHGR_OTG_EN GENMASK(3, 2) +#define S2MU005_CHGR_OTG_EN_ON 0x3 + +/* S2MU005_REG_FLED_STATUS */ +#define S2MU005_FLED_FLASH_STATUS(x) (BIT(7) >> 2 * (x)) +#define S2MU005_FLED_TORCH_STATUS(x) (BIT(6) >> 2 * (x)) + +/* S2MU005_REG_FLED_CHx_CTRL0 */ +#define S2MU005_FLED_FLASH_IOUT GENMASK(3, 0) + +/* S2MU005_REG_FLED_CHx_CTRL1 */ +#define S2MU005_FLED_TORCH_IOUT GENMASK(3, 0) + +/* S2MU005_REG_FLED_CHx_CTRL2 */ +#define S2MU005_FLED_TORCH_TIMEOUT GENMASK(3, 0) + +/* S2MU005_REG_FLED_CHx_CTRL3 */ +#define S2MU005_FLED_FLASH_TIMEOUT GENMASK(3, 0) + +/* S2MU005_REG_FLED_CTRL1 */ +#define S2MU005_FLED_CH_EN BIT(7) + +/* + * S2MU005_REG_FLED_CTRL4 - Rev. EVT0 + * S2MU005_REG_FLED_CTRL6 - Rev. EVT1 and later + */ +#define S2MU005_FLED_FLASH_EN(x) (GENMASK(7, 6) >> 4 * (x)) +#define S2MU005_FLED_TORCH_EN(x) (GENMASK(5, 4) >> 4 * (x)) + +/* S2MU005_REG_RGB_EN */ +#define S2MU005_RGB_RESET BIT(6) +#define S2MU005_RGB_SLOPE GENMASK(5, 0) + +#define S2MU005_RGB_SLOPE_CONST (BIT(4) | BIT(2) | BIT(0)) +#define S2MU005_RGB_SLOPE_SMOOTH (BIT(5) | BIT(3) | BIT(1)) + +/* S2MU005_REG_RGB_CHx_RAMP */ +#define S2MU005_RGB_CH_RAMP_UP GENMASK(7, 4) +#define S2MU005_RGB_CH_RAMP_DN GENMASK(3, 0) + +/* S2MU005_REG_RGB_CHx_STAY */ +#define S2MU005_RGB_CH_STAY_HI GENMASK(7, 4) +#define S2MU005_RGB_CH_STAY_LO GENMASK(3, 0) + +/* S2MU005_REG_MUIC_DEV1 */ +#define S2MU005_MUIC_OTG BIT(7) +#define S2MU005_MUIC_DCP BIT(6) +#define S2MU005_MUIC_CDP BIT(5) +#define S2MU005_MUIC_T1_T2_CHG BIT(4) +#define S2MU005_MUIC_UART BIT(3) +#define S2MU005_MUIC_SDP BIT(2) +#define S2MU005_MUIC_LANHUB BIT(1) +#define S2MU005_MUIC_AUDIO BIT(0) + +/* S2MU005_REG_MUIC_DEV2 */ +#define S2MU005_MUIC_SDP_1P8S BIT(7) +#define S2MU005_MUIC_AV BIT(6) +#define S2MU005_MUIC_TTY BIT(5) +#define S2MU005_MUIC_PPD BIT(4) +#define S2MU005_MUIC_JIG_UART_OFF BIT(3) +#define S2MU005_MUIC_JIG_UART_ON BIT(2) +#define S2MU005_MUIC_JIG_USB_OFF BIT(1) +#define S2MU005_MUIC_JIG_USB_ON BIT(0) + +/* S2MU005_REG_MUIC_DEV3 */ +#define S2MU005_MUIC_U200_CHG BIT(7) +#define S2MU005_MUIC_VBUS_AV BIT(4) +#define S2MU005_MUIC_VBUS_R255 BIT(1) +#define S2MU005_MUIC_MHL BIT(0) + +/* S2MU005_REG_MUIC_DEVAPPLE */ +#define S2MU005_MUIC_APPLE_CHG_0P5A BIT(7) +#define S2MU005_MUIC_APPLE_CHG_1P0A BIT(6) +#define S2MU005_MUIC_APPLE_CHG_2P0A BIT(5) +#define S2MU005_MUIC_APPLE_CHG_2P4A BIT(4) +#define S2MU005_MUIC_SDP_DCD_OUT BIT(3) +#define S2MU005_MUIC_RID_WAKEUP BIT(2) +#define S2MU005_MUIC_VBUS_WAKEUP BIT(1) +#define S2MU005_MUIC_BCV1P2_OR_OPEN BIT(0) + +/* S2MU005_REG_ID */ +#define S2MU005_ID_MASK GENMASK(3, 0) + +/* S2MU005_REG_MUIC_SWCTRL */ +#define S2MU005_MUIC_DM_DP GENMASK(7, 2) +#define S2MU005_MUIC_JIG BIT(0) + +#define S2MU005_MUIC_DM_DP_UART 0x12 +#define S2MU005_MUIC_DM_DP_USB 0x09 + +/* S2MU005_REG_MUIC_CTRL1 */ +#define S2MU005_MUIC_OPEN BIT(4) +#define S2MU005_MUIC_RAW_DATA BIT(3) +#define S2MU005_MUIC_MAN_SW BIT(2) +#define S2MU005_MUIC_WAIT BIT(1) +#define S2MU005_MUIC_IRQ BIT(0) + +/* S2MU005_REG_MUIC_CTRL3 */ +#define S2MU005_MUIC_ONESHOT_ADC BIT(2) + +/* S2MU005_REG_MUIC_LDOADC_L and S2MU005_REG_MUIC_LDOADC_H */ +#define S2MU005_MUIC_VSET GENMASK(4, 0) + +#define S2MU005_MUIC_VSET_3P0V 0x1f +#define S2MU005_MUIC_VSET_2P6V 0x0e +#define S2MU005_MUIC_VSET_2P4V 0x0c +#define S2MU005_MUIC_VSET_2P2V 0x0a +#define S2MU005_MUIC_VSET_2P0V 0x08 +#define S2MU005_MUIC_VSET_1P5V 0x03 +#define S2MU005_MUIC_VSET_1P4V 0x02 +#define S2MU005_MUIC_VSET_1P2V 0x00 + +#endif /* __LINUX_MFD_S2MU005_H */ -- cgit v1.2.3 From 7c150c17c01d4d64942b9872d66dd7670e8ba80e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Corvin=20K=C3=B6hne?= Date: Wed, 8 Apr 2026 08:29:42 +0200 Subject: dt-binding: leds: Publish common bindings under dual license MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Changes leds/common.h DT binding header file to be published under GPLv2 or BSD-2-Clause license terms. This change allows this common LED bindings header file to be used in software components as bootloaders and OSes that are not published under GPLv2 terms. All contributors to leds/common.h file in copy. Signed-off-by: Corvin Köhne Acked-by: Krzysztof Kozlowski Acked-by: Gergo Koteles Acked-by: Jacek Anaszewski Acked-by: Rafał Miłecki Link: https://patch.msgid.link/20260408062942.7128-1-corvin.koehne@gmail.com Signed-off-by: Lee Jones --- include/dt-bindings/leds/common.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/dt-bindings/leds/common.h b/include/dt-bindings/leds/common.h index 4f017bea0123..b7bafbaf7df3 100644 --- a/include/dt-bindings/leds/common.h +++ b/include/dt-bindings/leds/common.h @@ -1,4 +1,4 @@ -/* SPDX-License-Identifier: GPL-2.0 */ +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) */ /* * This header provides macros for the common LEDs device tree bindings. * -- cgit v1.2.3 From 2682d6308654850ee4d4f9b3bbe3a31417890594 Mon Sep 17 00:00:00 2001 From: Armin Wolf Date: Sat, 9 May 2026 23:46:03 +0200 Subject: leds: Introduce the multi_max_intensity sysfs attribute Some multicolor LEDs support global brightness control in hardware, meaning that the maximum intensity of the color components is not connected to the maximum global brightness. Such LEDs cannot be described properly by the current multicolor LED class interface, because it assumes that the maximum intensity of each color component is described by the maximum global brightness of the LED. Fix this by introducing a new sysfs attribute called "multi_max_intensity" holding the maximum intensity values for the color components of a multicolor LED class device. Drivers can use the new max_intensity field inside struct mc_subled to tell the multicolor LED class code about those values. Intensity values written by userspace applications will be limited to this maximum value. Drivers for multicolor LEDs that do not support global brightness control in hardware might still want to use the maximum global LED brightness supplied via devicetree as the maximum intensity of each individual color component. Such drivers should set max_intensity to 0 so that the multicolor LED core can act accordingly. The lp50xx and ncp5623 LED drivers already use hardware-based control for the global LED brightness. Modify those drivers to correctly initalize .max_intensity to avoid being limited to the maximum global brightness supplied via devicetree. Reviewed-by: Werner Sembach Reviewed-by: Jacek Anaszewski Signed-off-by: Armin Wolf Link: https://patch.msgid.link/20260509214603.262368-2-W_Armin@gmx.de Signed-off-by: Lee Jones --- include/linux/led-class-multicolor.h | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/led-class-multicolor.h b/include/linux/led-class-multicolor.h index db9f34c6736e..8a05836cae25 100644 --- a/include/linux/led-class-multicolor.h +++ b/include/linux/led-class-multicolor.h @@ -9,10 +9,31 @@ #include #include +/** + * struct mc_subled - Color component description. + * @color_index: Color ID. + * @brightness: Scaled intensity. + * @intensity: Current intensity. + * @max_intensity: Maximum supported intensity value. + * @channel: Channel index. + * + * Describes a color component of a multicolor LED. Many multicolor LEDs + * do not support global brightness control in hardware, so they use + * the brightness field in connection with led_mc_calc_color_components() + * to perform the intensity scaling in software. + * Such drivers should set max_intensity to 0 to signal the multicolor LED core + * that the maximum global brightness of the LED class device should be used for + * limiting incoming intensity values. + * + * Multicolor LEDs that do support global brightness control in hardware + * should instead set max_intensity to the maximum intensity value supported + * by the hardware for a given color component. + */ struct mc_subled { unsigned int color_index; unsigned int brightness; unsigned int intensity; + unsigned int max_intensity; unsigned int channel; }; @@ -53,7 +74,14 @@ int led_classdev_multicolor_register_ext(struct device *parent, */ void led_classdev_multicolor_unregister(struct led_classdev_mc *mcled_cdev); -/* Calculate brightness for the monochrome LED cluster */ +/** + * led_mc_calc_color_components() - Calculates component brightness values of a LED cluster. + * @mcled_cdev - Multicolor LED class device of the LED cluster. + * @brightness - Global brightness of the LED cluster. + * + * Calculates the brightness values for each color component of a monochrome LED cluster, + * see Documentation/leds/leds-class-multicolor.rst for details. + */ int led_mc_calc_color_components(struct led_classdev_mc *mcled_cdev, enum led_brightness brightness); -- cgit v1.2.3 From 6a2cb13761d90ef3fa960db189a2cc1bdf965ae1 Mon Sep 17 00:00:00 2001 From: Matti Vaittinen Date: Tue, 7 Apr 2026 16:26:48 +0300 Subject: mfd: bd72720: Drop BUCK11 ID The BD72720 header reserves an ID for BUCK11. While this does not (at the moment) cause problems I can see, it is misleading as the BD72720 contains only 10 BUCKs. Make the code clearer and drop the BUCK11 ID. Fixes: af25277b1ddc ("mfd: rohm-bd71828: Support ROHM BD72720") Signed-off-by: Matti Vaittinen Link: https://patch.msgid.link/812c3749a18d609d6f4698506bc516ec7183dfdd.1775565298.git.mazziesaccount@gmail.com Signed-off-by: Lee Jones --- include/linux/mfd/rohm-bd72720.h | 1 - 1 file changed, 1 deletion(-) (limited to 'include') diff --git a/include/linux/mfd/rohm-bd72720.h b/include/linux/mfd/rohm-bd72720.h index ae7343bcab06..d8ddbf232bb3 100644 --- a/include/linux/mfd/rohm-bd72720.h +++ b/include/linux/mfd/rohm-bd72720.h @@ -21,7 +21,6 @@ enum { BD72720_BUCK8, BD72720_BUCK9, BD72720_BUCK10, - BD72720_BUCK11, BD72720_LDO1, BD72720_LDO2, BD72720_LDO3, -- cgit v1.2.3 From 9adbe53e32cdf3785cf71e27962282c628e97f5c Mon Sep 17 00:00:00 2001 From: Alexey Charkov Date: Tue, 31 Mar 2026 19:43:46 +0400 Subject: mfd: bq257xx: Add BQ25792 support Add register definitions and a new 'type' enum to be passed via MFD private data to support the BQ25792, which is a newer variant of the BQ257xx family. BQ25792 shares similar logic of operation with the already supported BQ25703A but has a completely different register map and different electrical constraints. Signed-off-by: Alexey Charkov Tested-by: Chris Morgan Link: https://patch.msgid.link/20260331-bq25792-v6-9-0278fba33eb9@flipper.net Signed-off-by: Lee Jones --- include/linux/mfd/bq257xx.h | 412 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 412 insertions(+) (limited to 'include') diff --git a/include/linux/mfd/bq257xx.h b/include/linux/mfd/bq257xx.h index 1d6ddc7fb09f..4ec72eb920f2 100644 --- a/include/linux/mfd/bq257xx.h +++ b/include/linux/mfd/bq257xx.h @@ -98,7 +98,419 @@ #define BQ25703_EN_OTG_MASK BIT(12) +#define BQ25792_REG00_MIN_SYS_VOLTAGE 0x00 +#define BQ25792_REG01_CHARGE_VOLTAGE_LIMIT 0x01 +#define BQ25792_REG03_CHARGE_CURRENT_LIMIT 0x03 +#define BQ25792_REG05_INPUT_VOLTAGE_LIMIT 0x05 +#define BQ25792_REG06_INPUT_CURRENT_LIMIT 0x06 +#define BQ25792_REG08_PRECHARGE_CONTROL 0x08 +#define BQ25792_REG09_TERMINATION_CONTROL 0x09 +#define BQ25792_REG0A_RECHARGE_CONTROL 0x0a +#define BQ25792_REG0B_VOTG_REGULATION 0x0b +#define BQ25792_REG0D_IOTG_REGULATION 0x0d +#define BQ25792_REG0E_TIMER_CONTROL 0x0e +#define BQ25792_REG0F_CHARGER_CONTROL_0 0x0f +#define BQ25792_REG10_CHARGER_CONTROL_1 0x10 +#define BQ25792_REG11_CHARGER_CONTROL_2 0x11 +#define BQ25792_REG12_CHARGER_CONTROL_3 0x12 +#define BQ25792_REG13_CHARGER_CONTROL_4 0x13 +#define BQ25792_REG14_CHARGER_CONTROL_5 0x14 +/* REG15 reserved */ +#define BQ25792_REG16_TEMPERATURE_CONTROL 0x16 +#define BQ25792_REG17_NTC_CONTROL_0 0x17 +#define BQ25792_REG18_NTC_CONTROL_1 0x18 +#define BQ25792_REG19_ICO_CURRENT_LIMIT 0x19 +#define BQ25792_REG1B_CHARGER_STATUS_0 0x1b +#define BQ25792_REG1C_CHARGER_STATUS_1 0x1c +#define BQ25792_REG1D_CHARGER_STATUS_2 0x1d +#define BQ25792_REG1E_CHARGER_STATUS_3 0x1e +#define BQ25792_REG1F_CHARGER_STATUS_4 0x1f +#define BQ25792_REG20_FAULT_STATUS_0 0x20 +#define BQ25792_REG21_FAULT_STATUS_1 0x21 +#define BQ25792_REG22_CHARGER_FLAG_0 0x22 +#define BQ25792_REG23_CHARGER_FLAG_1 0x23 +#define BQ25792_REG24_CHARGER_FLAG_2 0x24 +#define BQ25792_REG25_CHARGER_FLAG_3 0x25 +#define BQ25792_REG26_FAULT_FLAG_0 0x26 +#define BQ25792_REG27_FAULT_FLAG_1 0x27 +#define BQ25792_REG28_CHARGER_MASK_0 0x28 +#define BQ25792_REG29_CHARGER_MASK_1 0x29 +#define BQ25792_REG2A_CHARGER_MASK_2 0x2a +#define BQ25792_REG2B_CHARGER_MASK_3 0x2b +#define BQ25792_REG2C_FAULT_MASK_0 0x2c +#define BQ25792_REG2D_FAULT_MASK_1 0x2d +#define BQ25792_REG2E_ADC_CONTROL 0x2e +#define BQ25792_REG2F_ADC_FUNCTION_DISABLE_0 0x2f +#define BQ25792_REG30_ADC_FUNCTION_DISABLE_1 0x30 +#define BQ25792_REG31_IBUS_ADC 0x31 +#define BQ25792_REG33_IBAT_ADC 0x33 +#define BQ25792_REG35_VBUS_ADC 0x35 +#define BQ25792_REG37_VAC1_ADC 0x37 +#define BQ25792_REG39_VAC2_ADC 0x39 +#define BQ25792_REG3B_VBAT_ADC 0x3b +#define BQ25792_REG3D_VSYS_ADC 0x3d +#define BQ25792_REG3F_TS_ADC 0x3f +#define BQ25792_REG41_TDIE_ADC 0x41 +#define BQ25792_REG43_DP_ADC 0x43 +#define BQ25792_REG45_DM_ADC 0x45 +#define BQ25792_REG47_DPDM_DRIVER 0x47 +#define BQ25792_REG48_PART_INFORMATION 0x48 + +/* Minimal System Voltage */ +#define BQ25792_REG00_VSYSMIN_MASK GENMASK(5, 0) + +#define BQ25792_MINVSYS_MIN_UV 2500000 +#define BQ25792_MINVSYS_STEP_UV 250000 +#define BQ25792_MINVSYS_MAX_UV 16000000 + +/* Charge Voltage Limit */ +#define BQ25792_REG01_VREG_MASK GENMASK(10, 0) + +#define BQ25792_VBATREG_MIN_UV 3000000 +#define BQ25792_VBATREG_STEP_UV 10000 +#define BQ25792_VBATREG_MAX_UV 18800000 + +/* Charge Current Limit */ +#define BQ25792_REG03_ICHG_MASK GENMASK(8, 0) + +#define BQ25792_ICHG_MIN_UA 50000 +#define BQ25792_ICHG_STEP_UA 10000 +#define BQ25792_ICHG_MAX_UA 5000000 + +/* Input Voltage Limit */ +#define BQ25792_REG05_VINDPM_MASK GENMASK(7, 0) + +/* Input Current Limit */ +#define BQ25792_REG06_IINDPM_MASK GENMASK(8, 0) +#define BQ25792_IINDPM_DEFAULT_UA 3000000 +#define BQ25792_IINDPM_STEP_UA 10000 +#define BQ25792_IINDPM_MIN_UA 100000 +#define BQ25792_IINDPM_MAX_UA 3300000 + +/* Precharge Control */ +#define BQ25792_REG08_VBAT_LOWV_MASK GENMASK(7, 6) +#define BQ25792_REG08_IPRECHG_MASK GENMASK(5, 0) + +/* Termination Control */ +#define BQ25792_REG09_REG_RST BIT(6) +#define BQ25792_REG09_ITERM_MASK GENMASK(4, 0) + +/* Re-charge Control */ +#define BQ25792_REG0A_CELL_MASK GENMASK(7, 6) +#define BQ25792_REG0A_TRECHG_MASK GENMASK(5, 4) +#define BQ25792_REG0A_VRECHG_MASK GENMASK(3, 0) + +/* VOTG regulation */ +#define BQ25792_REG0B_VOTG_MASK GENMASK(10, 0) + +#define BQ25792_OTG_VOLT_MIN_UV 2800000 +#define BQ25792_OTG_VOLT_STEP_UV 10000 +#define BQ25792_OTG_VOLT_MAX_UV 22000000 +#define BQ25792_OTG_VOLT_NUM_VOLT ((BQ25792_OTG_VOLT_MAX_UV \ + - BQ25792_OTG_VOLT_MIN_UV) \ + / BQ25792_OTG_VOLT_STEP_UV + 1) + +/* IOTG regulation */ +#define BQ25792_REG0D_PRECHG_TMR BIT(7) +#define BQ25792_REG0D_IOTG_MASK GENMASK(6, 0) + +#define BQ25792_OTG_CUR_MIN_UA 120000 +#define BQ25792_OTG_CUR_STEP_UA 40000 +#define BQ25792_OTG_CUR_MAX_UA 3320000 + +/* Timer Control */ +#define BQ25792_REG0E_TOPOFF_TMR_MASK GENMASK(7, 6) +#define BQ25792_REG0E_EN_TRICHG_TMR BIT(5) +#define BQ25792_REG0E_EN_PRECHG_TMR BIT(4) +#define BQ25792_REG0E_EN_CHG_TMR BIT(3) +#define BQ25792_REG0E_CHG_TMR_MASK GENMASK(2, 1) +#define BQ25792_REG0E_TMR2X_EN BIT(0) + +/* Charger Control 0 */ +#define BQ25792_REG0F_EN_AUTO_IBATDIS BIT(7) +#define BQ25792_REG0F_FORCE_IBATDIS BIT(6) +#define BQ25792_REG0F_EN_CHG BIT(5) +#define BQ25792_REG0F_EN_ICO BIT(4) +#define BQ25792_REG0F_FORCE_ICO BIT(3) +#define BQ25792_REG0F_EN_HIZ BIT(2) +#define BQ25792_REG0F_EN_TERM BIT(1) +/* bit0 reserved */ + +/* Charger Control 1 */ +#define BQ25792_REG10_VAC_OVP_MASK GENMASK(5, 4) +#define BQ25792_REG10_WD_RST BIT(3) +#define BQ25792_REG10_WATCHDOG_MASK GENMASK(2, 0) + +/* Charger Control 2 */ +#define BQ25792_REG11_FORCE_INDET BIT(7) +#define BQ25792_REG11_AUTO_INDET_EN BIT(6) +#define BQ25792_REG11_EN_12V BIT(5) +#define BQ25792_REG11_EN_9V BIT(4) +#define BQ25792_REG11_HVDCP_EN BIT(3) +#define BQ25792_REG11_SDRV_CTRL_MASK GENMASK(2, 1) +#define BQ25792_REG11_SDRV_DLY BIT(0) + +/* Charger Control 3 */ +#define BQ25792_REG12_DIS_ACDRV BIT(7) +#define BQ25792_REG12_EN_OTG BIT(6) +#define BQ25792_REG12_PFM_OTG_DIS BIT(5) +#define BQ25792_REG12_PFM_FWD_DIS BIT(4) +#define BQ25792_REG12_WKUP_DLY BIT(3) +#define BQ25792_REG12_DIS_LDO BIT(2) +#define BQ25792_REG12_DIS_OTG_OOA BIT(1) +#define BQ25792_REG12_DIS_FWD_OOA BIT(0) + +/* Charger Control 4 */ +#define BQ25792_REG13_EN_ACDRV2 BIT(7) +#define BQ25792_REG13_EN_ACDRV1 BIT(6) +#define BQ25792_REG13_PWM_FREQ BIT(5) +#define BQ25792_REG13_DIS_STAT BIT(4) +#define BQ25792_REG13_DIS_VSYS_SHORT BIT(3) +#define BQ25792_REG13_DIS_VOTG_UVP BIT(2) +#define BQ25792_REG13_FORCE_VINDPM_DET BIT(1) +#define BQ25792_REG13_EN_IBUS_OCP BIT(0) + +/* Charger Control 5 */ +#define BQ25792_REG14_SFET_PRESENT BIT(7) +/* bit6 reserved */ +#define BQ25792_REG14_EN_IBAT BIT(5) +#define BQ25792_REG14_IBAT_REG_MASK GENMASK(4, 3) +#define BQ25792_REG14_EN_IINDPM BIT(2) +#define BQ25792_REG14_EN_EXTILIM BIT(1) +#define BQ25792_REG14_EN_BATOC BIT(0) + +#define BQ25792_IBAT_3A FIELD_PREP(BQ25792_REG14_IBAT_REG_MASK, 0) +#define BQ25792_IBAT_4A FIELD_PREP(BQ25792_REG14_IBAT_REG_MASK, 1) +#define BQ25792_IBAT_5A FIELD_PREP(BQ25792_REG14_IBAT_REG_MASK, 2) +#define BQ25792_IBAT_UNLIM FIELD_PREP(BQ25792_REG14_IBAT_REG_MASK, 3) + +/* Temperature Control */ +#define BQ25792_REG16_TREG_MASK GENMASK(7, 6) +#define BQ25792_REG16_TSHUT_MASK GENMASK(5, 4) +#define BQ25792_REG16_VBUS_PD_EN BIT(3) +#define BQ25792_REG16_VAC1_PD_EN BIT(2) +#define BQ25792_REG16_VAC2_PD_EN BIT(1) + +/* NTC Control 0 */ +#define BQ25792_REG17_JEITA_VSET_MASK GENMASK(7, 5) +#define BQ25792_REG17_JEITA_ISETH_MASK GENMASK(4, 3) +#define BQ25792_REG17_JEITA_ISETC_MASK GENMASK(2, 1) + +/* NTC Control 1 */ +#define BQ25792_REG18_TS_COOL_MASK GENMASK(7, 6) +#define BQ25792_REG18_TS_WARM_MASK GENMASK(5, 4) +#define BQ25792_REG18_BHOT_MASK GENMASK(3, 2) +#define BQ25792_REG18_BCOLD BIT(1) +#define BQ25792_REG18_TS_IGNORE BIT(0) + +/* ICO Current Limit */ +#define BQ25792_REG19_ICO_ILIM_MASK GENMASK(8, 0) + +/* Charger Status 0 */ +#define BQ25792_REG1B_IINDPM_STAT BIT(7) +#define BQ25792_REG1B_VINDPM_STAT BIT(6) +#define BQ25792_REG1B_WD_STAT BIT(5) +#define BQ25792_REG1B_POORSRC_STAT BIT(4) +#define BQ25792_REG1B_PG_STAT BIT(3) +#define BQ25792_REG1B_AC2_PRESENT_STAT BIT(2) +#define BQ25792_REG1B_AC1_PRESENT_STAT BIT(1) +#define BQ25792_REG1B_VBUS_PRESENT_STAT BIT(0) + +/* Charger Status 1 */ +#define BQ25792_REG1C_CHG_STAT_MASK GENMASK(7, 5) +#define BQ25792_REG1C_VBUS_STAT_MASK GENMASK(4, 1) +#define BQ25792_REG1C_BC12_DONE_STAT BIT(0) + +/* Charger Status 2 */ +#define BQ25792_REG1D_ICO_STAT_MASK GENMASK(7, 6) +#define BQ25792_REG1D_TREG_STAT BIT(2) +#define BQ25792_REG1D_DPDM_STAT BIT(1) +#define BQ25792_REG1D_VBAT_PRESENT_STAT BIT(0) + +/* Charger Status 3 */ +#define BQ25792_REG1E_ACRB2_STAT BIT(7) +#define BQ25792_REG1E_ACRB1_STAT BIT(6) +#define BQ25792_REG1E_ADC_DONE_STAT BIT(5) +#define BQ25792_REG1E_VSYS_STAT BIT(4) +#define BQ25792_REG1E_CHG_TMR_STAT BIT(3) +#define BQ25792_REG1E_TRICHG_TMR_STAT BIT(2) +#define BQ25792_REG1E_PRECHG_TMR_STAT BIT(1) + +/* Charger Status 4 */ +#define BQ25792_REG1F_VBATOTG_LOW_STAT BIT(4) +#define BQ25792_REG1F_TS_COLD_STAT BIT(3) +#define BQ25792_REG1F_TS_COOL_STAT BIT(2) +#define BQ25792_REG1F_TS_WARM_STAT BIT(1) +#define BQ25792_REG1F_TS_HOT_STAT BIT(0) + +/* FAULT Status 0 */ +#define BQ25792_REG20_IBAT_REG_STAT BIT(7) +#define BQ25792_REG20_VBUS_OVP_STAT BIT(6) +#define BQ25792_REG20_VBAT_OVP_STAT BIT(5) +#define BQ25792_REG20_IBUS_OCP_STAT BIT(4) +#define BQ25792_REG20_IBAT_OCP_STAT BIT(3) +#define BQ25792_REG20_CONV_OCP_STAT BIT(2) +#define BQ25792_REG20_VAC2_OVP_STAT BIT(1) +#define BQ25792_REG20_VAC1_OVP_STAT BIT(0) + +#define BQ25792_REG20_OVERVOLTAGE_MASK (BQ25792_REG20_VBAT_OVP_STAT | \ + BQ25792_REG20_VAC2_OVP_STAT | \ + BQ25792_REG20_VAC1_OVP_STAT) +#define BQ25792_REG20_OVERCURRENT_MASK (BQ25792_REG20_IBAT_OCP_STAT | \ + BQ25792_REG20_CONV_OCP_STAT) + +/* FAULT Status 1 */ +#define BQ25792_REG21_VSYS_SHORT_STAT BIT(7) +#define BQ25792_REG21_VSYS_OVP_STAT BIT(6) +#define BQ25792_REG21_OTG_OVP_STAT BIT(5) +#define BQ25792_REG21_OTG_UVP_STAT BIT(4) +#define BQ25792_REG21_TSHUT_STAT BIT(2) + + +/* Charger Flag 0 */ +#define BQ25792_REG22_IINDPM_FLAG BIT(7) +#define BQ25792_REG22_VINDPM_FLAG BIT(6) +#define BQ25792_REG22_WD_FLAG BIT(5) +#define BQ25792_REG22_POORSRC_FLAG BIT(4) +#define BQ25792_REG22_PG_FLAG BIT(3) +#define BQ25792_REG22_AC2_PRESENT_FLAG BIT(2) +#define BQ25792_REG22_AC1_PRESENT_FLAG BIT(1) +#define BQ25792_REG22_VBUS_PRESENT_FLAG BIT(0) + +/* Charger Flag 1 */ +#define BQ25792_REG23_CHG_FLAG BIT(7) +#define BQ25792_REG23_ICO_FLAG BIT(6) +#define BQ25792_REG23_VBUS_FLAG BIT(4) +#define BQ25792_REG23_TREG_FLAG BIT(2) +#define BQ25792_REG23_VBAT_PRESENT_FLAG BIT(1) +#define BQ25792_REG23_BC12_DONE_FLAG BIT(0) + +/* Charger Flag 2 */ +#define BQ25792_REG24_DPDM_DONE_FLAG BIT(6) +#define BQ25792_REG24_ADC_DONE_FLAG BIT(5) +#define BQ25792_REG24_VSYS_FLAG BIT(4) +#define BQ25792_REG24_CHG_TMR_FLAG BIT(3) +#define BQ25792_REG24_TRICHG_TMR_FLAG BIT(2) +#define BQ25792_REG24_PRECHG_TMR_FLAG BIT(1) +#define BQ25792_REG24_TOPOFF_TMR_FLAG BIT(0) + +/* Charger Flag 3 */ +#define BQ25792_REG25_VBATOTG_LOW_FLAG BIT(4) +#define BQ25792_REG25_TS_COLD_FLAG BIT(3) +#define BQ25792_REG25_TS_COOL_FLAG BIT(2) +#define BQ25792_REG25_TS_WARM_FLAG BIT(1) +#define BQ25792_REG25_TS_HOT_FLAG BIT(0) + +/* FAULT Flag 0 */ +#define BQ25792_REG26_IBAT_REG_FLAG BIT(7) +#define BQ25792_REG26_VBUS_OVP_FLAG BIT(6) +#define BQ25792_REG26_VBAT_OVP_FLAG BIT(5) +#define BQ25792_REG26_IBUS_OCP_FLAG BIT(4) +#define BQ25792_REG26_IBAT_OCP_FLAG BIT(3) +#define BQ25792_REG26_CONV_OCP_FLAG BIT(2) +#define BQ25792_REG26_VAC2_OVP_FLAG BIT(1) +#define BQ25792_REG26_VAC1_OVP_FLAG BIT(0) + +/* FAULT Flag 1 */ +#define BQ25792_REG27_VSYS_SHORT_FLAG BIT(7) +#define BQ25792_REG27_VSYS_OVP_FLAG BIT(6) +#define BQ25792_REG27_OTG_OVP_FLAG BIT(5) +#define BQ25792_REG27_OTG_UVP_FLAG BIT(4) +#define BQ25792_REG27_TSHUT_FLAG BIT(2) + +/* Charger Mask 0 */ +#define BQ25792_REG28_IINDPM_MASK BIT(7) +#define BQ25792_REG28_VINDPM_MASK BIT(6) +#define BQ25792_REG28_WD_MASK BIT(5) +#define BQ25792_REG28_POORSRC_MASK BIT(4) +#define BQ25792_REG28_PG_MASK BIT(3) +#define BQ25792_REG28_AC2_PRESENT_MASK BIT(2) +#define BQ25792_REG28_AC1_PRESENT_MASK BIT(1) +#define BQ25792_REG28_VBUS_PRESENT_MASK BIT(0) + +/* Charger Mask 1 */ +#define BQ25792_REG29_CHG_MASK BIT(7) +#define BQ25792_REG29_ICO_MASK BIT(6) +#define BQ25792_REG29_VBUS_MASK BIT(4) +#define BQ25792_REG29_TREG_MASK BIT(2) +#define BQ25792_REG29_VBAT_PRESENT_MASK BIT(1) +#define BQ25792_REG29_BC12_DONE_MASK BIT(0) + +/* Charger Mask 2 */ +#define BQ25792_REG2A_DPDM_DONE_MASK BIT(6) +#define BQ25792_REG2A_ADC_DONE_MASK BIT(5) +#define BQ25792_REG2A_VSYS_MASK BIT(4) +#define BQ25792_REG2A_CHG_TMR_MASK BIT(3) +#define BQ25792_REG2A_TRICHG_TMR_MASK BIT(2) +#define BQ25792_REG2A_PRECHG_TMR_MASK BIT(1) +#define BQ25792_REG2A_TOPOFF_TMR_MASK BIT(0) + +/* Charger Mask 3 */ +#define BQ25792_REG2B_VBATOTG_LOW_MASK BIT(4) +#define BQ25792_REG2B_TS_COLD_MASK BIT(3) +#define BQ25792_REG2B_TS_COOL_MASK BIT(2) +#define BQ25792_REG2B_TS_WARM_MASK BIT(1) +#define BQ25792_REG2B_TS_HOT_MASK BIT(0) + +/* FAULT Mask 0 */ +#define BQ25792_REG2C_IBAT_REG_MASK BIT(7) +#define BQ25792_REG2C_VBUS_OVP_MASK BIT(6) +#define BQ25792_REG2C_VBAT_OVP_MASK BIT(5) +#define BQ25792_REG2C_IBUS_OCP_MASK BIT(4) +#define BQ25792_REG2C_IBAT_OCP_MASK BIT(3) +#define BQ25792_REG2C_CONV_OCP_MASK BIT(2) +#define BQ25792_REG2C_VAC2_OVP_MASK BIT(1) +#define BQ25792_REG2C_VAC1_OVP_MASK BIT(0) + +/* FAULT Mask 1 */ +#define BQ25792_REG2D_VSYS_SHORT_MASK BIT(7) +#define BQ25792_REG2D_VSYS_OVP_MASK BIT(6) +#define BQ25792_REG2D_OTG_OVP_MASK BIT(5) +#define BQ25792_REG2D_OTG_UVP_MASK BIT(4) +#define BQ25792_REG2D_TSHUT_MASK BIT(2) + +/* ADC Control */ +#define BQ25792_REG2E_ADC_EN BIT(7) +#define BQ25792_REG2E_ADC_RATE BIT(6) +#define BQ25792_REG2E_ADC_SAMPLE_MASK GENMASK(5, 4) +#define BQ25792_REG2E_ADC_AVG BIT(3) +#define BQ25792_REG2E_ADC_AVG_INIT BIT(2) + +/* ADC Function Disable 0 */ +#define BQ25792_REG2F_IBUS_ADC_DIS BIT(7) +#define BQ25792_REG2F_IBAT_ADC_DIS BIT(6) +#define BQ25792_REG2F_VBUS_ADC_DIS BIT(5) +#define BQ25792_REG2F_VBAT_ADC_DIS BIT(4) +#define BQ25792_REG2F_VSYS_ADC_DIS BIT(3) +#define BQ25792_REG2F_TS_ADC_DIS BIT(2) +#define BQ25792_REG2F_TDIE_ADC_DIS BIT(1) + +/* ADC Function Disable 1 */ +#define BQ25792_REG30_DP_ADC_DIS BIT(7) +#define BQ25792_REG30_DM_ADC_DIS BIT(6) +#define BQ25792_REG30_VAC2_ADC_DIS BIT(5) +#define BQ25792_REG30_VAC1_ADC_DIS BIT(4) + +/* 0x31-0x45: ADC result registers (16-bit, RO): single full-width field */ + +#define BQ25792_ADCVSYSVBAT_STEP_UV 1000 +#define BQ25792_ADCIBAT_STEP_UA 1000 + +/* DPDM Driver */ +#define BQ25792_REG47_DPLUS_DAC_MASK GENMASK(7, 5) +#define BQ25792_REG47_DMINUS_DAC_MASK GENMASK(4, 2) + +/* Part Information */ +#define BQ25792_REG48_PN_MASK GENMASK(5, 3) +#define BQ25792_REG48_DEV_REV_MASK GENMASK(2, 0) + +enum bq257xx_type { + BQ25703A = 1, + BQ25792, +}; + struct bq257xx_device { struct i2c_client *client; struct regmap *regmap; + enum bq257xx_type type; }; -- cgit v1.2.3 From 4b51f0da731adb1d3468518dc2deb5dae83978b7 Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Wed, 29 Apr 2026 14:23:30 +0200 Subject: mfd: cs5535: Add, assign and expose the software node for the GPIO cell There are board files in-tree that want to request GPIOs from this chip. They currently rely on the GPIO core's mechanism of matching software nodes' labels against GPIO controller names. We want to remove this behavior from the kernel and to this end, we need to associate the referenced GPIO controller with its target software node. Create a dedicated GPIO software node for cs5535, assign it to the GPIO cell and expose its address in a new header. We only expose a single software node instance but that's alright: all existing hardware only contains a single cs5535 companion and the geode board file for which we expose this is legacy anyway. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260429-cs5535-swnode-v1-1-2bc5e17ddcf9@oss.qualcomm.com Signed-off-by: Lee Jones --- include/linux/mfd/cs5535.h | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 include/linux/mfd/cs5535.h (limited to 'include') diff --git a/include/linux/mfd/cs5535.h b/include/linux/mfd/cs5535.h new file mode 100644 index 000000000000..2e4ebf5d06af --- /dev/null +++ b/include/linux/mfd/cs5535.h @@ -0,0 +1,8 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef __MFD_CS5535_H__ +#define __MFD_CS5535_H__ + +extern const struct software_node cs5535_gpio_swnode; + +#endif /* __MFD_CS5535_H__ */ -- cgit v1.2.3 From 5618127fed7e8f974b3615d429ffdea670b203be Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Mon, 27 Apr 2026 16:34:27 +0200 Subject: mfd: wm8994: Remove dead legacy-gpio code The old-style gpio handling in wm8994 came from a commit 7c8844481a1c ("mfd: wm8994: Emulate level triggered interrupts if required") in linux-3.11, but nothing in the kernel ever set the 'irq_gpio' member in the wm8994_pdata structure, so this was always dead code. Remove it now to reduce the dependency on the legacy gpio interfaces. Signed-off-by: Arnd Bergmann Reviewed-by: Bartosz Golaszewski Reviewed-by: Charles Keepax Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260427143437.3059210-1-arnd@kernel.org Signed-off-by: Lee Jones --- include/linux/mfd/wm8994/pdata.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include') diff --git a/include/linux/mfd/wm8994/pdata.h b/include/linux/mfd/wm8994/pdata.h index 6e2962ef5b81..b95a56a338c3 100644 --- a/include/linux/mfd/wm8994/pdata.h +++ b/include/linux/mfd/wm8994/pdata.h @@ -226,11 +226,6 @@ struct wm8994_pdata { * lines is mastered. */ int max_channels_clocked[WM8994_NUM_AIF]; - - /** - * GPIO for the IRQ pin if host only supports edge triggering - */ - int irq_gpio; }; #endif -- cgit v1.2.3 From 7b7b7fa42d08087a9d5f3d49453dbe721cbbd2d4 Mon Sep 17 00:00:00 2001 From: Amit Sunil Dhamne Date: Mon, 4 May 2026 22:49:54 +0000 Subject: mfd: max77759: Improve static struct formatting and commentary Improve code style. This includes the following: - Formatting the max77759_chgr_irqs entries to fit in a single line instead of breaking them into multiple lines to improve readability. - Refactoring comments such that they're full sentences and have punctuation marks for a couple of macro definitions to adhere to the documentation style. - Explicitly initializing `MAX77759_CHGR_MODE_OFF`. Signed-off-by: Amit Sunil Dhamne Link: https://patch.msgid.link/20260504-fix-mfd-max77759-driver-v1-1-4d4a31a1d214@google.com Signed-off-by: Lee Jones --- include/linux/mfd/max77759.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/mfd/max77759.h b/include/linux/mfd/max77759.h index ec19be952877..7c0b13219d51 100644 --- a/include/linux/mfd/max77759.h +++ b/include/linux/mfd/max77759.h @@ -106,9 +106,9 @@ #define MAX77759_CHGR_REG_CHG_CNFG_10 0xc3 #define MAX77759_CHGR_REG_CHG_CNFG_11 0xc4 #define MAX77759_CHGR_REG_CHG_CNFG_12 0xc5 -/* Wireless Charging input channel select */ +/* Setting this enables the Wireless Charging input channel. */ #define MAX77759_CHGR_REG_CHG_CNFG_12_WCINSEL BIT(6) -/* CHGIN/USB input channel select */ +/* Setting this enables the CHGIN/USB input channel. */ #define MAX77759_CHGR_REG_CHG_CNFG_12_CHGINSEL BIT(5) #define MAX77759_CHGR_REG_CHG_CNFG_13 0xc6 #define MAX77759_CHGR_REG_CHG_CNFG_14 0xc7 @@ -204,7 +204,7 @@ enum max77759_chgr_chg_dtls_states { }; enum max77759_chgr_mode { - MAX77759_CHGR_MODE_OFF, + MAX77759_CHGR_MODE_OFF = 0x0, MAX77759_CHGR_MODE_CHG_BUCK_ON = 0x5, MAX77759_CHGR_MODE_OTG_BOOST_ON = 0xA, }; -- cgit v1.2.3 From e6f0018fbf1f4eabd3fb8ac71f06cb31efce3c86 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Thu, 30 Apr 2026 18:28:05 +0200 Subject: mfd: ezx-pcap: Remove unused driver Support for the Motorola EZX phones based on Intel PXA processors was removed in 2022, but this driver remained present in the tree. As far as I can tell, the support was never quite functional upstream because the board files did not actually instantiate the SPI device for the PCAP. There are still also drivers for the various mfd cells: keys, touchscreen, regulator and rtc, all of which are obviously orphaned as well but can be removed separately as the Kconfig dependency now prevents them from being enabled. