summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-10-02dt-bindings: clock: Add StarFive JHB100 System-1 clock and reset generatorChanghuang Liang
Add bindings for the System-1 clocks and reset generator (SYS1CRG) on JHB100 SoC. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02dt-bindings: clock: Add StarFive JHB100 System-0 clock and reset generatorChanghuang Liang
Add bindings for the System-0 clocks and reset generator (SYS0CRG) on JHB100 SoC. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02net: bridge: use net_bridge_dst for fdb destinationsNikolay Aleksandrov
Store fdb destinations in struct net_bridge_dst and access them through the destination helpers. This doesn't change their representation or behavior, fdb destinations still contain only bridge port pointers. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-3-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02Merge tag 'sound-7.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A fair amount of small fixes, which became much larger as a pile of pending homework during my vacation in the last weeks. The majority of changes are device-specific quirks and ASoC updates, along with a few ALSA core fixes and USB-audio hardening as well as a few regression fixes. ALSA Core: - Serialize ALSA sequencer compat port-info ioctls HD-audio: - Fix ALC235 codec headset handling - Fix regression on Tegra194 controller support - Quirks / fixes for Lenovo, ASUS, Acer, Dell, Higole, HP, and IPASON laptops USB-audio: - Hardening for line6 and ua101 drivers to deal with malformed packets - Fix input device leak on probe error in caiaq driver - Apply quirks generically for Audient and Behringer devices - Quirks for ASUS SupremeFX Hi-Fi, HiBy FC4 (native DSD), and MSI MAG B850M MORTAR WIFI ASoC: - Runtime PM fixes for SDCA class function driver - Fix uninitialized stream configs in RT1017 and MAX98363 SDW codecs - AMD ACP SoundWire support for ASUS and Lenovo models - Quirks for Intel machines (Lenovo Yoga Slim 7, Chuwi Hi8) - Qualcomm LPASS fixes for playback constraints and WSA macro volume - Codec / platform fixes for rt274/rt286, cs42l43, wm8903, Tegra ASRC Misc: - Regression fix for silent playback on Creative Titanium HD - Error handling fix at probe via auto-cleanup in ice1712" * tag 'sound-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits) spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260 ALSA: ice1712: Fix the error handling via auto-cleanup at probe ALSA: core: Define auto-cleanup for snd_card_free() ALSA: hda/realtek: Add ALC235 support for headset mode ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72 ALSA: hda/realtek: Fix mute and micmute LEDs on HP ENVY x360 15-ey0xxx ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 14-dv1001TU ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270) ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices ALSA: usb-audio: Apply boot quirk for Behringer models generically ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after enabling clocks ALSA: hda/realtek: Fix speakers on ASUS PM3406CHA ALSA: hda/realtek: Add quirk for HP Pavilion AiO 24 speaker ALSA: hda/realtek: Add mute LED quirk for HP Laptop 15-fd2xxx ASoC: amd: acp-config: Add ACP70 DMI quirk for ASUS UM5406GA ALSA: hda/realtek: Add mute LED quirks for HP Pavilion 15-eh3174nw and HP Laptop 15-dw1xxx ASoC: Intel: Add quirk to block match table for Lenovo Yoga Slim 7 ALSA: hda/realtek: Add mute LED quirk for HP Victus 15-fb2xxx ALSA: hda/realtek: Add quirk for Acer Nitro AN515-45 ALSA: hda/realtek: Add quirk for Lenovo ThinkBook G8+ ...
