summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-09-15dt-bindings: phy: qcom,qmp-usb3-dp: Extend X1E description for USB4Konrad Dybcio
Some instances of the QMP combo PHY (called USB43DP) feature a third functional sub-block, responsible for USB4/Thunderbolt 3 communication. Compared to the today's state of the binding, one more clock (P2RR2P - PHY-to-Router, Router-to-PHY) needs to be enabled for the PHY to be able to switch to USB4 mode. Allow that for X1E. Also, add a bindings define to let consumers access it. Assisted-by: Claude:sonnet-5 Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260908-topic-usb4phy-v5-1-73aac69578ef@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-09-14net: rtnetlink: add pacing_offload attribute to net_deviceWillem de Bruijn
Add a new flag to administratively control pacing offload. The feature is disabled by default. That does not cause regressions, as no driver advertises max_pacing_offload_horizon yet. Also add NLA_REJECT for max_pacing_offload_horizon, in line with other such read-only members of link-attrs. Both fields can be read with ynl --family rt-link --do getlink \ --json '{"ifname": "eth0"}' | grep pacing And pacing offload enabled with ynl --family rt-link --do setlink \ --json '{"ifname": "eth0", "pacing-offload": 1}' Signed-off-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260910171131.2532487-2-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-15firewire: core: correct comment about execution contextTakashi Sakamoto
The comment for fw_address_callback_t describes the execution context, but the callback has not been called from RCU read-side critical section since v6.17. Fixes: e884a8a0c573 ("firewire: core: call FCP address handlers outside RCU read-side critical section") Fixes: e8cf6875005b ("firewire: core: call handler for exclusive regions outside RCU read-side critical section") Link: https://lore.kernel.org/r/20260914221434.213633-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2026-09-14lsm: Preserve full ioctl commands in audit recordsMickaël Salaün
Ioctl commands are unsigned int values, with their encoded direction and size in the upper 16 bits. However, struct lsm_ioctlop_audit keeps only a u16, and the common audit formatter uses %hx. This logs 0xc00ffeee as 0xfeee and makes distinct commands with matching low 16 bits indistinguishable. Change cmd to unsigned int and use %x. Pass the full command through ioctl_has_perm() as well. Its driver and xperm values remain u8 values derived from the same low 16 bits, so SELinux enforcement does not change. Commands that fit in 16 bits keep the same audit text. Cc: Jeff Vander Stoep <jeffv@google.com> Cc: Paul Moore <paul@paul-moore.com> Fixes: 671a2781ff01 ("security: add ioctl specific auditing to lsm_audit") Signed-off-by: Mickaël Salaün <mic@digikod.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-09-14Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdmaLinus Torvalds
Pull rdma fixes from Jason Gunthorpe: "Lots of bug fixes from the last weeks: - Various error unwind bugs - Several more races and bugs in siw and rxe, including remote triggerable - HFI1 corruption with its credit scheme - Remove a bogus user triggerable dev_warn - Lock __ethtool_get_link_ksettings() properly - Fix a lockdep loop with diassociation - Several storage related bugs, some triggerable remotely - Do no leak physical addresses to userspace in bnxt_re - Fix wrong irq context for the xarrays in erdma - User triggerable race in ucma with multicast - Race in ipoib with multicast flushing and destruction" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (28 commits) RDMA/siw: Bound fragmented header copies by the remaining length RDMA/efa: Keep EQ resources alive while IRQ is registered RDMA/efa: Keep admin queues alive while IRQ is registered RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() IB/IPoIB: Avoid restoring OPER_UP after multicast flush RDMA/ucma: Serialize join and leave on copy_to_user failure RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted RDMA/irdma: Enforce local fence for IB_WR_REG_MR RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables RDMA/mad: Fix receive buffer leak when PKey enforcement fails RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() RDMA/bnxt_re: Avoid exposing umdbr to userspace RDMA/rtrs: guard against null kobj name RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup IB/isert: wait for deferred control PDU completions before releasing the connection IB/iser: reject a remote invalidation of an unregistered direction RDMA/srp: Fix srp_remove_target() IB/mlx4: Fix use-after-free on pkey sysfs registration failure RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency RDMA/core: Reject unregistering netdevs in ib_get_eth_speed ...