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202604301209.f1YXTsIr-lkp@intel.com/ Signed-off-by: Arnd Bergmann Reviewed-by: Linus Walleij Acked-by: Harald Welte Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/20260430162855.2029285-1-arnd@kernel.org Signed-off-by: Lee Jones --- include/linux/mfd/ezx-pcap.h | 253 ------------------------------------------- 1 file changed, 253 deletions(-) delete mode 100644 include/linux/mfd/ezx-pcap.h (limited to 'include') diff --git a/include/linux/mfd/ezx-pcap.h b/include/linux/mfd/ezx-pcap.h deleted file mode 100644 index ea51b1cdca5a..000000000000 --- a/include/linux/mfd/ezx-pcap.h +++ /dev/null @@ -1,253 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* - * Copyright 2009 Daniel Ribeiro - * - * For further information, please see http://wiki.openezx.org/PCAP2 - */ - -#ifndef EZX_PCAP_H -#define EZX_PCAP_H - -struct pcap_subdev { - int id; - const char *name; - void *platform_data; -}; - -struct pcap_platform_data { - unsigned int irq_base; - unsigned int config; - int gpio; - void (*init) (void *); /* board specific init */ - int num_subdevs; - struct pcap_subdev *subdevs; -}; - -struct pcap_chip; - -int ezx_pcap_write(struct pcap_chip *, u8, u32); -int ezx_pcap_read(struct pcap_chip *, u8, u32 *); -int ezx_pcap_set_bits(struct pcap_chip *, u8, u32, u32); -int pcap_to_irq(struct pcap_chip *, int); -int irq_to_pcap(struct pcap_chip *, int); -int pcap_adc_async(struct pcap_chip *, u8, u32, u8[], void *, void *); -void pcap_set_ts_bits(struct pcap_chip *, u32); - -#define PCAP_SECOND_PORT 1 -#define PCAP_CS_AH 2 - -#define PCAP_REGISTER_WRITE_OP_BIT 0x80000000 -#define PCAP_REGISTER_READ_OP_BIT 0x00000000 - -#define PCAP_REGISTER_VALUE_MASK 0x01ffffff -#define PCAP_REGISTER_ADDRESS_MASK 0x7c000000 -#define PCAP_REGISTER_ADDRESS_SHIFT 26 -#define PCAP_REGISTER_NUMBER 32 -#define PCAP_CLEAR_INTERRUPT_REGISTER 0x01ffffff -#define PCAP_MASK_ALL_INTERRUPT 0x01ffffff - -/* registers accessible by both pcap ports */ -#define PCAP_REG_ISR 0x0 /* Interrupt Status */ -#define PCAP_REG_MSR 0x1 /* Interrupt Mask */ -#define PCAP_REG_PSTAT 0x2 /* Processor Status */ -#define PCAP_REG_VREG2 0x6 /* Regulator Bank 2 Control */ -#define PCAP_REG_AUXVREG 0x7 /* Auxiliary Regulator Control */ -#define PCAP_REG_BATT 0x8 /* Battery Control */ -#define PCAP_REG_ADC 0x9 /* AD Control */ -#define PCAP_REG_ADR 0xa /* AD Result */ -#define PCAP_REG_CODEC 0xb /* Audio Codec Control */ -#define PCAP_REG_RX_AMPS 0xc /* RX Audio Amplifiers Control */ -#define PCAP_REG_ST_DAC 0xd /* Stereo DAC Control */ -#define PCAP_REG_BUSCTRL 0x14 /* Connectivity Control */ -#define PCAP_REG_PERIPH 0x15 /* Peripheral Control */ -#define PCAP_REG_LOWPWR 0x18 /* Regulator Low Power Control */ -#define PCAP_REG_TX_AMPS 0x1a /* TX Audio Amplifiers Control */ -#define PCAP_REG_GP 0x1b /* General Purpose */ -#define PCAP_REG_TEST1 0x1c -#define PCAP_REG_TEST2 0x1d -#define PCAP_REG_VENDOR_TEST1 0x1e -#define PCAP_REG_VENDOR_TEST2 0x1f - -/* registers accessible by pcap port 1 only (a1200, e2 & e6) */ -#define PCAP_REG_INT_SEL 0x3 /* Interrupt Select */ -#define PCAP_REG_SWCTRL 0x4 /* Switching Regulator Control */ -#define PCAP_REG_VREG1 0x5 /* Regulator Bank 1 Control */ -#define PCAP_REG_RTC_TOD 0xe /* RTC Time of Day */ -#define PCAP_REG_RTC_TODA 0xf /* RTC Time of Day Alarm */ -#define PCAP_REG_RTC_DAY 0x10 /* RTC Day */ -#define PCAP_REG_RTC_DAYA 0x11 /* RTC Day Alarm */ -#define PCAP_REG_MTRTMR 0x12 /* AD Monitor Timer */ -#define PCAP_REG_PWR 0x13 /* Power Control */ -#define PCAP_REG_AUXVREG_MASK 0x16 /* Auxiliary Regulator Mask */ -#define PCAP_REG_VENDOR_REV 0x17 -#define PCAP_REG_PERIPH_MASK 0x19 /* Peripheral Mask */ - -/* PCAP2 Interrupts */ -#define PCAP_NIRQS 23 -#define PCAP_IRQ_ADCDONE 0 /* ADC done port 1 */ -#define PCAP_IRQ_TS 1 /* Touch Screen */ -#define PCAP_IRQ_1HZ 2 /* 1HZ timer */ -#define PCAP_IRQ_WH 3 /* ADC above high limit */ -#define PCAP_IRQ_WL 4 /* ADC below low limit */ -#define PCAP_IRQ_TODA 5 /* Time of day alarm */ -#define PCAP_IRQ_USB4V 6 /* USB above 4V */ -#define PCAP_IRQ_ONOFF 7 /* On/Off button */ -#define PCAP_IRQ_ONOFF2 8 /* On/Off button 2 */ -#define PCAP_IRQ_USB1V 9 /* USB above 1V */ -#define PCAP_IRQ_MOBPORT 10 -#define PCAP_IRQ_MIC 11 /* Mic attach/HS button */ -#define PCAP_IRQ_HS 12 /* Headset attach */ -#define PCAP_IRQ_ST 13 -#define PCAP_IRQ_PC 14 /* Power Cut */ -#define PCAP_IRQ_WARM 15 -#define PCAP_IRQ_EOL 16 /* Battery End Of Life */ -#define PCAP_IRQ_CLK 17 -#define PCAP_IRQ_SYSRST 18 /* System Reset */ -#define PCAP_IRQ_DUMMY 19 -#define PCAP_IRQ_ADCDONE2 20 /* ADC done port 2 */ -#define PCAP_IRQ_SOFTRESET 21 -#define PCAP_IRQ_MNEXB 22 - -/* voltage regulators */ -#define V1 0 -#define V2 1 -#define V3 2 -#define V4 3 -#define V5 4 -#define V6 5 -#define V7 6 -#define V8 7 -#define V9 8 -#define V10 9 -#define VAUX1 10 -#define VAUX2 11 -#define VAUX3 12 -#define VAUX4 13 -#define VSIM 14 -#define VSIM2 15 -#define VVIB 16 -#define SW1 17 -#define SW2 18 -#define SW3 19 -#define SW1S 20 -#define SW2S 21 - -#define PCAP_BATT_DAC_MASK 0x000000ff -#define PCAP_BATT_DAC_SHIFT 0 -#define PCAP_BATT_B_FDBK (1 << 8) -#define PCAP_BATT_EXT_ISENSE (1 << 9) -#define PCAP_BATT_V_COIN_MASK 0x00003c00 -#define PCAP_BATT_V_COIN_SHIFT 10 -#define PCAP_BATT_I_COIN (1 << 14) -#define PCAP_BATT_COIN_CH_EN (1 << 15) -#define PCAP_BATT_EOL_SEL_MASK 0x000e0000 -#define PCAP_BATT_EOL_SEL_SHIFT 17 -#define PCAP_BATT_EOL_CMP_EN (1 << 20) -#define PCAP_BATT_BATT_DET_EN (1 << 21) -#define PCAP_BATT_THERMBIAS_CTRL (1 << 22) - -#define PCAP_ADC_ADEN (1 << 0) -#define PCAP_ADC_RAND (1 << 1) -#define PCAP_ADC_AD_SEL1 (1 << 2) -#define PCAP_ADC_AD_SEL2 (1 << 3) -#define PCAP_ADC_ADA1_MASK 0x00000070 -#define PCAP_ADC_ADA1_SHIFT 4 -#define PCAP_ADC_ADA2_MASK 0x00000380 -#define PCAP_ADC_ADA2_SHIFT 7 -#define PCAP_ADC_ATO_MASK 0x00003c00 -#define PCAP_ADC_ATO_SHIFT 10 -#define PCAP_ADC_ATOX (1 << 14) -#define PCAP_ADC_MTR1 (1 << 15) -#define PCAP_ADC_MTR2 (1 << 16) -#define PCAP_ADC_TS_M_MASK 0x000e0000 -#define PCAP_ADC_TS_M_SHIFT 17 -#define PCAP_ADC_TS_REF_LOWPWR (1 << 20) -#define PCAP_ADC_TS_REFENB (1 << 21) -#define PCAP_ADC_BATT_I_POLARITY (1 << 22) -#define PCAP_ADC_BATT_I_ADC (1 << 23) - -#define PCAP_ADC_BANK_0 0 -#define PCAP_ADC_BANK_1 1 -/* ADC bank 0 */ -#define PCAP_ADC_CH_COIN 0 -#define PCAP_ADC_CH_BATT 1 -#define PCAP_ADC_CH_BPLUS 2 -#define PCAP_ADC_CH_MOBPORTB 3 -#define PCAP_ADC_CH_TEMPERATURE 4 -#define PCAP_ADC_CH_CHARGER_ID 5 -#define PCAP_ADC_CH_AD6 6 -/* ADC bank 1 */ -#define PCAP_ADC_CH_AD7 0 -#define PCAP_ADC_CH_AD8 1 -#define PCAP_ADC_CH_AD9 2 -#define PCAP_ADC_CH_TS_X1 3 -#define PCAP_ADC_CH_TS_X2 4 -#define PCAP_ADC_CH_TS_Y1 5 -#define PCAP_ADC_CH_TS_Y2 6 - -#define PCAP_ADC_T_NOW 0 -#define PCAP_ADC_T_IN_BURST 1 -#define PCAP_ADC_T_OUT_BURST 2 - -#define PCAP_ADC_ATO_IN_BURST 6 -#define PCAP_ADC_ATO_OUT_BURST 0 - -#define PCAP_ADC_TS_M_XY 1 -#define PCAP_ADC_TS_M_PRESSURE 2 -#define PCAP_ADC_TS_M_PLATE_X 3 -#define PCAP_ADC_TS_M_PLATE_Y 4 -#define PCAP_ADC_TS_M_STANDBY 5 -#define PCAP_ADC_TS_M_NONTS 6 - -#define PCAP_ADR_ADD1_MASK 0x000003ff -#define PCAP_ADR_ADD1_SHIFT 0 -#define PCAP_ADR_ADD2_MASK 0x000ffc00 -#define PCAP_ADR_ADD2_SHIFT 10 -#define PCAP_ADR_ADINC1 (1 << 20) -#define PCAP_ADR_ADINC2 (1 << 21) -#define PCAP_ADR_ASC (1 << 22) -#define PCAP_ADR_ONESHOT (1 << 23) - -#define PCAP_BUSCTRL_FSENB (1 << 0) -#define PCAP_BUSCTRL_USB_SUSPEND (1 << 1) -#define PCAP_BUSCTRL_USB_PU (1 << 2) -#define PCAP_BUSCTRL_USB_PD (1 << 3) -#define PCAP_BUSCTRL_VUSB_EN (1 << 4) -#define PCAP_BUSCTRL_USB_PS (1 << 5) -#define PCAP_BUSCTRL_VUSB_MSTR_EN (1 << 6) -#define PCAP_BUSCTRL_VBUS_PD_ENB (1 << 7) -#define PCAP_BUSCTRL_CURRLIM (1 << 8) -#define PCAP_BUSCTRL_RS232ENB (1 << 9) -#define PCAP_BUSCTRL_RS232_DIR (1 << 10) -#define PCAP_BUSCTRL_SE0_CONN (1 << 11) -#define PCAP_BUSCTRL_USB_PDM (1 << 12) -#define PCAP_BUSCTRL_BUS_PRI_ADJ (1 << 24) - -/* leds */ -#define PCAP_LED0 0 -#define PCAP_LED1 1 -#define PCAP_BL0 2 -#define PCAP_BL1 3 -#define PCAP_LED_3MA 0 -#define PCAP_LED_4MA 1 -#define PCAP_LED_5MA 2 -#define PCAP_LED_9MA 3 -#define PCAP_LED_T_MASK 0xf -#define PCAP_LED_C_MASK 0x3 -#define PCAP_BL_MASK 0x1f -#define PCAP_BL0_SHIFT 0 -#define PCAP_LED0_EN (1 << 5) -#define PCAP_LED1_EN (1 << 6) -#define PCAP_LED0_T_SHIFT 7 -#define PCAP_LED1_T_SHIFT 11 -#define PCAP_LED0_C_SHIFT 15 -#define PCAP_LED1_C_SHIFT 17 -#define PCAP_BL1_SHIFT 20 - -/* RTC */ -#define PCAP_RTC_DAY_MASK 0x3fff -#define PCAP_RTC_TOD_MASK 0xffff -#define PCAP_RTC_PC_MASK 0x7 -#define SEC_PER_DAY 86400 - -#endif -- cgit v1.2.3 From 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 Mon Sep 17 00:00:00 2001 From: Maoyi Xie Date: Fri, 12 Jun 2026 16:59:35 +0800 Subject: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper. Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs. Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK. Reported-by: Xiao Liang Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/ Fixes: b57708add314 ("gre: add x-netns support") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260612085941.3158249-2-maoyixie.tju@gmail.com Signed-off-by: Jakub Kicinski --- include/net/rtnetlink.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h index ec65a8cebb99..2bff41aacc98 100644 --- a/include/net/rtnetlink.h +++ b/include/net/rtnetlink.h @@ -256,6 +256,8 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm, int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer, struct netlink_ext_ack *exterr); struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid); +bool rtnl_dev_link_net_capable(const struct net_device *dev, + const struct net *link_net); #define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind) -- cgit v1.2.3 From 7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823 Mon Sep 17 00:00:00 2001 From: Xin Long Date: Mon, 15 Jun 2026 15:36:30 -0400 Subject: sctp: hold socket lock when dumping endpoints in sctp_diag SCTP_DIAG endpoint dumping was traversing endpoint address lists without holding lock_sock(), while those lists could change concurrently via socket operations (e.g., bindx changes). This creates a race where nla_reserve() counts addresses under RCU protection, but the subsequent copy may see fewer entries, potentially leaking uninitialized memory to userspace. Fix this by: - Taking a reference on each endpoint during hash traversal - Moving socket operations (lock_sock()) outside read_lock_bh() - Serializing address list access during dump - Reworking sctp_for_each_endpoint() to support restart-based traversal with (net, pos) tracking Also: - Add WARN_ON_ONCE() for inconsistent address counts - Fix idiag_states filtering for LISTEN vs association cases - Skip dumping endpoints being freed (ep->base.dead) - Move dump position tracking into iterator, removing cb->args[4] and its comment for sctp_ep_dump()., - Update the comment for cb->args[4] and remove the comment for unused cb->args[5] for sctp_sock_dump(). Note: traversal is restart-based and may re-scan buckets multiple times, but this is acceptable due to small bucket sizes and required to support sleeping-safe callbacks. This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero Day Initiative. Reported-by: Zero Day Initiative Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Signed-off-by: Xin Long Link: https://patch.msgid.link/4c1b49ab87e0f7d552ebd8172b364b1994e913c9.1781552190.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski --- include/net/sctp/sctp.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h index 60b073fd3ed8..d50c27812504 100644 --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h @@ -111,7 +111,8 @@ int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net, const union sctp_addr *paddr, void *p, int dif); int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done, struct net *net, int *pos, void *p); -int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p); +int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), + struct net *net, int *pos, void *p); int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc, struct sctp_info *info); -- cgit v1.2.3 From 28c5d230980bdd8cb18c073225296c7747995935 Mon Sep 17 00:00:00 2001 From: Zhan Xusheng Date: Wed, 17 Jun 2026 15:43:34 +0800 Subject: erofs: add folio order to trace_erofs_read_folio erofs supports large folios for reads, but the actual folio order instantiated in the page cache may be lower due to allocation constraints such as memory fragmentation. trace_erofs_read_folio already receives the folio being read but currently records only its index. Add folio_order() to the tracepoint so that users can observe the realized folio order and verify the effectiveness of large folio reads. Also drop the uptodate field: read_folio() is only called for a non-uptodate folio, so it is always 0. Suggested-by: Gao Xiang Signed-off-by: Zhan Xusheng Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang --- include/trace/events/erofs.h | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/trace/events/erofs.h b/include/trace/events/erofs.h index cd0e3fd8c23f..0a178cb10fb1 100644 --- a/include/trace/events/erofs.h +++ b/include/trace/events/erofs.h @@ -90,7 +90,7 @@ TRACE_EVENT(erofs_read_folio, __field(erofs_nid_t, nid ) __field(int, dir ) __field(pgoff_t, index ) - __field(int, uptodate) + __field(unsigned int, order ) __field(bool, raw ) ), @@ -99,16 +99,15 @@ TRACE_EVENT(erofs_read_folio, __entry->nid = EROFS_I(inode)->nid; __entry->dir = S_ISDIR(inode->i_mode); __entry->index = folio->index; - __entry->uptodate = folio_test_uptodate(folio); + __entry->order = folio_order(folio); __entry->raw = raw; ), - TP_printk("dev = (%d,%d), nid = %llu, %s, index = %lu, uptodate = %d " - "raw = %d", + TP_printk("dev = (%d,%d), nid = %llu, %s, index = %lu, order = %u, raw = %d", show_dev_nid(__entry), show_file_type(__entry->dir), (unsigned long)__entry->index, - __entry->uptodate, + __entry->order, __entry->raw) ); -- cgit v1.2.3 From 71553a60675994a79575567f6d56e214f9030dc4 Mon Sep 17 00:00:00 2001 From: "Vlastimil Babka (SUSE)" Date: Thu, 11 Jun 2026 18:24:06 +0200 Subject: mm/slab: replace __GFP_NO_OBJ_EXT with SLAB_ALLOC_NO_RECURSE for sheaves Finish the switch away from __GFP_NO_OBJ_EXT by replacing it with SLAB_ALLOC_NO_RECURSE when allocating empty sheaves. Pass alloc_flags to [__]alloc_empty_sheaf(). Callers that can't be part of a recursive kmalloc() chain simply pass SLAB_ALLOC_DEFAULT. Use kmalloc_flags() instead of kzalloc() for allocating the sheaf. With that we can finalize the removal the __GFP_NO_OBJ_EXT handling from obj_ext allocations as well, leaving only SLAB_ALLOC_NO_RECURSE in place. This leaves __GFP_NO_OBJ_EXT with no users in slab, so stop allowing the flag in kmalloc_nolock(). Link: https://patch.msgid.link/20260610-slab_alloc_flags-v2-16-7190909db118@kernel.org Reviewed-by: Hao Li Reviewed-by: Harry Yoo (Oracle) Reviewed-by: Suren Baghdasaryan Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/slab.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/slab.h b/include/linux/slab.h index b955f3cbb732..43c3d9b51107 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -1039,9 +1039,9 @@ void *_kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags, in /** * kmalloc_nolock - Allocate an object of given size from any context. * @size: size to allocate - * @gfp_flags: GFP flags. Only __GFP_ACCOUNT, __GFP_ZERO, __GFP_NO_OBJ_EXT - * allowed. Also __GFP_NOWARN and __GFP_NOMEMALLOC are allowed but added - * internally thus not necessary. + * @gfp_flags: GFP flags. Only __GFP_ACCOUNT and __GFP_ZERO allowed. Also + * __GFP_NOWARN and __GFP_NOMEMALLOC are allowed but added internally thus not + * necessary. * @node: node number of the target node. * * Return: pointer to the new object or NULL in case of error. -- cgit v1.2.3 From 6808645b71f02752852731764961a16f728772a6 Mon Sep 17 00:00:00 2001 From: Pedro Falcato Date: Thu, 11 Jun 2026 13:46:41 +0100 Subject: mm/slab: add a node-track-caller variant for kmem buckets allocation This is required by users that want to use kmem buckets, but still desire specifying the NUMA node. Reviewed-by: Kees Cook Acked-by: Vlastimil Babka (SUSE) Acked-by: Harry Yoo (Oracle) Signed-off-by: Pedro Falcato Link: https://patch.msgid.link/20260611124642.345400-2-pfalcato@suse.de Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/slab.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/slab.h b/include/linux/slab.h index 43c3d9b51107..333c85492314 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -1156,8 +1156,11 @@ void *kmalloc_nolock(size_t size, gfp_t gfp_flags, int node); #define kmem_buckets_alloc(_b, _size, _flags) \ alloc_hooks(__kmalloc_node_noprof(PASS_KMALLOC_PARAMS(_size, _b, __kmalloc_token(_size)), _flags, NUMA_NO_NODE)) -#define kmem_buckets_alloc_track_caller(_b, _size, _flags) \ - alloc_hooks(__kmalloc_node_track_caller_noprof(PASS_KMALLOC_PARAMS(_size, _b, __kmalloc_token(_size)), _flags, NUMA_NO_NODE, _RET_IP_)) +#define kmem_buckets_alloc_node_track_caller(_b, _size, _flags, _node) \ + alloc_hooks(__kmalloc_node_track_caller_noprof(PASS_KMALLOC_PARAMS(_size, _b, __kmalloc_token(_size)), _flags, _node, _RET_IP_)) + +#define kmem_buckets_alloc_track_caller(_b, _size, _flags) \ + kmem_buckets_alloc_node_track_caller(_b, _size, _flags, NUMA_NO_NODE) static __always_inline __alloc_size(1) void *_kmalloc_node_noprof(size_t size, gfp_t flags, int node, kmalloc_token_t token) { -- cgit v1.2.3 From 7b5f5865fb11e60edd03c5e063e2d228b7062317 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Wed, 17 Jun 2026 09:31:25 -0700 Subject: slab: recognize @GFP parameter as optional in kernel-doc Since the @GFP parameter in kmalloc_obj() etc. is now optional, change the kernel-doc to indicate that it is optional. This avoids kernel-doc warnings: WARNING: include/linux/slab.h:1101 Excess function parameter 'GFP' description in 'kmalloc_obj' WARNING: include/linux/slab.h:1113 Excess function parameter 'GFP' description in 'kmalloc_objs' WARNING: include/linux/slab.h:1128 Excess function parameter 'GFP' description in 'kmalloc_flex' Fixes: e19e1b480ac7 ("add default_gfp() helper macro and use it in the new *alloc_obj() helpers") Signed-off-by: Randy Dunlap Acked-by: Harry Yoo (Oracle) Link: https://patch.msgid.link/20260617163125.2716279-1-rdunlap@infradead.org Signed-off-by: Vlastimil Babka (SUSE) --- include/linux/slab.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/slab.h b/include/linux/slab.h index 333c85492314..516fdcf1b6c5 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -1094,7 +1094,7 @@ void *kmalloc_nolock(size_t size, gfp_t gfp_flags, int node); /** * kmalloc_obj - Allocate a single instance of the given type * @VAR_OR_TYPE: Variable or type to allocate. - * @GFP: GFP flags for the allocation. + * @...: optional GFP flags for the allocation (GFP_KERNEL when not specified). * * Returns: newly allocated pointer to a @VAR_OR_TYPE on success, or NULL * on failure. @@ -1106,7 +1106,7 @@ void *kmalloc_nolock(size_t size, gfp_t gfp_flags, int node); * kmalloc_objs - Allocate an array of the given type * @VAR_OR_TYPE: Variable or type to allocate an array of. * @COUNT: How many elements in the array. - * @GFP: GFP flags for the allocation. + * @...: optional GFP flags for the allocation (GFP_KERNEL when not specified). * * Returns: newly allocated pointer to array of @VAR_OR_TYPE on success, * or NULL on failure. @@ -1119,7 +1119,7 @@ void *kmalloc_nolock(size_t size, gfp_t gfp_flags, int node); * @VAR_OR_TYPE: Variable or type to allocate (with its flex array). * @FAM: The name of the flexible array member of the structure. * @COUNT: How many flexible array member elements are desired. - * @GFP: GFP flags for the allocation. + * @...: optional GFP flags for the allocation (GFP_KERNEL when not specified). * * Returns: newly allocated pointer to @VAR_OR_TYPE on success, NULL on * failure. If @FAM has been annotated with __counted_by(), the allocation -- cgit v1.2.3 From 079a028d6327e68cfa5d38b36123637b321c19a7 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Mon, 23 Mar 2026 01:27:25 +0000 Subject: string: Remove strncpy() from the kernel strncpy() has been a persistent source of bugs due to its ambiguous intended usage and frequently counter-intuitive semantics: it may not NUL-terminate the destination, and it unconditionally zero-pads to the full length, which isn't always needed. All former callers have been migrated[1] to: - strscpy() for NUL-terminated destinations - strscpy_pad() for NUL-terminated destinations needing zero-padding - strtomem_pad() for non-NUL-terminated fixed-width fields - memcpy_and_pad() for bounded copies with explicit padding - memcpy() for known-length copies Remove the generic implementation, its declaration, the FORTIFY_SOURCE wrapper, and associated tests. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook --- include/linux/fortify-string.h | 49 ------------------------------------------ include/linux/string.h | 3 --- 2 files changed, 52 deletions(-) (limited to 'include') diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h index 171982e53c9a..cf841dc71fef 100644 --- a/include/linux/fortify-string.h +++ b/include/linux/fortify-string.h @@ -26,7 +26,6 @@ #define FORTIFY_WRITE 1 #define EACH_FORTIFY_FUNC(macro) \ - macro(strncpy), \ macro(strnlen), \ macro(strlen), \ macro(strscpy), \ @@ -95,8 +94,6 @@ extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat); extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy); extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen); extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat); -extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy); - #else #if defined(__SANITIZE_MEMORY__) @@ -120,7 +117,6 @@ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) #define __underlying_strcpy __builtin_strcpy #define __underlying_strlen __builtin_strlen #define __underlying_strncat __builtin_strncat -#define __underlying_strncpy __builtin_strncpy #endif @@ -159,50 +155,6 @@ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) (bounds) < (length) \ ) -/** - * strncpy - Copy a string to memory with non-guaranteed NUL padding - * - * @p: pointer to destination of copy - * @q: pointer to NUL-terminated source string to copy - * @size: bytes to write at @p - * - * If strlen(@q) >= @size, the copy of @q will stop after @size bytes, - * and @p will NOT be NUL-terminated - * - * If strlen(@q) < @size, following the copy of @q, trailing NUL bytes - * will be written to @p until @size total bytes have been written. - * - * Do not use this function. While FORTIFY_SOURCE tries to avoid - * over-reads of @q, it cannot defend against writing unterminated - * results to @p. Using strncpy() remains ambiguous and fragile. - * Instead, please choose an alternative, so that the expectation - * of @p's contents is unambiguous: - * - * +--------------------+--------------------+------------+ - * | **p** needs to be: | padded to **size** | not padded | - * +====================+====================+============+ - * | NUL-terminated | strscpy_pad() | strscpy() | - * +--------------------+--------------------+------------+ - * | not NUL-terminated | strtomem_pad() | strtomem() | - * +--------------------+--------------------+------------+ - * - * Note strscpy*()'s differing return values for detecting truncation, - * and strtomem*()'s expectation that the destination is marked with - * __nonstring when it is a character array. - * - */ -__FORTIFY_INLINE __diagnose_as(__builtin_strncpy, 1, 2, 3) -char *strncpy(char * const POS p, const char *q, __kernel_size_t size) -{ - const size_t p_size = __member_size(p); - - if (__compiletime_lessthan(p_size, size)) - __write_overflow(); - if (p_size < size) - fortify_panic(FORTIFY_FUNC_strncpy, FORTIFY_WRITE, p_size, size, p); - return __underlying_strncpy(p, q, size); -} - extern __kernel_size_t __real_strnlen(const char *, __kernel_size_t) __RENAME(strnlen); /** * strnlen - Return bounded count of characters in a NUL-terminated string @@ -809,7 +761,6 @@ char *strcpy(char * const POS p, const char * const POS q) #undef __underlying_strcpy #undef __underlying_strlen #undef __underlying_strncat -#undef __underlying_strncpy #undef POS #undef POS0 diff --git a/include/linux/string.h b/include/linux/string.h index b850bd91b3d8..5702daca4326 100644 --- a/include/linux/string.h +++ b/include/linux/string.h @@ -67,9 +67,6 @@ void *vmemdup_array_user(const void __user *src, size_t n, size_t size) #ifndef __HAVE_ARCH_STRCPY extern char * strcpy(char *,const char *); #endif -#ifndef __HAVE_ARCH_STRNCPY -extern char * strncpy(char *,const char *, __kernel_size_t); -#endif ssize_t sized_strscpy(char *, const char *, size_t); /* -- cgit v1.2.3 From c9c9b37f8c5505224e8d206184df3bb668ee00cf Mon Sep 17 00:00:00 2001 From: Haoze Xie Date: Mon, 8 Jun 2026 13:43:44 +0800 Subject: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). If such a packet is queued to NFQUEUE, __nf_queue() upgrades that fake dst with skb_dst_force(). At that point the queued skb can hold a real dst reference after bridge teardown has started. The problem is not that every bridged packet needs its own dst reference. The problem is that NFQUEUE can keep the bridge private fake dst alive after unregister begins. Fix this by keeping the bridge fake dst model unchanged and pinning the bridge master device only while the packet sits in NFQUEUE. Record the bridge device in nf_queue_entry when the queued skb carries a bridge fake dst, take a device reference for the queue lifetime, and drop it when the queue entry is freed. Also make sure queued entries are reaped when that bridge device goes down, and drop the redundant nf_bridge_info_exists() test from the fake dst detection. This keeps netdev_priv(br->dev) alive until verdict completion, so the embedded fake rtable and its metrics backing storage cannot be freed out from under dst_release(). It also avoids the constant refcount bump and avoids using ipv4-specific dst helpers for IPv6 bridge traffic. Fixes: 34666d467cbf ("netfilter: bridge: move br_netfilter out of the core") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Haoze Xie Signed-off-by: Ren Wei Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_queue.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h index 3978c3174cdb..fc3e81c07364 100644 --- a/include/net/netfilter/nf_queue.h +++ b/include/net/netfilter/nf_queue.h @@ -18,6 +18,7 @@ struct nf_queue_entry { unsigned int id; unsigned int hook_index; /* index in hook_entries->hook[] */ #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) + struct net_device *bridge_dev; struct net_device *physin; struct net_device *physout; #endif -- cgit v1.2.3 From bff1c8b49a9cb5c04af20f4e7d43bf4af5863bc6 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Thu, 18 Jun 2026 08:16:18 +0200 Subject: netfilter: nft_meta_bridge: add validate callback for get operations Blamed commit added NFT_META_BRI_IIFHWADDR to the set validate callback, yet this is a get operation. Add a get validate callback and move the NFT_META_BRI_IIFHWADDR key there. AFAICS this is harmless, NFT_META_BRI_IIFHWADDR can deal with a NULL input device and the set handler ignores a NFT_META_BRI_IIFHWADDR operation, but it allows to read 4 bytes off bridge skb->cb[]. Fixes: cbd2257dc96e ("netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support") Signed-off-by: Florian Westphal Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nft_meta.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h index f74e63290603..6cf1d910bbf8 100644 --- a/include/net/netfilter/nft_meta.h +++ b/include/net/netfilter/nft_meta.h @@ -40,6 +40,8 @@ void nft_meta_set_eval(const struct nft_expr *expr, void nft_meta_set_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr); +int nft_meta_get_validate(const struct nft_ctx *ctx, + const struct nft_expr *expr); int nft_meta_set_validate(const struct nft_ctx *ctx, const struct nft_expr *expr); -- cgit v1.2.3 From b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 18 Jun 2026 13:56:38 +0200 Subject: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct extension is added, then the new GC worker does not need to bump the ct refcount to check if the ct->ext helper is available. This removes the extra bump on the refcount for expectation timers, this allows to remove several nf_ct_expect_put() calls after the unlink, after this update only refcount remains at 1 while on the expectation hashes. This patch implicitly addresses a race with the existing timer API allowing an expectation to access a stale exp->master pointer which has been already released when expectation removal loses races with an expiring timer, ie. timer_del() reporting false. Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This is needed by nf_conntrack_unexpect_related() which is called in error paths to invalidate newly created expectations that has been added into the hashes. These expectactions cannot be inmediately released as GC or nf_ct_remove_expectations() could race to make it. On expectation insert, the runtime GC reaps stale expectations before checking the expectation limit set by policy. Set current timestamp in nf_ct_expect_alloc(), then add the expectation policy timeout (or custom timeout specified added on top of this) to specify the expectation lifetime. Fixes: bffcaad9afdf ("netfilter: ctnetlink: ensure safe access to master conntrack") Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_expect.h | 16 +++++++++++++--- include/uapi/linux/netfilter/nf_conntrack_common.h | 1 + 2 files changed, 14 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h index 80f50fd0f7ad..be4a120d549e 100644 --- a/include/net/netfilter/nf_conntrack_expect.h +++ b/include/net/netfilter/nf_conntrack_expect.h @@ -54,8 +54,8 @@ struct nf_conntrack_expect { /* The conntrack of the master connection */ struct nf_conn *master; - /* Timer function; deletes the expectation. */ - struct timer_list timeout; + /* jiffies32 when this expectation expires */ + u32 timeout; #if IS_ENABLED(CONFIG_NF_NAT) union nf_inet_addr saved_addr; @@ -69,6 +69,14 @@ struct nf_conntrack_expect { struct rcu_head rcu; }; +static inline bool nf_ct_exp_is_expired(const struct nf_conntrack_expect *exp) +{ + if (READ_ONCE(exp->flags) & NF_CT_EXPECT_DEAD) + return true; + + return (__s32)(READ_ONCE(exp->timeout) - nfct_time_stamp) <= 0; +} + static inline struct net *nf_ct_exp_net(struct nf_conntrack_expect *exp) { return read_pnet(&exp->net); @@ -130,7 +138,6 @@ static inline void nf_ct_unlink_expect(struct nf_conntrack_expect *exp) void nf_ct_remove_expectations(struct nf_conn *ct); void nf_ct_unexpect_related(struct nf_conntrack_expect *exp); -bool nf_ct_remove_expect(struct nf_conntrack_expect *exp); void nf_ct_expect_iterate_destroy(bool (*iter)(struct nf_conntrack_expect *e, void *data), void *data); void nf_ct_expect_iterate_net(struct net *net, @@ -153,5 +160,8 @@ static inline int nf_ct_expect_related(struct nf_conntrack_expect *expect, return nf_ct_expect_related_report(expect, 0, 0, flags); } +struct nf_conn_help; +void nf_ct_expectation_gc(struct nf_conn_help *master_help); + #endif /*_NF_CONNTRACK_EXPECT_H*/ diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h index 56b6b60a814f..ee51045ae1d6 100644 --- a/include/uapi/linux/netfilter/nf_conntrack_common.h +++ b/include/uapi/linux/netfilter/nf_conntrack_common.h @@ -160,6 +160,7 @@ enum ip_conntrack_expect_events { #define NF_CT_EXPECT_USERSPACE 0x4 #ifdef __KERNEL__ +#define NF_CT_EXPECT_DEAD 0x8 #define NF_CT_EXPECT_MASK (NF_CT_EXPECT_PERMANENT | NF_CT_EXPECT_INACTIVE | \ NF_CT_EXPECT_USERSPACE) #endif -- cgit v1.2.3 From f00e6c1d282578b077b87b88f42e701bc40f2fff Mon Sep 17 00:00:00 2001 From: Remi Pommarel Date: Thu, 21 May 2026 11:40:29 +0200 Subject: 9p: Cache negative dentries for lookup performance Not caching negative dentries can result in poor performance for workloads that repeatedly look up non-existent paths. Each such lookup triggers a full 9P transaction with the server, adding unnecessary overhead. A typical example is source compilation, where multiple cc1 processes are spawned and repeatedly search for the same missing header files over and over again. This change enables caching of negative dentries, so that lookups for known non-existent paths do not require a full 9P transaction. The cached negative dentries are retained for a configurable duration (expressed in milliseconds), as specified by the ndentry_timeout field in struct v9fs_session_info. If set to -1, negative dentries are cached indefinitely. This optimization reduces lookup overhead and improves performance for workloads involving frequent access to non-existent paths. Signed-off-by: Remi Pommarel Message-ID: Signed-off-by: Dominique Martinet --- include/net/9p/client.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/net/9p/client.h b/include/net/9p/client.h index 838a94218b59..55c6cb54bd25 100644 --- a/include/net/9p/client.h +++ b/include/net/9p/client.h @@ -192,6 +192,7 @@ struct p9_rdma_opts { * @dfltgid: default numeric groupid to mount hierarchy as * @uid: if %V9FS_ACCESS_SINGLE, the numeric uid which mounted the hierarchy * @session_lock_timeout: retry interval for blocking locks + * @ndentry_timeout_ms: Negative dentry lookup cache retention time in ms * * This strucure holds options which are parsed and will be transferred * to the v9fs_session_info structure when mounted, and therefore largely @@ -203,6 +204,7 @@ struct p9_session_opts { unsigned short debug; unsigned int afid; unsigned int cache; + unsigned int ndentry_timeout_ms; #ifdef CONFIG_9P_FSCACHE char *cachetag; #endif -- cgit v1.2.3 From 0c3a350d13ce8bb7c3427597819b0dfbc19ba242 Mon Sep 17 00:00:00 2001 From: Hao Ge Date: Thu, 4 Jun 2026 10:40:08 +0800 Subject: mm/alloc_tag: replace fixed-size early PFN array with dynamic linked list Pages allocated before page_ext is available have their codetag left uninitialized. Track these early PFNs and clear their codetag in clear_early_alloc_pfn_tag_refs() to avoid "alloc_tag was not set" warnings when they are freed later. Currently a fixed-size array of 8192 entries is used, with a warning if the limit is exceeded. However, the number of early allocations depends on the number of CPUs and can be larger than 8192. Replace the fixed-size array with a dynamically allocated linked list of pfn_pool structs. Each node is allocated via alloc_page() and mapped to a pfn_pool containing a next pointer, an atomic slot counter, and a PFN array that fills the remainder of the page. The tracking pages themselves are allocated via alloc_page(), which would trigger __pgalloc_tag_add() -> alloc_tag_add_early_pfn() and recurse indefinitely. Introduce __GFP_NO_CODETAG (reuses the %__GFP_NO_OBJ_EXT bit) and pass gfp_flags through pgalloc_tag_add() so that the early path can skip recording allocations that carry this flag. Link: https://lore.kernel.org/20260604024008.46592-1-hao.ge@linux.dev Signed-off-by: Hao Ge Suggested-by: Suren Baghdasaryan Acked-by: Suren Baghdasaryan Cc: Kent Overstreet Signed-off-by: Andrew Morton --- include/linux/alloc_tag.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/alloc_tag.h b/include/linux/alloc_tag.h index 02de2ede560f..068ba2e77c5d 100644 --- a/include/linux/alloc_tag.h +++ b/include/linux/alloc_tag.h @@ -163,11 +163,11 @@ static inline void alloc_tag_sub_check(union codetag_ref *ref) { WARN_ONCE(ref && !ref->ct, "alloc_tag was not set\n"); } -void alloc_tag_add_early_pfn(unsigned long pfn); +void alloc_tag_add_early_pfn(unsigned long pfn, gfp_t gfp_flags); #else static inline void alloc_tag_add_check(union codetag_ref *ref, struct alloc_tag *tag) {} static inline void alloc_tag_sub_check(union codetag_ref *ref) {} -static inline void alloc_tag_add_early_pfn(unsigned long pfn) {} +static inline void alloc_tag_add_early_pfn(unsigned long pfn, gfp_t gfp_flags) {} #endif /* Caller should verify both ref and tag to be valid */ -- cgit v1.2.3 From 67c2696cf76aa276376fdd845c7d1b3e16b97af2 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Tue, 24 Mar 2026 14:42:25 -0700 Subject: lib: split codetag_lock_module_list() Letting a function argument indicate whether a lock or unlock operation should be performed is incompatible with compile-time analysis of locking operations by sparse and Clang. Hence, split codetag_lock_module_list() into two functions: a function that locks cttype->mod_lock and another function that unlocks cttype->mod_lock. No functionality has been changed. See also commit 916cc5167cc6 ("lib: code tagging framework"). Link: https://lore.kernel.org/20260324214226.3684605-1-bvanassche@acm.org Signed-off-by: Bart Van Assche Acked-by: Suren Baghdasaryan Cc: Kent Overstreet Cc: Nathan Chancellor Signed-off-by: Andrew Morton --- include/linux/codetag.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/codetag.h b/include/linux/codetag.h index 8ea2a5f7c98a..ddae7484ca45 100644 --- a/include/linux/codetag.h +++ b/include/linux/codetag.h @@ -74,8 +74,9 @@ struct codetag_iterator { .flags = 0, \ } -void codetag_lock_module_list(struct codetag_type *cttype, bool lock); +void codetag_lock_module_list(struct codetag_type *cttype); bool codetag_trylock_module_list(struct codetag_type *cttype); +void codetag_unlock_module_list(struct codetag_type *cttype); struct codetag_iterator codetag_get_ct_iter(struct codetag_type *cttype); struct codetag *codetag_next_ct(struct codetag_iterator *iter); -- cgit v1.2.3 From d04fa025671ea49e6950b3261af115eff1e6a608 Mon Sep 17 00:00:00 2001 From: Dev Jain Date: Fri, 5 Jun 2026 10:14:09 -0600 Subject: mm/khugepaged: generalize alloc_charge_folio() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pass order to alloc_charge_folio() and update mTHP statistics. Link: https://lore.kernel.org/20260605161422.213817-3-npache@redhat.com Signed-off-by: Dev Jain Co-developed-by: Nico Pache Signed-off-by: Nico Pache Reviewed-by: Wei Yang Reviewed-by: Lance Yang Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Acked-by: Usama Arif Acked-by: David Hildenbrand (Arm) Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Bagas Sanjaya Cc: Barry Song Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Rientjes Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Liam R. Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Pedro Falcato Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Signed-off-by: Andrew Morton --- include/linux/huge_mm.