2026-10-02Merge tag 'random-7.3-rc6-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator fixes from Jason Donenfeld: - VMGENID memory needs to be mapped with the decrypted tag, so that SEV-SNP machines can boot - A fix for an initialization race in VMGENID, followed by a cleanup - Trivial kernel doc cleanups in siphash and random.c - A fix for a new compilation failure with recent clang on PPC and RISC-V, due to generating an out-of-line memset in the vDSO * tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: vDSO: avoid call to memset() when zeroing reserved parameter random: fix vgetrandom_opaque_params kernel-doc random: vDSO: fix repeated word 'to' in comment siphash: clean up kernel-doc comments virt: vmgenid: move to using dev_set/get_drvdata virt: vmgenid: set driver_data before registering notification handlers virt: vmgenid: remap memory as decrypted
2026-10-02PCI/pwrctrl: tc9563: Switch per-port reset to GPIO descriptor APILorenzo Bianconi
Remove the local TC9563_GPIO_MASK and TC9563_GPIO_DEASSERT_BITS definitions, which are no longer used after switching to the GPIO descriptor API. Move TC9563_GPIO_CONFIG and TC9563_RESET_GPIO definitions in tc9563.h header file. Replace the direct regmap-based per-port reset logic in assert_deassert_reset() with gpiod_direction_output() calls, falling back to the legacy regmap approach only when no reset-gpios DT property is present for a given port. Add the reset GPIO pointer to struct tc9563_pwrctrl_cfg and introduce tc9563_pwrctrl_parse_reset_line() to look up reset-gpios from each PCI downstream port child node. The lookup is done lazily at the beginning of power_on(), returning -EPROBE_DEFER until the GPIO chip is registered. Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Alex Elder <elder@riscstar.com> Link: https://patch.msgid.link/20260909-pci-tc9563-aux-v5-4-c9b33f56c8d3@oss.qualcomm.com
2026-10-02gpio: tc9563: Add support for the embedded GPIO controllerAlex Elder
Add a driver for the GPIO controller embedded in the Toshiba TC9563 PCIe switch (and the Qualcomm QPS615). The device implements 37 GPIOs using two register banks: three registers control the first 32 GPIOs and three more control GPIOs 32-36. GPIOs 20 and 21 are reserved while GPIOs 22-24, 27-28, 31, and 34 are input-only. Register the driver as an auxiliary device driver. The TC9563 power controller creates the auxiliary device and provides a regmap that gives access to the GPIO registers, so use the gpio-regmap helpers to implement the GPIO chip. Signed-off-by: Alex Elder <elder@riscstar.com> Co-developed-by: Daniel Thompson <daniel@riscstar.com> Signed-off-by: Daniel Thompson <daniel@riscstar.com> Co-developed-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> [bhelgaas: commit log per https://lore.kernel.org/arQ2mDjqHv4gmoOK@lore-desk] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Linus Walleij <linusw@kernel.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260909-pci-tc9563-aux-v5-2-c9b33f56c8d3@oss.qualcomm.com
2026-10-02firmware: arm_rmm: Add wrappers for Realm related RMI commandsSteven Price
Introduce wrappers for the RMI functions needed for creating and managing realm guests. This will be used by the KVM to manage the Realms. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Steven Price <steven.price@arm.com> Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> [catalin.marinas@arm.com: remove regs copy in rmi_smccc_invoke_once()] Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02PM: hibernate: Add an arch hook for preventing hibernationSuzuki K Poulose
Add a hook to allow arch code disable hibernation. On arm64, with an RMM active, there could be pages that are delegated to the "Realm" security state. Any access to them are fatal (e.g., hibernate save image or restoring an image to a delegated page). pKVM host also has its restrictions on enabling hibernation. Add a weak arch hook to let the architectures have a say. Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Len Brown <lenb@kernel.org> Cc: Pavel Machek <pavel@kernel.org> Cc: linux-pm@vger.kernel.org Cc: Sudeep Holla <sudeep.holla@kernel.org> Suggested-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02firmware: arm_rmm: Ensure the RMM has GPT entries for memorySteven Price