2026-09-14f2fs: parameterize node helpers and macrosChao Yu
In gang-lookup loops such as last_fsync_dnode(), f2fs_sync_node_pages(), and f2fs_fsync_node_pages(), candidate dirty node folios returned by filemap_get_folios_tag() are inspected and filtered before acquiring their folio locks: - IS_DNODE - is_cold_node - ino_of_node - ofs_of_node (called by IS_DNODE) These helpers previously relied on F2FS_F_SB(folio) which dereferences folio->mapping to obtain sbi. This can suffer a race condition with concurrent node truncation, causing a NULL pointer dereference panic: Thread A Thread B - f2fs_sync_node_pages - filemap_get_folios_tag - truncate_node - invalidate_mapping_pages - filemap_remove_folio - folio->mapping = NULL - IS_DNODE - F2FS_F_SB - folio->mapping->host (panic) To resolve this race condition, pass struct f2fs_sb_info *sbi explicitly to these helpers. All these helpers fundamentally rely on F2FS_NODE_FOOTER(), which dynamically locates the node footer at: folio_address(folio) + F2FS_BLKSIZE(sbi) - sizeof(struct node_footer). Consequently, F2FS_NODE_FOOTER() and its direct sibling footer accessors: - IS_INODE - nid_of_node - cpver_of_node - next_blkaddr_of_node are also parameterized with struct f2fs_sb_info *sbi. In get_dnode_base() and get_dnode_addr(), derive sbi safely via `inode ? F2FS_I_SB(inode) : F2FS_F_SB(node_folio)` to support callers passing NULL inode (e.g. is_alive()). Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: parameterize block size and mask macrosKelvin Zhang
Block size constants, shift counts, masks, and page-to-block ratios were globally defined assuming a fixed 4KB block size. Parameterize F2FS_BLKSIZE, F2FS_BLKSIZE_BITS, F2FS_BLKSIZE_MASK, F2FS_BLKS_PER_PAGE, and CP_CHKSUM_OFFSET with struct f2fs_sb_info *sbi to reference sbi->blocksize, sbi->log_blocksize, and runtime masks. Update call sites across metadata operations, data I/O, file operations, garbage collection, inline data, and sysfs information. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe node tree geometry dynamicallyKelvin Zhang
The file indexing tree boundaries separating direct, indirect, and double-indirect node blocks depend on the number of data block addresses and node IDs contained in each node block. Parameterize index boundary macros (NODE_DIR1_BLOCK, NODE_DIR2_BLOCK, NODE_IND1_BLOCK, NODE_IND2_BLOCK, and NODE_DIND_BLOCK) and address capacity helpers (DEF_ADDRS_PER_BLOCK, NIDS_PER_BLOCK, cur_addrs_per_inode, addrs_per_page, and addrs_per_folio) with struct f2fs_sb_info *sbi. Update file mapping, block allocation, truncate, garbage collection, and recovery paths to compute indexing tree offsets from the runtime geometry. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: parameterize byte and block conversion macrosKelvin Zhang
Byte-to-block and block-to-byte conversion helpers previously relied on global PAGE_SIZE, PAGE_SHIFT, or F2FS_BLKSIZE_BITS. Parameterize F2FS_BYTES_TO_BLK, F2FS_BLK_TO_BYTES, F2FS_BLK_END_BYTES, F2FS_BLK_ALIGN, and max_file_blocks with struct f2fs_sb_info *sbi using sbi->log_blocksize. Update all call sites across data mapping, file operations, fiemap queries, fsverity checks, NAT bitmap allocations, and truncate paths. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: parameterize sector conversion macrosKelvin Zhang
Sector-to-block and block-to-sector conversion helpers previously assumed a fixed sector count per block derived from 4KB pages. Parameterize F2FS_LOG_SECTORS_PER_BLOCK, SECTOR_FROM_BLOCK, and SECTOR_TO_BLOCK with struct f2fs_sb_info *sbi, using sbi->log_sectors_per_block. Update all call sites across metadata I/O, data mapping, discard operations, and zoned block device reporting. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe xattr block layout dynamicallyKelvin Zhang
The usable capacity of dedicated on-disk extended attribute blocks and inline xattr regions scales with the filesystem block size. Parameterize VALID_XATTR_BLOCK_SIZE and MAX_INLINE_XATTR_SIZE to calculate usable xattr limits dynamically from sbi->blocksize rather than hardcoding PAGE_SIZE or DEF_ADDRS_PER_INODE. Update mount option consistency validation for inline_xattr_size to evaluate allowed boundaries dynamically against the runtime block size. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe {i,d,id}node block layout dynamicallyKelvin Zhang
An inode block ends with five i_nid entries followed by a node footer. Data block address pointers (i_addr[]) precede them. Similarly, direct and indirect node blocks contain data addresses or node IDs followed by a node footer at the end of the block. Describe struct f2fs_inode, struct direct_node, and struct indirect_node using flexible array members. Compute the locations of i_nid and node footers dynamically from the filesystem block size. Introduce F2FS_INODE_NIDS() and F2FS_NODE_FOOTER() helpers to access these tail fields. Compute sbi->addrs_per_inode, sbi->addrs_per_block, and sbi->nids_per_block in init_sb_info(), and update node management, file mapping, and recovery paths accordingly. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe dentry block layout dynamicallyKelvin Zhang
An on-disk directory block contains a bitmap, reserved padding, an array of directory entries (struct f2fs_dir_entry), and matching filename slots. A fixed compile-time structure couples their offsets to 4KB blocks and relies on static reserved-space definitions. Remove struct f2fs_dentry_block and compute region offsets (bitmap bytes, directory-entry count, and filename slots) dynamically from the filesystem block size. Access directory blocks through struct f2fs_dentry_ptr views initialized with the runtime geometry. Update directory operations, inline dentry handling, and recovery paths to use the dynamic block layout. No functional change is introduced for 4KB blocks. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe orphan block layout dynamicallyKelvin Zhang