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index c0d223d0c556..e225d1d4a3fe 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -128,6 +128,8 @@ enum mthp_stat_item { MTHP_STAT_ANON_FAULT_ALLOC, MTHP_STAT_ANON_FAULT_FALLBACK, MTHP_STAT_ANON_FAULT_FALLBACK_CHARGE, + MTHP_STAT_COLLAPSE_ALLOC, + MTHP_STAT_COLLAPSE_ALLOC_FAILED, MTHP_STAT_ZSWPOUT, MTHP_STAT_SWPIN, MTHP_STAT_SWPIN_FALLBACK, -- cgit v1.2.3 From b5b8b329c4b456806e3bcc6bf3490fbc508e9080 Mon Sep 17 00:00:00 2001 From: Nico Pache Date: Fri, 5 Jun 2026 10:14:15 -0600 Subject: mm/khugepaged: add per-order mTHP collapse failure statistics MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add three new mTHP statistics to track collapse failures for different orders when encountering swap PTEs, excessive none PTEs, and shared PTEs: - collapse_exceed_swap_pte: Increment when mTHP collapse fails due to encountering a swap PTE. - collapse_exceed_none_pte: Counts when mTHP collapse fails due to exceeding the none PTE threshold for the given order - collapse_exceed_shared_pte: Counts when mTHP collapse fails due to encountering a shared PTE. These statistics complement the existing THP_SCAN_EXCEED_* events by providing per-order granularity for mTHP collapse attempts. The stats are exposed via sysfs under `/sys/kernel/mm/transparent_hugepage/hugepages-*/stats/` for each supported hugepage size. As we currently do not support collapsing mTHPs that contain a swap or shared entry, those statistics keep track of how often we are encountering failed mTHP collapses due to these restrictions. We will add support for mTHP collapse for anonymous pages next; lets also track when this happens at the PMD level within the per-mTHP stats. Link: https://lore.kernel.org/20260605161422.213817-9-npache@redhat.com Signed-off-by: Nico Pache Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand (Arm) Reviewed-by: Lance Yang Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Bagas Sanjaya Cc: Baolin Wang Cc: Barry Song Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Rientjes Cc: Dev Jain Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Liam R. Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Pedro Falcato Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/huge_mm.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index e225d1d4a3fe..89f4c22d7d62 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -144,6 +144,9 @@ enum mthp_stat_item { MTHP_STAT_SPLIT_DEFERRED, MTHP_STAT_NR_ANON, MTHP_STAT_NR_ANON_PARTIALLY_MAPPED, + MTHP_STAT_COLLAPSE_EXCEED_SWAP, + MTHP_STAT_COLLAPSE_EXCEED_NONE, + MTHP_STAT_COLLAPSE_EXCEED_SHARED, __MTHP_STAT_COUNT }; -- cgit v1.2.3 From ceaa0b641311e6279722b03acfbcd173d166518f Mon Sep 17 00:00:00 2001 From: Nico Pache Date: Fri, 5 Jun 2026 10:14:16 -0600 Subject: mm/khugepaged: improve tracepoints for mTHP orders MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add the order to the mm_collapse_huge_page<_swapin,_isolate> tracepoints to give better insight into what order is being operated at for. Link: https://lore.kernel.org/20260605161422.213817-10-npache@redhat.com Signed-off-by: Nico Pache Reviewed-by: Lorenzo Stoakes Reviewed-by: Baolin Wang Acked-by: David Hildenbrand (Arm) Reviewed-by: Lance Yang Cc: Alistair Popple Cc: Andrea Arcangeli Cc: Anshuman Khandual Cc: Bagas Sanjaya Cc: Barry Song Cc: Brendan Jackman Cc: Byungchul Park Cc: Catalin Marinas Cc: David Rientjes Cc: Dev Jain Cc: Gregory Price Cc: "Huang, Ying" Cc: Hugh Dickins Cc: Jan Kara Cc: Jann Horn Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Kefeng Wang Cc: Liam R. Howlett Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Matthew Brost Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nanyong Sun Cc: Pedro Falcato Cc: Peter Xu Cc: Rafael Aquini Cc: Rakie Kim Cc: Randy Dunlap Cc: Ryan Roberts Cc: Shivank Garg Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Takashi Iwai (SUSE) Cc: Thomas Hellström Cc: Usama Arif Cc: Usama Arif Cc: Vishal Moola (Oracle) Cc: Vlastimil Babka Cc: Wei Yang Cc: Will Deacon Cc: Yang Shi Cc: Zach O'Keefe Cc: Zi Yan Signed-off-by: Andrew Morton --- include/trace/events/huge_memory.h | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) (limited to 'include') diff --git a/include/trace/events/huge_memory.h b/include/trace/events/huge_memory.h index bcdc57eea270..291fae364c62 100644 --- a/include/trace/events/huge_memory.h +++ b/include/trace/events/huge_memory.h @@ -89,40 +89,44 @@ TRACE_EVENT(mm_khugepaged_scan_pmd, TRACE_EVENT(mm_collapse_huge_page, - TP_PROTO(struct mm_struct *mm, int isolated, int status), + TP_PROTO(struct mm_struct *mm, int isolated, int status, unsigned int order), - TP_ARGS(mm, isolated, status), + TP_ARGS(mm, isolated, status, order), TP_STRUCT__entry( __field(struct mm_struct *, mm) __field(int, isolated) __field(int, status) + __field(unsigned int, order) ), TP_fast_assign( __entry->mm = mm; __entry->isolated = isolated; __entry->status = status; + __entry->order = order; ), - TP_printk("mm=%p, isolated=%d, status=%s", + TP_printk("mm=%p, isolated=%d, status=%s, order=%u", __entry->mm, __entry->isolated, - __print_symbolic(__entry->status, SCAN_STATUS)) + __print_symbolic(__entry->status, SCAN_STATUS), + __entry->order) ); TRACE_EVENT(mm_collapse_huge_page_isolate, TP_PROTO(struct folio *folio, int none_or_zero, - int referenced, int status), + int referenced, int status, unsigned int order), - TP_ARGS(folio, none_or_zero, referenced, status), + TP_ARGS(folio, none_or_zero, referenced, status, order), TP_STRUCT__entry( __field(unsigned long, pfn) __field(int, none_or_zero) __field(int, referenced) __field(int, status) + __field(unsigned int, order) ), TP_fast_assign( @@ -130,26 +134,30 @@ TRACE_EVENT(mm_collapse_huge_page_isolate, __entry->none_or_zero = none_or_zero; __entry->referenced = referenced; __entry->status = status; + __entry->order = order; ), - TP_printk("scan_pfn=0x%lx, none_or_zero=%d, referenced=%d, status=%s", + TP_printk("scan_pfn=0x%lx, none_or_zero=%d, referenced=%d, status=%s, order=%u", __entry->pfn, __entry->none_or_zero, __entry->referenced, - __print_symbolic(__entry->status, SCAN_STATUS)) + __print_symbolic(__entry->status, SCAN_STATUS), + __entry->order) ); TRACE_EVENT(mm_collapse_huge_page_swapin, - TP_PROTO(struct mm_struct *mm, int swapped_in, int referenced, int ret), + TP_PROTO(struct mm_struct *mm, int swapped_in, int referenced, int ret, + unsigned int order), - TP_ARGS(mm, swapped_in, referenced, ret), + TP_ARGS(mm, swapped_in, referenced, ret, order), TP_STRUCT__entry( __field(struct mm_struct *, mm) __field(int, swapped_in) __field(int, referenced) __field(int, ret) + __field(unsigned int, order) ), TP_fast_assign( @@ -157,13 +165,15 @@ TRACE_EVENT(mm_collapse_huge_page_swapin, __entry->swapped_in = swapped_in; __entry->referenced = referenced; __entry->ret = ret; + __entry->order = order; ), - TP_printk("mm=%p, swapped_in=%d, referenced=%d, ret=%d", + TP_printk("mm=%p, swapped_in=%d, referenced=%d, ret=%d, order=%u", __entry->mm, __entry->swapped_in, __entry->referenced, - __entry->ret) + __entry->ret, + __entry->order) ); TRACE_EVENT(mm_khugepaged_scan_file, -- cgit v1.2.3 From cd2d3d1f26c27eace8c70bd481889afd3c34a42c Mon Sep 17 00:00:00 2001 From: Zi Yan Date: Sun, 17 May 2026 09:54:03 -0400 Subject: mm/khugepaged: remove READ_ONLY_THP_FOR_FS check Patch series "Remove CONFIG_READ_ONLY_THP_FOR_FS and enable file THP for writable files", v6. This patch (of 14): collapse_file() requires FSes supporting large folio with at least PMD_ORDER, so replace the READ_ONLY_THP_FOR_FS check with that. MADV_COLLAPSE ignores shmem huge config, so exclude the check for shmem. While at it, replace VM_BUG_ON with VM_WARN_ON_ONCE. Add a helper function mapping_pmd_folio_support() for FSes supporting large folio with at least PMD_ORDER. Link: https://lore.kernel.org/20260517135416.1434539-1-ziy@nvidia.com Link: https://lore.kernel.org/20260517135416.1434539-2-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Lance Yang Reviewed-by: Baolin Wang Acked-by: David Hildenbrand (Arm) Reviewed-by: Nico Pache Cc: Al Viro Cc: Barry Song Cc: Chris Mason Cc: Christian Brauner Cc: David Sterba Cc: Dev Jain Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Song Liu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/pagemap.h | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'include') diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h index 1f50991b43e3..308d846531d0 100644 --- a/include/linux/pagemap.h +++ b/include/linux/pagemap.h @@ -513,6 +513,33 @@ static inline bool mapping_large_folio_support(const struct address_space *mappi return mapping_max_folio_order(mapping) > 0; } +/** + * mapping_pmd_folio_support() - Check if a mapping supports PMD-sized folio + * @mapping: The address_space + * + * While some mappings support large folios, they might not support PMD-sized + * folios. This function checks whether a mapping supports PMD-sized folios. + * For example, khugepaged needs this information before attempting to + * collapsing THPs. + * + * Return: True if PMD-sized folios are supported, otherwise false. + */ +#ifdef CONFIG_TRANSPARENT_HUGEPAGE +static inline bool mapping_pmd_folio_support(const struct address_space *mapping) +{ + /* AS_FOLIO_ORDER is only reasonable for pagecache folios */ + VM_WARN_ON_ONCE((unsigned long)mapping & FOLIO_MAPPING_ANON); + + return mapping_min_folio_order(mapping) <= PMD_ORDER && + mapping_max_folio_order(mapping) >= PMD_ORDER; +} +#else +static inline bool mapping_pmd_folio_support(const struct address_space *mapping) +{ + return false; +} +#endif + /* Return the maximum folio size for this pagecache mapping, in bytes. */ static inline size_t mapping_max_folio_size(const struct address_space *mapping) { -- cgit v1.2.3 From efc36a715383439d7987b2d592b7549144fb5aad Mon Sep 17 00:00:00 2001 From: Zi Yan Date: Sun, 17 May 2026 09:54:06 -0400 Subject: mm/khugepaged: remove READ_ONLY_THP_FOR_FS check in hugepage_enabled() Remove the READ_ONLY_THP_FOR_FS gate and khugepaged for file-backed pmd-sized hugepages are enabled by the global transparent hugepage control. khugepaged can still be enabled by per-size control for anon and shmem when the global control is off. Add shmem_hpage_pmd_enabled() stub for !CONFIG_SHMEM to remove IS_ENABLED(SHMEM) in hugepage_enabled(). Clean up hugepage_enabled() by moving anon code to anon_hpage_enabled(). Link: https://lore.kernel.org/20260517135416.1434539-5-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Baolin Wang Acked-by: David Hildenbrand (Arm) Reviewed-by: Nico Pache Reviewed-by: Lance Yang Cc: Al Viro Cc: Barry Song Cc: Chris Mason Cc: Christian Brauner Cc: David Sterba Cc: Dev Jain Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Song Liu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/shmem_fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h index 93a0ba872ebe..acb8dd961b45 100644 --- a/include/linux/shmem_fs.h +++ b/include/linux/shmem_fs.h @@ -127,7 +127,7 @@ int shmem_writeout(struct folio *folio, struct swap_iocb **plug, void shmem_truncate_range(struct inode *inode, loff_t start, uoff_t end); int shmem_unuse(unsigned int type); -#ifdef CONFIG_TRANSPARENT_HUGEPAGE +#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && defined(CONFIG_SHMEM) unsigned long shmem_allowable_huge_orders(struct inode *inode, struct vm_area_struct *vma, pgoff_t index, loff_t write_end, bool shmem_huge_force); -- cgit v1.2.3 From 044925f9b56501f893bbfb7f4acfdbe0f5fba0d1 Mon Sep 17 00:00:00 2001 From: Zi Yan Date: Sun, 17 May 2026 09:54:08 -0400 Subject: mm: fs: remove filemap_nr_thps*() functions and their users They are used by READ_ONLY_THP_FOR_FS to handle writes to FSes without large folio support, so that read-only THPs created in these FSes are not seen by the FSes when the underlying fd becomes writable. Now read-only PMD THPs only appear in a FS with large folio support and the supported orders include PMD_ORDER. READ_ONLY_THP_FOR_FS was using mapping->nr_thps, inode->i_writecount, and smp_mb() to prevent writes to a read-only THP and collapsing writable folios into a THP. In collapse_file(), mapping->nr_thps is increased, then smp_mb(), and if inode->i_writecount > 0, collapse is stopped, while do_dentry_open() first increases inode->i_writecount, then a full memory fence, and if mapping->nr_thps > 0, all read-only THPs are truncated. Now this mechanism can be removed along with READ_ONLY_THP_FOR_FS code, since a dirty folio check has been added after try_to_unmap() in collapse_file() to prevent dirty folios from being collapsed as clean. Link: https://lore.kernel.org/20260517135416.1434539-7-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Baolin Wang Reviewed-by: Lance Yang Cc: Al Viro Cc: Barry Song Cc: Chris Mason Cc: Christian Brauner Cc: David Sterba Cc: Dev Jain Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Shuah Khan Cc: Song Liu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/pagemap.h | 29 ----------------------------- 1 file changed, 29 deletions(-) (limited to 'include') diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h index 308d846531d0..627771e82eb1 100644 --- a/include/linux/pagemap.h +++ b/include/linux/pagemap.h @@ -546,35 +546,6 @@ static inline size_t mapping_max_folio_size(const struct address_space *mapping) return PAGE_SIZE << mapping_max_folio_order(mapping); } -static inline int filemap_nr_thps(const struct address_space *mapping) -{ -#ifdef CONFIG_READ_ONLY_THP_FOR_FS - return atomic_read(&mapping->nr_thps); -#else - return 0; -#endif -} - -static inline void filemap_nr_thps_inc(struct address_space *mapping) -{ -#ifdef CONFIG_READ_ONLY_THP_FOR_FS - if (!mapping_large_folio_support(mapping)) - atomic_inc(&mapping->nr_thps); -#else - WARN_ON_ONCE(mapping_large_folio_support(mapping) == 0); -#endif -} - -static inline void filemap_nr_thps_dec(struct address_space *mapping) -{ -#ifdef CONFIG_READ_ONLY_THP_FOR_FS - if (!mapping_large_folio_support(mapping)) - atomic_dec(&mapping->nr_thps); -#else - WARN_ON_ONCE(mapping_large_folio_support(mapping) == 0); -#endif -} - struct address_space *folio_mapping(const struct folio *folio); /** -- cgit v1.2.3 From 27e7918905ee918d8ca268afc98234e8c8450641 Mon Sep 17 00:00:00 2001 From: Zi Yan Date: Sun, 17 May 2026 09:54:09 -0400 Subject: fs: remove nr_thps from struct address_space filemap_nr_thps*() are removed, the related field, address_space->nr_thps, is no longer needed. Remove it. This shrinks struct address_space by 8 bytes on 64-bit systems which may increase the number of inodes we can cache. Link: https://lore.kernel.org/20260517135416.1434539-8-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Lorenzo Stoakes (Oracle) Acked-by: David Hildenbrand (Arm) Reviewed-by: Lance Yang Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Baolin Wang Reviewed-by: Nico Pache Cc: Al Viro Cc: Barry Song Cc: Chris Mason Cc: Christian Brauner Cc: David Sterba Cc: Dev Jain Cc: Jan Kara Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Shuah Khan Cc: Song Liu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/fs.h | 5 ----- 1 file changed, 5 deletions(-) (limited to 'include') diff --git a/include/linux/fs.h b/include/linux/fs.h index 11559c513dfb..bb9cc4f7207c 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -460,7 +460,6 @@ struct mapping_metadata_bhs { * memory mappings. * @gfp_mask: Memory allocation flags to use for allocating pages. * @i_mmap_writable: Number of VM_SHARED, VM_MAYWRITE mappings. - * @nr_thps: Number of THPs in the pagecache (non-shmem only). * @i_mmap: Tree of private and shared mappings. * @i_mmap_rwsem: Protects @i_mmap and @i_mmap_writable. * @nrpages: Number of page entries, protected by the i_pages lock. @@ -476,10 +475,6 @@ struct address_space { struct rw_semaphore invalidate_lock; gfp_t gfp_mask; atomic_t i_mmap_writable; -#ifdef CONFIG_READ_ONLY_THP_FOR_FS - /* number of thp, only for non-shmem files */ - atomic_t nr_thps; -#endif struct rb_root_cached i_mmap; unsigned long nrpages; pgoff_t writeback_index; -- cgit v1.2.3 From 15e2258e255525ddae5c78c1ffdc88fe8a1116e6 Mon Sep 17 00:00:00 2001 From: Zi Yan Date: Sun, 17 May 2026 09:54:11 -0400 Subject: mm/truncate: use folio_split() in truncate_inode_partial_folio() After READ_ONLY_THP_FOR_FS is removed, FS either supports large folio or not. folio_split() can be used on a FS with large folio support without worrying about getting a THP on a FS without large folio support. When READ_ONLY_THP_FOR_FS was present, a PMD large pagecache folio can appear in a FS without large folio support after khugepaged or madvise(MADV_COLLAPSE) creates it. During truncate_inode_partial_folio(), such a PMD large pagecache folio is split and if the FS does not support large folio, it needs to be split to order-0 ones and could not be split non uniformly to ones with various orders. try_folio_split_to_order() was added to handle this situation by checking folio_check_splittable(..., SPLIT_TYPE_NON_UNIFORM) to detect if the large folio is created due to READ_ONLY_THP_FOR_FS and the FS does not support large folio. Now READ_ONLY_THP_FOR_FS is removed, all large pagecache folios are created with FSes supporting large folio, this function is no longer needed and all large pagecache folios can be split non uniformly. Link: https://lore.kernel.org/20260517135416.1434539-10-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Lance Yang Acked-by: David Hildenbrand (Arm) Cc: Al Viro Cc: Baolin Wang Cc: Barry Song Cc: Chris Mason Cc: Christian Brauner Cc: David Sterba Cc: Dev Jain Cc: Jan Kara Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Mike Rapoport Cc: Nico Pache Cc: Ryan Roberts Cc: Shuah Khan Cc: Song Liu Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- include/linux/huge_mm.h | 25 ++----------------------- 1 file changed, 2 insertions(+), 23 deletions(-) (limited to 'include') diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 89f4c22d7d62..ad20f7f8c179 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -419,27 +419,6 @@ static inline int split_huge_page_to_order(struct page *page, unsigned int new_o return split_huge_page_to_list_to_order(page, NULL, new_order); } -/** - * try_folio_split_to_order() - try to split a @folio at @page to @new_order - * using non uniform split. - * @folio: folio to be split - * @page: split to @new_order at the given page - * @new_order: the target split order - * - * Try to split a @folio at @page using non uniform split to @new_order, if - * non uniform split is not supported, fall back to uniform split. After-split - * folios are put back to LRU list. Use min_order_for_split() to get the lower - * bound of @new_order. - * - * Return: 0 - split is successful, otherwise split failed. - */ -static inline int try_folio_split_to_order(struct folio *folio, - struct page *page, unsigned int new_order) -{ - if (folio_check_splittable(folio, new_order, SPLIT_TYPE_NON_UNIFORM)) - return split_huge_page_to_order(&folio->page, new_order); - return folio_split(folio, new_order, page, NULL); -} static inline int split_huge_page(struct page *page) { return split_huge_page_to_list_to_order(page, NULL, 0); @@ -677,8 +656,8 @@ static inline int split_folio_to_list(struct folio *folio, struct list_head *lis return -EINVAL; } -static inline int try_folio_split_to_order(struct folio *folio, - struct page *page, unsigned int new_order) +static inline int folio_split(struct folio *folio, unsigned int new_order, + struct page *page, struct list_head *list) { VM_WARN_ON_ONCE_FOLIO(1, folio); return -EINVAL; -- cgit v1.2.3 From 13a1e1a618858407fa12c391f664ea750651f6b2 Mon Sep 17 00:00:00 2001 From: Lorenzo Stoakes Date: Fri, 19 Jun 2026 12:28:51 +0100 Subject: Revert "mm: limit filemap_fault readahead to VMA boundaries" This reverts commit 7b32f64bc512b40b268776c5ac4d354b325b3197. This patch caused a significant performance regression, so revert it, and we can determine whether the approach is sensible or not moving forwards, and if so how to avoid this. There was a merge conflict with commit de97ae6222c1 ("mm/readahead: no PG_readahead on EOF"), care was taken to ensure that the revert retained the behaviour of this patch and cleanly reverts commit 7b32f64bc512 ("mm: limit filemap_fault readahead to VMA boundaries") only. Link: https://lore.kernel.org/20260619112852.104213-1-ljs@kernel.org Fixes: 7b32f64bc512 ("mm: limit filemap_fault readahead to VMA boundaries") Signed-off-by: Lorenzo Stoakes Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202606181547.617a6967-lkp@intel.com Acked-by: David Hildenbrand (Arm) Reviewed-by: Pedro Falcato Reviewed-by: Matthew Wilcox (Oracle) Cc: Jan Kara Cc: Kalesh Singh Signed-off-by: Andrew Morton --- include/linux/pagemap.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h index 627771e82eb1..2c3718d592d6 100644 --- a/include/linux/pagemap.h +++ b/include/linux/pagemap.h @@ -1348,7 +1348,6 @@ struct readahead_control { struct file_ra_state *ra; /* private: use the readahead_* accessors instead */ pgoff_t _index; - pgoff_t _max_index; /* limit readahead to _max_index, inclusive */ unsigned int _nr_pages; unsigned int _batch_count; bool dropbehind; @@ -1362,7 +1361,6 @@ struct readahead_control { .mapping = m, \ .ra = r, \ ._index = i, \ - ._max_index = ULONG_MAX, \ } #define VM_READAHEAD_PAGES (SZ_128K / PAGE_SIZE) -- cgit v1.2.3 From 4c6d43db2a4d2cef3921e885cf34798f790d34ea Mon Sep 17 00:00:00 2001 From: Ilya Maximets Date: Tue, 16 Jun 2026 12:03:29 +0200 Subject: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't fit into the structure, even though the memory for them is actually allocated. memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report skb_tunnel_info_unclone+0x179/0x190 geneve_xmit+0x7fe/0xe00 The issue is triggered when built with clang and source fortification. Fix that by doing the copy in two stages: first - the main data with the options_len, then the options. This way the correct length should be known at the time of the copy. It would be better if the options_len never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with options_len set to a non-zero value from the metadata_dst_alloc(). Another option would be to use ip_tunnel_info_opts_set(), but it is doing too many unnecessary operations for the use case here. Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types") Reported-by: Johan Thomsen Closes: https://lore.kernel.org/netdev/CAKv6aAM8_EWgXScnKmKYm_4SwGDVBK++dzfP+Y6msUXbp99QUw@mail.gmail.com/ Signed-off-by: Ilya Maximets Link: https://patch.msgid.link/20260616100332.1308294-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski --- include/net/dst_metadata.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/net/dst_metadata.h b/include/net/dst_metadata.h index 1fc2fb03ce3f..f45d1e3163f0 100644 --- a/include/net/dst_metadata.h +++ b/include/net/dst_metadata.h @@ -164,8 +164,11 @@ static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb) if (!new_md) return ERR_PTR(-ENOMEM); - memcpy(&new_md->u.tun_info, &md_dst->u.tun_info, - sizeof(struct ip_tunnel_info) + md_size); + /* Copy in two stages to keep the __counted_by happy. */ + new_md->u.tun_info = md_dst->u.tun_info; + memcpy(ip_tunnel_info_opts(&new_md->u.tun_info), + ip_tunnel_info_opts(&md_dst->u.tun_info), md_size); + #ifdef CONFIG_DST_CACHE /* Unclone the dst cache if there is one */ if (new_md->u.tun_info.dst_cache.cache) { -- cgit v1.2.3 From f6b24566035835dc22796f24b1e8738581840b17 Mon Sep 17 00:00:00 2001 From: liujinbao1 Date: Wed, 6 May 2026 17:57:31 +0800 Subject: f2fs: Add trace_f2fs_fault_report Add trace_f2fs_fault_report to trigger reporting upon f2fs_bug_on, need_fsck, stop_checkpoint, and handle_eio. Since f2fs_bug_on and need_fsck can be triggered in hundreds of scenarios, define set_sbi_flag as a macro to help capture the effective fault function and line number. Signed-off-by: shengyong1 Signed-off-by: liujinbao1 Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim --- include/trace/events/f2fs.h | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) (limited to 'include') diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h index b5188d2671d7..270c1a2c24c4 100644 --- a/include/trace/events/f2fs.h +++ b/include/trace/events/f2fs.h @@ -2595,6 +2595,34 @@ DEFINE_EVENT(f2fs_priority_update, f2fs_priority_restore, TP_ARGS(sbi, lock_name, is_write, p, orig_prio, new_prio) ); +TRACE_EVENT(f2fs_fault_report, + + TP_PROTO(struct super_block *sb, unsigned int err_code, + const char *func, unsigned int data), + + TP_ARGS(sb, err_code, func, data), + + TP_STRUCT__entry( + __field(dev_t, dev) + __field(unsigned int, err_code) + __string(func, func) + __field(unsigned int, data) + ), + + TP_fast_assign( + __entry->dev = sb->s_dev; + __entry->err_code = err_code; + __assign_str(func); + __entry->data = data; + ), + + TP_printk("dev = (%d,%d), err_code = %u, func = %s, data = %u", + show_dev(__entry->dev), + __entry->err_code, + __get_str(func), + __entry->data) +); + #endif /* _TRACE_F2FS_H */ /* This part must be outside protection */ -- cgit v1.2.3 From 846c499a65816d13f1186e3090e825e8bb8bcb8b Mon Sep 17 00:00:00 2001 From: Wenjie Qi Date: Tue, 26 May 2026 13:35:57 +0800 Subject: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers. On a crafted image, mounting an unpatched kernel can drive orphan recovery into f2fs_bug_on() and panic the kernel. Validate entry_count before consuming entries so corrupted checkpoint data fails the mount with -EFSCORRUPTED and requests fsck instead. Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be recorded in the superblock s_errors[] field. This gives fsck a persistent hint even though mount-time orphan recovery failure may leave no chance to persist SBI_NEED_FSCK through a checkpoint. Cc: stable@kernel.org Fixes: 127e670abfa7 ("f2fs: add checkpoint operations") Signed-off-by: Wenjie Qi Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim --- include/linux/f2fs_fs.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h index 829a59399dac..bb2b6cd5d507 100644 --- a/include/linux/f2fs_fs.h +++ b/include/linux/f2fs_fs.h @@ -107,6 +107,7 @@ enum f2fs_error { ERROR_CORRUPTED_XATTR, ERROR_INVALID_NODE_REFERENCE, ERROR_INCONSISTENT_NAT, + ERROR_INCONSISTENT_ORPHAN, ERROR_MAX, }; -- cgit v1.2.3 From 7e1f9e2cd2d0e780c394a4402c40e125109fec72 Mon Sep 17 00:00:00 2001 From: Alex Markuze Date: Thu, 7 May 2026 08:54:07 +0000 Subject: ceph: add manual reset debugfs control and tracepoints Add the debugfs and trace plumbing used to trigger and observe manual client reset. The reset interface exposes a trigger file for operator-initiated reset and a status file for tracking the most recent run. The tracepoints record scheduling, completion, and blocked caller behavior so reset progress can be diagnosed from the client side. debugfs layout under /sys/kernel/debug/ceph//reset/: trigger - write to initiate a manual reset status - read to see the most recent reset result The reset directory is cleaned up via debugfs_remove_recursive() on the parent, so individual file dentries are not stored. Tracepoints: ceph_client_reset_schedule - reset queued ceph_client_reset_complete - reset finished (success or failure) ceph_client_reset_blocked - caller blocked waiting for reset ceph_client_reset_unblocked - caller unblocked after reset All tracepoints use a null-safe access for monc.auth->global_id to guard against early-init or late-teardown edge cases. Signed-off-by: Alex Markuze Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov --- include/trace/events/ceph.h | 67 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) (limited to 'include') diff --git a/include/trace/events/ceph.h b/include/trace/events/ceph.h index 08cb0659fbfc..1b990632f62b 100644 --- a/include/trace/events/ceph.h +++ b/include/trace/events/ceph.h @@ -226,6 +226,73 @@ TRACE_EVENT(ceph_handle_caps, __entry->mseq) ); +/* + * Client reset tracepoints - identify the client by its monitor- + * assigned global_id so traces remain meaningful when kernel pointer + * hashing is enabled. + */ +TRACE_EVENT(ceph_client_reset_schedule, + TP_PROTO(const struct ceph_mds_client *mdsc, const char *reason), + TP_ARGS(mdsc, reason), + TP_STRUCT__entry( + __field(u64, client_id) + __string(reason, reason ? reason : "") + ), + TP_fast_assign( + __entry->client_id = mdsc->fsc->client->monc.auth ? + mdsc->fsc->client->monc.auth->global_id : 0; + __assign_str(reason); + ), + TP_printk("client_id=%llu reason=%s", + __entry->client_id, __get_str(reason)) +); + +TRACE_EVENT(ceph_client_reset_complete, + TP_PROTO(const struct ceph_mds_client *mdsc, int ret), + TP_ARGS(mdsc, ret), + TP_STRUCT__entry( + __field(u64, client_id) + __field(int, ret) + ), + TP_fast_assign( + __entry->client_id = mdsc->fsc->client->monc.auth ? + mdsc->fsc->client->monc.auth->global_id : 0; + __entry->ret = ret; + ), + TP_printk("client_id=%llu ret=%d", __entry->client_id, __entry->ret) +); + +TRACE_EVENT(ceph_client_reset_blocked, + TP_PROTO(const struct ceph_mds_client *mdsc, int blocked_count), + TP_ARGS(mdsc, blocked_count), + TP_STRUCT__entry( + __field(u64, client_id) + __field(int, blocked_count) + ), + TP_fast_assign( + __entry->client_id = mdsc->fsc->client->monc.auth ? + mdsc->fsc->client->monc.auth->global_id : 0; + __entry->blocked_count = blocked_count; + ), + TP_printk("client_id=%llu blocked_count=%d", __entry->client_id, + __entry->blocked_count) +); + +TRACE_EVENT(ceph_client_reset_unblocked, + TP_PROTO(const struct ceph_mds_client *mdsc, int ret), + TP_ARGS(mdsc, ret), + TP_STRUCT__entry( + __field(u64, client_id) + __field(int, ret) + ), + TP_fast_assign( + __entry->client_id = mdsc->fsc->client->monc.auth ? + mdsc->fsc->client->monc.auth->global_id : 0; + __entry->ret = ret; + ), + TP_printk("client_id=%llu ret=%d", __entry->client_id, __entry->ret) +); + #undef EM #undef E_ #endif /* _TRACE_CEPH_H */ -- cgit v1.2.3 From 947d7ea6f60b5fe24d8f8b69e55e0d6e1e8855e7 Mon Sep 17 00:00:00 2001 From: Mario Limonciello Date: Wed, 20 May 2026 23:37:13 -0500 Subject: rtc: interface: Add rtc_read_next_alarm() to read next expiring timer Add a new function rtc_read_next_alarm() that reads the next expiring alarm from the RTC timerqueue. This is different from rtc_read_alarm(), which only reads the aie_timer. The wakealarm sysfs file programs the rtc->aie_timer, whereas the alarmtimer suspend routine programs its own timer into the RTC timerqueue. Both timers end up in the RTC's timerqueue, and the first expiring timer is what gets armed in the hardware. This new function allows code to query which alarm will actually fire next, regardless of which subsystem programmed it. This is needed by platform code that needs to program secondary timers based on the actual next wakeup time. Link: https://lore.kernel.org/all/87ed50z0le.ffs@tglx Suggested-by: Thomas Gleixner Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20260521043714.1022930-2-mario.limonciello@amd.com Signed-off-by: Alexandre Belloni --- include/linux/rtc.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/rtc.h b/include/linux/rtc.h index 95da051fb155..c09fc22819d0 100644 --- a/include/linux/rtc.h +++ b/include/linux/rtc.h @@ -190,6 +190,8 @@ extern int rtc_set_time(struct rtc_device *rtc, struct rtc_time *tm); int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm); extern int rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alrm); +extern int rtc_read_next_alarm(struct rtc_device *rtc, + struct rtc_wkalrm *alrm); extern int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alrm); extern int rtc_initialize_alarm(struct rtc_device *rtc, -- cgit v1.2.3 From b72f0db64205d9ce462038ba995d5d31eff32dc1 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Fri, 19 Jun 2026 21:27:20 +0000 Subject: ipv4: fib: Don't ignore error route in local/main tables. When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables. Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table: # unshare -n # ip link set lo up # ip route add 192.168.0.0/24 dev lo table 253 # ip route add unreachable 192.168.0.0/24 # ip route get 192.168.0.1 192.168.0.1 dev lo table default uid 0 cache Once a random rule is added, the error route is respected: # ip rule add table 0 # ip rule del table 0 # ip route get 192.168.0.1 RTNETLINK answers: No route to host Let's fix the inconsistent behaviour. Fixes: f4530fa574df ("ipv4: Avoid overhead when no custom FIB rules are installed.") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260619212753.3367244-1-kuniyu@google.com Signed-off-by: Jakub Kicinski --- include/net/ip_fib.h | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h index a71a98505650..c63a3c4967ae 100644 --- a/include/net/ip_fib.h +++ b/include/net/ip_fib.h @@ -374,7 +374,7 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp, struct fib_result *res, unsigned int flags) { struct fib_table *tb; - int err = -ENETUNREACH; + int err = -EAGAIN; flags |= FIB_LOOKUP_NOREF; if (net->ipv4.fib_has_custom_rules) @@ -388,17 +388,16 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp, if (tb) err = fib_table_lookup(tb, flp, res, flags); - if (!err) + if (err != -EAGAIN) goto out; tb = rcu_dereference_rtnl(net->ipv4.fib_default); if (tb) err = fib_table_lookup(tb, flp, res, flags); -out: if (err == -EAGAIN) err = -ENETUNREACH; - +out: rcu_read_unlock(); return err; -- cgit v1.2.3 From ef166ce08801c5237662868d9ec0331d53a38ece Mon Sep 17 00:00:00 2001 From: Dmitry Torokhov Date: Sat, 6 Jun 2026 15:04:20 -0700 Subject: Input: stop force-feedback timer when unregistering input devices Memoryless force-feedback devices use a timer to manage playback of effects. When a driver for such a device is unbound (or the device is unregistered for other reasons), the driver typically frees its private data synchronously. However, the input_dev structure (and its associated force-feedback structures, including the timer) is only freed when the last user closes the corresponding device node. If userspace keeps the device node open while the device is unregistered (e.g., during driver unbind), the force-feedback timer can still fire after the driver's private data has been freed. Introduce a new 'stop' callback to struct ff_device, and call it from input_unregister_device() before the device is deleted. Implement this callback for memoryless devices and synchronously shut down the timer to ensure it is stopped and cannot be rearmed once unregistration happens. Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Dmitry Torokhov --- include/linux/input.