The RMM maintains the state of all the granules in the system to make sure that the host is abiding by the rules. This state can be maintained at different granularity, per page (TRACKING_FINE) or per region (TRACKING_COARSE or TRACKING_INTERMEDIATE). The region size depends on the underlying "RMI_GRANULE_SIZE". For a "coarse"/"intermediate" region, all pages in the region must be of the same state, this implies we need to have "fine" tracking for DRAM, so that we can delegate individual pages. For now we only support a statically carved out memory for tracking granules for the "fine" regions. This can be extended in the future to allow modifying the tracking granularity and remove the need for a static allocation by the firmware. Similarly, the firmware may create L0 GPT entries describing the total address space. But if we change the "PAS" (Physical Address Space) of a granule, then the firmware may need to create L1 tables to track the PAS at a finer granularity. Linux therefore checks if the platform firmware manages the PAR region. i.e., the firmware is in charge of managing the L1 GPTs (creation and the required memory for the GPT tables - via static carveouts) without host intervention. Support for dynamic GPT creation by the host will be added later. If the firmware requires us to manage the tracking or GPT memory, deactivate the RMM and reclaim any memory donated at RMM activation. Apply the same checks when hotplugged memory is brought online. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Gavin Shan <gshan@redhat.com> Signed-off-by: Steven Price <steven.price@arm.com> Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02firmware: arm_rmm: Add support for SROSteven Price
RMM v2.0 introduces the concept of "Stateful RMI Operations" (SRO). This means that an SMC can return with an operation still in progress. The host is expected to continue the operation until it reaches a conclusion (either success or failure). During this process the RMM can request additional memory ('donate') or hand memory back to the host ('reclaim'). The host can request an in progress operation is cancelled, but still continue the operation until it has completed (otherwise the incomplete operation may cause future RMM operations to fail). All memory donate operations are cancellable and if the RMM request cannot be satisfied, we cancel the request and fail the operation. (e.g., if the allocation size > MAX_PAGE_ORDER) The SRO is tracked using a struct rmi_sro_state object which keeps track of any memory which has been allocated but not yet consumed by the RMM or reclaimed from the RMM. This allows the memory to be reused in a future request within the same operation. It will also permit an operation to be done in a context where memory allocation may be difficult (e.g. atomic context) with the option to abort the operation and retry the memory allocation outside of the atomic context. The memory stored in the struct rmi_sro_state object can then be reused on the subsequent attempt. Wrappers for SRO RMI commands are also provided here because they depend on the rmi_sro_execute() implementation added by this patch. Delegate/undelegate handles are also added here because they now use the SRO/stateful command infrastructure and are also used for the memory DONATE/RECLAIM flows. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Gavin Shan <gshan@redhat.com> Signed-off-by: Steven Price <steven.price@arm.com> Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02firmware: arm_rmm: Check for RMI support at initSteven Price
Query the RMI version number and check if it is a compatible version. All RMM feature registers are read and exposed for future code to use. Also restrict the support to SMC conduit. We only support this for Little Endian kernels, the Big Endian kernel support is anyway marked BROKEN and is being removed. Cc: Marc Zyngier <maz@kernel.org> Cc: Oliver Upton <oupton@kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Gavin Shan <gshan@redhat.com> Signed-off-by: Steven Price <steven.price@arm.com> Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02arm_mpam: add MPAM-Fb MSC firmware access supportAndre Przywara
The Arm MPAM Firmware-backed (Fb) Profile document[1] describes an alternative way of accessing the "Memory System Components" (MSC) in an MPAM enabled system. Normally the MSCs are MMIO mapped, but in some implementations this might not be possible (MSC located outside of the local socket, MSC mapped secure-only) or desirable (direct MMIO access too slow or needs to be mediated through a control processor). MPAM-fb standardises a protocol to abstract MSC accesses, building on the SCMI protocol. Add functions that do an MSC read or write access by redirecting the request through a firmware interface. For now this done via an ACPI PCC shared memory and mailbox combination. Since the protocol used is only a small subset of the full SCMI spec, and the SCMI protocol has no full ACPI support anyway, open-code the (simple) SCMI message generation, for just the fields we need. [1] https://developer.arm.com/documentation/den0144/latest Signed-off-by: Andre Przywara <andre.przywara@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Tested-by: Ritwick Sharma <ritwick.sharma@arm.com> # on Arm AGI CPU Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Srivathsa L Rao <srivathsa.rao@oss.qualcomm.com> Reviewed-by: Ben Horgan <ben.horgan@arm.com> Signed-off-by: James Morse <james.morse@arm.com>