An on-disk orphan block contains a variable-length array of 32-bit inode numbers followed by a fixed footer at the end of the block. A compile-time whole-block structure cannot represent the footer position when the block size varies at runtime. Remove struct f2fs_orphan_block, introduce struct f2fs_orphan_block_footer, and compute sbi->orphans_per_block dynamically in init_sb_info(). Add helpers to access the inode entry array and footer from a block buffer. Update orphan inode recovery, checkpointing, and mount paths to use the parameterized helpers. This preserves the on-disk format while decoupling orphan handling from compile-time constants. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe NAT block layout dynamicallyKelvin Zhang
A NAT block is a filesystem-block-sized array of struct f2fs_nat_entry elements. The compile-time NAT_ENTRY_PER_BLOCK definition hardcodes the NAT capacity to a 4KB block size. Replace the fixed array in struct f2fs_nat_block with a C flexible array member, and calculate sbi->nat_entries_per_block dynamically in init_sb_info(). Parameterize NAT geometry helpers (NAT_ENTRY_PER_BLOCK, NAT_BLOCK_OFFSET, f2fs_start_nid, NAT_BLK_CNT, and f2fs_nat_bitmap_size) with sbi. Update call sites across node management, checkpointing, GC, and sysfs. This is a layout-only change without behavioral differences for 4KB blocks. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe SIT block layout dynamicallyKelvin Zhang
An SIT block consists of an on-disk array of struct f2fs_sit_entry elements whose total capacity depends on the filesystem block size. The existing fixed SIT_ENTRY_PER_BLOCK macro hardcodes a 4KB block size. Convert the entries array in struct f2fs_sit_block into a C flexible array member, and calculate sbi->sit_entries_per_block dynamically in init_sb_info(). Parameterize SIT indexing helpers (SIT_ENTRY_PER_BLOCK, SIT_BLOCK_OFFSET, SIT_BLK_CNT, and f2fs_start_segno) to take struct f2fs_sb_info *sbi, and update all call sites across segment management, checkpointing, and mount. This is a layout-only change; valid 4KB filesystems retain identical runtime geometry and behavior. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14x86,fs/resctrl: Add resctrl_arch_preconvert_bw()Dave Martin
On MPAM systems the rounding behaviour of the MBA control would be improved if the rounding in the fs/resctrl code is removed but this is not the case for x86. To allow any rounding or conversion of the bandwidth value provided by the user to be specified by the arch code a new arch hook is required. Introduce resctrl_arch_preconvert_bw(), and add its x86 implementation. This is currently unused in resctrl but when plumbed in it will replace the call to roundup() in bw_validate(). Signed-off-by: Dave Martin <dave.martin@arm.com> Signed-off-by: Ben Horgan <ben.horgan@arm.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Reinette Chatre <reinette.chatre@intel.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Link: https://patch.msgid.link/20260911163613.1131447-2-ben.horgan@arm.com
2026-09-14drm/sysfs: Remove drm_class_device_(un)register()Maíra Canal
The last usage of the functions drm_class_device_register() and drm_class_device_unregister() was removed in commit ed89fff97382 ("drm/ttm: drop sysfs directory"). Remove such functions as they are no longer used. Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260803132706.1497980-2-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-09-14ASoC: codecs: Fix resource leaks on card re-bindMark Brown
Chancel Liu <chancel.liu@oss.nxp.com> says: Several ASoC codec drivers set up per-device resources from their ASoC component probe, but the associated cleanup is tied to the underlying bus (I2C/SPI) device rather than being balanced per component probe. This is fine for a plain probe/remove, but it breaks when the sound card is unregistered and re-registered while the bus device stays bound (a card re-bind): the component probe runs again while the previous bus-level resources are still live. Two kinds of resources are affected: - Regulator disable notifiers (wm8962, wm8995, tlv320aic31xx, tlv320aic3x) The same notifier_block is re-registered on the still-registered regulator notifier chain, which triggers notifier callback ..._regulator_event_N already registered WARNING: ... at kernel/notifier.c:23 notifier_chain_register and corrupts the chain. - Beep input devices (wm8962, cs42l52, cs42l56) A new input device is allocated and registered on every component probe while the free path only clears the pointer, leaking the previous input device and its sysfs/input node. The two problems need opposite fixes: the notifiers are registered from the component probe, so the registration is moved to the bus probe so it runs once per bus bind; the beep device is freed from the component remove path, so it is switched from devm_input_allocate_device() to input_allocate_device() paired with an explicit input_unregister_device() on that same free path. Verified with wm8962. The remaining patches fix other codec drivers following the same patterns. Link: https://patch.msgid.link/20260913101531.2787654-1-chancel.liu@oss.nxp.com
2026-09-14wifi: radiotap: add S1G TLVs and channel frequencyLachlan Hodges
Add the necessary definitions to create radiotap S1G TLVs and channel flags for S1G sniffers. Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260909073014.53344-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-14block,iomap: remove the old read side bounce buffering supportChristoph Hellwig
bio_iov_iter_bounce_read turned to generate suboptimal I/O sizes and isn't usable for lazy bounce buffering. Now that is has been replaced with the iomap side implementation that requires extra bounce bios, it is unused and can be removed. Change the interface so that the previously hidden write-side implementation is directly exposed. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-17-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14iomap,xfs: move integrity verification to the file systemChristoph Hellwig