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/linux/input.h b/include/linux/input.h index 06ca62328db1..3022bb730898 100644 --- a/include/linux/input.h +++ b/include/linux/input.h @@ -543,6 +543,8 @@ extern const struct class input_class; * @set_autocenter: Called to auto-center device * @destroy: called by input core when parent input device is being * destroyed + * @stop: called by input core when parent input device is being + * unregistered * @private: driver-specific data, will be freed automatically * @ffbit: bitmap of force feedback capabilities truly supported by * device (not emulated like ones in input_dev->ffbit) @@ -571,6 +573,7 @@ struct ff_device { void (*set_autocenter)(struct input_dev *dev, u16 magnitude); void (*destroy)(struct ff_device *); + void (*stop)(struct ff_device *); void *private; -- cgit v1.2.3 From 22f9dbed18bcc865d750ed109c6ae2dd4cf2af55 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Sat, 13 Jun 2026 22:25:24 -0700 Subject: netfilter: x_tables.h: fix all kernel-doc warnings - use correct names in kernel-doc comments - add missing struct members to kernel-doc comments Warning: include/linux/netfilter/x_tables.h:41 struct member 'targinfo' not described in 'xt_action_param' Warning: include/linux/netfilter/x_tables.h:41 Excess struct member 'targetinfo' description in 'xt_action_param' Warning: include/linux/netfilter/x_tables.h:90 struct member 'family' not described in 'xt_mtchk_param' Warning: include/linux/netfilter/x_tables.h:90 struct member 'nft_compat' not described in 'xt_mtchk_param' Warning: include/linux/netfilter/x_tables.h:101 expecting prototype for struct xt_mdtor_param. Prototype was for struct xt_mtdtor_param instead Warning: include/linux/netfilter/x_tables.h:121 struct member 'net' not described in 'xt_tgchk_param' Warning: include/linux/netfilter/x_tables.h:121 struct member 'table' not described in 'xt_tgchk_param' Warning: include/linux/netfilter/x_tables.h:121 struct member 'target' not described in 'xt_tgchk_param' Warning: include/linux/netfilter/x_tables.h:121 struct member 'targinfo' not described in 'xt_tgchk_param' Warning: include/linux/netfilter/x_tables.h:121 struct member 'hook_mask' not described in 'xt_tgchk_param' Warning: include/linux/netfilter/x_tables.h:121 struct member 'family' not described in 'xt_tgchk_param' Warning: include/linux/netfilter/x_tables.h:121 struct member 'nft_compat' not described in 'xt_tgchk_param' Warning: include/linux/netfilter/x_tables.h:345 expecting prototype for xt_recseq(). Prototype was for DECLARE_PER_CPU() instead Signed-off-by: Randy Dunlap Signed-off-by: Pablo Neira Ayuso --- include/linux/netfilter/x_tables.h | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h index 20d70dddbe50..25062f4a0dd5 100644 --- a/include/linux/netfilter/x_tables.h +++ b/include/linux/netfilter/x_tables.h @@ -18,7 +18,7 @@ * @match: the match extension * @target: the target extension * @matchinfo: per-match data - * @targetinfo: per-target data + * @targinfo: per-target data * @state: pointer to hook state this packet came from * @fragoff: packet is a fragment, this is the data offset * @thoff: position of transport header relative to skb->data @@ -77,7 +77,9 @@ static inline u_int8_t xt_family(const struct xt_action_param *par) * @match: struct xt_match through which this function was invoked * @matchinfo: per-match data * @hook_mask: via which hooks the new rule is reachable - * Other fields as above. + * @family: actual NFPROTO_* through which the function is invoked + * (helpful when match->family == NFPROTO_UNSPEC) + * @nft_compat: running from the nft compat layer if true */ struct xt_mtchk_param { struct net *net; @@ -91,8 +93,13 @@ struct xt_mtchk_param { }; /** - * struct xt_mdtor_param - match destructor parameters - * Fields as above. + * struct xt_mtdtor_param - match destructor parameters + * + * @net: network namespace through which the check was invoked + * @match: struct xt_match through which this function was invoked + * @matchinfo: per-match data + * @family: actual NFPROTO_* through which the function is invoked + * (helpful when match->family == NFPROTO_UNSPEC) */ struct xt_mtdtor_param { struct net *net; @@ -105,10 +112,16 @@ struct xt_mtdtor_param { * struct xt_tgchk_param - parameters for target extensions' * checkentry functions * + * @net: network namespace through which the check was invoked + * @table: table the rule is tried to be inserted into * @entryinfo: the family-specific rule data * (struct ipt_entry, ip6t_entry, arpt_entry, ebt_entry) - * - * Other fields see above. + * @target: the target extension + * @targinfo: per-target data + * @hook_mask: via which hooks the new rule is reachable + * @family: actual NFPROTO_* through which the function is invoked + * (helpful when match->family == NFPROTO_UNSPEC) + * @nft_compat: running from the nft compat layer if true */ struct xt_tgchk_param { struct net *net; @@ -336,9 +349,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size); void xt_free_table_info(struct xt_table_info *info); /** - * xt_recseq - recursive seqcount for netfilter use + * var xt_recseq - recursive seqcount for netfilter use * - * Packet processing changes the seqcount only if no recursion happened + * Packet processing changes the seqcount only if no recursion happened. * get_counters() can use read_seqcount_begin()/read_seqcount_retry(), * because we use the normal seqcount convention : * Low order bit set to 1 if a writer is active. -- cgit v1.2.3 From 57f940017a777aadf38b99db44cf35f727c26f4c Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 12 Jun 2026 08:03:50 +0200 Subject: netfilter: conntrack: add deprecation warnings for irc and pptp trackers IRC Direct client-to-client requires plaintext. IRC over TLS should be preferred, making this helper ineffective. Add a deprecation warning and update the help text to better reflect that this is needed for the DCC extension, not IRC itself. PPTP is esoteric these days and it is the only helper that requires the destroy callback in the conntrack helper API. Removal would simplify the conntrack core. Both helpers are IPv4 only. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_helper.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index 81025101f86d..c761cd8158b2 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -114,6 +114,10 @@ int nf_conntrack_helpers_register(struct nf_conntrack_helper *, unsigned int, void nf_conntrack_helpers_unregister(struct nf_conntrack_helper **, unsigned int); +#define nf_conntrack_helper_deprecated(name) \ + pr_warn("The %s conntrack helper is scheduled for removal.\n" \ + "Please contact the netfilter-devel mailing list if you still need this.\n", name) + struct nf_conn_help *nf_ct_helper_ext_add(struct nf_conn *ct, gfp_t gfp); int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, -- cgit v1.2.3 From 979c13114c0bb6ab9135e2c93e00c79c412aef09 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 22 Jun 2026 21:35:14 +0200 Subject: netfilter: nf_conntrack_expect: store master_tuple in expectation Store master conntrack tuple in the expectation since exp->master might refer to a different conntrack when accessed from rcu read side lock area due to typesafe rcu rules. Fixes: 02a3231b6d82 ("netfilter: nf_conntrack_expect: store netns and zone in expectation") Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_conntrack_expect.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h index be4a120d549e..c024345c9bd8 100644 --- a/include/net/netfilter/nf_conntrack_expect.h +++ b/include/net/netfilter/nf_conntrack_expect.h @@ -26,6 +26,7 @@ struct nf_conntrack_expect { possible_net_t net; /* We expect this tuple, with the following mask */ + struct nf_conntrack_tuple master_tuple; struct nf_conntrack_tuple tuple; struct nf_conntrack_tuple_mask mask; -- cgit v1.2.3 From 5714c8359f4fc171ab8e0bd0dfc4c61fb36e1db6 Mon Sep 17 00:00:00 2001 From: Charles Keepax Date: Tue, 23 Jun 2026 11:18:10 +0100 Subject: soundwire: Move wait for initialisation helper to header As SoundWire devices tend to enumerate on the bus after probe, drivers frequently need to wait for the device to initialise from common driver code. The common system is to split drivers into a core module and then a module for each communication bus. These two facts tend to cause Kconfig issues, the issue tends to be when SOUNDWIRE=m and DRIVER_I2C=y, this usually selects DRIVER=y. The driver code then wants to call sdw_slave_wait_for_init(), but this results in calling a module function from built in code. A depends on SOUNDWIRE | !SOUNDWIRE could be added to the end driver but this seems slightly off as it adds a lot of counter intuitive depends. A simpler solution is to make sdw_slave_wait_for_init() a static inline function. As part of doing this add a check for the slave device being NULL acknowledging that this is likely called from code that is shared between control buses. It does require dropping the call to sdw_show_ping_status() but this can be added back in end drivers that used it originally. Currently this is causing rand config issues on RT5682 and will soon also cause similar problems on cs42l43. Acked-by: Vinod Koul Acked-by: Arnd Bergmann Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20260623101814.24044-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown --- include/linux/soundwire/sdw.h | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-) (limited to 'include') diff --git a/include/linux/soundwire/sdw.h b/include/linux/soundwire/sdw.h index a46cbaec5949..b484784e2690 100644 --- a/include/linux/soundwire/sdw.h +++ b/include/linux/soundwire/sdw.h @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -1093,8 +1094,6 @@ int sdw_slave_get_current_bank(struct sdw_slave *sdev); int sdw_slave_get_scale_index(struct sdw_slave *slave, u8 *base); -int sdw_slave_wait_for_init(struct sdw_slave *slave, int timeout_ms); - /* messaging and data APIs */ int sdw_read(struct sdw_slave *slave, u32 addr); int sdw_write(struct sdw_slave *slave, u32 addr, u8 value); @@ -1138,12 +1137,6 @@ static inline int sdw_slave_get_current_bank(struct sdw_slave *sdev) return -EINVAL; } -static inline int sdw_slave_wait_for_init(struct sdw_slave *slave, int timeout_ms) -{ - WARN_ONCE(1, "SoundWire API is disabled"); - return -EINVAL; -} - /* messaging and data APIs */ static inline int sdw_read(struct sdw_slave *slave, u32 addr) { @@ -1207,4 +1200,33 @@ static inline int sdw_update_no_pm(struct sdw_slave *slave, u32 addr, u8 mask, u #endif /* CONFIG_SOUNDWIRE */ +/** + * sdw_slave_wait_for_init - Wait for device initialisation + * @slave: Pointer to the SoundWire peripheral. + * @timeout_ms: Timeout in milliseconds. + * + * Wait for a peripheral device to enumerate and be initialised by the + * SoundWire core. + * + * Return: Zero on success, and a negative error code on failure. + */ +static inline int sdw_slave_wait_for_init(struct sdw_slave *slave, int timeout_ms) +{ + unsigned long time; + + if (!slave) + return 0; + + time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(timeout_ms)); + if (!time) { + dev_err(&slave->dev, "Initialization not complete\n"); + return -ETIMEDOUT; + } + + slave->unattach_request = 0; + + return 0; +} + #endif /* __SOUNDWIRE_H */ -- cgit v1.2.3 From 71c6e7808ee99a6e1b29bc30486baf825f9ec728 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= Date: Wed, 29 Apr 2026 15:26:11 +0300 Subject: resource: Make resource_alignment() input const resource MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit resource_alignment() does not need to change resource so it can be made const. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260429122617.7324-6-ilpo.jarvinen@linux.intel.com --- include/linux/ioport.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/ioport.h b/include/linux/ioport.h index 3c73c9c0d4f7..f7930b3dfd0a 100644 --- a/include/linux/ioport.h +++ b/include/linux/ioport.h @@ -261,7 +261,7 @@ extern int allocate_resource(struct resource *root, struct resource *new, struct resource *lookup_resource(struct resource *root, resource_size_t start); int adjust_resource(struct resource *res, resource_size_t start, resource_size_t size); -resource_size_t resource_alignment(struct resource *res); +resource_size_t resource_alignment(const struct resource *res); /** * resource_set_size - Calculate resource end address from size and start -- cgit v1.2.3 From 79a648209dadcc0f2ff0f27100fd79d1c890ccf8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= Date: Wed, 29 Apr 2026 15:26:13 +0300 Subject: PCI: Make pci_sriov_resource_alignment() pci_dev const MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pci_sriov_resource_alignment() inputs struct pci_dev which it should not need to alter to calculate alignment. Make pci_dev pci_sriov_resource_alignment() inputs const. It requires making pci_iov_resource_size() input const as well. Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20260429122617.7324-8-ilpo.jarvinen@linux.intel.com --- include/linux/pci.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index 2c4454583c11..0ced3bbd08c0 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -2540,7 +2540,7 @@ int pci_vfs_assigned(struct pci_dev *dev); int pci_sriov_set_totalvfs(struct pci_dev *dev, u16 numvfs); int pci_sriov_get_totalvfs(struct pci_dev *dev); int pci_sriov_configure_simple(struct pci_dev *dev, int nr_virtfn); -resource_size_t pci_iov_resource_size(struct pci_dev *dev, int resno); +resource_size_t pci_iov_resource_size(const struct pci_dev *dev, int resno); int pci_iov_vf_bar_set_size(struct pci_dev *dev, int resno, int size); u32 pci_iov_vf_bar_get_sizes(struct pci_dev *dev, int resno, int num_vfs); void pci_vf_drivers_autoprobe(struct pci_dev *dev, bool probe); @@ -2548,7 +2548,8 @@ void pci_vf_drivers_autoprobe(struct pci_dev *dev, bool probe); /* Arch may override these (weak) */ int pcibios_sriov_enable(struct pci_dev *pdev, u16 num_vfs); int pcibios_sriov_disable(struct pci_dev *pdev); -resource_size_t pcibios_iov_resource_alignment(struct pci_dev *dev, int resno); +resource_size_t pcibios_iov_resource_alignment(const struct pci_dev *dev, + int resno); #else static inline int pci_iov_virtfn_bus(struct pci_dev *dev, int id) { @@ -2593,7 +2594,8 @@ static inline int pci_sriov_set_totalvfs(struct pci_dev *dev, u16 numvfs) static inline int pci_sriov_get_totalvfs(struct pci_dev *dev) { return 0; } #define pci_sriov_configure_simple NULL -static inline resource_size_t pci_iov_resource_size(struct pci_dev *dev, int resno) +static inline resource_size_t pci_iov_resource_size(const struct pci_dev *dev, + int resno) { return 0; } static inline int pci_iov_vf_bar_set_size(struct pci_dev *dev, int resno, int size) { return -ENODEV; } -- cgit v1.2.3 From ca617c60af9f6bb74216645ce4362dcb96697d52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Date: Fri, 8 May 2026 04:35:26 +0000 Subject: PCI/sysfs: Convert PCI resource files to static attributes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently, the PCI resource files (resourceN, resourceN_wc) are dynamically created by pci_create_sysfs_dev_files(), called from both pci_bus_add_device() and the pci_sysfs_init() late_initcall, with only a sysfs_initialized flag for synchronisation. This has caused warnings and boot panics when both paths race on the same device, e.g.: sysfs: cannot create duplicate filename '/devices/pci0000:3c/0000:3c:01.0/0000:3e:00.2/resource2' This is especially likely on Devicetree-based platforms, where the PCI host controllers are platform drivers that probe via the driver model, which can happen during or after the late_initcall. As such, pci_bus_add_device() and pci_sysfs_init() are more likely to overlap. Convert to static const attributes with three attribute groups (I/O, UC, WC), each with an .is_bin_visible() callback that checks resource flags, BAR length, and non_mappable_bars. A .bin_size() callback provides pci_resource_len() to the kernfs node for correct stat and lseek behaviour. As part of this conversion: - Rename pci_read_resource_io() and pci_write_resource_io() to pci_read_resource() and pci_write_resource() since the callbacks are no longer I/O-specific in the static attribute context. - Update __resource_resize_store() to use sysfs_create_groups() and sysfs_remove_groups(), which re-evaluates visibility and runs the .bin_size() callback for the static resource attribute groups. - Remove pci_create_resource_files(), pci_remove_resource_files(), and pci_create_attr() which are no longer needed. - Move the __weak stubs outside the #if guard so they remain available for callers converted in subsequent commits. Platforms that do not define the HAVE_PCI_MMAP macro or the ARCH_GENERIC_PCI_MMAP_RESOURCE macro, such as Alpha architecture, continue using their platform-specific resource file creation. For reference, the dynamic creation dates back to the pre-Git era: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/drivers/pci/pci-sysfs.c?id=42298be0eeb5ae98453b3374c36161b05a46c5dc The write-combine support was added in commit 45aec1ae72fc ("x86: PAT export resource_wc in pci sysfs"). Many other reports mentioned in the cover letter (first Link: below). Link: https://lore.kernel.org/r/20260508043543.217179-1-kwilczynski@kernel.org/ Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215515 Closes: https://github.com/openwrt/openwrt/issues/17143 Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Tested-by: Shivaprasad G Bhat Link: https://patch.msgid.link/20260508043543.217179-8-kwilczynski@kernel.org --- include/linux/pci.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index e93fbe6b57fe..974605c9fce2 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -2531,10 +2531,8 @@ int pcibios_alloc_irq(struct pci_dev *dev); void pcibios_free_irq(struct pci_dev *dev); resource_size_t pcibios_default_alignment(void); -#if !defined(HAVE_PCI_MMAP) && !defined(ARCH_GENERIC_PCI_MMAP_RESOURCE) extern int pci_create_resource_files(struct pci_dev *dev); extern void pci_remove_resource_files(struct pci_dev *dev); -#endif #if defined(CONFIG_PCI_MMCONFIG) || defined(CONFIG_ACPI_MCFG) void __init pci_mmcfg_early_init(void); -- cgit v1.2.3 From 2c31a9675f50a61c9ceed6dab2545be7aa896d1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Date: Fri, 8 May 2026 04:35:28 +0000 Subject: PCI/sysfs: Add stubs for pci_{create,remove}_sysfs_dev_files() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On platforms with HAVE_PCI_MMAP or ARCH_GENERIC_PCI_MMAP_RESOURCE, resource files are now handled by static attribute groups registered via pci_dev_groups[]. Stub out the pci_create_sysfs_dev_files() and pci_remove_sysfs_dev_files(), as the dynamic resource file creation is no longer needed. Also, simplify pci_sysfs_init() on these platforms to only iterate buses for legacy attributes creation, skipping the per-device loop. Move the __weak stubs for pci_create_resource_files() and pci_remove_resource_files() into the #else branch since only platforms without HAVE_PCI_MMAP (such as Alpha architecture) still need them. Guard the res_attr[] and res_attr_wc[] fields in struct pci_dev the same way. Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Tested-by: Shivaprasad G Bhat Link: https://patch.msgid.link/20260508043543.217179-10-kwilczynski@kernel.org --- include/linux/pci.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index 974605c9fce2..b998a56f6010 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -515,8 +515,10 @@ struct pci_dev { spinlock_t pcie_cap_lock; /* Protects RMW ops in capability accessors */ u32 saved_config_space[16]; /* Config space saved at suspend time */ struct hlist_head saved_cap_space; +#if !defined(HAVE_PCI_MMAP) && !defined(ARCH_GENERIC_PCI_MMAP_RESOURCE) struct bin_attribute *res_attr[DEVICE_COUNT_RESOURCE]; /* sysfs file for resources */ struct bin_attribute *res_attr_wc[DEVICE_COUNT_RESOURCE]; /* sysfs file for WC mapping of resources */ +#endif #ifdef CONFIG_HOTPLUG_PCI_PCIE unsigned int broken_cmd_compl:1; /* No compl for some cmds */ @@ -2531,8 +2533,10 @@ int pcibios_alloc_irq(struct pci_dev *dev); void pcibios_free_irq(struct pci_dev *dev); resource_size_t pcibios_default_alignment(void); +#if !defined(HAVE_PCI_MMAP) && !defined(ARCH_GENERIC_PCI_MMAP_RESOURCE) extern int pci_create_resource_files(struct pci_dev *dev); extern void pci_remove_resource_files(struct pci_dev *dev); +#endif #if defined(CONFIG_PCI_MMCONFIG) || defined(CONFIG_ACPI_MCFG) void __init pci_mmcfg_early_init(void); -- cgit v1.2.3 From b45bebbfa0be8b1c8be5d3c5946f8f04d556fdf0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Date: Fri, 8 May 2026 04:35:37 +0000 Subject: PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently, pci_create_sysfs_dev_files() and pci_remove_sysfs_dev_files() are no-op stubs. With both the generic and Alpha resource files now handled by static attribute groups, no platform needs dynamic per-device sysfs file creation. Remove both functions, their declarations, and the call sites in pci_bus_add_device() and pci_stop_dev(). Remove __weak pci_create_resource_files() and pci_remove_resource_files() stubs and their declarations in pci.h, as no architecture overrides them anymore. Remove the res_attr[] and res_attr_wc[] fields from struct pci_dev which were used to track dynamically allocated resource attributes. Finally, simplify pci_sysfs_init() to only handle legacy file creation under HAVE_PCI_LEGACY, removing the per-device loop and the HAVE_PCI_SYSFS_INIT helper added earlier. Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Tested-by: Shivaprasad G Bhat Link: https://patch.msgid.link/20260508043543.217179-19-kwilczynski@kernel.org --- include/linux/pci.h | 9 --------- 1 file changed, 9 deletions(-) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index b998a56f6010..c56f2cf0d2ab 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -515,10 +515,6 @@ struct pci_dev { spinlock_t pcie_cap_lock; /* Protects RMW ops in capability accessors */ u32 saved_config_space[16]; /* Config space saved at suspend time */ struct hlist_head saved_cap_space; -#if !defined(HAVE_PCI_MMAP) && !defined(ARCH_GENERIC_PCI_MMAP_RESOURCE) - struct bin_attribute *res_attr[DEVICE_COUNT_RESOURCE]; /* sysfs file for resources */ - struct bin_attribute *res_attr_wc[DEVICE_COUNT_RESOURCE]; /* sysfs file for WC mapping of resources */ -#endif #ifdef CONFIG_HOTPLUG_PCI_PCIE unsigned int broken_cmd_compl:1; /* No compl for some cmds */ @@ -2533,11 +2529,6 @@ int pcibios_alloc_irq(struct pci_dev *dev); void pcibios_free_irq(struct pci_dev *dev); resource_size_t pcibios_default_alignment(void); -#if !defined(HAVE_PCI_MMAP) && !defined(ARCH_GENERIC_PCI_MMAP_RESOURCE) -extern int pci_create_resource_files(struct pci_dev *dev); -extern void pci_remove_resource_files(struct pci_dev *dev); -#endif - #if defined(CONFIG_PCI_MMCONFIG) || defined(CONFIG_ACPI_MCFG) void __init pci_mmcfg_early_init(void); void __init pci_mmcfg_late_init(void); -- cgit v1.2.3 From e52e497e3778c99c3fb26ef6a47af6a219133f8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Date: Fri, 8 May 2026 04:35:38 +0000 Subject: PCI: Add macros for legacy I/O and memory address space sizes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add defines for the standard PCI legacy address space sizes, replacing the raw literals used by the legacy sysfs attributes. Then, replace open-coded values with the newly added macros. No functional changes intended. Suggested-by: Ilpo Järvinen Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Tested-by: Shivaprasad G Bhat Link: https://patch.msgid.link/20260508043543.217179-20-kwilczynski@kernel.org --- include/linux/pci.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index c56f2cf0d2ab..e37677a8dd3c 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -27,6 +27,7 @@ #include #include +#include #include #include #include @@ -1169,6 +1170,10 @@ enum { /* These external functions are only available when PCI support is enabled */ #ifdef CONFIG_PCI +/* PCI legacy I/O port and memory address space sizes. */ +#define PCI_LEGACY_IO_SIZE (SZ_64K - 1) +#define PCI_LEGACY_MEM_SIZE SZ_1M + extern unsigned int pci_flags; static inline void pci_set_flags(int flags) { pci_flags = flags; } -- cgit v1.2.3 From 2800a911ced1540baa78de7494218aaf1c7dc4fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Date: Fri, 8 May 2026 04:35:42 +0000 Subject: PCI/sysfs: Remove pci_create_legacy_files() and pci_sysfs_init() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently, pci_create_legacy_files() and pci_remove_legacy_files() are no-op stubs. With legacy attributes now handled by static groups registered via pcibus_groups[], no call site needs them. Remove both functions, their declarations, and the call sites in pci_register_host_bridge(), pci_alloc_child_bus(), and pci_remove_bus(). Remove the pci_sysfs_init() late_initcall and sysfs_initialized. The late_initcall originally existed to create all the dynamic PCI sysfs files, but with both resource and legacy attributes now handled by static groups, it is no longer needed. Remove the legacy_io and legacy_mem fields from struct pci_bus which were used to track the dynamically allocated legacy attributes. Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Tested-by: Shivaprasad G Bhat Link: https://patch.msgid.link/20260508043543.217179-24-kwilczynski@kernel.org --- include/linux/pci.h | 2 -- 1 file changed, 2 deletions(-) (limited to 'include') diff --git a/include/linux/pci.h b/include/linux/pci.h index e37677a8dd3c..74b767012766 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -726,8 +726,6 @@ struct pci_bus { pci_bus_flags_t bus_flags; /* Inherited by child buses */ struct device *bridge; struct device dev; - struct bin_attribute *legacy_io; /* Legacy I/O for this bus */ - struct bin_attribute *legacy_mem; /* Legacy mem */ unsigned int is_added:1; unsigned int unsafe_warn:1; /* warned about RW1C config write */ unsigned int flit_mode:1; /* Link in Flit mode */ -- cgit v1.2.3 From a7ea04d1ad39d60da397de75b503062ad5fa562b Mon Sep 17 00:00:00 2001 From: Richard Fitzgerald Date: Tue, 23 Jun 2026 14:58:21 +0100 Subject: ASoC: soc-core: Don't fail if device_link could not be created If device_link_add() fails in snd_soc_bind_card() just skip that driver pair and carry on. This means that ASoC must now keep track of which components it was able to device_link to the card->dev. The new card_device_link member of struct snd_soc_component is non-NULL if a device_link exists. The intent of the device link is to ensure that the machine driver system-suspends before the component drivers, to prevent ASoC suspend attempting to reconfigure a driver that has already suspended. It isn't possible to create this device link if the machine driver is a parent of the component driver or already has a device_link in the opposite direction. In this case skip the link. A warn is placed in kernel log since this might indicate a genuine design problem with those two drivers (this can be downgraded to dbg in future when people are happy that all these special drivers correctly handle their reversed shutdown order). Fixes: 0f54ce994b23 ("ASoC: soc-core: Create device_link to ensure correct suspend order") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/linux-sound/61bd38e7-5eb9-4448-a93f-afa2ccbd1c9d@opensource.cirrus.com/T/#m496fe5a11b0a3649afd2e85da5e1cea82bb16d8a Tested-by: Marek Szyprowski Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20260623135821.4125543-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown --- include/sound/soc-component.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/sound/soc-component.h b/include/sound/soc-component.h index 11bc9527653f..aa423865dbe7 100644 --- a/include/sound/soc-component.h +++ b/include/sound/soc-component.h @@ -10,6 +10,8 @@ #include +struct device_link; + /* * Component probe and remove ordering levels for components with runtime * dependencies. @@ -216,6 +218,8 @@ struct snd_soc_component { struct list_head card_aux_list; /* for auxiliary bound components */ struct list_head card_list; + struct device_link *card_device_link; + const struct snd_soc_component_driver *driver; struct list_head dai_list; -- cgit v1.2.3 From e7c1627afda2484baf65449be15873c2550f917a Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Wed, 24 Jun 2026 10:00:02 +0200 Subject: block: fix GFP_ flags confusion in bio_integrity_alloc_buf bio_integrity_alloc_buf usage of GFP_ flags is messed up. For one it mixes GFP_NOFS and GFP_NOIO for neighbouring allocations, but it also makes the allocations fail more often than needed. That code was copied from bio_alloc_bioset which needs to do that so that it can punt to the rescuer workqueue, but none of that is needed for the integrity allocations that either sits in the file system or at the very bottom of the I/O stack. Failing early means we'll do a fully waiting allocation from the mempool ->alloc callback which is usually much larger than required. Fix this by passing a gfp_t so that the file system path can pass GFP_NOFS and the auto-integrity code can pass GFP_NOIO, and don't modify the allocation type except for disabling warnings. Fixes: ec7f31b2a2d3 ("block: make bio auto-integrity deadlock safe") Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://patch.msgid.link/20260624080014.1998650-2-hch@lst.de Signed-off-by: Jens Axboe --- include/linux/bio-integrity.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/bio-integrity.h b/include/linux/bio-integrity.h index af5178434ec6..c3dda32fd803 100644 --- a/include/linux/bio-integrity.h +++ b/include/linux/bio-integrity.h @@ -141,7 +141,7 @@ static inline int bio_integrity_add_page(struct bio *bio, struct page *page, } #endif /* CONFIG_BLK_DEV_INTEGRITY */ -void bio_integrity_alloc_buf(struct bio *bio, bool zero_buffer); +void bio_integrity_alloc_buf(struct bio *bio, gfp_t gfp, bool zero_buffer); void bio_integrity_free_buf(struct bio_integrity_payload *bip); void bio_integrity_setup_default(struct bio *bio); -- cgit v1.2.3 From 64184f07e7516eb3ac1839387eb7cbe2dbeaa96f Mon Sep 17 00:00:00 2001 From: Baojun Xu Date: Thu, 25 Jun 2026 18:28:15 +0800 Subject: ASoC: tas2781: Update default register address to TAS2563 The previous TAS2781 address is overwritten during calibration, so switching to the TAS2563 address is required. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20260625102815.20043-1-baojun.xu@ti.com Signed-off-by: Mark Brown --- include/sound/tas2781.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/sound/tas2781.h b/include/sound/tas2781.h index d45f805b5d18..b763da613769 100644 --- a/include/sound/tas2781.h +++ b/include/sound/tas2781.h @@ -59,9 +59,9 @@ #define TASDEVICE_CHECKSUM_REG TASDEVICE_REG(0x0, 0x0, 0x7e) /* XM_340 */ -#define TASDEVICE_XM_A1_REG TASDEVICE_REG(0x64, 0x63, 0x3c) +#define TASDEVICE_XM_A1_REG TASDEVICE_REG(0x64, 0x02, 0x4c) /* XM_341 */ -#define TASDEVICE_XM_A2_REG TASDEVICE_REG(0x64, 0x63, 0x38) +#define TASDEVICE_XM_A2_REG TASDEVICE_REG(0x64, 0x02, 0x64) /* Volume control */ #define TAS2563_DVC_LVL TASDEVICE_REG(0x00, 0x02, 0x0c) -- cgit v1.2.3 From 1105ef941c1a28e115d1b97f17e1c85576884100 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 24 Jun 2026 12:04:39 -0700 Subject: net: ethtool: keep rtnl_lock for ops using ethtool_op_get_link() Breno reports following splats on mlx5: RTNL: assertion failed at net/core/dev.c (2241) WARNING: net/core/dev.c:2241 at netif_state_change+0xed/0x130, CPU#5: ethtool/1335 RIP: 0010:netif_state_change+0xf9/0x130 Call Trace: __linkwatch_sync_dev+0xea/0x120 ethtool_op_get_link+0xe/0x20 __ethtool_get_link+0x26/0x40 linkstate_prepare_data+0x51/0x200 ethnl_default_doit+0x213/0x470 genl_family_rcv_msg_doit+0xdd/0x110 Looks like I missed ethtool_op_get_link() trying to sync linkwatch, which needs rtnl_lock. Not all drivers do this - bnxt doesn't, it just returns the link state, so add an opt-in bit. Reported-by: Breno Leitao Fixes: 45079e00133e ("net: ethtool: optionally skip rtnl_lock on Netlink path for GET ops") Acked-by: Stanislav Fomichev Reviewed-by: Breno Leitao Acked-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20260624190439.2521219-1-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/ethtool.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index 1b834e2a522e..5d491a98265e 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -942,6 +942,7 @@ struct kernel_ethtool_ts_info { #define ETHTOOL_OP_NEEDS_RTNL_GPAUSEPARAM BIT(5) #define ETHTOOL_OP_NEEDS_RTNL_SPAUSEPARAM BIT(6) #define ETHTOOL_OP_NEEDS_RTNL_RSS BIT(7) +#define ETHTOOL_OP_NEEDS_RTNL_GLINK BIT(8) /** * struct ethtool_ops - optional netdev operations @@ -978,6 +979,7 @@ struct kernel_ethtool_ts_info { * - phylink helpers (note that phydev is currently unsupported!) * - netdev_update_features() * - netif_set_real_num_tx_queues() + * - ethtool_op_get_link() (syncs link watch under rtnl_lock) * * @get_drvinfo: Report driver/device information. Modern drivers no * longer have to implement this callback. Most fields are -- cgit v1.2.3 From 12c765be84d28f22deca10e775889f54bd571a85 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 24 Jun 2026 11:20:15 -0700 Subject: net: turn the rx_mode work into a generic netdev_work facility The rx_mode update runs from a workqueue: drivers have their ndo_set_rx_mode_async() callback executed by a single global work item under RTNL and ops lock. This is a useful pattern. Support multiple "events" that need to be serviced and make RX_MODE sync the first one. Call the events "core" because later on we will let drivers define and schedule their own. Reviewed-by: Kuniyuki Iwashima Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260624182018.2445732-2-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index b67a12541eac..732506787db3 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1930,8 +1930,9 @@ enum netdev_reg_state { * has been enabled due to the need to listen to * additional unicast addresses in a device that * does not implement ndo_set_rx_mode() - * @rx_mode_node: List entry for rx_mode work processing - * @rx_mode_tracker: Refcount tracker for rx_mode work + * @work_node: List entry for async netdev_work processing + * @work_tracker: Refcount tracker for async netdev_work + * @work_core_pending: Core-defined pending netdev_work (NETDEV_WORK_*) * @rx_mode_addr_cache: Recycled snapshot entries for rx_mode work * @rx_mode_retry_timer: Timer that re-queues rx_mode work after failure * @rx_mode_retry_count: Number of consecutive retries already scheduled @@ -2326,8 +2327,9 @@ struct net_device { unsigned int promiscuity; unsigned int allmulti; bool uc_promisc; - struct list_head rx_mode_node; - netdevice_tracker rx_mode_tracker; + struct list_head work_node; + netdevice_tracker work_tracker; + unsigned long work_core_pending; struct netdev_hw_addr_list rx_mode_addr_cache; struct timer_list rx_mode_retry_timer; unsigned int rx_mode_retry_count; -- cgit v1.2.3 From 129cdce9da9e44c52d38889e0411be9817bca114 Mon Sep 17 00:00:00 2001 From: Jakub Kicinski Date: Wed, 24 Jun 2026 11:20:16 -0700 Subject: net: add the driver-facing netdev_work scheduling API With an extra event mask we can easily extend the netdev work to also service driver-defined events. For advanced drivers this is probably not a perfect match, but it makes running deferred work easier in simple cases. Expose the netdev_work facility to drivers. Add helpers to schedule work and a dedicated ndo to perform the driver- -scheduled actions. Reviewed-by: Kuniyuki Iwashima Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20260624182018.2445732-3-kuba@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/netdevice.