2026-10-02firmware: arm_rmm: Add SMC definitions for calling the RMMSteven Price
The RMM (Realm Management Monitor) provides functionality that can be accessed by SMC calls from the host. The SMC definitions are based on DEN0137[1] version 2.0-bet3 [1] https://developer.arm.com/documentation/den0137/2-0bet3/ Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Tested-by: Gavin Shan <gshan@redhat.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Steven Price <steven.price@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02Merge branches 'clk-fixes', 'clk-pile' and 'clk-renesas' into clk-nextBrian Masney
2026-10-02dt-bindings: clk: zte: Add zx297520v3 LSP clock and reset controllerStefan Dösinger
The clock controller of the zx297520v3 Low Speed Peripherals is relatively clean. One register per device with gates, muxes and resets and for some devices a divider. There are even bits in the matrix controller to control propagation of clock lines down to LSP. The clocks are sorted by register address and I am convinced that the device list is complete. There are, however, a few more registers that are likely extra dividers for TDM and I2S devices. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Stefan Dösinger <stefandoesinger@gmail.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-10-02dt-bindings: clk: zte: Add zx297520v3 matrix clock and reset controllerStefan Dösinger
This controller contains clocks and resets for high speed devices on the zx297520v3 board and hardware spinlocks that I expect will be necessary to communicate correctly with the LTE DSP firmware blob. I don't know much about the hwlocks yet other than that they exist, so there is no header yet adding meaning to their indices. Presumably that meaning doesn't exist in hardware and is de facto defined by ZTE's firmware blobs running on the rprocs. The zte-zx297520v3-crm driver will instantiate separate MFD children for clocks and resets, which are handled by separate clock and reset drivers. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Stefan Dösinger <stefandoesinger@gmail.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-10-02dt-bindings: clk: zte: Add zx297520v3 top clock and reset controllerStefan Dösinger
These SoCs have 3 clock and reset controllers: Top, Matrix and LSP. Clocks go from oscillator -> top -> matrix -> LSP, with a register in top controlling most clocks that get passed to matrix and a register in matrix controlling all the clocks that get passed to LSP. Generally every device has two clocks (one work clock, and one that connects it to the bus, I call it PCLK), two reset bits (I don't know what the difference is - sometimes asserting one is enough to reset the device, sometimes both need to be asserted). PCLK and WCLK are controlled by individual gates. Some devices have a mux and/or a divider for their work clock. Some devices, like the GPIO controller, only have reset bits and no clocks. The top clock controller is fed by a 26 MHz external oscillator and has 4 PLLs to generate other clock rates. ZTE's kernel mostly relies on the boot ROM to set up PLLs, but one LTE-related PLL is not configured on some boards. Therefore my driver contains code to program PLLs. It produces identical settings as the boot ROM for the pre-programmed frequencies. Not all clocks will have an explicit user in the end. I am defining a lot of them simply to shut them off. The boot loader sets up a few of the proprietary timers, which will send regular IRQs (although the kernel of course doesn't need to listen to them). I don't plan to add a driver for the proprietary timer as I see no use for them - the ARM arch timer works just fine. I will add a driver for the very similar proprietary watchdog though. The clock list in this patch is pretty complete but not exhaustive. There are other bits that are enabled, but I couldn't deduce what they are controlling by trial and error. Some of them seem to do nothing. Others cause an instant hang of the board when disabled. It is quite likely that a handful more clocks will be added in the future, but not a large number. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Stefan Dösinger <stefandoesinger@gmail.com> Signed-off-by: Brian Masney <bmasney@redhat.com>