Integrity support in file systems already requires file system-specific completion handling because it must be run in process context. Move the actual verification to the file system so that it can better handle errors in file system specific ways, and to support lazy bounce buffering. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-13-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14iomap: better read bounce buffering supportChristoph Hellwig
Add helpers to bounce buffer an upper bio into one or more lower bios using bounce buffers, and to copy the data back on completion. Compared to the existing IOMAP_DIO_BOUNCE support for read bios, this has two advantages: by removing the special bounce bio_vec it allows to the full and "round" size of a single bio, i.e., 1MiB when using 4k pages. This is important for good performance on HDD. Additionally it allows to bounce buffer a bio from completion conext, and thus implement a "lazy" bounce buffering scheme, where the data is only read into a bounce buffer after an initial checksum validation failure, thus avoiding the bounce buffering I/O for most I/O. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-11-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14block,iomap: fix protection information verification with initial bvec offsetChristoph Hellwig
When reconstructing a bvec_iter from an ioend for protection information verification, iomap currently ignores the offset into the initial bio_vec. This can't happen for buffered I/O or direct I/O to user addresses, but is exercised by splice on O_DIRECT file descriptors or when using the loop driver in direct I/O mode. Fortunately the only file system PI user (XFS) currently always bounce buffers, so this can't actually be triggered yet. But we'll want to make the bounce buffering conditional soon, for which this needs to be fixed. Store the initial offset in struct iomap_ioend, and pass a pre-constructed bvec_iter to fs_bio_integrity_verify. For the synchronous read case the fix is even simpler as this path can simply stash away the original bvec_iter. Fixes: 0bde8a12b554 ("block: add fs_bio_integrity helpers") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-10-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14iomap: add a IOMAP_IOEND_INTEGRITY flagChristoph Hellwig
This will make it easier to share code for the various submit callback provided by the file system to iomap. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-7-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14iomap: add a iomap_ioend_flags helperChristoph Hellwig
Add a helper to initialize the ioend flags to the values that can be directly derived from the iomap. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-6-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14block: pass a maxlen argument to bio_iov_iter_get_pagesChristoph Hellwig
Writes that require additional per-I/O allocations such as when using file system level protection information can be limited to a maximum size. Allow passing that to bio_iov_iter_get_pages. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14dma-fence: Fix dma_fence_enable_signaling() reference in kernel-docKarl Mehltretter
The kernel-doc comment of dma_fence_is_signaled_locked() refers to dma_fence_enable_sw_signaling, which was renamed to dma_fence_enable_signaling by commit 9370a5c664e8 ("dma-buf: rename dma_fence_enable_sw_signaling"). Say dma_fence_enable_signaling. Fixes: 9370a5c664e8 ("dma-buf: rename dma_fence_enable_sw_signaling") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Christian König <christian.koenig@amd.com> Link: https://lore.kernel.org/r/20260911221100.7079-1-kmehltretter@gmail.com
2026-09-14tracing: Include linux/types.h in trace_remote_event.hFuad Tabba
trace_remote_event.h uses bool without including linux/types.h, so a translation unit that includes it ahead of anything else that pulls types.h in fails to build, as with nvhe/trace.h at EL2. Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Acked-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Acked-by: Steven Rostedt <rostedt@goodmis.org.> Link: https://patch.msgid.link/20260901140326.3812068-2-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Handle userspace accesses to IRS MMIO regionSascha Bischoff
As part of saving and restoring the state of a GICv5-based system, userspace must save and restore the IRS MMIO registers. These include important information such as the guest IST configuration, and KVM must present consistent state to the guest after migration. Introduce KVM_DEV_ARM_VGIC_GRP_IRS_REGS and provide accessors to read and write the virtual IRS register state. This is modelled on the GICv3 ITS register interface, as the migration requirements are broadly the same. Reuse the guest MMIO handlers where userspace and guest accesses have the same semantics. Add userspace-specific handling where restoring a register image must not trigger the operation associated with a guest MMIO write. Validate restored ID register fields against the capabilities KVM and the host can support. Restore the emulated IST configuration without allocating or freeing a host IST, and report operation status registers as idle. Accept writes to IRS_SPI_CFGR, IRS_IIDR, and IRS_AIDR without changing their state, allowing userspace to replay the values it previously read. Restoring IRS_IST_BASER.Valid recreates the guest-visible configuration, but the host LPI IST cannot be allocated until userspace supplies its contents. Track this as a pending LPI IST restore and reject guest entry until userspace restores the IST through KVM_DEV_ARM_VGIC_GRP_IST. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-33-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Mask per-vCPU PPI state in vgic_v5_finalize_ppi_state()Sascha Bischoff