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'include') diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 732506787db3..9981d637f8b5 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1131,6 +1131,9 @@ struct netdev_net_notifier { * netdev_hw_addr_list_for_each(ha, uc). Return 0 on success or a * negative errno to request a retry via the core backoff. * + * void (*ndo_work)(struct net_device *dev, unsigned long events); + * Run deferred work scheduled with netdev_work_sched(@events). + * * int (*ndo_set_mac_address)(struct net_device *dev, void *addr); * This function is called when the Media Access Control address * needs to be changed. If this interface is not defined, the @@ -1460,6 +1463,8 @@ struct net_device_ops { struct net_device *dev, struct netdev_hw_addr_list *uc, struct netdev_hw_addr_list *mc); + void (*ndo_work)(struct net_device *dev, + unsigned long events); int (*ndo_set_mac_address)(struct net_device *dev, void *addr); int (*ndo_validate_addr)(struct net_device *dev); @@ -1932,6 +1937,8 @@ enum netdev_reg_state { * does not implement ndo_set_rx_mode() * @work_node: List entry for async netdev_work processing * @work_tracker: Refcount tracker for async netdev_work + * @work_pending: Driver-defined pending netdev_work, passed to + * ndo_work() (see netdev_work_sched()) * @work_core_pending: Core-defined pending netdev_work (NETDEV_WORK_*) * @rx_mode_addr_cache: Recycled snapshot entries for rx_mode work * @rx_mode_retry_timer: Timer that re-queues rx_mode work after failure @@ -2329,6 +2336,7 @@ struct net_device { bool uc_promisc; struct list_head work_node; netdevice_tracker work_tracker; + unsigned long work_pending; unsigned long work_core_pending; struct netdev_hw_addr_list rx_mode_addr_cache; struct timer_list rx_mode_retry_timer; @@ -5178,6 +5186,9 @@ void dev_fetch_sw_netstats(struct rtnl_link_stats64 *s, const struct pcpu_sw_netstats __percpu *netstats); void dev_get_tstats64(struct net_device *dev, struct rtnl_link_stats64 *s); +void netdev_work_sched(struct net_device *dev, unsigned long events); +unsigned long netdev_work_cancel(struct net_device *dev, unsigned long mask); + enum { NESTED_SYNC_IMM_BIT, NESTED_SYNC_TODO_BIT, -- cgit v1.2.3 From 8df969463bc26a7250707f485ee3ac61426d671f Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Wed, 11 Mar 2026 22:14:15 -0700 Subject: NTB: fix kernel-doc warnings in ntb.h Correct a function name and function parameter name to avoid kernel-doc warnings: Warning: include/linux/ntb.h:575 expecting prototype for ntb_default_port_count(). Prototype was for ntb_default_peer_port_count() instead Warning: include/linux/ntb.h:590 function parameter 'pidx' not described in 'ntb_default_peer_port_number' Signed-off-by: Randy Dunlap Acked-by: Dave Jiang Signed-off-by: Jon Mason --- include/linux/ntb.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/ntb.h b/include/linux/ntb.h index 879c3e89e026..ae72caa03859 100644 --- a/include/linux/ntb.h +++ b/include/linux/ntb.h @@ -567,7 +567,7 @@ void ntb_msg_event(struct ntb_dev *ntb); int ntb_default_port_number(struct ntb_dev *ntb); /** - * ntb_default_port_count() - get the default number of peer device ports + * ntb_default_peer_port_count() - get the default number of peer device ports * @ntb: NTB device context. * * By default hardware driver supports just one peer device. @@ -582,7 +582,7 @@ int ntb_default_peer_port_count(struct ntb_dev *ntb); /** * ntb_default_peer_port_number() - get the default peer port by given index * @ntb: NTB device context. - * @idx: Peer port index (should not differ from zero). + * @pidx: Peer port index (should not differ from zero). * * By default hardware driver supports just one peer device, so this method * shall return the corresponding value from enum ntb_default_port. -- cgit v1.2.3 From 4575e9aac5336d1365138c0284773bf8da4b1fa3 Mon Sep 17 00:00:00 2001 From: Alex Williamson Date: Mon, 15 Jun 2026 13:12:29 -0600 Subject: vfio/pci: Latch disable_idle_d3 per device When disable_idle_d3 was introduced in vfio-pci, it directly manipulated the device power state with pci_set_power_state(). There were no refcounts to maintain or balanced operations, we could unconditionally bring the device to D0 and conditionally move it to D3hot. Therefore the module parameter was made writable. Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect of the module parameter was nullified. The parameter value could still be changed through sysfs, but the vfio-pci driver latched the values into vfio-pci-core globals at module init. Loading the vfio-pci module, or unloading and reloading, with non-default or different values could change the globals relative to existing devices bound to vfio-pci variant drivers. Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM"), which marks the point where power states became refcounted. PM get and put operations need to be balanced, but the same module operations noted above can change the global variables relative to those devices already bound to vfio-pci variant drivers. This introduces a window where PM operations can now become unbalanced. To resolve this with a narrow footprint for stable backports, the disable_idle_d3 flag is latched into the vfio_pci_core_device at the time of initialization, such that the device always operates with a consistent value. NB. vfio_pci_dev_set_try_reset() now unconditionally raises the runtime PM usage count around bus reset to account for disable_idle_d3 becoming a per-device rather than global flag. When this flag is set, the additional get/put pair is harmless and allows continued use of the shared vfio_pci_dev_set_pm_runtime_get() helper. Fixes: 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Alex Williamson Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260615191241.688297-2-alex.williamson@nvidia.com Signed-off-by: Alex Williamson --- include/linux/vfio_pci_core.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 5fc6ce4dd786..27aab3fdbb91 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -127,6 +127,7 @@ struct vfio_pci_core_device { bool needs_pm_restore:1; bool pm_intx_masked:1; bool pm_runtime_engaged:1; + bool disable_idle_d3:1; bool sriov_active; struct pci_saved_state *pci_saved_state; struct pci_saved_state *pm_save; -- cgit v1.2.3 From e73638e55f861758d49f14d7bb5dba3035981cd7 Mon Sep 17 00:00:00 2001 From: Alex Williamson Date: Mon, 15 Jun 2026 13:12:31 -0600 Subject: vfio/pci: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit. This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach across to another device (ex. reset) use dedicated storage units. Note that the virq_disabled and bardirty flags are relocated to fill an existing hole in the structure. Bitfield justifications: has_dyn_msix: written only in vfio_pci_core_enable() pci_2_3: written only in vfio_pci_core_enable() reset_works: written only in vfio_pci_core_enable() extended_caps: written only in vfio_cap_len() under vfio_config_init() has_vga: written only in vfio_pci_core_enable() nointx: written only in vfio_pci_core_enable() needs_pm_restore: written only in vfio_pci_probe_power_state() disable_idle_d3: written only at .init in vfio_pci_core_init_dev() Dedicated storage units: virq_disabled: written by guest INTx command writes in vfio_basic_config_write() while the device is open bardirty: written by guest BAR writes in vfio_basic_config_write() while the device is open pm_intx_masked: written in the runtime-PM suspend path. pm_runtime_engaged: written by low-power feature entry/exit paths needs_reset: set in vfio_pci_core_disable() and cleared for devices in the set by vfio_pci_dev_set_try_reset() sriov_active: written by vfio_pci_core_sriov_configure() via sysfs sriov_numvfs while bound. Fixes: 9cd0f6d5cbb6 ("vfio/pci: Use bitfield for struct vfio_pci_core_device flags") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Alex Williamson Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260615191241.688297-4-alex.williamson@nvidia.com Signed-off-by: Alex Williamson --- include/linux/vfio_pci_core.h | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'include') diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 27aab3fdbb91..985b8af5a04b 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -101,6 +101,9 @@ struct vfio_pci_core_device { const struct vfio_pci_device_ops *pci_ops; void __iomem *barmap[PCI_STD_NUM_BARS]; bool bar_mmap_supported[PCI_STD_NUM_BARS]; + /* Flags modified at runtime - dedicated storage unit */ + bool virq_disabled; + bool bardirty; u8 *pci_config_map; u8 *vconfig; struct perm_bits *msi_perm; @@ -115,19 +118,19 @@ struct vfio_pci_core_device { u16 msix_size; u32 msix_offset; u32 rbar[7]; + /* Flags only modified on setup/release - bitfield ok */ bool has_dyn_msix:1; bool pci_2_3:1; - bool virq_disabled:1; bool reset_works:1; bool extended_caps:1; - bool bardirty:1; bool has_vga:1; - bool needs_reset:1; bool nointx:1; bool needs_pm_restore:1; - bool pm_intx_masked:1; - bool pm_runtime_engaged:1; bool disable_idle_d3:1; + /* Flags modified at runtime - dedicated storage unit */ + bool needs_reset; + bool pm_intx_masked; + bool pm_runtime_engaged; bool sriov_active; struct pci_saved_state *pci_saved_state; struct pci_saved_state *pm_save; -- cgit v1.2.3 From 3788cd493e444742bc2ba252eb5c09ffc8b345dc Mon Sep 17 00:00:00 2001 From: Alex Williamson Date: Mon, 15 Jun 2026 13:12:33 -0600 Subject: vfio/pci: Latch all module parameters per device The vfio-pci module parameters of disable_idle_d3, nointxmask, and disable_vga latch vfio-pci policy into vfio-pci-core globals each time the vfio-pci module is initialized. The disable_idle_d3 parameter has already migrated to a per-device flag in order to provide consistency for refcounted PM operations for the lifetime of the device registration. Pull the remaining vfio-pci module-parameter policy out of vfio-pci-core into per-device flags set at device initialization. This also restores the mutable aspect of the disable_idle_d3 and nointxmask module parameters for vfio-pci, with the caveat that the parameters are latched into the device at probe. A notable change for variant drivers is that their devices are no longer affected by vfio-pci module parameters and those drivers may need to adopt similar module parameters if any devices have a hidden dependency on vfio-pci setting non-default policy. Assisted-by: Claude:claude-opus-4-8 Acked-by: Chengwen Feng Signed-off-by: Alex Williamson Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260615191241.688297-6-alex.williamson@nvidia.com Signed-off-by: Alex Williamson --- include/linux/vfio_pci_core.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 985b8af5a04b..9a1674c152aa 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -127,6 +127,8 @@ struct vfio_pci_core_device { bool nointx:1; bool needs_pm_restore:1; bool disable_idle_d3:1; + bool nointxmask:1; + bool disable_vga:1; /* Flags modified at runtime - dedicated storage unit */ bool needs_reset; bool pm_intx_masked; @@ -161,8 +163,6 @@ int vfio_pci_core_register_dev_region(struct vfio_pci_core_device *vdev, unsigned int type, unsigned int subtype, const struct vfio_pci_regops *ops, size_t size, u32 flags, void *data); -void vfio_pci_core_set_params(bool nointxmask, bool is_disable_vga, - bool is_disable_idle_d3); void vfio_pci_core_close_device(struct vfio_device *core_vdev); int vfio_pci_core_init_dev(struct vfio_device *core_vdev); void vfio_pci_core_release_dev(struct vfio_device *core_vdev); -- cgit v1.2.3 From 8bc4d43bccbd60efe85d0a44d5bf41762f2f0c30 Mon Sep 17 00:00:00 2001 From: Michael Bommarito Date: Thu, 25 Jun 2026 19:21:39 +0100 Subject: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU") removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that "the destruction of info/keys is delayed until the socket destructor" and therefore "no one can discover it anymore". That argument does not hold for the call site in tcp_connect() (net/ipv4/tcp_output.c:4327-4332). At that point the socket is in TCP_SYN_SENT, has already been inserted into the inet ehash by inet_hash_connect() in tcp_v4_connect(), and is therefore very much discoverable: any softirq running tcp_v4_rcv() on another CPU can take the socket out of the ehash, walk into tcp_inbound_hash(), and load tp->ao_info via implicit RCU before bh_lock_sock_nested() is taken on the destroying CPU. The reader path then enters __tcp_ao_do_lookup() (net/ipv4/tcp_ao.c:208) which re-loads tp->ao_info via rcu_dereference_check(); the re-load can still observe the (about-to-be-freed) pointer because there is no synchronize_rcu() between rcu_assign_pointer(tp->ao_info, NULL) and tcp_ao_info_free() in tcp_ao_destroy_sock(). The captured pointer is then walked at line 223: hlist_for_each_entry_rcu(key, &ao->head, node, ...) The writer's synchronous kfree() is free to complete between the line 218 re-fetch and the line 223 hlist iteration. The slab is reused (or simply LIST_POISON1-stamped if not yet reused) and the iteration walks attacker-controlled or poison memory in softirq context. Reproducer (no debug shim, stock x86_64 v7.1-rc2 SMP+KASAN, QEMU+KVM): an unprivileged uid=1000 process inside CLONE_NEWUSER|CLONE_NEWNET installs TCP_MD5SIG + TCP_AO_ADD_KEY on a TCP socket, sprays forged TCP-AO segments toward its eventual 4-tuple via raw sockets, then calls connect(). The md5-wins reconciliation in tcp_connect() fires tcp_ao_destroy_sock(); the softirq backlog reader on the loopback NAPI path crashes on the freed ao->head.first walk: Oops: general protection fault, probably for non-canonical address 0xfbd59c000000002f KASAN: maybe wild-memory-access in range [0xdead000000000178-0xdead00000000017f] CPU: 0 UID: 1000 PID: 100 Comm: repro_userns RIP: 0010:__tcp_ao_do_lookup+0x107/0x1c0 Call Trace: __tcp_ao_do_lookup+0x107/0x1c0 tcp_ao_inbound_lookup.constprop.0+0x12a/0x200 tcp_inbound_ao_hash+0x5ea/0x1520 tcp_inbound_hash+0x7ce/0x1240 tcp_v4_rcv+0x1e7a/0x3e10 ... Restore the RCU grace period: re-add struct rcu_head to tcp_ao_info and replace the synchronous tcp_ao_info_free() with a call_rcu() callback. Readers that captured tp->ao_info before rcu_assign_pointer NULLed it now see the object remain valid until rcu_read_unlock(). With the patch applied the reproducer runs cleanly for 2000 iterations on the same kernel build. Fixes: 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU") Cc: stable@vger.kernel.org # v6.18+ Reviewed-by: Dmitry Safonov Signed-off-by: Michael Bommarito Reviewed-by: Eric Dumazet Signed-off-by: Dmitry Safonov <0x7f454c46@gmail.com> Link: https://patch.msgid.link/20260625-tcp-md5-connect-v3-1-1fd313d6c1e0@gmail.com Signed-off-by: Jakub Kicinski --- include/net/tcp_ao.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/net/tcp_ao.h b/include/net/tcp_ao.h index 29fd7b735afa..9a2333e62e99 100644 --- a/include/net/tcp_ao.h +++ b/include/net/tcp_ao.h @@ -145,6 +145,7 @@ struct tcp_ao_info { u32 snd_sne; u32 rcv_sne; refcount_t refcnt; /* Protects twsk destruction */ + struct rcu_head rcu; }; #ifdef CONFIG_TCP_MD5SIG -- cgit v1.2.3 From ac4aa4b41bee8d6353cd2992fe8ecbb8ef2123cb Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Mon, 15 Jun 2026 18:30:27 +0300 Subject: drm/dp: fix kernel-doc for struct drm_dp_as_sdp Add the missing coasting_vtotal kernel-doc member documentation for struct drm_dp_as_sdp. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260615153027.1899784-1-jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/display/drm_dp_helper.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/drm/display/drm_dp_helper.h b/include/drm/display/drm_dp_helper.h index 8c2d77a032f0..ab16c1be3900 100644 --- a/include/drm/display/drm_dp_helper.h +++ b/include/drm/display/drm_dp_helper.h @@ -115,6 +115,7 @@ struct drm_dp_vsc_sdp { * @duration_decr_ms: Successive frame duration decrease * @target_rr_divider: Target refresh rate divider * @mode: Adaptive Sync Operation Mode + * @coasting_vtotal: Coasting vtotal */ struct drm_dp_as_sdp { unsigned char sdp_type; -- cgit v1.2.3 From 9ec3aeace4334e0d2aa105d1d25fd8a95fb9ba95 Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Mon, 15 Jun 2026 18:30:12 +0300 Subject: drm/fixed: fix kernel-doc for drm_sm2fixp() Fix the kernel-doc comment for drm_sm2fixp(). Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260615153012.1899576-1-jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/drm_fixed.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h index 33de514a5221..21d822aeed55 100644 --- a/include/drm/drm_fixed.h +++ b/include/drm/drm_fixed.h @@ -79,7 +79,8 @@ static inline u32 dfixed_div(fixed20_12 A, fixed20_12 B) #define DRM_FIXED_ALMOST_ONE (DRM_FIXED_ONE - DRM_FIXED_EPSILON) /** - * @drm_sm2fixp + * drm_sm2fixp() - convert signed-magnitude to fixed point + * @a: 1.31.32 signed-magnitude fixed point * * Convert a 1.31.32 signed-magnitude fixed point to 32.32 * 2s-complement fixed point -- cgit v1.2.3 From 64ace85a725957e2359785d2a22cd285eec966de Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Mon, 15 Jun 2026 18:29:49 +0300 Subject: drm/ras: include linux/types.h in drm_ras.h drm_ras.h uses u32. Include linux/types.h for it. Reviewed-by: Thomas Zimmermann Link: https://patch.msgid.link/20260615152949.1899358-1-jani.nikula@intel.com Signed-off-by: Jani Nikula --- include/drm/drm_ras.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h index f2a787bc4f64..0beede3ddc4e 100644 --- a/include/drm/drm_ras.h +++ b/include/drm/drm_ras.h @@ -6,6 +6,8 @@ #ifndef __DRM_RAS_H__ #define __DRM_RAS_H__ +#include + #include /** -- cgit v1.2.3 From a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4 Mon Sep 17 00:00:00 2001 From: Matt Bobrowski Date: Sun, 28 Jun 2026 20:11:03 +0000 Subject: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized When CONFIG_BPF_LSM=y is set, BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at boot time (e.g. omitted from the "lsm=" boot parameter), lsm_prepare() is never executed for the BPF LSM. Consequently, the BPF inode security blob offset (bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at its default compiled size of 8 bytes instead of being updated to a valid offset past the reserved struct rcu_head (typically 16 bytes or more). When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE map, bpf_inode() evaluates inode->i_security + 8. This erroneously aliases the struct rcu_head.func callback pointer at the beginning of the inode->i_security blob. During subsequent map element cleanup or inode destruction, writing NULL to owner_storage clears the queued RCU callback pointer. When rcu_do_batch() later executes the queued callback, it attempts an instruction fetch at address 0x0, triggering an immediate kernel panic. Fix this by introducing a global bpf_lsm_initialized boolean flag marked with __ro_after_init. Set this flag to true inside bpf_lsm_init() when the LSM framework successfully registers the BPF LSM. Gate map allocation in inode_storage_map_alloc() on this flag, returning -EOPNOTSUPP if the BPF LSM is in turn uninitialized. This fail-fast approach prevents userspace from allocating inode storage maps when the supporting BPF LSM infrastructure is absent, avoiding zombie map states. Fixes: 8ea636848aca ("bpf: Implement bpf_local_storage for inodes") Reported-by: oxsignal Signed-off-by: Matt Bobrowski Signed-off-by: Daniel Borkmann Reviewed-by: Emil Tsalapatis Reviewed-by: Amery Hung Link: https://lore.kernel.org/bpf/20260628201103.3624525-1-mattbobrowski@google.com --- include/linux/bpf_lsm.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h index 143775a27a2a..dda272d78f01 100644 --- a/include/linux/bpf_lsm.h +++ b/include/linux/bpf_lsm.h @@ -14,6 +14,8 @@ #ifdef CONFIG_BPF_LSM +extern bool bpf_lsm_initialized __ro_after_init; + #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ RET bpf_lsm_##NAME(__VA_ARGS__); #include @@ -56,6 +58,8 @@ bool bpf_lsm_hook_returns_errno(u32 btf_id); #else /* !CONFIG_BPF_LSM */ +#define bpf_lsm_initialized false + static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id) { return false; -- cgit v1.2.3 From 26d060ba39354eec0345fb73b5f8309edd6ec82c Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Fri, 19 Jun 2026 13:45:47 +0200 Subject: xen: Replace __ASSEMBLY__ with __ASSEMBLER__ in header files While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize now on the __ASSEMBLER__ macro that is provided by the compilers. This is a completely mechanical patch (done with a simple "sed -i" statement). Signed-off-by: Thomas Huth Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260619114547.159637-1-thuth@redhat.com> --- include/xen/interface/xen-mca.h | 4 ++-- include/xen/interface/xen.h | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) (limited to 'include') diff --git a/include/xen/interface/xen-mca.h b/include/xen/interface/xen-mca.h index 1c9afbe8cc26..8f5815f1d3ab 100644 --- a/include/xen/interface/xen-mca.h +++ b/include/xen/interface/xen-mca.h @@ -50,7 +50,7 @@ /* OUT: There was no machine check data to fetch. */ #define XEN_MC_NODATA 0x2 -#ifndef __ASSEMBLY__ +#ifndef __ASSEMBLER__ /* vIRQ injected to Dom0 */ #define VIRQ_MCA VIRQ_ARCH_0 @@ -388,5 +388,5 @@ struct xen_mce_log { #define MCE_GET_LOG_LEN _IOR('M', 2, int) #define MCE_GETCLEAR_FLAGS _IOR('M', 3, int) -#endif /* __ASSEMBLY__ */ +#endif /* __ASSEMBLER__ */ #endif /* __XEN_PUBLIC_ARCH_X86_MCA_H__ */ diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h index 0ca23eca2a9c..40c9793e9880 100644 --- a/include/xen/interface/xen.h +++ b/include/xen/interface/xen.h @@ -337,7 +337,7 @@ #define MMUEXT_MARK_SUPER 19 #define MMUEXT_UNMARK_SUPER 20 -#ifndef __ASSEMBLY__ +#ifndef __ASSEMBLER__ struct mmuext_op { unsigned int cmd; union { @@ -415,7 +415,7 @@ DEFINE_GUEST_HANDLE_STRUCT(mmuext_op); #define MAX_VMASST_TYPE 5 -#ifndef __ASSEMBLY__ +#ifndef __ASSEMBLER__ typedef uint16_t domid_t; @@ -760,11 +760,11 @@ struct tmem_op { DEFINE_GUEST_HANDLE(u64); -#else /* __ASSEMBLY__ */ +#else /* __ASSEMBLER__ */ /* In assembly code we cannot use C numeric constant suffixes. */ #define mk_unsigned_long(x) x -#endif /* !__ASSEMBLY__ */ +#endif /* !__ASSEMBLER__ */ #endif /* __XEN_PUBLIC_XEN_H__ */ -- cgit v1.2.3 From 96cce16e26dd02a8678f1e87f88a4b5cdb63b995 Mon Sep 17 00:00:00 2001 From: Pawan Gupta Date: Mon, 29 Jun 2026 22:37:52 -0700 Subject: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active. Signed-off-by: Pawan Gupta Acked-by: Daniel Borkmann Signed-off-by: Daniel Borkmann --- include/linux/filter.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'include') diff --git a/include/linux/filter.h b/include/linux/filter.h index 67d337ede91b..f68694f94ee7 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -21,6 +21,7 @@ #include #include #include +#include #include #include @@ -1314,6 +1315,15 @@ extern long bpf_jit_limit_max; typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); +/* + * Flush the indirect branch predictors before reusing JIT memory, so that + * indirect jumps into a newly written program don't reuse predictions left + * behind by an old program that occupied the same space. + */ +void bpf_arch_pred_flush(void); +DECLARE_STATIC_CALL(bpf_arch_pred_flush, bpf_arch_pred_flush); +DECLARE_STATIC_KEY_FALSE(bpf_pred_flush_enabled); + void bpf_jit_fill_hole_with_zero(void *area, unsigned int size); struct bpf_binary_header * -- cgit v1.2.3 From 0bb99f2cfaae6822d734d69722de30af823efdf3 Mon Sep 17 00:00:00 2001 From: Pawan Gupta Date: Mon, 29 Jun 2026 22:38:23 -0700 Subject: bpf: Restrict JIT predictor flush to cBPF Currently predictor flush on memory reuse is done for all BPF JIT allocations, but only cBPF programs can be loaded by an unprivileged user. eBPF is privileged by default, and flushing predictors for all CPUs on every eBPF reuse penalizes the common case for no security benefit. eBPF allocations can be frequent on busy systems, only flush predictors for cBPF programs. Trampoline and dispatcher allocations also skip the flush as they are eBPF-only. Signed-off-by: Pawan Gupta Acked-by: Daniel Borkmann Signed-off-by: Daniel Borkmann --- include/linux/filter.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/filter.h b/include/linux/filter.h index f68694f94ee7..14acb2455746 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -1338,7 +1338,7 @@ void bpf_jit_free(struct bpf_prog *fp); struct bpf_binary_header * bpf_jit_binary_pack_hdr(const struct bpf_prog *fp); -void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns); +void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic); void bpf_prog_pack_free(void *ptr, u32 size); static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp) @@ -1352,7 +1352,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image, unsigned int alignment, struct bpf_binary_header **rw_hdr, u8 **rw_image, - bpf_jit_fill_hole_t bpf_fill_ill_insns); + bpf_jit_fill_hole_t bpf_fill_ill_insns, + bool was_classic); int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header, struct bpf_binary_header *rw_header); void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header, -- cgit v1.2.3 From 9825cf2cb59fac7480e7fac9eee13ab9af3f1ea8 Mon Sep 17 00:00:00 2001 From: "Rafael J. Wysocki" Date: Tue, 30 Jun 2026 18:03:03 +0200 Subject: ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias Commit 292db66afd20 ("ACPICA: Unbreak tools build after switching over to strscpy_pad()") added an #ifdef based on a __KERNEL__ check which is sort of nasty to the acpi_ut_safe_strncpy() definition to unbreak ACPICA tools builds broken by commit 97f7d3f9c9ac ("ACPICA: Replace strncpy() with strscpy_pad() in acpi_ut_safe_strncpy()"). However, that #ifdef effectively produces dead code when tools are built because they don't call acpi_ut_safe_strncpy(). Accordingly, drop the existing definition of acpi_ut_safe_strncpy() and define it as a strscpy_pad() alias. Fixes: 292db66afd20 ("ACPICA: Unbreak tools build after switching over to strscpy_pad()") Signed-off-by: Rafael J. Wysocki [ rjw: Tweak the changelog ] Link: https://patch.msgid.link/12941764.O9o76ZdvQC@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki --- include/acpi/platform/aclinuxex.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/acpi/platform/aclinuxex.h b/include/acpi/platform/aclinuxex.h index aeb74e2f9d4f..760e1ded325c 100644 --- a/include/acpi/platform/aclinuxex.h +++ b/include/acpi/platform/aclinuxex.h @@ -134,6 +134,7 @@ static inline void acpi_os_terminate_debugger(void) /* * OSL interfaces added by Linux */ +#define acpi_ut_safe_strncpy strscpy_pad #endif /* __KERNEL__ */ -- cgit v1.2.3 From fa746e23d1094f9a68afe5973746b0e32078fd8b Mon Sep 17 00:00:00 2001 From: David Howells Date: Thu, 25 Jun 2026 15:06:28 +0100 Subject: netfs: Fix kdoc warning Fix a kdoc warning due to a misnamed parameter in the description. Reported-by: Matthew Wilcox Signed-off-by: David Howells Link: https://patch.msgid.link/20260625140640.3116900-11-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/netfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/netfs.h b/include/linux/netfs.h index 243c0f737938..bdc270e84b30 100644 --- a/include/linux/netfs.h +++ b/include/linux/netfs.h @@ -753,7 +753,7 @@ static inline void netfs_inode_init(struct netfs_inode *ctx, /** * netfs_resize_file - Note that a file got resized - * @ctx: The netfs inode being resized + * @ictx: The netfs inode being resized * @new_i_size: The new file size * @changed_on_server: The change was applied to the server * -- cgit v1.2.3 From 41376400c4717fed43490030902f9e4c9062b285 Mon Sep 17 00:00:00 2001 From: David Howells Date: Thu, 25 Jun 2026 15:06:29 +0100 Subject: netfs: Replace wb_lock with a bit lock for asynchronicity The netfs_inode::wb_lock mutex is used to prevent multiple simultaneous writebacks from fighting each other (a writeback thread will write multiple discontiguous regions within the same request). The mutex, however, only serialises the issuing of subrequests; it doesn't serialise the collection of results, and, in particular, the updating of file size information and fscache populatedness data. Unfortunately, the mutex cannot be held around the entire process as it has to be unlocked in the same thread in which it is locked - and we don't want to hold up the allocator whilst we complete the writeback. Fix this by replacing the mutex with a bit flag and a list of lock waiters so that the lock can be dropped in the collector thread after collection is complete. Link: https://sashiko.dev/#/patchset/20260608145432.681865-1-dhowells%40redhat.com Signed-off-by: David Howells Link: https://patch.msgid.link/20260625140640.3116900-12-dhowells@redhat.com cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner (Amutable) --- include/linux/netfs.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'include') diff --git a/include/linux/netfs.h b/include/linux/netfs.h index bdc270e84b30..1bc120d61c5b 100644 --- a/include/linux/netfs.h +++ b/include/linux/netfs.h @@ -61,14 +61,16 @@ struct netfs_inode { #if IS_ENABLED(CONFIG_FSCACHE) struct fscache_cookie *cache; #endif - struct mutex wb_lock; /* Writeback serialisation */ + struct list_head wb_queue; /* Queue of processes wanting to do writeback */ loff_t _remote_i_size; /* Size of the remote file */ loff_t _zero_point; /* Size after which we assume there's no data * on the server */ + spinlock_t lock; /* Lock covering wb_queue */ atomic_t io_count; /* Number of outstanding reqs */ unsigned long flags; #define NETFS_ICTX_ODIRECT 0 /* The file has DIO in progress */ #define NETFS_ICTX_UNBUFFERED 1 /* I/O should not use the pagecache */ +#define NETFS_ICTX_WB_LOCK 2 /* Writeback serialisation lock */ #define NETFS_ICTX_MODIFIED_ATTR 3 /* Indicate change in mtime/ctime */ #define NETFS_ICTX_SINGLE_NO_UPLOAD 4 /* Monolithic payload, cache but no upload */ }; @@ -462,6 +464,10 @@ int netfs_alloc_folioq_buffer(struct address_space *mapping, size_t *_cur_size, ssize_t size, gfp_t gfp); void netfs_free_folioq_buffer(struct folio_queue *fq); +/* Writeback exclusion API. */ +bool netfs_wb_begin(struct netfs_inode *ictx, bool nowait); +void netfs_wb_end(struct netfs_inode *ictx); + /** * netfs_inode - Get the netfs inode context from the inode * @inode: The inode to query @@ -743,7 +749,8 @@ static inline void netfs_inode_init(struct netfs_inode *ctx, #if IS_ENABLED(CONFIG_FSCACHE) ctx->cache = NULL; #endif - mutex_init(&ctx->wb_lock); + INIT_LIST_HEAD(&ctx->wb_queue); + spin_lock_init(&ctx->lock); /* ->releasepage() drives zero_point */ if (use_zero_point) { ctx->_zero_point = ctx->_remote_i_size; -- cgit v1.2.3 From 044472d5ee7d71f918fa3f61bd65e4933a0c006e Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 29 Jun 2026 14:17:38 +0200 Subject: iomap: consolidate bio submission Add a iomap_bio_submit_read_endio helper factored out of iomap_bio_submit_read to that all ->submit_read implementations for iomap_read_ops that use iomap_bio_read_folio_range can shared the logic. Right now that logic is mostly trivial, but already has a bug for XFS because the XFS version is too trivial: file system integrity validation needs a workqueue context and thus can't happen from the default iomap bi_end_io I/O handler. Unfortunately the iomap refactoring just before fs integrity landed moved code around here and the call go misplaced, meaning it never got called. The PI information still is verified by the block layer, but the offloading is less efficient (and the future userspace interface can't get at it). Fixes: 0b10a370529c ("iomap: support T10 protection information") Cc: stable@vger.kernel.org # v7.1 Signed-off-by: Christoph Hellwig Link: https://patch.msgid.link/20260629121750.3392300-2-hch@lst.de Acked-by: Namjae Jeon Reviewed-by: "Darrick J. Wong" Reviewed-by: Joanne Koong Signed-off-by: Christian Brauner (Amutable) --- include/linux/iomap.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/iomap.h b/include/linux/iomap.h index 3582ed1fe236..56b43d594e6e 100644 --- a/include/linux/iomap.h +++ b/include/linux/iomap.h @@ -622,6 +622,8 @@ extern struct bio_set iomap_ioend_bioset; #ifdef CONFIG_BLOCK int iomap_bio_read_folio_range(const struct iomap_iter *iter, struct iomap_read_folio_ctx *ctx, size_t plen); +void iomap_bio_submit_read_endio(const struct iomap_iter *iter, + struct iomap_read_folio_ctx *ctx, bio_end_io_t end_io); extern const struct iomap_read_ops iomap_bio_read_ops; -- cgit v1.2.3 From ad428f5811bd7fb3d91fa002174de533f9da94d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 30 Jun 2026 11:24:20 +0200 Subject: mod_devicetable.h: Split into per subsystem headers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit is included transitively in nearly every driver in an x86_64 allmodconfig build of v7.1: $ find drivers -name \*.o -not -name \*.mod.o | wc -l 21330 $ find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l 17038 The result is that even when touching an obscure device id struct most of the kernel needs to be recompiled. Given that each driver typically only needs one or two of these structures, splitting into per subsystem headers and only including what is really needed reduces the amount of needed recompilation. Implement the first step and define each device id struct in a separate header (together with its associated #defines). is modified to include all the new headers to continue to provide the same symbols. Several headers currently include , those that are most lukrative to include only their subsystem headers only are: $ git -C source grep -l mod_devicetable.h include/linux | while read h; do echo -n "$h:"; find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l $h | wc -l; done | sort -t: -k2 -n -r | head include/linux/of.h:10897 include/linux/pci.h:7920 include/linux/acpi.h:7097 include/linux/i2c.h:5402 include/linux/spi/spi.h:1897 include/linux/dmi.h:1643 include/linux/usb.h:1222 include/linux/input.h:1205 include/linux/mdio.h:835 include/linux/phy.h:733 struct cpu_feature isn't really a device_id struct. That is kept in for now. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Acked-by: Geert Uytterhoeven # zorro Link: https://patch.msgid.link/41400e323be8640702b906d04327e833c5bdaf4a.1782808461.git.u.kleine-koenig@baylibre.com [Drop "MOD" from the header guards] Signed-off-by: Uwe Kleine-König (The Capable Hub) --- include/linux/device-id/acpi.h | 32 ++ include/linux/device-id/amba.h | 19 + include/linux/device-id/ap.h | 20 + include/linux/device-id/apr.h | 21 + include/linux/device-id/auxiliary.h | 17 + include/linux/device-id/bcma.h | 25 + include/linux/device-id/ccw.h | 27 + include/linux/device-id/cdx.h | 40 ++ include/linux/device-id/coreboot.h | 20 + include/linux/device-id/css.h | 17 + include/linux/device-id/dfl.h | 34 ++ include/linux/device-id/dmi.h | 58 ++ include/linux/device-id/eisa.h | 21 + include/linux/device-id/fsl_mc.h | 22 + include/linux/device-id/hda.h | 17 + include/linux/device-id/hid.h | 22 + include/linux/device-id/hv_vmbus.h | 18 + include/linux/device-id/i2c.h | 19 + include/linux/device-id/i3c.h | 26 + include/linux/device-id/ieee1394.h | 27 + include/linux/device-id/input.h | 62 +++ include/linux/device-id/ipack.h | 17 + include/linux/device-id/isapnp.h | 16 + include/linux/device-id/ishtp.h | 24 + include/linux/device-id/mcb.h | 15 + include/linux/device-id/mdio.h | 35 ++ include/linux/device-id/mei_cl.h | 31 ++ include/linux/device-id/mhi.h | 24 + include/linux/device-id/mips_cdmm.h | 17 + include/linux/device-id/of.h | 15 + include/linux/device-id/parisc.h | 21 + include/linux/device-id/pci.h | 54 ++ include/linux/device-id/pcmcia.h | 48 ++ include/linux/device-id/platform.h | 17 + include/linux/device-id/pnp.h | 26 + include/linux/device-id/rio.h | 28 + include/linux/device-id/rpmsg.h | 19 + include/linux/device-id/sdio.h | 21 + include/linux/device-id/sdw.h | 18 + include/linux/device-id/serio.h | 18 + include/linux/device-id/slim.h | 23 + include/linux/device-id/spi.h | 19 + include/linux/device-id/spmi.h | 17 + include/linux/device-id/ssam.h | 28 + include/linux/device-id/ssb.h | 24 + include/linux/device-id/tb.h | 37 ++ include/linux/device-id/tee_client.h | 18 + include/linux/device-id/typec.h | 26 + include/linux/device-id/ulpi.h | 16 + include/linux/device-id/usb.h | 111 ++++ include/linux/device-id/vchiq.h | 9 + include/linux/device-id/vio.h | 11 + include/linux/device-id/virtio.h | 16 + include/linux/device-id/wmi.h | 19 + include/linux/device-id/x86_cpu.h | 44 ++ include/linux/device-id/zorro.h | 19 + include/linux/mod_devicetable.h | 1014 ++-------------------------------- 57 files changed, 1521 insertions(+), 958 deletions(-) create mode 100644 include/linux/device-id/acpi.h create mode 100644 include/linux/device-id/amba.h create mode 100644 include/linux/device-id/ap.h create mode 100644 include/linux/device-id/apr.h create mode 100644 include/linux/device-id/auxiliary.h create mode 100644 include/linux/device-id/bcma.h create mode 100644 include/linux/device-id/ccw.h create mode 100644 include/linux/device-id/cdx.h create mode 100644 include/linux/device-id/coreboot.h create mode 100644 include/linux/device-id/css.h create mode 100644 include/linux/device-id/dfl.h create mode 100644 include/linux/device-id/dmi.h create mode 100644 include/linux/device-id/eisa.h create mode 100644 include/linux/device-id/fsl_mc.h create mode 100644 include/linux/device-id/hda.h create mode 100644 include/linux/device-id/hid.h create mode 100644 include/linux/device-id/hv_vmbus.h create mode 100644 include/linux/device-id/i2c.h create mode 100644 include/linux/device-id/i3c.h create mode 100644 include/linux/device-id/ieee1394.h create mode 100644 include/linux/device-id/input.h create mode 100644 include/linux/device-id/ipack.h create mode 100644 include/linux/device-id/isapnp.h create mode 100644 include/linux/device-id/ishtp.h create mode 100644 include/linux/device-id/mcb.h create mode 100644 include/linux/device-id/mdio.h create mode 100644 include/linux/device-id/mei_cl.h create mode 100644 include/linux/device-id/mhi.h create mode 100644 include/linux/device-id/mips_cdmm.h create mode 100644 include/linux/device-id/of.h create mode 100644 include/linux/device-id/parisc.h create mode 100644 include/linux/device-id/pci.h create mode 100644 include/linux/device-id/pcmcia.h create mode 100644 include/linux/device-id/platform.h create mode 100644 include/linux/device-id/pnp.h create mode 100644 include/linux/device-id/rio.h create mode 100644 include/linux/device-id/rpmsg.h create mode 100644 include/linux/device-id/sdio.h create mode 100644 include/linux/device-id/sdw.h create mode 100644 include/linux/device-id/serio.h create mode 100644 include/linux/device-id/slim.h create mode 100644 include/linux/device-id/spi.h create mode 100644 include/linux/device-id/spmi.h create mode 100644 include/linux/device-id/ssam.h create mode 100644 include/linux/device-id/ssb.h create mode 100644 include/linux/device-id/tb.h create mode 100644 include/linux/device-id/tee_client.h create mode 100644 include/linux/device-id/typec.h create mode 100644 include/linux/device-id/ulpi.h create mode 100644 include/linux/device-id/usb.h create mode 100644 include/linux/device-id/vchiq.h create mode 100644 include/linux/device-id/vio.h create mode 100644 include/linux/device-id/virtio.h create mode 100644 include/linux/device-id/wmi.h create mode 100644 include/linux/device-id/x86_cpu.h create mode 100644 include/linux/device-id/zorro.h (limited to 'include') diff --git a/include/linux/device-id/acpi.h b/include/linux/device-id/acpi.h new file mode 100644 index 000000000000..65800cefddca --- /dev/null +++ b/include/linux/device-id/acpi.h @@ -0,0 +1,32 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_ACPI_H +#define LINUX_DEVICE_ID_ACPI_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define ACPI_ID_LEN 16 + +struct acpi_device_id { + __u8 id[ACPI_ID_LEN]; + kernel_ulong_t driver_data; + __u32 cls; + __u32 cls_msk; +}; + +/** + * ACPI_DEVICE_CLASS - macro used to describe an ACPI device with + * the PCI-defined class-code information + * + * @_cls : the class, subclass, prog-if triple for this device + * @_msk : the class mask for this device + * + * This macro is used to create a struct acpi_device_id that matches a + * specific PCI class. The .id and .driver_data fields will be left + * initialized with the default value. + */ +#define ACPI_DEVICE_CLASS(_cls, _msk) .cls = (_cls), .cls_msk = (_msk), + +#endif /* ifndef LINUX_DEVICE_ID_ACPI_H */ diff --git a/include/linux/device-id/amba.h b/include/linux/device-id/amba.h new file mode 100644 index 000000000000..114d66a784ac --- /dev/null +++ b/include/linux/device-id/amba.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_AMBA_H +#define LINUX_DEVICE_ID_AMBA_H + +/** + * struct amba_id - identifies a device on an AMBA bus + * @id: The significant bits if the hardware device ID + * @mask: Bitmask specifying which bits of the id field are significant when + * matching. A driver binds to a device when ((hardware device ID) & mask) + * == id. + * @data: Private data used by the driver. + */ +struct amba_id { + unsigned int id; + unsigned int mask; + void *data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_AMBA_H */ diff --git a/include/linux/device-id/ap.h b/include/linux/device-id/ap.h new file mode 100644 index 000000000000..0992333a34db --- /dev/null +++ b/include/linux/device-id/ap.h @@ -0,0 +1,20 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_AP_H +#define LINUX_DEVICE_ID_AP_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define AP_DEVICE_ID_MATCH_CARD_TYPE 0x01 +#define AP_DEVICE_ID_MATCH_QUEUE_TYPE 0x02 + +/* s390 AP bus devices */ +struct ap_device_id { + __u16 match_flags; /* which fields to match against */ + __u8 dev_type; /* device type */ + kernel_ulong_t driver_info; +}; + +#endif /* ifndef LINUX_DEVICE_ID_AP_H */ diff --git a/include/linux/device-id/apr.h b/include/linux/device-id/apr.h new file mode 100644 index 000000000000..f282608ea018 --- /dev/null +++ b/include/linux/device-id/apr.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_APR_H +#define LINUX_DEVICE_ID_APR_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define APR_NAME_SIZE 32 +#define APR_MODULE_PREFIX "apr:" + +struct apr_device_id { + char name[APR_NAME_SIZE]; + __u32 domain_id; + __u32 svc_id; + __u32 svc_version; + kernel_ulong_t driver_data; /* Data private to the driver */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_APR_H */ diff --git a/include/linux/device-id/auxiliary.h b/include/linux/device-id/auxiliary.h new file mode 100644 index 000000000000..9d512dfb23dd --- /dev/null +++ b/include/linux/device-id/auxiliary.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_AUXILIARY_H +#define LINUX_DEVICE_ID_AUXILIARY_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +#define AUXILIARY_NAME_SIZE 40 +#define AUXILIARY_MODULE_PREFIX "auxiliary:" + +struct auxiliary_device_id { + char name[AUXILIARY_NAME_SIZE]; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_AUXILIARY_H */ diff --git a/include/linux/device-id/bcma.h b/include/linux/device-id/bcma.h new file mode 100644 index 000000000000..3e6b973dc4ae --- /dev/null +++ b/include/linux/device-id/bcma.h @@ -0,0 +1,25 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_BCMA_H +#define LINUX_DEVICE_ID_BCMA_H + +#ifdef __KERNEL__ +#include +#endif + +#define BCMA_CORE(_manuf, _id, _rev, _class) \ + { .manuf = _manuf, .id = _id, .rev = _rev, .class = _class, } + +#define BCMA_ANY_MANUF 0xFFFF +#define BCMA_ANY_ID 0xFFFF +#define BCMA_ANY_REV 0xFF +#define BCMA_ANY_CLASS 0xFF + +/* Broadcom's specific AMBA core, see drivers/bcma/ */ +struct bcma_device_id { + __u16 manuf; + __u16 id; + __u8 rev; + __u8 class; +} __attribute__((packed,aligned(2))); + +#endif /* ifndef LINUX_DEVICE_ID_BCMA_H */ diff --git a/include/linux/device-id/ccw.h b/include/linux/device-id/ccw.h new file mode 100644 index 000000000000..6b7086aa5ca8 --- /dev/null +++ b/include/linux/device-id/ccw.h @@ -0,0 +1,27 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_CCW_H +#define LINUX_DEVICE_ID_CCW_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define CCW_DEVICE_ID_MATCH_CU_TYPE 0x01 +#define CCW_DEVICE_ID_MATCH_CU_MODEL 0x02 +#define CCW_DEVICE_ID_MATCH_DEVICE_TYPE 0x04 +#define CCW_DEVICE_ID_MATCH_DEVICE_MODEL 0x08 + +/* s390 CCW devices */ +struct ccw_device_id { + __u16 match_flags; /* which fields to match against */ + + __u16 cu_type; /* control unit type */ + __u16 dev_type; /* device type */ + __u8 cu_model; /* control unit model */ + __u8 dev_model; /* device model */ + + kernel_ulong_t driver_info; +}; + +#endif /* ifndef LINUX_DEVICE_ID_CCW_H */ diff --git a/include/linux/device-id/cdx.h b/include/linux/device-id/cdx.h new file mode 100644 index 000000000000..c6cb2b5cab5a --- /dev/null +++ b/include/linux/device-id/cdx.h @@ -0,0 +1,40 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_CDX_H +#define LINUX_DEVICE_ID_CDX_H + +#ifdef __KERNEL__ +#include +#endif + +#define CDX_ANY_ID (0xFFFF) + +enum { + CDX_ID_F_VFIO_DRIVER_OVERRIDE = 1, +}; + +/** + * struct cdx_device_id - CDX device identifier + * @vendor: Vendor ID + * @device: Device ID + * @subvendor: Subsystem vendor ID (or CDX_ANY_ID) + * @subdevice: Subsystem device ID (or CDX_ANY_ID) + * @class: Device class + * Most drivers do not need to specify class/class_mask + * as vendor/device is normally sufficient. + * @class_mask: Limit which sub-fields of the class field are compared. + * @override_only: Match only when dev->driver_override is this driver. + * + * Type of entries in the "device Id" table for CDX devices supported by + * a CDX device driver. + */ +struct cdx_device_id { + __u16 vendor; + __u16 device; + __u16 subvendor; + __u16 subdevice; + __u32 class; + __u32 class_mask; + __u32 override_only; +}; + +#endif /* ifndef LINUX_DEVICE_ID_CDX_H */ diff --git a/include/linux/device-id/coreboot.h b/include/linux/device-id/coreboot.h new file mode 100644 index 000000000000..ff459879781e --- /dev/null +++ b/include/linux/device-id/coreboot.h @@ -0,0 +1,20 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_COREBOOT_H +#define LINUX_DEVICE_ID_COREBOOT_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/** + * struct coreboot_device_id - Identifies a coreboot table entry + * @tag: tag ID + * @driver_data: driver specific data + */ +struct coreboot_device_id { + __u32 tag; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_COREBOOT_H */ diff --git a/include/linux/device-id/css.h b/include/linux/device-id/css.h new file mode 100644 index 000000000000..67435bb22618 --- /dev/null +++ b/include/linux/device-id/css.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_CSS_H +#define LINUX_DEVICE_ID_CSS_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* s390 css bus devices (subchannels) */ +struct css_device_id { + __u8 match_flags; + __u8 type; /* subchannel type */ + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_CSS_H */ diff --git a/include/linux/device-id/dfl.h b/include/linux/device-id/dfl.h new file mode 100644 index 000000000000..bd0c9dbafeeb --- /dev/null +++ b/include/linux/device-id/dfl.h @@ -0,0 +1,34 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_DFL_H +#define LINUX_DEVICE_ID_DFL_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* + * DFL (Device Feature List) + * + * DFL defines a linked list of feature headers within the device MMIO space to + * provide an extensible way of adding features. Software can walk through these + * predefined data structures to enumerate features. It is now used in the FPGA. + * See Documentation/fpga/dfl.rst for more information. + * + * The dfl bus type is introduced to match the individual feature devices (dfl + * devices) for specific dfl drivers. + */ + +/** + * struct dfl_device_id - dfl device identifier + * @type: DFL FIU type of the device. See enum dfl_id_type. + * @feature_id: feature identifier local to its DFL FIU type. + * @driver_data: driver specific data. + */ +struct dfl_device_id { + __u16 type; + __u16 feature_id; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_DFL_H */ diff --git a/include/linux/device-id/dmi.h b/include/linux/device-id/dmi.h new file mode 100644 index 000000000000..fdc4adbad133 --- /dev/null +++ b/include/linux/device-id/dmi.h @@ -0,0 +1,58 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_DMI_H +#define LINUX_DEVICE_ID_DMI_H + +#define DMI_MATCH(a, b) { .slot = a, .substr = b } +#define DMI_EXACT_MATCH(a, b) { .slot = a, .substr = b, .exact_match = 1 } + +/* dmi */ +enum dmi_field { + DMI_NONE, + DMI_BIOS_VENDOR, + DMI_BIOS_VERSION, + DMI_BIOS_DATE, + DMI_BIOS_RELEASE, + DMI_EC_FIRMWARE_RELEASE, + DMI_SYS_VENDOR, + DMI_PRODUCT_NAME, + DMI_PRODUCT_VERSION, + DMI_PRODUCT_SERIAL, + DMI_PRODUCT_UUID, + DMI_PRODUCT_SKU, + DMI_PRODUCT_FAMILY, + DMI_BOARD_VENDOR, + DMI_BOARD_NAME, + DMI_BOARD_VERSION, + DMI_BOARD_SERIAL, + DMI_BOARD_ASSET_TAG, + DMI_CHASSIS_VENDOR, + DMI_CHASSIS_TYPE, + DMI_CHASSIS_VERSION, + DMI_CHASSIS_SERIAL, + DMI_CHASSIS_ASSET_TAG, + DMI_STRING_MAX, + DMI_OEM_STRING, /* special case - will not be in dmi_ident */ +}; + +struct dmi_strmatch { + unsigned char slot:7; + unsigned char exact_match:1; + char substr[79]; +}; + +struct dmi_system_id { + int (*callback)(const struct dmi_system_id *); + const char *ident; + struct dmi_strmatch matches[4]; + void *driver_data; +}; + +/* + * struct dmi_device_id appears during expansion of + * "MODULE_DEVICE_TABLE(dmi, x)". Compiler doesn't look inside it + * but this is enough for gcc 3.4.6 to error out: + * error: storage size of '__mod_dmi_device_table' isn't known + */ +#define dmi_device_id dmi_system_id + +#endif /* ifndef LINUX_DEVICE_ID_DMI_H */ diff --git a/include/linux/device-id/eisa.h b/include/linux/device-id/eisa.h new file mode 100644 index 000000000000..1eeae6247524 --- /dev/null +++ b/include/linux/device-id/eisa.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_EISA_H +#define LINUX_DEVICE_ID_EISA_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +/* EISA */ + +#define EISA_SIG_LEN 8 + +/* The EISA signature, in ASCII form, null terminated */ +struct eisa_device_id { + char sig[EISA_SIG_LEN]; + kernel_ulong_t driver_data; +}; + +#define EISA_DEVICE_MODALIAS_FMT "eisa:s%s" + +#endif /* ifndef LINUX_DEVICE_ID_EISA_H */ diff --git a/include/linux/device-id/fsl_mc.h b/include/linux/device-id/fsl_mc.h new file mode 100644 index 000000000000..0cfa94923670 --- /dev/null +++ b/include/linux/device-id/fsl_mc.h @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_FSL_MC_H +#define LINUX_DEVICE_ID_FSL_MC_H + +#ifdef __KERNEL__ +#include +#endif + +/** + * struct fsl_mc_device_id - MC object device identifier + * @vendor: vendor ID + * @obj_type: MC object type + * + * Type of entries in the "device Id" table for MC object devices supported by + * a MC object device driver. The last entry of the table has vendor set to 0x0 + */ +struct fsl_mc_device_id { + __u16 vendor; + const char obj_type[16]; +}; + +#endif /* ifndef LINUX_DEVICE_ID_FSL_MC_H */ diff --git a/include/linux/device-id/hda.h b/include/linux/device-id/hda.h new file mode 100644 index 000000000000..42542580f955 --- /dev/null +++ b/include/linux/device-id/hda.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_HDA_H +#define LINUX_DEVICE_ID_HDA_H + +#ifdef __KERNEL__ +#include +#endif + +struct hda_device_id { + __u32 vendor_id; + __u32 rev_id; + __u8 api_version; + const char *name; + unsigned long driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_HDA_H */ diff --git a/include/linux/device-id/hid.h b/include/linux/device-id/hid.h new file mode 100644 index 000000000000..e865fc64bf94 --- /dev/null +++ b/include/linux/device-id/hid.h @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_HID_H +#define LINUX_DEVICE_ID_HID_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define HID_ANY_ID (~0) +#define HID_BUS_ANY 0xffff +#define HID_GROUP_ANY 0x0000 + +struct hid_device_id { + __u16 bus; + __u16 group; + __u32 vendor; + __u32 product; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_HID_H */ diff --git a/include/linux/device-id/hv_vmbus.h b/include/linux/device-id/hv_vmbus.h new file mode 100644 index 000000000000..a7682c05619f --- /dev/null +++ b/include/linux/device-id/hv_vmbus.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_HV_VMBUS_H +#define LINUX_DEVICE_ID_HV_VMBUS_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* + * For Hyper-V devices we use the device guid as the id. + */ +struct hv_vmbus_device_id { + guid_t guid; + kernel_ulong_t driver_data; /* Data private to the driver */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_HV_VMBUS_H */ diff --git a/include/linux/device-id/i2c.h b/include/linux/device-id/i2c.h new file mode 100644 index 000000000000..21f9b581e7a9 --- /dev/null +++ b/include/linux/device-id/i2c.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_I2C_H +#define LINUX_DEVICE_ID_I2C_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +/* i2c */ + +#define I2C_NAME_SIZE 20 +#define I2C_MODULE_PREFIX "i2c:" + +struct i2c_device_id { + char name[I2C_NAME_SIZE]; + kernel_ulong_t driver_data; /* Data private to the driver */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_I2C_H */ diff --git a/include/linux/device-id/i3c.h b/include/linux/device-id/i3c.h new file mode 100644 index 000000000000..5d8222c9f908 --- /dev/null +++ b/include/linux/device-id/i3c.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_I3C_H +#define LINUX_DEVICE_ID_I3C_H + +#ifdef __KERNEL__ +#include +#endif + +/* i3c */ + +#define I3C_MATCH_DCR 0x1 +#define I3C_MATCH_MANUF 0x2 +#define I3C_MATCH_PART 0x4 +#define I3C_MATCH_EXTRA_INFO 0x8 + +struct i3c_device_id { + __u8 match_flags; + __u8 dcr; + __u16 manuf_id; + __u16 part_id; + __u16 extra_info; + + const void *data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_I3C_H */ diff --git a/include/linux/device-id/ieee1394.h b/include/linux/device-id/ieee1394.h new file mode 100644 index 000000000000..63023964724a --- /dev/null +++ b/include/linux/device-id/ieee1394.h @@ -0,0 +1,27 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_IEEE1394_H +#define LINUX_DEVICE_ID_IEEE1394_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define IEEE1394_MATCH_VENDOR_ID 0x0001 +#define IEEE1394_MATCH_MODEL_ID 0x0002 +#define IEEE1394_MATCH_SPECIFIER_ID 0x0004 +#define IEEE1394_MATCH_VERSION 0x0008 + +struct ieee1394_device_id { + __u32 match_flags; + __u32 vendor_id; + __u32 model_id; + __u32 specifier_id; + __u32 version; + union { + kernel_ulong_t driver_data; + const void *driver_data_ptr; + }; +}; + +#endif /* ifndef LINUX_DEVICE_ID_IEEE1394_H */ diff --git a/include/linux/device-id/input.h b/include/linux/device-id/input.h new file mode 100644 index 000000000000..66d7e78d32c0 --- /dev/null +++ b/include/linux/device-id/input.h @@ -0,0 +1,62 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_INPUT_H +#define LINUX_DEVICE_ID_INPUT_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* Input */ +#define INPUT_DEVICE_ID_EV_MAX 0x1f +#define INPUT_DEVICE_ID_KEY_MIN_INTERESTING 0x71 +#define INPUT_DEVICE_ID_KEY_MAX 0x2ff +#define INPUT_DEVICE_ID_REL_MAX 0x0f +#define INPUT_DEVICE_ID_ABS_MAX 0x3f +#define INPUT_DEVICE_ID_MSC_MAX 0x07 +#define INPUT_DEVICE_ID_LED_MAX 0x0f +#define INPUT_DEVICE_ID_SND_MAX 0x07 +#define INPUT_DEVICE_ID_FF_MAX 0x7f +#define INPUT_DEVICE_ID_SW_MAX 0x11 +#define INPUT_DEVICE_ID_PROP_MAX 0x1f + +#define INPUT_DEVICE_ID_MATCH_BUS 1 +#define INPUT_DEVICE_ID_MATCH_VENDOR 2 +#define INPUT_DEVICE_ID_MATCH_PRODUCT 4 +#define INPUT_DEVICE_ID_MATCH_VERSION 8 + +#define INPUT_DEVICE_ID_MATCH_EVBIT 0x0010 +#define INPUT_DEVICE_ID_MATCH_KEYBIT 0x0020 +#define INPUT_DEVICE_ID_MATCH_RELBIT 0x0040 +#define INPUT_DEVICE_ID_MATCH_ABSBIT 0x0080 +#define INPUT_DEVICE_ID_MATCH_MSCIT 0x0100 +#define INPUT_DEVICE_ID_MATCH_LEDBIT 0x0200 +#define INPUT_DEVICE_ID_MATCH_SNDBIT 0x0400 +#define INPUT_DEVICE_ID_MATCH_FFBIT 0x0800 +#define INPUT_DEVICE_ID_MATCH_SWBIT 0x1000 +#define INPUT_DEVICE_ID_MATCH_PROPBIT 0x2000 + +struct input_device_id { + + kernel_ulong_t flags; + + __u16 bustype; + __u16 vendor; + __u16 product; + __u16 version; + + kernel_ulong_t evbit[INPUT_DEVICE_ID_EV_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t keybit[INPUT_DEVICE_ID_KEY_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t relbit[INPUT_DEVICE_ID_REL_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t absbit[INPUT_DEVICE_ID_ABS_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t mscbit[INPUT_DEVICE_ID_MSC_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t ledbit[INPUT_DEVICE_ID_LED_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t sndbit[INPUT_DEVICE_ID_SND_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t ffbit[INPUT_DEVICE_ID_FF_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t swbit[INPUT_DEVICE_ID_SW_MAX / BITS_PER_LONG + 1]; + kernel_ulong_t propbit[INPUT_DEVICE_ID_PROP_MAX / BITS_PER_LONG + 1]; + + kernel_ulong_t driver_info; +}; + +#endif /* ifndef LINUX_DEVICE_ID_INPUT_H */ diff --git a/include/linux/device-id/ipack.h b/include/linux/device-id/ipack.h new file mode 100644 index 000000000000..7f9b425e1e30 --- /dev/null +++ b/include/linux/device-id/ipack.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_IPACK_H +#define LINUX_DEVICE_ID_IPACK_H + +#ifdef __KERNEL__ +#include +#endif + +#define IPACK_ANY_FORMAT 0xff +#define IPACK_ANY_ID (~0) +struct ipack_device_id { + __u8 format; /* Format version or IPACK_ANY_ID */ + __u32 vendor; /* Vendor ID or IPACK_ANY_ID */ + __u32 device; /* Device ID or IPACK_ANY_ID */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_IPACK_H */ diff --git a/include/linux/device-id/isapnp.h b/include/linux/device-id/isapnp.h new file mode 100644 index 000000000000..ba659c32650a --- /dev/null +++ b/include/linux/device-id/isapnp.h @@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_ISAPNP_H +#define LINUX_DEVICE_ID_ISAPNP_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +#define ISAPNP_ANY_ID 0xffff +struct isapnp_device_id { + unsigned short card_vendor, card_device; + unsigned short vendor, function; + kernel_ulong_t driver_data; /* data private to the driver */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_ISAPNP_H */ diff --git a/include/linux/device-id/ishtp.h b/include/linux/device-id/ishtp.h new file mode 100644 index 000000000000..c66f144b4cb6 --- /dev/null +++ b/include/linux/device-id/ishtp.h @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_ISHTP_H +#define LINUX_DEVICE_ID_ISHTP_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* ISHTP (Integrated Sensor Hub Transport Protocol) */ + +#define ISHTP_MODULE_PREFIX "ishtp:" + +/** + * struct ishtp_device_id - ISHTP device identifier + * @guid: GUID of the device. + * @driver_data: pointer to driver specific data + */ +struct ishtp_device_id { + guid_t guid; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_ISHTP_H */ diff --git a/include/linux/device-id/mcb.h b/include/linux/device-id/mcb.h new file mode 100644 index 000000000000..a5daec32c21c --- /dev/null +++ b/include/linux/device-id/mcb.h @@ -0,0 +1,15 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_MCB_H +#define LINUX_DEVICE_ID_MCB_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +struct mcb_device_id { + __u16 device; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_MCB_H */ diff --git a/include/linux/device-id/mdio.h b/include/linux/device-id/mdio.h new file mode 100644 index 000000000000..e6cda2d91ddb --- /dev/null +++ b/include/linux/device-id/mdio.h @@ -0,0 +1,35 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_MDIO_H +#define LINUX_DEVICE_ID_MDIO_H + +#ifdef __KERNEL__ +#include +#endif + +#define MDIO_MODULE_PREFIX "mdio:" + +#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u" +#define MDIO_ID_ARGS(_id) \ + ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ + ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \ + ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \ + ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \ + ((_id)>>15) & 1, ((_id)>>14) & 1, ((_id)>>13) & 1, ((_id)>>12) & 1, \ + ((_id)>>11) & 1, ((_id)>>10) & 1, ((_id)>>9) & 1, ((_id)>>8) & 1, \ + ((_id)>>7) & 1, ((_id)>>6) & 1, ((_id)>>5) & 1, ((_id)>>4) & 1, \ + ((_id)>>3) & 1, ((_id)>>2) & 1, ((_id)>>1) & 1, (_id) & 1 + +/** + * struct mdio_device_id - identifies PHY devices on an MDIO/MII bus + * @phy_id: The result of + * (mdio_read(&MII_PHYSID1) << 16 | mdio_read(&MII_PHYSID2)) & @phy_id_mask + * for this PHY type + * @phy_id_mask: Defines the significant bits of @phy_id. A value of 0 + * is used to terminate an array of struct mdio_device_id. + */ +struct mdio_device_id { + __u32 phy_id; + __u32 phy_id_mask; +}; + +#endif /* ifndef LINUX_DEVICE_ID_MDIO_H */ diff --git a/include/linux/device-id/mei_cl.h b/include/linux/device-id/mei_cl.h new file mode 100644 index 000000000000..aeeb95da4b29 --- /dev/null +++ b/include/linux/device-id/mei_cl.h @@ -0,0 +1,31 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_MEI_CL_H +#define LINUX_DEVICE_ID_MEI_CL_H + +#ifdef __KERNEL__ +#include +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define MEI_CL_MODULE_PREFIX "mei:" +#define MEI_CL_NAME_SIZE 32 +#define MEI_CL_VERSION_ANY 0xff + +/** + * struct mei_cl_device_id - MEI client device identifier + * @name: helper name + * @uuid: client uuid + * @version: client protocol version + * @driver_info: information used by the driver. + * + * identifies mei client device by uuid and name + */ +struct mei_cl_device_id { + char name[MEI_CL_NAME_SIZE]; + uuid_le uuid; + __u8 version; + kernel_ulong_t driver_info; +}; + +#endif /* ifndef LINUX_DEVICE_ID_MEI_CL_H */ diff --git a/include/linux/device-id/mhi.h b/include/linux/device-id/mhi.h new file mode 100644 index 000000000000..30a27a71a57f --- /dev/null +++ b/include/linux/device-id/mhi.h @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_MHI_H +#define LINUX_DEVICE_ID_MHI_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +#define MHI_DEVICE_MODALIAS_FMT "mhi:%s" +#define MHI_NAME_SIZE 32 + +#define MHI_EP_DEVICE_MODALIAS_FMT "mhi_ep:%s" + +/** + * struct mhi_device_id - MHI device identification + * @chan: MHI channel name + * @driver_data: driver data; + */ +struct mhi_device_id { + const char chan[MHI_NAME_SIZE]; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_MHI_H */ diff --git a/include/linux/device-id/mips_cdmm.h b/include/linux/device-id/mips_cdmm.h new file mode 100644 index 000000000000..e1623884103a --- /dev/null +++ b/include/linux/device-id/mips_cdmm.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_MIPS_CDMM_H +#define LINUX_DEVICE_ID_MIPS_CDMM_H + +#ifdef __KERNEL__ +#include +#endif + +/** + * struct mips_cdmm_device_id - identifies devices in MIPS CDMM bus + * @type: Device type identifier. + */ +struct mips_cdmm_device_id { + __u8 type; +}; + +#endif /* ifndef LINUX_DEVICE_ID_MIPS_CDMM_H */ diff --git a/include/linux/device-id/of.h b/include/linux/device-id/of.h new file mode 100644 index 000000000000..28ea360f8f9a --- /dev/null +++ b/include/linux/device-id/of.h @@ -0,0 +1,15 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_OF_H +#define LINUX_DEVICE_ID_OF_H + +/* + * Struct used for matching a device + */ +struct of_device_id { + char name[32]; + char type[32]; + char compatible[128]; + const void *data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_OF_H */ diff --git a/include/linux/device-id/parisc.h b/include/linux/device-id/parisc.h new file mode 100644 index 000000000000..2974eb26a8be --- /dev/null +++ b/include/linux/device-id/parisc.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_PARISC_H +#define LINUX_DEVICE_ID_PARISC_H + +#ifdef __KERNEL__ +#include +#endif + +#define PA_HWTYPE_ANY_ID 0xff +#define PA_HVERSION_REV_ANY_ID 0xff +#define PA_HVERSION_ANY_ID 0xffff +#define PA_SVERSION_ANY_ID 0xffffffff + +struct parisc_device_id { + __u8 hw_type; /* 5 bits used */ + __u8 hversion_rev; /* 4 bits */ + __u16 hversion; /* 12 bits */ + __u32 sversion; /* 20 bits */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_PARISC_H */ diff --git a/include/linux/device-id/pci.h b/include/linux/device-id/pci.h new file mode 100644 index 000000000000..4a635d531cd6 --- /dev/null +++ b/include/linux/device-id/pci.h @@ -0,0 +1,54 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_PCI_H +#define LINUX_DEVICE_ID_PCI_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define PCI_ANY_ID (~0) + +enum { + PCI_ID_F_VFIO_DRIVER_OVERRIDE = 1, +}; + +/** + * struct pci_device_id - PCI device ID structure + * @vendor: Vendor ID to match (or PCI_ANY_ID) + * @device: Device ID to match (or PCI_ANY_ID) + * @subvendor: Subsystem vendor ID to match (or PCI_ANY_ID) + * @subdevice: Subsystem device ID to match (or PCI_ANY_ID) + * @class: Device class, subclass, and "interface" to match. + * See Appendix D of the PCI Local Bus Spec or + * include/linux/pci_ids.h for a full list of classes. + * Most drivers do not need to specify class/class_mask + * as vendor/device is normally sufficient. + * @class_mask: Limit which sub-fields of the class field are compared. + * See drivers/scsi/sym53c8xx_2/ for example of usage. + * @driver_data: Data private to the driver. + * Most drivers don't need to use driver_data field. + * Best practice is to use driver_data as an index + * into a static list of equivalent device types, + * instead of using it as a pointer. + * @override_only: Match only when dev->driver_override is this driver. + */ +struct pci_device_id { + __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/ + __u32 subvendor, subdevice; /* Subsystem ID's or PCI_ANY_ID */ + __u32 class, class_mask; /* (class,subclass,prog-if) triplet */ + kernel_ulong_t driver_data; /* Data private to the driver */ + __u32 override_only; +}; + +/* pci_epf */ + +#define PCI_EPF_NAME_SIZE 20 +#define PCI_EPF_MODULE_PREFIX "pci_epf:" + +struct pci_epf_device_id { + char name[PCI_EPF_NAME_SIZE]; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_PCI_H */ diff --git a/include/linux/device-id/pcmcia.h b/include/linux/device-id/pcmcia.h new file mode 100644 index 000000000000..c0d809be2338 --- /dev/null +++ b/include/linux/device-id/pcmcia.h @@ -0,0 +1,48 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_PCMCIA_H +#define LINUX_DEVICE_ID_PCMCIA_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* PCMCIA */ + +#define PCMCIA_DEV_ID_MATCH_MANF_ID 0x0001 +#define PCMCIA_DEV_ID_MATCH_CARD_ID 0x0002 +#define PCMCIA_DEV_ID_MATCH_FUNC_ID 0x0004 +#define PCMCIA_DEV_ID_MATCH_FUNCTION 0x0008 +#define PCMCIA_DEV_ID_MATCH_PROD_ID1 0x0010 +#define PCMCIA_DEV_ID_MATCH_PROD_ID2 0x0020 +#define PCMCIA_DEV_ID_MATCH_PROD_ID3 0x0040 +#define PCMCIA_DEV_ID_MATCH_PROD_ID4 0x0080 +#define PCMCIA_DEV_ID_MATCH_DEVICE_NO 0x0100 +#define PCMCIA_DEV_ID_MATCH_FAKE_CIS 0x0200 +#define PCMCIA_DEV_ID_MATCH_ANONYMOUS 0x0400 + +struct pcmcia_device_id { + __u16 match_flags; + + __u16 manf_id; + __u16 card_id; + + __u8 func_id; + + /* for real multi-function devices */ + __u8 function; + + /* for pseudo multi-function devices */ + __u8 device_no; + + __u32 prod_id_hash[4]; + + /* not matched against in kernelspace */ + const char * prod_id[4]; + + /* not matched against */ + kernel_ulong_t driver_info; + char * cisfile; +}; + +#endif /* ifndef LINUX_DEVICE_ID_PCMCIA_H */ diff --git a/include/linux/device-id/platform.h b/include/linux/device-id/platform.h new file mode 100644 index 000000000000..d6beeb4a2574 --- /dev/null +++ b/include/linux/device-id/platform.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_PLATFORM_H +#define LINUX_DEVICE_ID_PLATFORM_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +#define PLATFORM_NAME_SIZE 24 +#define PLATFORM_MODULE_PREFIX "platform:" + +struct platform_device_id { + char name[PLATFORM_NAME_SIZE]; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_PLATFORM_H */ diff --git a/include/linux/device-id/pnp.h b/include/linux/device-id/pnp.h new file mode 100644 index 000000000000..325f17216df8 --- /dev/null +++ b/include/linux/device-id/pnp.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_PNP_H +#define LINUX_DEVICE_ID_PNP_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define PNP_ID_LEN 8 +#define PNP_MAX_DEVICES 8 + +struct pnp_device_id { + __u8 id[PNP_ID_LEN]; + kernel_ulong_t driver_data; +}; + +struct pnp_card_device_id { + __u8 id[PNP_ID_LEN]; + kernel_ulong_t driver_data; + struct { + __u8 id[PNP_ID_LEN]; + } devs[PNP_MAX_DEVICES]; +}; + +#endif /* ifndef LINUX_DEVICE_ID_PNP_H */ diff --git a/include/linux/device-id/rio.h b/include/linux/device-id/rio.h new file mode 100644 index 000000000000..31addf69ad1f --- /dev/null +++ b/include/linux/device-id/rio.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_RIO_H +#define LINUX_DEVICE_ID_RIO_H + +#ifdef __KERNEL__ +#include +#endif + +/* RapidIO */ + +#define RIO_ANY_ID 0xffff + +/** + * struct rio_device_id - RIO device identifier + * @did: RapidIO device ID + * @vid: RapidIO vendor ID + * @asm_did: RapidIO assembly device ID + * @asm_vid: RapidIO assembly vendor ID + * + * Identifies a RapidIO device based on both the device/vendor IDs and + * the assembly device/vendor IDs. + */ +struct rio_device_id { + __u16 did, vid; + __u16 asm_did, asm_vid; +}; + +#endif /* ifndef LINUX_DEVICE_ID_RIO_H */ diff --git a/include/linux/device-id/rpmsg.h b/include/linux/device-id/rpmsg.h new file mode 100644 index 000000000000..dd53e7b7dc4f --- /dev/null +++ b/include/linux/device-id/rpmsg.