2026-10-02dt-bindings: clock: ma35d1: Add missing WDT/WWDT parent clocksMiquel Raynal
The WDT and WWDT muxes have PCLK3/4096 and PCLK4/4096 among their possible parents, but these fixed factor clocks are currently not defined, even though they are needed to properly describe the clock tree. Add them to the bindings. Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://patch.msgid.link/20260930-perso-ma35d1-upstream-clk-v6-4-48937ee6c9bb@bootlin.com Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
2026-10-02dt-bindings: clock: ma35d1: Drop CLK_MAX_IDX defineMiquel Raynal
Drop CLK_MAX_IDX define of MA35D1 include. This is not a binding and should not be placed here. Value is defined in the user driver. Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://patch.msgid.link/20260930-perso-ma35d1-upstream-clk-v6-3-48937ee6c9bb@bootlin.com Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
2026-10-02ALSA: Drop unused snd_card_free_on_error()Takashi Iwai
Now that all users of snd_card_free_on_error() are gone by refactoring with auto-cleanup, let's drop the superfluous function. Also, update the documentation for reflecting the recommended error handling procedure, too. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20261002085517.693510-33-tiwai@suse.de
2026-10-02Merge branch 'for-linus' into for-nextTakashi Iwai
Pull again 7.3-devel branch for working on snd_card_free auto-clean changes. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-10-02bpf: Support per-call-site kfunc specializationEmil Tsalapatis
specialize_kfunc() currently updates the canonical kfunc descriptor in place. Different call sites therefore cannot select different specializations of the same kfunc, and the selected target depends on verification order. Keep canonical descriptors unchanged for verifier lookups. Specialize a copy for each call site, then reuse or append an immutable target descriptor and store its index in the finalized call instruction. Allow space for one canonical and one specialized target per kfunc. This is conservative because most kfuncs do not specialize. Adding specialized kfunc versions does not require resorting the array because lookups are only used for deduplication and func_model lookup. Deduplication for specialized kfuncs is handled by the specialization process itself, while all specializations of a function share the same proto and func_model. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-7-emil@etsalapatis.com
2026-10-02bpf: Directly store kfunc desc index in instruction off fieldEmil Tsalapatis
Currently, the verifier sort the kfunc desc table twice: Once during kfunc collection by function ID, useful during verification, and once by immediate address, useful during JIT bytecode lowering time. The latter sort can be removed by storing in the instruction the kfunc desc array index the desc is in and using that instead. Modify the JITs to follow the same convention. This change simplifies the subsequent patch that adds per-call site function specialization. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-6-emil@etsalapatis.com
2026-10-02bpf: Add sleepable argument to bpf_alloc_pages()Emil Tsalapatis
bpf_alloc_pages() currently decides whether it may use the blocking page allocator from the current execution context alone. Let callers further restrict that choice by passing whether their context is sleepable. Use the blocking allocator only when both the caller and runtime context allow sleeping. Add __GFP_RETRY_MAYFAIL so this path can reclaim without invoking the OOM killer when the allocation is charged to another memcg. Existing non-sleepable callers retain the no-lock allocation behavior. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-3-emil@etsalapatis.com
2026-10-02bpf: Use an llist for page allocationsEmil Tsalapatis
bpf_map_alloc_pages() does not use its map argument. Storing allocated pages in an array also forces arena callers to allocate a separate pointer array. Expose the single-page allocator as bpf_alloc_page(), rename the bulk helper to bpf_alloc_pages(), and return bulk allocations through an llist using page->pcp_llist. Add bpf_free_pages() to safely release all pages remaining on such a list. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-2-emil@etsalapatis.com
2026-10-02Merge tag 'asoc-fix-v7.3-rc5' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.3 A bigger collection of fixes than usual due to your vacation but nothing hugely remarkable here, just fairly standard quirks and driver specific bugfixes.