Only a subset of the possible PPIs are exposed to a guest when running with a vGICv5. First of all, only the architected PPIs are considered by KVM. Secondly, only a set of those is exposed to a guest: those corresponding to devices that KVM emulates, such as the timers and PMU, and the GICv5 SW_PPI. The finalisation of exposed PPIs happens on first vCPU run, as this is the first time when the full set of exposed devices is known. At this stage a mask is calculated, and this mask is applied both to hide non-exposed PPI state from the guest and to reduce overhead when iterating over the PPIs. While preparing userspace access to the GICv5 system registers, it became apparent that restoring the GICv5 PPI registers can result in a mismatch between the state supplied by userspace and the state KVM intends to expose. Userspace can provide Enable, Active, and Pending state for PPIs that KVM has chosen to hide from the guest. Userspace must restore PPI state before any vCPU runs. The userspace access path added subsequently enforces this ordering. Rework vgic_v5_finalize_ppi_state() to calculate the mask of exposed PPIs and clear any state belonging to non-exposed PPIs. This ensures that only the state KVM intends to expose is visible to the guest. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-31-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic: Introduce set_pending_state() to irq_opsSascha Bischoff
There are times, such as with GICv5 SPIs and LPIs, where the hardware itself manages parts of the interrupt lifecycle. This means that pending state can be directly communicated to the hardware instead of being represented only in the VGIC shadow state. In order to accommodate cases where the hardware handles pending state directly, add a new set_pending_state() function pointer to irq_ops. The intent is for this to be used after the VGIC shadow pending state has changed, allowing the backend to mirror the updated state into hardware. This new function is plumbed into kvm_vgic_inject_irq(), and is only called if irq_ops are provided and this function pointer is explicitly set. In the general case, this has no effect. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-27-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Register the IRS IODEVSascha Bischoff
Now that we have an emulated IRS, it needs to be registered, which ensures that guest accesses to the MMIO regions handled by the device are handled appropriately in KVM. Therefore, as part of vgic_map_resources, the GICv5 IRS IODEV is registered. If the address for the IRS is not provided, bail out reporting an error - this is not a supported config. As part of this change, expose setting the address of the emulated IRS via KVM_VGIC_V5_ADDR_TYPE_IRS to userspace. Also allow userspace to set the number of SPIs handled by the emulated GICv5 implementation, using a GICv5-specific SPI count rather than the legacy total interrupt count. Limit the configurable range to 32 through 1024 SPIs, in multiples of 32. KVM keeps one struct vgic_irq per SPI in a physically contiguous allocation, and allowing the full 16-bit KVM_IRQ_LINE SPI namespace would make that allocation exceed KMALLOC_MAX_SIZE on common arm64 configurations. The default routing has one IRQCHIP route per configured SPI, so size the common IRQ routing table for the largest GICv5 configuration. The model-specific routing validation retains the 988-pin limit for GICv2 and GICv3. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-23-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Add GICv5 IRS IODEV and MMIO emulationSascha Bischoff
In order to properly support GICv5-based VMs in KVM, emulate the CONFIG_FRAME for a virtual IRS. This emulation needs to handle guest accesses to the MMIO region and mimic the behaviour of a real IRS. Introduce an IODEV for the GICv5 IRS and an associated initialisation function that sets up the SPIs and initial IRS state. The MMIO emulation allows the guest to query the IRS_IDx registers, manipulate SPIs, configure ISTs, and so forth. Allow 32-bit accesses to the 64-bit IRS registers in addition to 64-bit accesses. Reconstruct IRS_IST_BASER for reads and merge partial writes so that updating either word preserves the other half. The emulation tracks selector state across MMIO accesses. For example, a guest writes IRS_PE_SELR to select a PE by IAFFID. This is the VPE ID for a VM, but the guest does not know this. If the guest reads IRS_PE_STATUSR, KVM checks whether that IAFFID selects a valid VPE and sets the V bit accordingly. IRS_PE_CR0 is accepted as write-ignored because KVM does not support 1-of-N routing. The same selector and status register model is exposed for SPIs. Track the state of IRS_CR0.IRSEN and introduce KVM_REQ_RELOAD_GICv5 to reload the GICv5 context of running vCPUs when it changes. Only make the request when the enable state changes, avoiding unnecessary IPIs for writes that leave it unchanged. The LPI IST requires KVM to perform actions on behalf of the guest. Treat changes to IRS_IST_BASER.Valid as the lifetime of the guest's IST. On an Invalid-to-Valid transition, validate IRS_IST_CFGR, allocate a shadow host IST, and assign it to the physical IRS through the VMTE. On a Valid-to-Invalid transition, invalidate and free the host IST. Ignore guest address changes while the BASER remains valid, and prevent changes to IRS_IST_CFGR during that time. As far as the guest is concerned, the IST memory it provided is being used by the hardware, but the physical IRS uses the host shadow IST instead. This change provides the core IRS IODEV and MMIO emulation, but does not plumb the device into the rest of KVM yet. The CoreSight identification registers are added separately. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-21-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Add IRS IODEV support to MMIO handlersSascha Bischoff
In order to support proper VMs (that support more than just PPIs) for GICv5, it is important to emulate the GICv5 IRS too. The IRS includes an MMIO interface which is used to interact with and configure the IRS. As part of providing the emulated IRS MMIO interface in KVM, extend enum iodev_type to include a GICv5 IRS device, and extend the MMIO code to handle reads and writes to that type of IO device. This will allow the creation of a GICv5 IRS IO Device in KVM. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-19-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Introduce struct vgic_v5_irs and IRS base addressSascha Bischoff