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_RPMSG_H +#define LINUX_DEVICE_ID_RPMSG_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +/* rpmsg */ + +#define RPMSG_NAME_SIZE 32 +#define RPMSG_DEVICE_MODALIAS_FMT "rpmsg:%s" + +struct rpmsg_device_id { + char name[RPMSG_NAME_SIZE]; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_RPMSG_H */ diff --git a/include/linux/device-id/sdio.h b/include/linux/device-id/sdio.h new file mode 100644 index 000000000000..609d60a10cd3 --- /dev/null +++ b/include/linux/device-id/sdio.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_SDIO_H +#define LINUX_DEVICE_ID_SDIO_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* SDIO */ + +#define SDIO_ANY_ID (~0) + +struct sdio_device_id { + __u8 class; /* Standard interface or SDIO_ANY_ID */ + __u16 vendor; /* Vendor or SDIO_ANY_ID */ + __u16 device; /* Device ID or SDIO_ANY_ID */ + kernel_ulong_t driver_data; /* Data private to the driver */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_SDIO_H */ diff --git a/include/linux/device-id/sdw.h b/include/linux/device-id/sdw.h new file mode 100644 index 000000000000..dbed7fde1ace --- /dev/null +++ b/include/linux/device-id/sdw.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_SDW_H +#define LINUX_DEVICE_ID_SDW_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +struct sdw_device_id { + __u16 mfg_id; + __u16 part_id; + __u8 sdw_version; + __u8 class_id; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_SDW_H */ diff --git a/include/linux/device-id/serio.h b/include/linux/device-id/serio.h new file mode 100644 index 000000000000..b4c02adf220c --- /dev/null +++ b/include/linux/device-id/serio.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_SERIO_H +#define LINUX_DEVICE_ID_SERIO_H + +#ifdef __KERNEL__ +#include +#endif + +#define SERIO_ANY 0xff + +struct serio_device_id { + __u8 type; + __u8 extra; + __u8 id; + __u8 proto; +}; + +#endif /* ifndef LINUX_DEVICE_ID_SERIO_H */ diff --git a/include/linux/device-id/slim.h b/include/linux/device-id/slim.h new file mode 100644 index 000000000000..54f8abe09e18 --- /dev/null +++ b/include/linux/device-id/slim.h @@ -0,0 +1,23 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_SLIM_H +#define LINUX_DEVICE_ID_SLIM_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* SLIMbus */ + +#define SLIMBUS_NAME_SIZE 32 +#define SLIMBUS_MODULE_PREFIX "slim:" + +struct slim_device_id { + __u16 manf_id, prod_code; + __u16 dev_index, instance; + + /* Data private to the driver */ + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_SLIM_H */ diff --git a/include/linux/device-id/spi.h b/include/linux/device-id/spi.h new file mode 100644 index 000000000000..7a77d0d6672b --- /dev/null +++ b/include/linux/device-id/spi.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_SPI_H +#define LINUX_DEVICE_ID_SPI_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +/* spi */ + +#define SPI_NAME_SIZE 32 +#define SPI_MODULE_PREFIX "spi:" + +struct spi_device_id { + char name[SPI_NAME_SIZE]; + kernel_ulong_t driver_data; /* Data private to the driver */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_SPI_H */ diff --git a/include/linux/device-id/spmi.h b/include/linux/device-id/spmi.h new file mode 100644 index 000000000000..a821c42cfc9a --- /dev/null +++ b/include/linux/device-id/spmi.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_SPMI_H +#define LINUX_DEVICE_ID_SPMI_H + +#ifdef __KERNEL__ +typedef unsigned long kernel_ulong_t; +#endif + +#define SPMI_NAME_SIZE 32 +#define SPMI_MODULE_PREFIX "spmi:" + +struct spmi_device_id { + char name[SPMI_NAME_SIZE]; + kernel_ulong_t driver_data; /* Data private to the driver */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_SPMI_H */ diff --git a/include/linux/device-id/ssam.h b/include/linux/device-id/ssam.h new file mode 100644 index 000000000000..550cca115a55 --- /dev/null +++ b/include/linux/device-id/ssam.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_SSAM_H +#define LINUX_DEVICE_ID_SSAM_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* Surface System Aggregator Module */ + +#define SSAM_MATCH_TARGET 0x1 +#define SSAM_MATCH_INSTANCE 0x2 +#define SSAM_MATCH_FUNCTION 0x4 + +struct ssam_device_id { + __u8 match_flags; + + __u8 domain; + __u8 category; + __u8 target; + __u8 instance; + __u8 function; + + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_SSAM_H */ diff --git a/include/linux/device-id/ssb.h b/include/linux/device-id/ssb.h new file mode 100644 index 000000000000..678d40828299 --- /dev/null +++ b/include/linux/device-id/ssb.h @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_SSB_H +#define LINUX_DEVICE_ID_SSB_H + +#ifdef __KERNEL__ +#include +#endif + +#define SSB_ANY_VENDOR 0xFFFF +#define SSB_ANY_ID 0xFFFF +#define SSB_ANY_REV 0xFF + +/* SSB core, see drivers/ssb/ */ +struct ssb_device_id { + __u16 vendor; + __u16 coreid; + __u8 revision; + __u8 __pad; +} __attribute__((packed, aligned(2))); + +#define SSB_DEVICE(_vendor, _coreid, _revision) \ + { .vendor = _vendor, .coreid = _coreid, .revision = _revision } + +#endif /* ifndef LINUX_DEVICE_ID_SSB_H */ diff --git a/include/linux/device-id/tb.h b/include/linux/device-id/tb.h new file mode 100644 index 000000000000..4c62edff8bb7 --- /dev/null +++ b/include/linux/device-id/tb.h @@ -0,0 +1,37 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_TB_H +#define LINUX_DEVICE_ID_TB_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define TBSVC_MATCH_PROTOCOL_KEY 0x0001 +#define TBSVC_MATCH_PROTOCOL_ID 0x0002 +#define TBSVC_MATCH_PROTOCOL_VERSION 0x0004 +#define TBSVC_MATCH_PROTOCOL_REVISION 0x0008 + +/** + * struct tb_service_id - Thunderbolt service identifiers + * @match_flags: Flags used to match the structure + * @protocol_key: Protocol key the service supports + * @protocol_id: Protocol id the service supports + * @protocol_version: Version of the protocol + * @protocol_revision: Revision of the protocol software + * @driver_data: Driver specific data + * + * Thunderbolt XDomain services are exposed as devices where each device + * carries the protocol information the service supports. Thunderbolt + * XDomain service drivers match against that information. + */ +struct tb_service_id { + __u32 match_flags; + char protocol_key[8 + 1]; + __u32 protocol_id; + __u32 protocol_version; + __u32 protocol_revision; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_TB_H */ diff --git a/include/linux/device-id/tee_client.h b/include/linux/device-id/tee_client.h new file mode 100644 index 000000000000..ed81f4228185 --- /dev/null +++ b/include/linux/device-id/tee_client.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_TEE_CLIENT_H +#define LINUX_DEVICE_ID_TEE_CLIENT_H + +#ifdef __KERNEL__ +#include +#endif + +/** + * struct tee_client_device_id - tee based device identifier + * @uuid: For TEE based client devices we use the device uuid as + * the identifier. + */ +struct tee_client_device_id { + uuid_t uuid; +}; + +#endif /* ifndef LINUX_DEVICE_ID_TEE_CLIENT_H */ diff --git a/include/linux/device-id/typec.h b/include/linux/device-id/typec.h new file mode 100644 index 000000000000..dc234733408b --- /dev/null +++ b/include/linux/device-id/typec.h @@ -0,0 +1,26 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_TYPEC_H +#define LINUX_DEVICE_ID_TYPEC_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* USB Type-C Alternate Modes */ + +#define TYPEC_ANY_MODE 0x7 + +/** + * struct typec_device_id - USB Type-C alternate mode identifiers + * @svid: Standard or Vendor ID + * @mode: Mode index + * @driver_data: Driver specific data + */ +struct typec_device_id { + __u16 svid; + __u8 mode; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_TYPEC_H */ diff --git a/include/linux/device-id/ulpi.h b/include/linux/device-id/ulpi.h new file mode 100644 index 000000000000..b5105b4cfacc --- /dev/null +++ b/include/linux/device-id/ulpi.h @@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_ULPI_H +#define LINUX_DEVICE_ID_ULPI_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +struct ulpi_device_id { + __u16 vendor; + __u16 product; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_ULPI_H */ diff --git a/include/linux/device-id/usb.h b/include/linux/device-id/usb.h new file mode 100644 index 000000000000..a7ce5f6e1106 --- /dev/null +++ b/include/linux/device-id/usb.h @@ -0,0 +1,111 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_USB_H +#define LINUX_DEVICE_ID_USB_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* + * Device table entry for "new style" table-driven USB drivers. + * User mode code can read these tables to choose which modules to load. + * Declare the table as a MODULE_DEVICE_TABLE. + * + * A probe() parameter will point to a matching entry from this table. + * Use the driver_info field for each match to hold information tied + * to that match: device quirks, etc. + * + * Terminate the driver's table with an all-zeroes entry. + * Use the flag values to control which fields are compared. + */ + +/** + * struct usb_device_id - identifies USB devices for probing and hotplugging + * @match_flags: Bit mask controlling which of the other fields are used to + * match against new devices. Any field except for driver_info may be + * used, although some only make sense in conjunction with other fields. + * This is usually set by a USB_DEVICE_*() macro, which sets all + * other fields in this structure except for driver_info. + * @idVendor: USB vendor ID for a device; numbers are assigned + * by the USB forum to its members. + * @idProduct: Vendor-assigned product ID. + * @bcdDevice_lo: Low end of range of vendor-assigned product version numbers. + * This is also used to identify individual product versions, for + * a range consisting of a single device. + * @bcdDevice_hi: High end of version number range. The range of product + * versions is inclusive. + * @bDeviceClass: Class of device; numbers are assigned + * by the USB forum. Products may choose to implement classes, + * or be vendor-specific. Device classes specify behavior of all + * the interfaces on a device. + * @bDeviceSubClass: Subclass of device; associated with bDeviceClass. + * @bDeviceProtocol: Protocol of device; associated with bDeviceClass. + * @bInterfaceClass: Class of interface; numbers are assigned + * by the USB forum. Products may choose to implement classes, + * or be vendor-specific. Interface classes specify behavior only + * of a given interface; other interfaces may support other classes. + * @bInterfaceSubClass: Subclass of interface; associated with bInterfaceClass. + * @bInterfaceProtocol: Protocol of interface; associated with bInterfaceClass. + * @bInterfaceNumber: Number of interface; composite devices may use + * fixed interface numbers to differentiate between vendor-specific + * interfaces. + * @driver_info: Holds information used by the driver. Usually it holds + * a pointer to a descriptor understood by the driver, or perhaps + * device flags. + * + * In most cases, drivers will create a table of device IDs by using + * USB_DEVICE(), or similar macros designed for that purpose. + * They will then export it to userspace using MODULE_DEVICE_TABLE(), + * and provide it to the USB core through their usb_driver structure. + * + * See the usb_match_id() function for information about how matches are + * performed. Briefly, you will normally use one of several macros to help + * construct these entries. Each entry you provide will either identify + * one or more specific products, or will identify a class of products + * which have agreed to behave the same. You should put the more specific + * matches towards the beginning of your table, so that driver_info can + * record quirks of specific products. + */ +struct usb_device_id { + /* which fields to match against? */ + __u16 match_flags; + + /* Used for product specific matches; range is inclusive */ + __u16 idVendor; + __u16 idProduct; + __u16 bcdDevice_lo; + __u16 bcdDevice_hi; + + /* Used for device class matches */ + __u8 bDeviceClass; + __u8 bDeviceSubClass; + __u8 bDeviceProtocol; + + /* Used for interface class matches */ + __u8 bInterfaceClass; + __u8 bInterfaceSubClass; + __u8 bInterfaceProtocol; + + /* Used for vendor-specific interface matches */ + __u8 bInterfaceNumber; + + /* not matched against */ + kernel_ulong_t driver_info + __attribute__((aligned(sizeof(kernel_ulong_t)))); +}; + +/* Some useful macros to use to create struct usb_device_id */ +#define USB_DEVICE_ID_MATCH_VENDOR 0x0001 +#define USB_DEVICE_ID_MATCH_PRODUCT 0x0002 +#define USB_DEVICE_ID_MATCH_DEV_LO 0x0004 +#define USB_DEVICE_ID_MATCH_DEV_HI 0x0008 +#define USB_DEVICE_ID_MATCH_DEV_CLASS 0x0010 +#define USB_DEVICE_ID_MATCH_DEV_SUBCLASS 0x0020 +#define USB_DEVICE_ID_MATCH_DEV_PROTOCOL 0x0040 +#define USB_DEVICE_ID_MATCH_INT_CLASS 0x0080 +#define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100 +#define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200 +#define USB_DEVICE_ID_MATCH_INT_NUMBER 0x0400 + +#endif /* ifndef LINUX_DEVICE_ID_USB_H */ diff --git a/include/linux/device-id/vchiq.h b/include/linux/device-id/vchiq.h new file mode 100644 index 000000000000..16b1b874c02d --- /dev/null +++ b/include/linux/device-id/vchiq.h @@ -0,0 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_VCHIQ_H +#define LINUX_DEVICE_ID_VCHIQ_H + +struct vchiq_device_id { + char name[32]; +}; + +#endif /* ifndef LINUX_DEVICE_ID_VCHIQ_H */ diff --git a/include/linux/device-id/vio.h b/include/linux/device-id/vio.h new file mode 100644 index 000000000000..8ed7ea9cec07 --- /dev/null +++ b/include/linux/device-id/vio.h @@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_VIO_H +#define LINUX_DEVICE_ID_VIO_H + +/* VIO */ +struct vio_device_id { + char type[32]; + char compat[32]; +}; + +#endif /* ifndef LINUX_DEVICE_ID_VIO_H */ diff --git a/include/linux/device-id/virtio.h b/include/linux/device-id/virtio.h new file mode 100644 index 000000000000..9648a42d4f26 --- /dev/null +++ b/include/linux/device-id/virtio.h @@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_VIRTIO_H +#define LINUX_DEVICE_ID_VIRTIO_H + +#ifdef __KERNEL__ +#include +#endif + +#define VIRTIO_DEV_ANY_ID 0xffffffff + +struct virtio_device_id { + __u32 device; + __u32 vendor; +}; + +#endif /* ifndef LINUX_DEVICE_ID_VIRTIO_H */ diff --git a/include/linux/device-id/wmi.h b/include/linux/device-id/wmi.h new file mode 100644 index 000000000000..9f55c83c5203 --- /dev/null +++ b/include/linux/device-id/wmi.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_WMI_H +#define LINUX_DEVICE_ID_WMI_H + +/* WMI */ + +#define WMI_MODULE_PREFIX "wmi:" + +/** + * struct wmi_device_id - WMI device identifier + * @guid_string: 36 char string of the form fa50ff2b-f2e8-45de-83fa-65417f2f49ba + * @context: pointer to driver specific data + */ +struct wmi_device_id { + const char guid_string[UUID_STRING_LEN+1]; + const void *context; +}; + +#endif /* ifndef LINUX_DEVICE_ID_WMI_H */ diff --git a/include/linux/device-id/x86_cpu.h b/include/linux/device-id/x86_cpu.h new file mode 100644 index 000000000000..f44e5253ccca --- /dev/null +++ b/include/linux/device-id/x86_cpu.h @@ -0,0 +1,44 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_X86_CPU_H +#define LINUX_DEVICE_ID_X86_CPU_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +/* Wild cards for x86_cpu_id::vendor, family, model and feature */ +#define X86_VENDOR_ANY 0xffff +#define X86_FAMILY_ANY 0 +#define X86_MODEL_ANY 0 +#define X86_STEPPING_ANY 0 +#define X86_STEP_MIN 0 +#define X86_STEP_MAX 0xf +#define X86_PLATFORM_ANY 0x0 +#define X86_FEATURE_ANY 0 /* Same as FPU, you can't test for that */ +#define X86_CPU_TYPE_ANY 0 + +/* + * Match x86 CPUs for CPU specific drivers. + * See documentation of "x86_match_cpu" for details. + */ + +/* + * MODULE_DEVICE_TABLE expects this struct to be called x86cpu_device_id. + * Although gcc seems to ignore this error, clang fails without this define. + */ +#define x86cpu_device_id x86_cpu_id +struct x86_cpu_id { + __u16 vendor; + __u16 family; + __u16 model; + __u16 steppings; + __u16 feature; /* bit index */ + /* Solely for kernel-internal use: DO NOT EXPORT to userspace! */ + __u16 flags; + __u8 platform_mask; + __u8 type; + kernel_ulong_t driver_data; +}; + +#endif /* ifndef LINUX_DEVICE_ID_X86_CPU_H */ diff --git a/include/linux/device-id/zorro.h b/include/linux/device-id/zorro.h new file mode 100644 index 000000000000..5fdac8168983 --- /dev/null +++ b/include/linux/device-id/zorro.h @@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef LINUX_DEVICE_ID_ZORRO_H +#define LINUX_DEVICE_ID_ZORRO_H + +#ifdef __KERNEL__ +#include +typedef unsigned long kernel_ulong_t; +#endif + +#define ZORRO_WILDCARD (0xffffffff) /* not official */ + +#define ZORRO_DEVICE_MODALIAS_FMT "zorro:i%08X" + +struct zorro_device_id { + __u32 id; /* Device ID or ZORRO_WILDCARD */ + kernel_ulong_t driver_data; /* Data private to the driver */ +}; + +#endif /* ifndef LINUX_DEVICE_ID_ZORRO_H */ diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h index 3b0c9a251a2e..a397213bedac 100644 --- a/include/linux/mod_devicetable.h +++ b/include/linux/mod_devicetable.h @@ -9,706 +9,65 @@ #define LINUX_MOD_DEVICETABLE_H #ifdef __KERNEL__ -#include #include -#include -typedef unsigned long kernel_ulong_t; #endif -#define PCI_ANY_ID (~0) - -enum { - PCI_ID_F_VFIO_DRIVER_OVERRIDE = 1, -}; - -/** - * struct pci_device_id - PCI device ID structure - * @vendor: Vendor ID to match (or PCI_ANY_ID) - * @device: Device ID to match (or PCI_ANY_ID) - * @subvendor: Subsystem vendor ID to match (or PCI_ANY_ID) - * @subdevice: Subsystem device ID to match (or PCI_ANY_ID) - * @class: Device class, subclass, and "interface" to match. - * See Appendix D of the PCI Local Bus Spec or - * include/linux/pci_ids.h for a full list of classes. - * Most drivers do not need to specify class/class_mask - * as vendor/device is normally sufficient. - * @class_mask: Limit which sub-fields of the class field are compared. - * See drivers/scsi/sym53c8xx_2/ for example of usage. - * @driver_data: Data private to the driver. - * Most drivers don't need to use driver_data field. - * Best practice is to use driver_data as an index - * into a static list of equivalent device types, - * instead of using it as a pointer. - * @override_only: Match only when dev->driver_override is this driver. - */ -struct pci_device_id { - __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/ - __u32 subvendor, subdevice; /* Subsystem ID's or PCI_ANY_ID */ - __u32 class, class_mask; /* (class,subclass,prog-if) triplet */ - kernel_ulong_t driver_data; /* Data private to the driver */ - __u32 override_only; -}; - - -#define IEEE1394_MATCH_VENDOR_ID 0x0001 -#define IEEE1394_MATCH_MODEL_ID 0x0002 -#define IEEE1394_MATCH_SPECIFIER_ID 0x0004 -#define IEEE1394_MATCH_VERSION 0x0008 - -struct ieee1394_device_id { - __u32 match_flags; - __u32 vendor_id; - __u32 model_id; - __u32 specifier_id; - __u32 version; - union { - kernel_ulong_t driver_data; - const void *driver_data_ptr; - }; -}; - - -/* - * Device table entry for "new style" table-driven USB drivers. - * User mode code can read these tables to choose which modules to load. - * Declare the table as a MODULE_DEVICE_TABLE. - * - * A probe() parameter will point to a matching entry from this table. - * Use the driver_info field for each match to hold information tied - * to that match: device quirks, etc. - * - * Terminate the driver's table with an all-zeroes entry. - * Use the flag values to control which fields are compared. - */ - -/** - * struct usb_device_id - identifies USB devices for probing and hotplugging - * @match_flags: Bit mask controlling which of the other fields are used to - * match against new devices. Any field except for driver_info may be - * used, although some only make sense in conjunction with other fields. - * This is usually set by a USB_DEVICE_*() macro, which sets all - * other fields in this structure except for driver_info. - * @idVendor: USB vendor ID for a device; numbers are assigned - * by the USB forum to its members. - * @idProduct: Vendor-assigned product ID. - * @bcdDevice_lo: Low end of range of vendor-assigned product version numbers. - * This is also used to identify individual product versions, for - * a range consisting of a single device. - * @bcdDevice_hi: High end of version number range. The range of product - * versions is inclusive. - * @bDeviceClass: Class of device; numbers are assigned - * by the USB forum. Products may choose to implement classes, - * or be vendor-specific. Device classes specify behavior of all - * the interfaces on a device. - * @bDeviceSubClass: Subclass of device; associated with bDeviceClass. - * @bDeviceProtocol: Protocol of device; associated with bDeviceClass. - * @bInterfaceClass: Class of interface; numbers are assigned - * by the USB forum. Products may choose to implement classes, - * or be vendor-specific. Interface classes specify behavior only - * of a given interface; other interfaces may support other classes. - * @bInterfaceSubClass: Subclass of interface; associated with bInterfaceClass. - * @bInterfaceProtocol: Protocol of interface; associated with bInterfaceClass. - * @bInterfaceNumber: Number of interface; composite devices may use - * fixed interface numbers to differentiate between vendor-specific - * interfaces. - * @driver_info: Holds information used by the driver. Usually it holds - * a pointer to a descriptor understood by the driver, or perhaps - * device flags. - * - * In most cases, drivers will create a table of device IDs by using - * USB_DEVICE(), or similar macros designed for that purpose. - * They will then export it to userspace using MODULE_DEVICE_TABLE(), - * and provide it to the USB core through their usb_driver structure. - * - * See the usb_match_id() function for information about how matches are - * performed. Briefly, you will normally use one of several macros to help - * construct these entries. Each entry you provide will either identify - * one or more specific products, or will identify a class of products - * which have agreed to behave the same. You should put the more specific - * matches towards the beginning of your table, so that driver_info can - * record quirks of specific products. - */ -struct usb_device_id { - /* which fields to match against? */ - __u16 match_flags; - - /* Used for product specific matches; range is inclusive */ - __u16 idVendor; - __u16 idProduct; - __u16 bcdDevice_lo; - __u16 bcdDevice_hi; - - /* Used for device class matches */ - __u8 bDeviceClass; - __u8 bDeviceSubClass; - __u8 bDeviceProtocol; - - /* Used for interface class matches */ - __u8 bInterfaceClass; - __u8 bInterfaceSubClass; - __u8 bInterfaceProtocol; - - /* Used for vendor-specific interface matches */ - __u8 bInterfaceNumber; - - /* not matched against */ - kernel_ulong_t driver_info - __attribute__((aligned(sizeof(kernel_ulong_t)))); -}; - -/* Some useful macros to use to create struct usb_device_id */ -#define USB_DEVICE_ID_MATCH_VENDOR 0x0001 -#define USB_DEVICE_ID_MATCH_PRODUCT 0x0002 -#define USB_DEVICE_ID_MATCH_DEV_LO 0x0004 -#define USB_DEVICE_ID_MATCH_DEV_HI 0x0008 -#define USB_DEVICE_ID_MATCH_DEV_CLASS 0x0010 -#define USB_DEVICE_ID_MATCH_DEV_SUBCLASS 0x0020 -#define USB_DEVICE_ID_MATCH_DEV_PROTOCOL 0x0040 -#define USB_DEVICE_ID_MATCH_INT_CLASS 0x0080 -#define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100 -#define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200 -#define USB_DEVICE_ID_MATCH_INT_NUMBER 0x0400 - -#define HID_ANY_ID (~0) -#define HID_BUS_ANY 0xffff -#define HID_GROUP_ANY 0x0000 - -struct hid_device_id { - __u16 bus; - __u16 group; - __u32 vendor; - __u32 product; - kernel_ulong_t driver_data; -}; - -/* s390 CCW devices */ -struct ccw_device_id { - __u16 match_flags; /* which fields to match against */ - - __u16 cu_type; /* control unit type */ - __u16 dev_type; /* device type */ - __u8 cu_model; /* control unit model */ - __u8 dev_model; /* device model */ - - kernel_ulong_t driver_info; -}; - -#define CCW_DEVICE_ID_MATCH_CU_TYPE 0x01 -#define CCW_DEVICE_ID_MATCH_CU_MODEL 0x02 -#define CCW_DEVICE_ID_MATCH_DEVICE_TYPE 0x04 -#define CCW_DEVICE_ID_MATCH_DEVICE_MODEL 0x08 - -/* s390 AP bus devices */ -struct ap_device_id { - __u16 match_flags; /* which fields to match against */ - __u8 dev_type; /* device type */ - kernel_ulong_t driver_info; -}; - -#define AP_DEVICE_ID_MATCH_CARD_TYPE 0x01 -#define AP_DEVICE_ID_MATCH_QUEUE_TYPE 0x02 - -/* s390 css bus devices (subchannels) */ -struct css_device_id { - __u8 match_flags; - __u8 type; /* subchannel type */ - kernel_ulong_t driver_data; -}; - -#define ACPI_ID_LEN 16 - -struct acpi_device_id { - __u8 id[ACPI_ID_LEN]; - kernel_ulong_t driver_data; - __u32 cls; - __u32 cls_msk; -}; - -/** - * ACPI_DEVICE_CLASS - macro used to describe an ACPI device with - * the PCI-defined class-code information - * - * @_cls : the class, subclass, prog-if triple for this device - * @_msk : the class mask for this device - * - * This macro is used to create a struct acpi_device_id that matches a - * specific PCI class. The .id and .driver_data fields will be left - * initialized with the default value. - */ -#define ACPI_DEVICE_CLASS(_cls, _msk) .cls = (_cls), .cls_msk = (_msk), - -#define PNP_ID_LEN 8 -#define PNP_MAX_DEVICES 8 - -struct pnp_device_id { - __u8 id[PNP_ID_LEN]; - kernel_ulong_t driver_data; -}; - -struct pnp_card_device_id { - __u8 id[PNP_ID_LEN]; - kernel_ulong_t driver_data; - struct { - __u8 id[PNP_ID_LEN]; - } devs[PNP_MAX_DEVICES]; -}; - - -#define SERIO_ANY 0xff - -struct serio_device_id { - __u8 type; - __u8 extra; - __u8 id; - __u8 proto; -}; - -struct hda_device_id { - __u32 vendor_id; - __u32 rev_id; - __u8 api_version; - const char *name; - unsigned long driver_data; -}; - -struct sdw_device_id { - __u16 mfg_id; - __u16 part_id; - __u8 sdw_version; - __u8 class_id; - kernel_ulong_t driver_data; -}; - -/* - * Struct used for matching a device - */ -struct of_device_id { - char name[32]; - char type[32]; - char compatible[128]; - const void *data; -}; - -/* VIO */ -struct vio_device_id { - char type[32]; - char compat[32]; -}; - -/* PCMCIA */ - -struct pcmcia_device_id { - __u16 match_flags; - - __u16 manf_id; - __u16 card_id; - - __u8 func_id; - - /* for real multi-function devices */ - __u8 function; - - /* for pseudo multi-function devices */ - __u8 device_no; - - __u32 prod_id_hash[4]; - - /* not matched against in kernelspace */ - const char * prod_id[4]; - - /* not matched against */ - kernel_ulong_t driver_info; - char * cisfile; -}; - -#define PCMCIA_DEV_ID_MATCH_MANF_ID 0x0001 -#define PCMCIA_DEV_ID_MATCH_CARD_ID 0x0002 -#define PCMCIA_DEV_ID_MATCH_FUNC_ID 0x0004 -#define PCMCIA_DEV_ID_MATCH_FUNCTION 0x0008 -#define PCMCIA_DEV_ID_MATCH_PROD_ID1 0x0010 -#define PCMCIA_DEV_ID_MATCH_PROD_ID2 0x0020 -#define PCMCIA_DEV_ID_MATCH_PROD_ID3 0x0040 -#define PCMCIA_DEV_ID_MATCH_PROD_ID4 0x0080 -#define PCMCIA_DEV_ID_MATCH_DEVICE_NO 0x0100 -#define PCMCIA_DEV_ID_MATCH_FAKE_CIS 0x0200 -#define PCMCIA_DEV_ID_MATCH_ANONYMOUS 0x0400 - -/* Input */ -#define INPUT_DEVICE_ID_EV_MAX 0x1f -#define INPUT_DEVICE_ID_KEY_MIN_INTERESTING 0x71 -#define INPUT_DEVICE_ID_KEY_MAX 0x2ff -#define INPUT_DEVICE_ID_REL_MAX 0x0f -#define INPUT_DEVICE_ID_ABS_MAX 0x3f -#define INPUT_DEVICE_ID_MSC_MAX 0x07 -#define INPUT_DEVICE_ID_LED_MAX 0x0f -#define INPUT_DEVICE_ID_SND_MAX 0x07 -#define INPUT_DEVICE_ID_FF_MAX 0x7f -#define INPUT_DEVICE_ID_SW_MAX 0x11 -#define INPUT_DEVICE_ID_PROP_MAX 0x1f - -#define INPUT_DEVICE_ID_MATCH_BUS 1 -#define INPUT_DEVICE_ID_MATCH_VENDOR 2 -#define INPUT_DEVICE_ID_MATCH_PRODUCT 4 -#define INPUT_DEVICE_ID_MATCH_VERSION 8 - -#define INPUT_DEVICE_ID_MATCH_EVBIT 0x0010 -#define INPUT_DEVICE_ID_MATCH_KEYBIT 0x0020 -#define INPUT_DEVICE_ID_MATCH_RELBIT 0x0040 -#define INPUT_DEVICE_ID_MATCH_ABSBIT 0x0080 -#define INPUT_DEVICE_ID_MATCH_MSCIT 0x0100 -#define INPUT_DEVICE_ID_MATCH_LEDBIT 0x0200 -#define INPUT_DEVICE_ID_MATCH_SNDBIT 0x0400 -#define INPUT_DEVICE_ID_MATCH_FFBIT 0x0800 -#define INPUT_DEVICE_ID_MATCH_SWBIT 0x1000 -#define INPUT_DEVICE_ID_MATCH_PROPBIT 0x2000 - -struct input_device_id { - - kernel_ulong_t flags; - - __u16 bustype; - __u16 vendor; - __u16 product; - __u16 version; - - kernel_ulong_t evbit[INPUT_DEVICE_ID_EV_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t keybit[INPUT_DEVICE_ID_KEY_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t relbit[INPUT_DEVICE_ID_REL_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t absbit[INPUT_DEVICE_ID_ABS_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t mscbit[INPUT_DEVICE_ID_MSC_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t ledbit[INPUT_DEVICE_ID_LED_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t sndbit[INPUT_DEVICE_ID_SND_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t ffbit[INPUT_DEVICE_ID_FF_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t swbit[INPUT_DEVICE_ID_SW_MAX / BITS_PER_LONG + 1]; - kernel_ulong_t propbit[INPUT_DEVICE_ID_PROP_MAX / BITS_PER_LONG + 1]; - - kernel_ulong_t driver_info; -}; - -/* EISA */ - -#define EISA_SIG_LEN 8 - -/* The EISA signature, in ASCII form, null terminated */ -struct eisa_device_id { - char sig[EISA_SIG_LEN]; - kernel_ulong_t driver_data; -}; - -#define EISA_DEVICE_MODALIAS_FMT "eisa:s%s" - -struct parisc_device_id { - __u8 hw_type; /* 5 bits used */ - __u8 hversion_rev; /* 4 bits */ - __u16 hversion; /* 12 bits */ - __u32 sversion; /* 20 bits */ -}; - -#define PA_HWTYPE_ANY_ID 0xff -#define PA_HVERSION_REV_ANY_ID 0xff -#define PA_HVERSION_ANY_ID 0xffff -#define PA_SVERSION_ANY_ID 0xffffffff - -/* SDIO */ - -#define SDIO_ANY_ID (~0) - -struct sdio_device_id { - __u8 class; /* Standard interface or SDIO_ANY_ID */ - __u16 vendor; /* Vendor or SDIO_ANY_ID */ - __u16 device; /* Device ID or SDIO_ANY_ID */ - kernel_ulong_t driver_data; /* Data private to the driver */ -}; - -/* SSB core, see drivers/ssb/ */ -struct ssb_device_id { - __u16 vendor; - __u16 coreid; - __u8 revision; - __u8 __pad; -} __attribute__((packed, aligned(2))); -#define SSB_DEVICE(_vendor, _coreid, _revision) \ - { .vendor = _vendor, .coreid = _coreid, .revision = _revision, } - -#define SSB_ANY_VENDOR 0xFFFF -#define SSB_ANY_ID 0xFFFF -#define SSB_ANY_REV 0xFF - -/* Broadcom's specific AMBA core, see drivers/bcma/ */ -struct bcma_device_id { - __u16 manuf; - __u16 id; - __u8 rev; - __u8 class; -} __attribute__((packed,aligned(2))); -#define BCMA_CORE(_manuf, _id, _rev, _class) \ - { .manuf = _manuf, .id = _id, .rev = _rev, .class = _class, } - -#define BCMA_ANY_MANUF 0xFFFF -#define BCMA_ANY_ID 0xFFFF -#define BCMA_ANY_REV 0xFF -#define BCMA_ANY_CLASS 0xFF - -struct virtio_device_id { - __u32 device; - __u32 vendor; -}; -#define VIRTIO_DEV_ANY_ID 0xffffffff - -/* - * For Hyper-V devices we use the device guid as the id. - */ -struct hv_vmbus_device_id { - guid_t guid; - kernel_ulong_t driver_data; /* Data private to the driver */ -}; - -/* rpmsg */ - -#define RPMSG_NAME_SIZE 32 -#define RPMSG_DEVICE_MODALIAS_FMT "rpmsg:%s" - -struct rpmsg_device_id { - char name[RPMSG_NAME_SIZE]; - kernel_ulong_t driver_data; -}; - -/* i2c */ - -#define I2C_NAME_SIZE 20 -#define I2C_MODULE_PREFIX "i2c:" - -struct i2c_device_id { - char name[I2C_NAME_SIZE]; - kernel_ulong_t driver_data; /* Data private to the driver */ -}; - -/* pci_epf */ - -#define PCI_EPF_NAME_SIZE 20 -#define PCI_EPF_MODULE_PREFIX "pci_epf:" - -struct pci_epf_device_id { - char name[PCI_EPF_NAME_SIZE]; - kernel_ulong_t driver_data; -}; - -/* i3c */ - -#define I3C_MATCH_DCR 0x1 -#define I3C_MATCH_MANUF 0x2 -#define I3C_MATCH_PART 0x4 -#define I3C_MATCH_EXTRA_INFO 0x8 - -struct i3c_device_id { - __u8 match_flags; - __u8 dcr; - __u16 manuf_id; - __u16 part_id; - __u16 extra_info; - - const void *data; -}; - -/* spi */ - -#define SPI_NAME_SIZE 32 -#define SPI_MODULE_PREFIX "spi:" - -struct spi_device_id { - char name[SPI_NAME_SIZE]; - kernel_ulong_t driver_data; /* Data private to the driver */ -}; - -/* SLIMbus */ - -#define SLIMBUS_NAME_SIZE 32 -#define SLIMBUS_MODULE_PREFIX "slim:" - -struct slim_device_id { - __u16 manf_id, prod_code; - __u16 dev_index, instance; - - /* Data private to the driver */ - kernel_ulong_t driver_data; -}; - -#define APR_NAME_SIZE 32 -#define APR_MODULE_PREFIX "apr:" - -struct apr_device_id { - char name[APR_NAME_SIZE]; - __u32 domain_id; - __u32 svc_id; - __u32 svc_version; - kernel_ulong_t driver_data; /* Data private to the driver */ -}; - -#define SPMI_NAME_SIZE 32 -#define SPMI_MODULE_PREFIX "spmi:" - -struct spmi_device_id { - char name[SPMI_NAME_SIZE]; - kernel_ulong_t driver_data; /* Data private to the driver */ -}; - -/* dmi */ -enum dmi_field { - DMI_NONE, - DMI_BIOS_VENDOR, - DMI_BIOS_VERSION, - DMI_BIOS_DATE, - DMI_BIOS_RELEASE, - DMI_EC_FIRMWARE_RELEASE, - DMI_SYS_VENDOR, - DMI_PRODUCT_NAME, - DMI_PRODUCT_VERSION, - DMI_PRODUCT_SERIAL, - DMI_PRODUCT_UUID, - DMI_PRODUCT_SKU, - DMI_PRODUCT_FAMILY, - DMI_BOARD_VENDOR, - DMI_BOARD_NAME, - DMI_BOARD_VERSION, - DMI_BOARD_SERIAL, - DMI_BOARD_ASSET_TAG, - DMI_CHASSIS_VENDOR, - DMI_CHASSIS_TYPE, - DMI_CHASSIS_VERSION, - DMI_CHASSIS_SERIAL, - DMI_CHASSIS_ASSET_TAG, - DMI_STRING_MAX, - DMI_OEM_STRING, /* special case - will not be in dmi_ident */ -}; - -struct dmi_strmatch { - unsigned char slot:7; - unsigned char exact_match:1; - char substr[79]; -}; - -struct dmi_system_id { - int (*callback)(const struct dmi_system_id *); - const char *ident; - struct dmi_strmatch matches[4]; - void *driver_data; -}; -/* - * struct dmi_device_id appears during expansion of - * "MODULE_DEVICE_TABLE(dmi, x)". Compiler doesn't look inside it - * but this is enough for gcc 3.4.6 to error out: - * error: storage size of '__mod_dmi_device_table' isn't known - */ -#define dmi_device_id dmi_system_id - -#define DMI_MATCH(a, b) { .slot = a, .substr = b } -#define DMI_EXACT_MATCH(a, b) { .slot = a, .substr = b, .exact_match = 1 } - -#define PLATFORM_NAME_SIZE 24 -#define PLATFORM_MODULE_PREFIX "platform:" - -struct platform_device_id { - char name[PLATFORM_NAME_SIZE]; - kernel_ulong_t driver_data; -}; - -#define MDIO_MODULE_PREFIX "mdio:" - -#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u" -#define MDIO_ID_ARGS(_id) \ - ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ - ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \ - ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \ - ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \ - ((_id)>>15) & 1, ((_id)>>14) & 1, ((_id)>>13) & 1, ((_id)>>12) & 1, \ - ((_id)>>11) & 1, ((_id)>>10) & 1, ((_id)>>9) & 