In order to properly emulate the operation of the IRS from KVM, we require storage for the MMIO register state. This change introduces struct vgic_v5_irs, and adds a pointer to it to the struct vgic_dist. This new data structure contains the storage for IRS MMIO state that is required for emulating the MMIO interface in KVM. This provides persistent storage, and a way to track data across MMIO writes, e.g., selecting an SPI and updating the configuration of it is two MMIO writes. Note that only a pointer to the data structure is added to struct vgic_dist as this new structure is very large, and hence it makes sense to dynamically allocate it and just provide a pointer to retrieve it in struct vgic_dist. In addition to adding a structure to store the MMIO state for the IRS, we add the base address in GPA space to struct vgic_v5_irs. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-18-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Add resident/non-resident hyp callsSascha Bischoff
GICv5 introduces the concept of VPE residency - a VPE can be either resident or non-resident. When the VPE is resident, the IRS is allowed to select interrupts that target that VPE (or the VM) as the HPPI (Highest Priority Pending Interrupt). As the IRS handles both SPIs and LPIs, these will only be picked as the IRS's HPPI when a VPE is resident. A GICv5 VPE is made resident by writing ICH_CONTEXTR_EL2 with ICH_CONTEXTR_EL2.V set, together with valid VM and VPE IDs. This informs the IRS that a specific VPE is running, and that it can begin HPPI selection for that VPE. Making a VPE non-resident (by making the ICH_CONTEXTR_EL2 invalid) informs the IRS that the VPE is no longer running, and it stops HPPI selection for it. This change introduces two new hyp calls - one to make a VPE resident and its counterpart to make a VPE non-resident. As part of making a VPE resident, the resulting ICH_CONTEXTR_EL2.F bit is checked to catch residency faults. Such a fault indicates a broken VM/VPE setup, so warn and mark the VM dead. Both of these new hypercalls are explicitly no-ops with pKVM as we currently don't support the combination of GICv5 and pKVM. Furthermore, this change extends vgic_v5_load() and vgic_v5_put() to make the VPEs resident and non-resident, respectively. Hence, the VPE is considered resident for the entire load-to-put interval. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-16-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Set up VMTEs and VPE doorbellsSascha Bischoff
A GICv5 VM needs a VM table entry before it can use SPIs and LPIs, which are backed by the host IRS. The VM table itself is created at probe time, but each VM still needs to claim and populate one VMTE before it can use those interrupts. VPE doorbells are allocated from the host LPI irq domain. Without that domain, KVM cannot issue IRS commands or receive doorbell wakeups. Fail the GICv5 KVM probe if the host driver did not create an LPI domain. Allocate a VM ID during vgic_v5_init(). The VM ID is also the index into the VM table, so allocating it selects the VMTE slot that will be used for the lifetime of the VM. Create a per-VM VPE doorbell irq domain, allocate one doorbell interrupt per vCPU, request the interrupts, and keep the doorbell IRQ number in the vCPU's GICv5 state. The doorbell handler marks the VPE doorbell as fired, raises KVM_REQ_IRQ_PENDING, and kicks the target vCPU so that KVM can re-evaluate pending interrupt state. The doorbell domain indexes its interrupts using the dense vcpu_idx, while GICv5 uses the userspace-provided vcpu_id as the VPE ID. Store a backpointer to the VM and use it to resolve the vCPU before issuing VPE-specific IRS commands. This preserves the userspace VPE ID when vCPU IDs are sparse. With the VM ID and doorbells in place, initialise the VMTE backing state, including the VM descriptor, VPE table, and preallocated VPED storage. The doorbells have to exist before making the VMTE valid, as they provide the IRQ-side conduit used by the IRS commands. Make the VMTE valid via the IRS, then populate the VPETE for each vCPU. Add vgic_v5_teardown() to unwind the state in the reverse order. Make the VMTE invalid, clear the per-vCPU VPETEs, release the VMTE backing state, free the doorbell IRQs and irq domain, and finally release the VM ID so that the VMTE slot can be reused by a later VM. If invalidating the VMTE, clearing a VPETE, or releasing the VMTE fails, still free the software doorbells and domain, but keep the VM ID allocated so that the VMTE slot is not reused while hardware-visible state may remain. On init failure, call the same teardown path so that partially created state is unwound consistently. As part of resetting vCPUs, mark them as valid in the VM's VPE table. This informs the IRS that a specific VPE may be made resident. Without this, the IRS will treat the VPE as invalid. Also introduce vgic_v5_send_command(), a wrapper around the VPE doorbells. It takes a struct kvm_vcpu pointer and the command to run, and invokes the function bound to that command through the vCPU's doorbell. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-15-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Implement VPE IRS MMIO OpsSascha Bischoff
Introduce interfaces to make VPEs valid, and to configure them, via the host's IRS. As with the other valid bits in the GICv5 VM tables, VPEs cannot be made valid directly, and instead are made valid via an IRS MMIO Op. Additionally, some of the VPE configuration takes place via the IRS MMIO interface too (via the IRS_VPE_CR0, IRS_VPE_DBR). VPE doorbells are, for example, configured via this interface. The existing VPE-doorbell-based commands are extended with: VPE_MAKE_VALID - Make the VPE valid in the VPET Note: There is no VPE_MAKE_INVALID as VPEs are only made invalid on teardown, at which point the whole VMTE is marked as invalid. Hence, it is not required. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-14-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: vgic: Enforce model-specific vCPU limitsSascha Bischoff
A GICv5 host with FEAT_GCIE_LEGACY can expose either a native vGICv5 or a vGICv3 device. These models do not necessarily have the same vCPU limit: the native GICv5 limit is probed from the IRS VPE capacity, while the GICv3 limit remains the fixed KVM vGICv3 limit. Keep the IRS-derived limit separately for vGICv5 creation. The pre-VGIC KVM_CAP_MAX_VCPUS value continues to expose the largest limit among the still-selectable models, and kvm_vgic_create() clamps the VM to the limit of the VGIC model userspace actually selected. Userspace can create vCPUs before creating a VGIC. Hence, checking only the number of existing vCPUs after reducing the limit is not sufficient. For example, a single vCPU with ID 500 passes the GICv2 count limit even though GICv2 can represent only eight target CPUs. The GICv2 code subsequently uses the vCPU ID in target and SGI source masks, leading to shifts beyond the width of the operand. GICv5 has a similar requirement because the userspace-provided vcpu_id is used as the index into the VPET. This means that the vcpu_id also represents the IAFFID for a VPE, and therefore is visible to the guest. After selecting the model-specific limit, validate every existing vCPU ID against it. KVM_CREATE_VCPU already enforces the same limit for vCPUs created after the VGIC, making the result independent of creation order. Link: https://lore.kernel.org/r/20260807133051.15D381F000E9@smtp.kernel.org Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-13-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Introduce guest IST alloc and managementSascha Bischoff
GICv5 guests use Interrupt State Tables (ISTs) to track and manage the interrupt state for SPIs and LPIs. These ISTs are provided to the host's IRS via the VMTE. On a host GICv5 system, SPIs do not require any up-front memory allocation prior to their use, unlike LPIs which require the OS to allocate an IST. For a GICv5 guest, the same holds from the guest's point of view: SPIs should require no explicit memory allocation by the guest. This means that KVM must provision the memory passed to the IRS for managing a guest's SPI state. Introduce the machinery needed to allocate a linear SPI IST. A later commit will allocate it as part of VM creation, before running the guest for the first time. The host is responsible for freeing this memory on guest teardown. For LPIs, the guest provisions memory for its LPI IST. KVM does not pass that memory directly to the host IRS. Instead, add support for allocating a shadow LPI IST and passing that to the IRS through the VMTE. The LPI IST may be allocated as a two-level structure when supported and required by the configured LPI ID space, as many more LPIs are expected than SPIs. The host frees this memory on guest teardown. Assigning an IST to a VM requires an IRS operation rather than writing the Valid bit directly in the VMTE. Extend the doorbell command interface with the operations needed to make SPI and LPI ISTs valid or invalid. Together with the existing VMT commands, the command set is: VMT_L2_MAP - Make a second level VM table valid VMTE_MAKE_VALID - Make a single VMTE, and hence VM, valid VMTE_MAKE_INVALID - Make a single VMTE, and hence VM, invalid SPI_VIST_MAKE_VALID - Make the SPI IST valid LPI_VIST_MAKE_VALID - Make the LPI IST valid LPI_VIST_MAKE_INVALID - Make the LPI IST invalid Once implemented, irq_set_vcpu_affinity() will act as an ioctl-like interface for issuing commands specific to either a VM or the particular VPE that the doorbell belongs to. None of these commands are plumbed through to the host IRS at this stage. There is intentionally no SPI_VIST_MAKE_INVALID command. The SPI IST will be allocated as part of VM creation and will remain valid for the lifetime of the VM. It can be freed after the VMTE has been made invalid during teardown. The LPI IST, on the other hand, is driven by the guest, which is free to invalidate and free its LPI IST at any point. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-11-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Create and manage VM and VPE tablesSascha Bischoff
GICv5 uses a set of in-memory tables to track and manage VM state. These must be allocated by the hypervisor and provided to the IRS. The VMT (Virtual Machine Table) is a linear or two-level table comprising VMT Entries (VMTEs). Each VMTE describes the state for a single VM. This state includes things such as the SPI and LPI IST configuration (coming in a future commit), an implementation-defined VM Descriptor, and a VPE Table (VPET). The VPET contains one entry per possible VPE ID belonging to a VM. It is used to mark a VPE as valid and provide the address of an implementation-defined VPE Descriptor (VPED), which the hardware uses to track and manage VPE state. Allocate each VM's VPEDs as a single dense array indexed by vcpu_idx, while the VPET remains indexed by the userspace-provided vcpu_id. This keeps VPED storage proportional to the number of vCPUs even when their IDs are sparse. The VMT and VPET are shared with the IRS. On systems with a non-coherent IRS, cache maintenance operates at cache-line granularity, while multiple entries can occupy the same cache line. Use a common lock for CPU accesses to these tables and IRS command processing so that writing back one entry cannot overwrite an IRS update to a neighbouring entry. The implementation-defined VMD and VPED storage is also visible to the IRS. Round these allocations up to whole cache lines to prevent cache maintenance from corrupting unrelated slab objects. Initialise the storage before publishing its addresses to the IRS. This commit adds support for allocating the VMT and its descriptor backing state, and for managing VMTEs. The VMTEs can be initialised or released for reuse. VM IDs are allocated with an IDA, while an XArray tracks the host-side allocations associated with populated VMTEs. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-10-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Add VPE doorbell domainSascha Bischoff