1, ((_id)>>8) & 1, \ - ((_id)>>7) & 1, ((_id)>>6) & 1, ((_id)>>5) & 1, ((_id)>>4) & 1, \ - ((_id)>>3) & 1, ((_id)>>2) & 1, ((_id)>>1) & 1, (_id) & 1 - -/** - * struct mdio_device_id - identifies PHY devices on an MDIO/MII bus - * @phy_id: The result of - * (mdio_read(&MII_PHYSID1) << 16 | mdio_read(&MII_PHYSID2)) & @phy_id_mask - * for this PHY type - * @phy_id_mask: Defines the significant bits of @phy_id. A value of 0 - * is used to terminate an array of struct mdio_device_id. - */ -struct mdio_device_id { - __u32 phy_id; - __u32 phy_id_mask; -}; - -struct zorro_device_id { - __u32 id; /* Device ID or ZORRO_WILDCARD */ - kernel_ulong_t driver_data; /* Data private to the driver */ -}; - -#define ZORRO_WILDCARD (0xffffffff) /* not official */ - -#define ZORRO_DEVICE_MODALIAS_FMT "zorro:i%08X" - -#define ISAPNP_ANY_ID 0xffff -struct isapnp_device_id { - unsigned short card_vendor, card_device; - unsigned short vendor, function; - kernel_ulong_t driver_data; /* data private to the driver */ -}; - -/** - * struct amba_id - identifies a device on an AMBA bus - * @id: The significant bits if the hardware device ID - * @mask: Bitmask specifying which bits of the id field are significant when - * matching. A driver binds to a device when ((hardware device ID) & mask) - * == id. - * @data: Private data used by the driver. - */ -struct amba_id { - unsigned int id; - unsigned int mask; - void *data; -}; - -/** - * struct mips_cdmm_device_id - identifies devices in MIPS CDMM bus - * @type: Device type identifier. - */ -struct mips_cdmm_device_id { - __u8 type; -}; - -/* - * Match x86 CPUs for CPU specific drivers. - * See documentation of "x86_match_cpu" for details. - */ - -/* - * MODULE_DEVICE_TABLE expects this struct to be called x86cpu_device_id. - * Although gcc seems to ignore this error, clang fails without this define. - */ -#define x86cpu_device_id x86_cpu_id -struct x86_cpu_id { - __u16 vendor; - __u16 family; - __u16 model; - __u16 steppings; - __u16 feature; /* bit index */ - /* Solely for kernel-internal use: DO NOT EXPORT to userspace! */ - __u16 flags; - __u8 platform_mask; - __u8 type; - kernel_ulong_t driver_data; -}; - -/* Wild cards for x86_cpu_id::vendor, family, model and feature */ -#define X86_VENDOR_ANY 0xffff -#define X86_FAMILY_ANY 0 -#define X86_MODEL_ANY 0 -#define X86_STEPPING_ANY 0 -#define X86_STEP_MIN 0 -#define X86_STEP_MAX 0xf -#define X86_PLATFORM_ANY 0x0 -#define X86_FEATURE_ANY 0 /* Same as FPU, you can't test for that */ -#define X86_CPU_TYPE_ANY 0 +#include "device-id/acpi.h" +#include "device-id/amba.h" +#include "device-id/ap.h" +#include "device-id/apr.h" +#include "device-id/auxiliary.h" +#include "device-id/bcma.h" +#include "device-id/ccw.h" +#include "device-id/cdx.h" +#include "device-id/coreboot.h" +#include "device-id/css.h" +#include "device-id/dfl.h" +#include "device-id/dmi.h" +#include "device-id/eisa.h" +#include "device-id/fsl_mc.h" +#include "device-id/hda.h" +#include "device-id/hid.h" +#include "device-id/hv_vmbus.h" +#include "device-id/i2c.h" +#include "device-id/i3c.h" +#include "device-id/ieee1394.h" +#include "device-id/input.h" +#include "device-id/ipack.h" +#include "device-id/isapnp.h" +#include "device-id/ishtp.h" +#include "device-id/mcb.h" +#include "device-id/mdio.h" +#include "device-id/mei_cl.h" +#include "device-id/mhi.h" +#include "device-id/mips_cdmm.h" +#include "device-id/of.h" +#include "device-id/parisc.h" +#include "device-id/pci.h" +#include "device-id/pcmcia.h" +#include "device-id/platform.h" +#include "device-id/pnp.h" +#include "device-id/rio.h" +#include "device-id/rpmsg.h" +#include "device-id/sdio.h" +#include "device-id/sdw.h" +#include "device-id/serio.h" +#include "device-id/slim.h" +#include "device-id/spi.h" +#include "device-id/spmi.h" +#include "device-id/ssam.h" +#include "device-id/ssb.h" +#include "device-id/tb.h" +#include "device-id/tee_client.h" +#include "device-id/typec.h" +#include "device-id/ulpi.h" +#include "device-id/usb.h" +#include "device-id/vchiq.h" +#include "device-id/vio.h" +#include "device-id/virtio.h" +#include "device-id/wmi.h" +#include "device-id/x86_cpu.h" +#include "device-id/zorro.h" /* * Generic table type for matching CPU features. @@ -719,265 +78,4 @@ struct cpu_feature { __u16 feature; }; -#define IPACK_ANY_FORMAT 0xff -#define IPACK_ANY_ID (~0) -struct ipack_device_id { - __u8 format; /* Format version or IPACK_ANY_ID */ - __u32 vendor; /* Vendor ID or IPACK_ANY_ID */ - __u32 device; /* Device ID or IPACK_ANY_ID */ -}; - -#define MEI_CL_MODULE_PREFIX "mei:" -#define MEI_CL_NAME_SIZE 32 -#define MEI_CL_VERSION_ANY 0xff - -/** - * struct mei_cl_device_id - MEI client device identifier - * @name: helper name - * @uuid: client uuid - * @version: client protocol version - * @driver_info: information used by the driver. - * - * identifies mei client device by uuid and name - */ -struct mei_cl_device_id { - char name[MEI_CL_NAME_SIZE]; - uuid_le uuid; - __u8 version; - kernel_ulong_t driver_info; -}; - -/* RapidIO */ - -#define RIO_ANY_ID 0xffff - -/** - * struct rio_device_id - RIO device identifier - * @did: RapidIO device ID - * @vid: RapidIO vendor ID - * @asm_did: RapidIO assembly device ID - * @asm_vid: RapidIO assembly vendor ID - * - * Identifies a RapidIO device based on both the device/vendor IDs and - * the assembly device/vendor IDs. - */ -struct rio_device_id { - __u16 did, vid; - __u16 asm_did, asm_vid; -}; - -struct mcb_device_id { - __u16 device; - kernel_ulong_t driver_data; -}; - -struct ulpi_device_id { - __u16 vendor; - __u16 product; - kernel_ulong_t driver_data; -}; - -/** - * struct fsl_mc_device_id - MC object device identifier - * @vendor: vendor ID - * @obj_type: MC object type - * - * Type of entries in the "device Id" table for MC object devices supported by - * a MC object device driver. The last entry of the table has vendor set to 0x0 - */ -struct fsl_mc_device_id { - __u16 vendor; - const char obj_type[16]; -}; - -/** - * struct tb_service_id - Thunderbolt service identifiers - * @match_flags: Flags used to match the structure - * @protocol_key: Protocol key the service supports - * @protocol_id: Protocol id the service supports - * @protocol_version: Version of the protocol - * @protocol_revision: Revision of the protocol software - * @driver_data: Driver specific data - * - * Thunderbolt XDomain services are exposed as devices where each device - * carries the protocol information the service supports. Thunderbolt - * XDomain service drivers match against that information. - */ -struct tb_service_id { - __u32 match_flags; - char protocol_key[8 + 1]; - __u32 protocol_id; - __u32 protocol_version; - __u32 protocol_revision; - kernel_ulong_t driver_data; -}; - -#define TBSVC_MATCH_PROTOCOL_KEY 0x0001 -#define TBSVC_MATCH_PROTOCOL_ID 0x0002 -#define TBSVC_MATCH_PROTOCOL_VERSION 0x0004 -#define TBSVC_MATCH_PROTOCOL_REVISION 0x0008 - -/* USB Type-C Alternate Modes */ - -#define TYPEC_ANY_MODE 0x7 - -/** - * struct typec_device_id - USB Type-C alternate mode identifiers - * @svid: Standard or Vendor ID - * @mode: Mode index - * @driver_data: Driver specific data - */ -struct typec_device_id { - __u16 svid; - __u8 mode; - kernel_ulong_t driver_data; -}; - -/** - * struct tee_client_device_id - tee based device identifier - * @uuid: For TEE based client devices we use the device uuid as - * the identifier. - */ -struct tee_client_device_id { - uuid_t uuid; -}; - -/* WMI */ - -#define WMI_MODULE_PREFIX "wmi:" - -/** - * struct wmi_device_id - WMI device identifier - * @guid_string: 36 char string of the form fa50ff2b-f2e8-45de-83fa-65417f2f49ba - * @context: pointer to driver specific data - */ -struct wmi_device_id { - const char guid_string[UUID_STRING_LEN+1]; - const void *context; -}; - -#define MHI_DEVICE_MODALIAS_FMT "mhi:%s" -#define MHI_NAME_SIZE 32 - -#define MHI_EP_DEVICE_MODALIAS_FMT "mhi_ep:%s" - -/** - * struct mhi_device_id - MHI device identification - * @chan: MHI channel name - * @driver_data: driver data; - */ -struct mhi_device_id { - const char chan[MHI_NAME_SIZE]; - kernel_ulong_t driver_data; -}; - -#define AUXILIARY_NAME_SIZE 40 -#define AUXILIARY_MODULE_PREFIX "auxiliary:" - -struct auxiliary_device_id { - char name[AUXILIARY_NAME_SIZE]; - kernel_ulong_t driver_data; -}; - -/* Surface System Aggregator Module */ - -#define SSAM_MATCH_TARGET 0x1 -#define SSAM_MATCH_INSTANCE 0x2 -#define SSAM_MATCH_FUNCTION 0x4 - -struct ssam_device_id { - __u8 match_flags; - - __u8 domain; - __u8 category; - __u8 target; - __u8 instance; - __u8 function; - - kernel_ulong_t driver_data; -}; - -/* - * DFL (Device Feature List) - * - * DFL defines a linked list of feature headers within the device MMIO space to - * provide an extensible way of adding features. Software can walk through these - * predefined data structures to enumerate features. It is now used in the FPGA. - * See Documentation/fpga/dfl.rst for more information. - * - * The dfl bus type is introduced to match the individual feature devices (dfl - * devices) for specific dfl drivers. - */ - -/** - * struct dfl_device_id - dfl device identifier - * @type: DFL FIU type of the device. See enum dfl_id_type. - * @feature_id: feature identifier local to its DFL FIU type. - * @driver_data: driver specific data. - */ -struct dfl_device_id { - __u16 type; - __u16 feature_id; - kernel_ulong_t driver_data; -}; - -/* ISHTP (Integrated Sensor Hub Transport Protocol) */ - -#define ISHTP_MODULE_PREFIX "ishtp:" - -/** - * struct ishtp_device_id - ISHTP device identifier - * @guid: GUID of the device. - * @driver_data: pointer to driver specific data - */ -struct ishtp_device_id { - guid_t guid; - kernel_ulong_t driver_data; -}; - -#define CDX_ANY_ID (0xFFFF) - -enum { - CDX_ID_F_VFIO_DRIVER_OVERRIDE = 1, -}; - -/** - * struct cdx_device_id - CDX device identifier - * @vendor: Vendor ID - * @device: Device ID - * @subvendor: Subsystem vendor ID (or CDX_ANY_ID) - * @subdevice: Subsystem device ID (or CDX_ANY_ID) - * @class: Device class - * Most drivers do not need to specify class/class_mask - * as vendor/device is normally sufficient. - * @class_mask: Limit which sub-fields of the class field are compared. - * @override_only: Match only when dev->driver_override is this driver. - * - * Type of entries in the "device Id" table for CDX devices supported by - * a CDX device driver. - */ -struct cdx_device_id { - __u16 vendor; - __u16 device; - __u16 subvendor; - __u16 subdevice; - __u32 class; - __u32 class_mask; - __u32 override_only; -}; - -struct vchiq_device_id { - char name[32]; -}; - -/** - * struct coreboot_device_id - Identifies a coreboot table entry - * @tag: tag ID - * @driver_data: driver specific data - */ -struct coreboot_device_id { - __u32 tag; - kernel_ulong_t driver_data; -}; - #endif /* LINUX_MOD_DEVICETABLE_H */ -- cgit v1.2.3 From e1da37efb51b46870f7e50ae5e8a03293335bce5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 30 Jun 2026 11:24:22 +0200 Subject: driver: core: Include headers for acpi_device_id and of_device_id for struct device_driver MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit struct device_driver contains pointers of type struct of_device_id* and struct acpi_device_id* but doesn't ensure these are defined. To make the header self-contained add the (very lightweight) includes that contain the respective definitions. Acked-by: Greg Kroah-Hartman Acked-by: Danilo Krummrich Acked-by: Rafael J. Wysocki (Intel) Acked-by: Takashi Sakamoto Link: https://patch.msgid.link/199ba71b4ac73f4b4d9f5d2be635c96eec73c70e.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) --- include/linux/device/driver.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/device/driver.h b/include/linux/device/driver.h index 38048e74d10a..768a1334c0a1 100644 --- a/include/linux/device/driver.h +++ b/include/linux/device/driver.h @@ -19,6 +19,8 @@ #include #include #include +#include +#include /** * enum probe_type - device driver probe type to try -- cgit v1.2.3 From 00cd8fc630e06e15a46200ce941d7fe98fea1e9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 30 Jun 2026 11:24:23 +0200 Subject: driver core: platform: Include header for struct platform_device_id MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Platform drivers can define an array containing the supported device variants to be assigned to the struct platform_driver's .id_table. While a forward declaration of struct platform_device_id is technically enough to make the driver self-contained, it's reasonable to provide the (very lightweight) data type definition for that array in to not add that burden to all platform drivers with an id-table. Note that currently transitively includes that provides struct platform_device_id. But that include is planned to be replaced by a tighter set of includes that only define the structures relevant for the stuff in . Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Link: https://patch.msgid.link/4ca29592c9d1c6d528a65e05b80af7355f3c79c5.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) --- include/linux/platform_device.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h index 26e6a43358e2..8c566f09d04e 100644 --- a/include/linux/platform_device.h +++ b/include/linux/platform_device.h @@ -11,6 +11,7 @@ #define _PLATFORM_DEVICE_H_ #include +#include #define PLATFORM_DEVID_NONE (-1) #define PLATFORM_DEVID_AUTO (-2) @@ -18,7 +19,6 @@ struct irq_affinity; struct mfd_cell; struct property_entry; -struct platform_device_id; struct platform_device { const char *name; -- cgit v1.2.3 From b14f81978d7ab6f28381f7cc0be7e65f244a083b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 30 Jun 2026 11:24:24 +0200 Subject: usb: serial: Include in MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All consumers of the latter also include the former, but without that struct usb_driver and struct usb_device_id (and maybe more) are not defined. Add an include for to make the header self-contained. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Link: https://patch.msgid.link/82219ab65d16ee5bfe5a35d11bc938baac3fd3bc.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) --- include/linux/usb/serial.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h index 75b2b763f1ba..534e6650e2aa 100644 --- a/include/linux/usb/serial.h +++ b/include/linux/usb/serial.h @@ -13,6 +13,7 @@ #include #include #include +#include /* The maximum number of ports one device can grab at once */ #define MAX_NUM_PORTS 16 -- cgit v1.2.3 From 2fb03de5256989d603f68dc07f06b6dbd72a9d92 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 30 Jun 2026 11:24:26 +0200 Subject: of: Explicitly include and MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit uses resource_size_t and relies on the transitive include -> . It also uses error constants and thus relying on the include chain -> -> -> . With the plan to split per subsystem and then only letting of_platform.h include the of-specific bits (which don't require these two headers), add the needed includes explicitly to keep the header self-contained. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Link: https://patch.msgid.link/a730991bc8813cf70c2445064ea425291538f709.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) --- include/linux/of_platform.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h index 17471ef8e092..48f73af88dd7 100644 --- a/include/linux/of_platform.h +++ b/include/linux/of_platform.h @@ -6,6 +6,8 @@ * */ +#include +#include #include struct device; -- cgit v1.2.3 From a66f9107a8ff8881f98bcbf4a271eac591f11e26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 30 Jun 2026 11:24:29 +0200 Subject: platform/x86: int3472: Add include defining struct dmi_system_id MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently is included transitively in int3472.h via -> -> However these includes will be tightend such that only the bits relevant for of will be provided by . To ensure that dmi_system_id stays around, include the respective header explicitly. Acked-by: Danilo Krummrich Acked-by: Ilpo Järvinen Acked-by: Takashi Sakamoto Acked-by: Sakari Ailus Link: https://patch.msgid.link/0ba52730f67dc995d9d896b81fa6a7320bf8cb4b.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) --- include/linux/platform_data/x86/int3472.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/linux/platform_data/x86/int3472.h b/include/linux/platform_data/x86/int3472.h index 93f1e1fe09b4..a73841dfae27 100644 --- a/include/linux/platform_data/x86/int3472.h +++ b/include/linux/platform_data/x86/int3472.h @@ -13,6 +13,7 @@ #include #include #include +#include #include /* FIXME drop this once the I2C_DEV_NAME_FORMAT macro has been added to include/linux/i2c.h */ @@ -72,7 +73,6 @@ container_of(clk, struct int3472_discrete_device, clock) struct acpi_device; -struct dmi_system_id; struct i2c_client; struct platform_device; -- cgit v1.2.3 From 4e38ddd96b528a35477a9dfd5e6748d3961c85ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 30 Jun 2026 11:24:31 +0200 Subject: ALSA: hda/core: Add include defining struct hda_device_id MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Traditionally all *_device_id were defined in a single header . This was split now with the objective that only the relevant bits are included. So including won't be enough to get a definition of (the unrelated to pci) struct hda_device_id. Add an explicit include for the header defining struct hda_device_id to keep working when stops providing this defintion. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Reviewed-by: Takashi Iwai Link: https://patch.msgid.link/376883bc5889d5cca01efb6f8d4e07a20158f2b8.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) --- include/sound/hdaudio.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/sound/hdaudio.h b/include/sound/hdaudio.h index f11bfc6b9f42..aa994d6e6d35 100644 --- a/include/sound/hdaudio.h +++ b/include/sound/hdaudio.h @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include -- cgit v1.2.3 From ecca1d63c1eadbbb38ceab82de0f7adfbc2b465d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Tue, 30 Jun 2026 11:24:35 +0200 Subject: Replace by more specific (headers) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit is included in a many files: $ git grep '' ef0c9f75a195 | wc -l 1598 ; some of them are widely used headers. To stop mixing up different and unrelated driver( type)s let the subsystem headers only use the subset of the recently split that are relevant for them. The fallout (I hope) is addressed in the previous commits that handle sources relying on e.g. pulling in the full legacy header and thus providing pci_device_id. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Link: https://patch.msgid.link/199fe46b624ba07fb9bd3e0cd6ff13757932cb5f.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) --- include/linux/acpi.h | 2 +- include/linux/amba/bus.h | 2 +- include/linux/auxiliary_bus.h | 2 +- include/linux/bcma/bcma.h | 2 +- include/linux/cdx/cdx_bus.h | 2 +- include/linux/dfl.h | 2 +- include/linux/dmi.h | 2 +- include/linux/eisa.h | 2 +- include/linux/firewire.h | 3 +-- include/linux/fsl/mc.h | 2 +- include/linux/hid.h | 2 +- include/linux/hyperv.h | 2 +- include/linux/i2c.h | 2 +- include/linux/i3c/device.h | 2 +- include/linux/input.h | 2 +- include/linux/intel-ish-client-if.h | 2 +- include/linux/ipack.h | 2 +- include/linux/isapnp.h | 2 +- include/linux/mcb.h | 2 +- include/linux/mei_cl_bus.h | 2 +- include/linux/mhi.h | 1 + include/linux/mmc/sdio_func.h | 2 +- include/linux/of.h | 2 +- include/linux/of_platform.h | 2 +- include/linux/pci-epf.h | 2 +- include/linux/pci.h | 2 +- include/linux/phy.h | 2 +- include/linux/platform_data/x86/soc.h | 2 +- include/linux/pnp.h | 2 +- include/linux/raspberrypi/vchiq_bus.h | 2 +- include/linux/rio.h | 2 +- include/linux/rpmsg.h | 2 +- include/linux/serio.h | 2 +- include/linux/slimbus.h | 2 +- include/linux/soc/qcom/apr.h | 2 +- include/linux/soundwire/sdw.h | 2 +- include/linux/spi/spi.h | 4 +++- include/linux/ssb/ssb.h | 2 +- include/linux/surface_aggregator/device.h | 2 +- include/linux/tee_drv.h | 2 +- include/linux/thunderbolt.h | 2 +- include/linux/ulpi/driver.h | 2 +- include/linux/usb.h | 2 +- include/linux/usb/typec_altmode.h | 2 +- include/linux/virtio.h | 2 +- include/linux/wmi.h | 2 +- include/linux/zorro.h | 2 +- include/pcmcia/ds.h | 2 +- include/sound/hda_codec.h | 2 +- 49 files changed, 51 insertions(+), 49 deletions(-) (limited to 'include') diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 10d6c6c11bdf..60ab50cb8930 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -13,7 +13,7 @@ #include /* for struct resource */ #include #include -#include +#include #include #include #include diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h index 6c54d5c0d21f..80a74cd2da7e 100644 --- a/include/linux/amba/bus.h +++ b/include/linux/amba/bus.h @@ -13,7 +13,7 @@ #include #include -#include +#include #include #include #include diff --git a/include/linux/auxiliary_bus.h b/include/linux/auxiliary_bus.h index 4e1ad8ccbcdd..de0ecd0fb05a 100644 --- a/include/linux/auxiliary_bus.h +++ b/include/linux/auxiliary_bus.h @@ -9,7 +9,7 @@ #define _AUXILIARY_BUS_H_ #include -#include +#include /** * DOC: DEVICE_LIFESPAN diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h index 60b94b944e9f..f02cb3909375 100644 --- a/include/linux/bcma/bcma.h +++ b/include/linux/bcma/bcma.h @@ -3,7 +3,7 @@ #define LINUX_BCMA_H_ #include -#include +#include #include #include diff --git a/include/linux/cdx/cdx_bus.h b/include/linux/cdx/cdx_bus.h index f54770f110bc..715b026ad95b 100644 --- a/include/linux/cdx/cdx_bus.h +++ b/include/linux/cdx/cdx_bus.h @@ -11,7 +11,7 @@ #include #include -#include +#include #include #define MAX_CDX_DEV_RESOURCES 4 diff --git a/include/linux/dfl.h b/include/linux/dfl.h index 1f02db0c1897..f28e70652080 100644 --- a/include/linux/dfl.h +++ b/include/linux/dfl.h @@ -9,7 +9,7 @@ #define __LINUX_DFL_H #include -#include +#include /** * enum dfl_id_type - define the DFL FIU types diff --git a/include/linux/dmi.h b/include/linux/dmi.h index c8700e6a694d..fbb62f7c3111 100644 --- a/include/linux/dmi.h +++ b/include/linux/dmi.h @@ -4,7 +4,7 @@ #include #include -#include +#include /* enum dmi_field is in mod_devicetable.h */ diff --git a/include/linux/eisa.h b/include/linux/eisa.h index cf55630b595b..52a97dc4c85a 100644 --- a/include/linux/eisa.h +++ b/include/linux/eisa.h @@ -4,7 +4,7 @@ #include #include -#include +#include #define EISA_MAX_SLOTS 8 diff --git a/include/linux/firewire.h b/include/linux/firewire.h index 986d712e4d94..fd35a6570cd8 100644 --- a/include/linux/firewire.h +++ b/include/linux/firewire.h @@ -14,6 +14,7 @@ #include #include #include +#include #include #include @@ -271,8 +272,6 @@ static inline void fw_unit_put(struct fw_unit *unit) #define fw_parent_device(unit) fw_device(unit->device.parent) -struct ieee1394_device_id; - struct fw_driver { struct device_driver driver; int (*probe)(struct fw_unit *unit, const struct ieee1394_device_id *id); diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h index 9f671e87c80c..c25f0f7e6dd4 100644 --- a/include/linux/fsl/mc.h +++ b/include/linux/fsl/mc.h @@ -11,7 +11,7 @@ #define _FSL_MC_H_ #include -#include +#include #include #include diff --git a/include/linux/hid.h b/include/linux/hid.h index 47dc0bc89fa4..b240baa95ab5 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -18,7 +18,7 @@ #include #include #include -#include /* hid_device_id */ +#include #include #include #include diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h index 9de2c8d6037a..a2b484679eb4 100644 --- a/include/linux/hyperv.h +++ b/include/linux/hyperv.h @@ -21,7 +21,7 @@ #include #include #include -#include +#include #include #include #include diff --git a/include/linux/i2c.h b/include/linux/i2c.h index 20fd41b51d5c..14ab4d3055af 100644 --- a/include/linux/i2c.h +++ b/include/linux/i2c.h @@ -12,7 +12,7 @@ #include /* for acpi_handle */ #include -#include +#include #include /* for struct device */ #include /* for completion */ #include diff --git a/include/linux/i3c/device.h b/include/linux/i3c/device.h index 971d53349b6f..0f065b883ee0 100644 --- a/include/linux/i3c/device.h +++ b/include/linux/i3c/device.h @@ -12,7 +12,7 @@ #include #include #include -#include +#include #include /** diff --git a/include/linux/input.h b/include/linux/input.h index 3022bb730898..76f7aa226202 100644 --- a/include/linux/input.h +++ b/include/linux/input.h @@ -19,7 +19,7 @@ #include #include #include -#include +#include struct input_dev_poller; diff --git a/include/linux/intel-ish-client-if.h b/include/linux/intel-ish-client-if.h index 2cd4f65aaa37..a07d952a2b29 100644 --- a/include/linux/intel-ish-client-if.h +++ b/include/linux/intel-ish-client-if.h @@ -9,7 +9,7 @@ #define _INTEL_ISH_CLIENT_IF_H_ #include -#include +#include struct ishtp_cl_device; struct ishtp_device; diff --git a/include/linux/ipack.h b/include/linux/ipack.h index 455f6c2a1903..7edbf9267338 100644 --- a/include/linux/ipack.h +++ b/include/linux/ipack.h @@ -6,7 +6,7 @@ * Author: Samuel Iglesias Gonsalvez */ -#include +#include #include #include diff --git a/include/linux/isapnp.h b/include/linux/isapnp.h index dba18c95844b..8f5a85ca6c1f 100644 --- a/include/linux/isapnp.h +++ b/include/linux/isapnp.h @@ -28,7 +28,7 @@ */ #ifdef __KERNEL__ -#include +#include #define DEVICE_COUNT_COMPATIBLE 4 diff --git a/include/linux/mcb.h b/include/linux/mcb.h index 4ab2691f51a6..874118765d0f 100644 --- a/include/linux/mcb.h +++ b/include/linux/mcb.h @@ -8,7 +8,7 @@ #ifndef _LINUX_MCB_H #define _LINUX_MCB_H -#include +#include #include #include diff --git a/include/linux/mei_cl_bus.h b/include/linux/mei_cl_bus.h index 5bdbd9e1d460..d5d29451eabf 100644 --- a/include/linux/mei_cl_bus.h +++ b/include/linux/mei_cl_bus.h @@ -7,7 +7,7 @@ #include #include -#include +#include struct mei_cl_device; struct mei_device; diff --git a/include/linux/mhi.h b/include/linux/mhi.h index fb3ba639f4f8..4b86ae6f6a82 100644 --- a/include/linux/mhi.h +++ b/include/linux/mhi.h @@ -14,6 +14,7 @@ #include #include #include +#include #define MHI_MAX_OEM_PK_HASH_SEGMENTS 16 diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h index 4534bf462aac..5d63a6465b0d 100644 --- a/include/linux/mmc/sdio_func.h +++ b/include/linux/mmc/sdio_func.h @@ -9,7 +9,7 @@ #define LINUX_MMC_SDIO_FUNC_H #include -#include +#include #include diff --git a/include/linux/of.h b/include/linux/of.h index 20e4f752d5b6..b920aac6b975 100644 --- a/include/linux/of.h +++ b/include/linux/of.h @@ -16,7 +16,7 @@ #include #include #include -#include +#include #include #include diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h index 48f73af88dd7..181c438a9b0a 100644 --- a/include/linux/of_platform.h +++ b/include/linux/of_platform.h @@ -8,7 +8,7 @@ #include #include -#include +#include struct device; struct device_node; diff --git a/include/linux/pci-epf.h b/include/linux/pci-epf.h index 8a6c64a35890..704e1dc8b30a 100644 --- a/include/linux/pci-epf.h +++ b/include/linux/pci-epf.h @@ -11,7 +11,7 @@ #include #include -#include +#include #include #include diff --git a/include/linux/pci.h b/include/linux/pci.h index ebb5b9d76360..64b308b6e61c 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -24,7 +24,7 @@ #define LINUX_PCI_H #include -#include +#include #include #include diff --git a/include/linux/phy.h b/include/linux/phy.h index 199a7aaa341b..fc680901275b 100644 --- a/include/linux/phy.h +++ b/include/linux/phy.h @@ -23,7 +23,7 @@ #include #include #include -#include +#include #include #include #include diff --git a/include/linux/platform_data/x86/soc.h b/include/linux/platform_data/x86/soc.h index f981907a5cb0..a6a6b313dfa7 100644 --- a/include/linux/platform_data/x86/soc.h +++ b/include/linux/platform_data/x86/soc.h @@ -12,7 +12,7 @@ #if IS_ENABLED(CONFIG_X86) -#include +#include #include diff --git a/include/linux/pnp.h b/include/linux/pnp.h index 23fe3eaf242d..e0c0d17eb7d8 100644 --- a/include/linux/pnp.h +++ b/include/linux/pnp.h @@ -12,7 +12,7 @@ #include #include #include -#include +#include #include #define PNP_NAME_LEN 50 diff --git a/include/linux/raspberrypi/vchiq_bus.h b/include/linux/raspberrypi/vchiq_bus.h index 9de179b39f85..e52291a3b247 100644 --- a/include/linux/raspberrypi/vchiq_bus.h +++ b/include/linux/raspberrypi/vchiq_bus.h @@ -7,7 +7,7 @@ #define _VCHIQ_DEVICE_H #include -#include +#include struct vchiq_drv_mgmt; diff --git a/include/linux/rio.h b/include/linux/rio.h index 2c29f21ba9e5..f42379775ce8 100644 --- a/include/linux/rio.h +++ b/include/linux/rio.h @@ -16,7 +16,7 @@ #include #include #include -#include +#include #ifdef CONFIG_RAPIDIO_DMA_ENGINE #include #endif diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h index 2e40eb54155e..0171c490339c 100644 --- a/include/linux/rpmsg.h +++ b/include/linux/rpmsg.h @@ -13,7 +13,7 @@ #include #include #include -#include +#include #include #include #include diff --git a/include/linux/serio.h b/include/linux/serio.h index 69a47674af65..98be7084412c 100644 --- a/include/linux/serio.h +++ b/include/linux/serio.h @@ -13,7 +13,7 @@ #include #include #include -#include +#include #include extern const struct bus_type serio_bus; diff --git a/include/linux/slimbus.h b/include/linux/slimbus.h index a4608d9a9684..ca6f1da4bdf3 100644 --- a/include/linux/slimbus.h +++ b/include/linux/slimbus.h @@ -8,7 +8,7 @@ #include #include #include -#include +#include extern const struct bus_type slimbus_bus; diff --git a/include/linux/soc/qcom/apr.h b/include/linux/soc/qcom/apr.h index 58fa1df96347..909e84f84e0c 100644 --- a/include/linux/soc/qcom/apr.h +++ b/include/linux/soc/qcom/apr.h @@ -5,7 +5,7 @@ #include #include -#include +#include #include #include diff --git a/include/linux/soundwire/sdw.h b/include/linux/soundwire/sdw.h index b484784e2690..79dd44922fbc 100644 --- a/include/linux/soundwire/sdw.h +++ b/include/linux/soundwire/sdw.h @@ -13,7 +13,7 @@ #include #include #include -#include +#include #include #include #include diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h index f6ed93eff00b..4c285d3ede1d 100644 --- a/include/linux/spi/spi.h +++ b/include/linux/spi/spi.h @@ -12,7 +12,9 @@ #include #include #include -#include +#include +#include +#include #include #include #include diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h index e1fb11e0f12c..7fee9afa9458 100644 --- a/include/linux/ssb/ssb.h +++ b/include/linux/ssb/ssb.h @@ -8,7 +8,7 @@ #include #include #include -#include +#include #include #include diff --git a/include/linux/surface_aggregator/device.h b/include/linux/surface_aggregator/device.h index 8cd8c38cf3f3..ed6b271e5a73 100644 --- a/include/linux/surface_aggregator/device.h +++ b/include/linux/surface_aggregator/device.h @@ -14,7 +14,7 @@ #define _LINUX_SURFACE_AGGREGATOR_DEVICE_H #include -#include +#include #include #include diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h index e561a26f537a..f3c5e106d853 100644 --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -9,7 +9,7 @@ #include #include #include -#include +#include #include #include diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h index feb1af175cfd..557288c0274b 100644 --- a/include/linux/thunderbolt.h +++ b/include/linux/thunderbolt.h @@ -23,7 +23,7 @@ struct device; #include #include #include -#include +#include #include #include #include diff --git a/include/linux/ulpi/driver.h b/include/linux/ulpi/driver.h index a8cb617a3028..c668d9c8d876 100644 --- a/include/linux/ulpi/driver.h +++ b/include/linux/ulpi/driver.h @@ -2,7 +2,7 @@ #ifndef __LINUX_ULPI_DRIVER_H #define __LINUX_ULPI_DRIVER_H -#include +#include #include diff --git a/include/linux/usb.h b/include/linux/usb.h index 25a203ac7a7e..1da4ad1610bc 100644 --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -2,7 +2,7 @@ #ifndef __LINUX_USB_H #define __LINUX_USB_H -#include +#include #include #define USB_MAJOR 180 diff --git a/include/linux/usb/typec_altmode.h b/include/linux/usb/typec_altmode.h index b90cc5cfff8d..ef21ead551be 100644 --- a/include/linux/usb/typec_altmode.h +++ b/include/linux/usb/typec_altmode.h @@ -3,7 +3,7 @@ #ifndef __USB_TYPEC_ALTMODE_H #define __USB_TYPEC_ALTMODE_H -#include +#include #include #include diff --git a/include/linux/virtio.h b/include/linux/virtio.h index bf089e51970e..93e573c56563 100644 --- a/include/linux/virtio.h +++ b/include/linux/virtio.h @@ -7,7 +7,7 @@ #include #include #include -#include +#include #include #include #include diff --git a/include/linux/wmi.h b/include/linux/wmi.h index d723e4b1cafb..defcb624a7e2 100644 --- a/include/linux/wmi.h +++ b/include/linux/wmi.h @@ -11,7 +11,7 @@ #include #include #include -#include +#include #include /** diff --git a/include/linux/zorro.h b/include/linux/zorro.h index f36c8d39553d..4514c3109deb 100644 --- a/include/linux/zorro.h +++ b/include/linux/zorro.h @@ -17,7 +17,7 @@ #include #include #include -#include +#include #include diff --git a/include/pcmcia/ds.h b/include/pcmcia/ds.h index b7a8de88b3c0..8ae92602e12f 100644 --- a/include/pcmcia/ds.h +++ b/include/pcmcia/ds.h @@ -14,7 +14,7 @@ #define _LINUX_DS_H #ifdef __KERNEL__ -#include +#include #endif #include diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h index 17945ab5e6e2..b4e327877739 100644 --- a/include/sound/hda_codec.h +++ b/include/sound/hda_codec.h @@ -9,7 +9,7 @@ #define __SOUND_HDA_CODEC_H #include -#include +#include #include #include #include -- cgit v1.2.3 From 3b212f9d70805d91febae01d618868f4860e267c Mon Sep 17 00:00:00 2001 From: Marek Szyprowski Date: Mon, 13 Jul 2026 10:56:53 +0200 Subject: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPT_RT is enabled on ARM, regular spinlock is converted to a sleeping lock (mutex-based), which must not be used in atomic context such as hard interrupt handlers. Switch the samsung_pwm_lock to the raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT. Fixes: 7aac482e6290 ("clocksource: samsung_pwm_timer: Make PWM spinlock global") Fixes: f11899894c0a ("clocksource: add samsung pwm timer driver") Signed-off-by: Marek Szyprowski Signed-off-by: Daniel Lezcano Reviewed-by: Krzysztof Kozlowski Reviewed-by: Sebastian Andrzej Siewior Acked-by: Uwe Kleine-König Link: https://patch.msgid.link/20260713085653.1145015-1-m.szyprowski@samsung.com --- include/clocksource/samsung_pwm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/clocksource/samsung_pwm.h b/include/clocksource/samsung_pwm.h index 9b435caa95fe..36f6f246e559 100644 --- a/include/clocksource/samsung_pwm.h +++ b/include/clocksource/samsung_pwm.h @@ -15,7 +15,7 @@ * spinlock is not shared between both drivers. */ #ifdef CONFIG_CLKSRC_SAMSUNG_PWM -extern spinlock_t samsung_pwm_lock; +extern raw_spinlock_t samsung_pwm_lock; #endif struct samsung_pwm_variant { -- cgit v1.2.3