VPE doorbells allow the GICv5 hardware to notify KVM when an SPI or LPI can be signalled to a non-resident VPE. This provides the mechanism used to wake blocked vcpus once the hardware determines that the interrupt is eligible to be delivered. Add support for a per-VM VPE doorbell irq domain. The domain is created under the GICv5 LPI domain, with one doorbell allocated per VPE. Store the allocated doorbell base in the VM's GICv5 state so that later patches can request per-vcpu doorbell IRQs and use them for IRS commands and wakeups. Add the per-VPE doorbell state to the GICv5 CPU interface state. The doorbell IRQ number is populated when the IRQs are requested, and the db_fired state is used by later patches once doorbell delivery is wired up. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-9-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Cache host IRS ID registersSascha Bischoff
KVM needs access to the host IRS configuration frame to configure virtual-machine resources. The frame ID registers describe the capabilities available to KVM. Cache IRS_IDR2, IRS_IDR3, and IRS_IDR4 rather than extracting their individual fields into kvm_vgic_global_state. Accessor helpers derive the required capabilities from the cached registers. Use the cached IRS_IDR4 VPE capacity to limit the maximum number of vCPUs, while retaining VGIC_V5_MAX_CPUS as KVM's own upper bound. Keeping the raw register values lets KVM adjust the exposed capabilities when needed, as is done for ICH_VTR_EL2, and avoids tying future EL2 code to the layout of kvm_vgic_global_state. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-8-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Define remaining IRS MMIO registersSascha Bischoff
Complete the set of defined IRS MMIO registers in the GICv5 header file. Up until now, the set of defined IRS MMIO registers has been driven by code requirements. However, in order to properly emulate the IRS MMIO interface in KVM, the full set of IRS MMIO registers needs to be added. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-5-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14irqchip/gic-v5: Provide OF IRS config frame attrs to KVMSascha Bischoff
KVM needs to interact with the host IRS in order to, for example, make VMs or VPEs valid. There are two potential approaches here. Either the host irqchip driver can provide an interface, or KVM can interact directly with the host IRS. The latter of these two is chosen as the set of MMIO registers that KVM needs to interact with is orthogonal to the set used by the host irqchip driver (with the exception of some of the read-only IRS_IDRx registers). Pass KVM a pointer to an IRS config frame - the config frame belonging to ANY IRS is fine as long as one IRS's config frame is used consistently - in struct gic_kvm_info. Additionally, include a flag telling KVM whether the IRS is coherent or non-coherent in order to make sure that KVM can do the correct cache state management, if required. Only OF (Device Tree) is supported with this change. ACPI is not. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-3-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14thunderbolt: Add tb_ring_poll_pending()Mika Westerberg
This helper can be used to figure out whether tb_ring_poll() has a frame to be returned. This can be used without the caller needing to take its own lock. Assisted-by: LLM Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-09-13Merge tag 'x86_urgent_for_7.3-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Dave Hansen: "The most notable fix is THP not silently losing user data and having been around for a couple of years. The main explanation I'd have for its longevity is that it requires a few different things to align at the same time: MADV_FREE, THP and heavy reclaim. - Fix user-space data loss with THP - Fix set_memory oopses - Fix addition of large constants in mul_u64_add_u64_div_u64() - Fix FineIBT hash offset in cfi_get_func_hash() - Fix PCI device reference counting in amd_smn_init()" * tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/amd_node: Fix PCI device reference counting in amd_smn_init() x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64() x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() x86/mm: Fix user-space data loss with MADV_FREE and THP x86/mm/pat: Allocate split page tables as kernel page tables x86/alternatives: Exclude text poking against change_page_attr() x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
2026-09-13Input: document that no new LED codes should be addedDmitry Torokhov
Add a comment to input-event-codes.h clarifying that no new LED definitions should be added to the input subsystem. The existing LED_* definitions are legacy and grandfathered for backwards compatibility with userspace via evdev. Any new LED indicators should instead use the dedicated LED subsystem. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-09-14ASoC: sdw_utils: cs_amp: Delete bogus and incorrect capture channel fixupRichard Fitzgerald
Delete the asoc_sdw_cs_spk_feedback_rtd_init(). This is not needed now that the ASoC bug it was working around has been fixed. And it was broken anyway because it didn't match the way the core SoundWire code mapped codec channels to frame bitslots. This code was added to avoid a problem where multiple codec DP outputs were mapped to the same SoundWire frame bit slot. This would allow a user to break the SoundWire bus just by enabling mixer outputs using ALSA controls. As no production system has used the capture stream, this workaround was of little consequence and the problem of conflicting DP mappings was not investigated. The ASoC bug that enabled too many channels on each codec has now been fixed. So this workaround can be completely deleted. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20260910114500.1586637-6-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>