2026-10-02slimbus: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20261002101506.1084743-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-02clocksource/drivers/timer-ti-dm: Register clocksource/event only for am654Markus Schneider-Pargmann (TI)
Registering clocksource/clockevent for the older platforms breaks booting them. The older platforms have their own implementation in early boot that is used to register clocksource/clockevent in timer-ti-dm-systimer.c. With am654, the timer is much more complex with more dependencies so doing this in early boot with the other driver is very difficult and gets ugly. Instead it is implemented in the platform driver for am654. However the old platforms may not register clocksource/clockevent in this driver as that would break the boot. Add a system_timer_capable flag that is only set for am654-timer that gates the clocksource/clockevent registration. Reported-by: H. Nikolaus Schaller <hns@goldelico.com> Closes: https://lore.kernel.org/r/2013A99A-0502-4128-ACFA-B04886224393@goldelico.com Fixes: b8eeeca55456 ("clocksource/drivers/timer-ti-dm: Add clocksource support") Signed-off-by: Markus Schneider-Pargmann (TI) <msp@baylibre.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Tested-by: Andreas Kemnade <andreas@kemnade.info> # OMAP3 GTA04 Tested-by: Kevin Hilman <khilman@baylibre.com> # OMAP3 Beagle XM Tested-by: H. Nikolaus Schaller <hns@goldelico.com> # OMAP3 OpenPandora Link: https://patch.msgid.link/20260828-v7-3-next-topic-ti-timer-dm-clocksource-omap-fix-v1-1-85f0e4dc6f9f@baylibre.com
2026-10-02irq: Explain better on NMI_MASK overflow conditionBoqun Feng
Currently __preempt_count_nmi_enter() uses 15 as the maximum NMI nesting level, and it's because 4 bits are used to represent the nesting level of NMI. Replace the tautological comment with a more direct mention to the 4 bits limitation to help readers understand this condition. Suggested-by: Shrikanth Hegde <sshegde@linux.ibm.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com> Link: https://patch.msgid.link/20261001082519.16195-5-boqun@kernel.org
2026-10-02irq: Add {over,under}flow detection for local_interrupt_{enable,disable}Boqun Feng
Currently there is no way to detect overflow and underflow inside the HARDIRQ_DISABLE_MASK part of preempt_count. Add these detection guarded by DEBUG_PREEMPT similar to the detection for PREEMPT_MASK {over,under}flow. Suggested-by: Shrikanth Hegde <sshegde@linux.ibm.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com> Link: https://patch.msgid.link/20261001082519.16195-3-boqun@kernel.org
2026-10-02tty: add missing driver flag kernel-doc colonJohan Hovold
A recent change adding a new TTY driver flag left out a colon required for well-formed kernel-doc. Fixes: 8df07fe93573 ("tty: fix saved termios reset race") Reported-by: Randy Dunlap <rdunlap@infradead.org> Link: https://lore.kernel.org/ec3a09d6-4ba4-41b8-abb1-b59e265f4532@infradead.org Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20261002072736.2063004-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-02KVM: Remove unused file_is_kvmSteffen Eiden
Remove the now unused file_is_kvm function. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-02KVM/vfio: Use file-based reference counting for KVMSteffen Eiden
Replace manual module reference counting with file-based reference counting for KVM integration. Previously, VFIO used symbol_get() to obtain function pointers for kvm_get_kvm_safe() and kvm_put_kvm(), then manually tracked module references through these symbols. This approach required storing the put_kvm function pointer in each device and carefully managing symbol references. Pass struct file pointers instead of struct kvm pointers throughout the VFIO-KVM interface, leveraging the kernel's existing file reference counting via get_file()/get_file_active() and fput(). Convert the x86 page-track API and update s390 vfio to use file_to_kvm_<arch>(). This simplifies the code. Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Acked-by: Alex Williamson <alex@shazbot.org> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> [borntraeger@linux.ibm.com remove _safe from vfio_device_get_kvm_safe] Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-02KVM: Add file back-pointer to struct kvmSteffen Eiden
Add kvm->file as a no-reference back-pointer to the VM file in struct kvm. The pointer is set at VM creation time and cleared under WRITE_ONCE() in kvm_vm_release() before the file is freed. Callers storing the file must take their own reference. Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-02KVM: Introduce file_to_kvm_<arch>() infrastructureSteffen Eiden
Add a macro mechanism that generates an opt-in and arch-namespaced file_to_kvm_<arch>() to convert a file reference to a kvm object if the file handle represents a kvm handle. Activate for x86 and for s390 (native KVM only). Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-02braille: nbcon: Allow to use a serial console with NBCON API as Braille consolePetr Mladek
The Braille console is not registered in console_list. Instead, it is integrated with the virtual terminal (VT) and shows what is displayed on the terminal. It writes the data using con->write*() callback of the associated serial console driver. braille_write() is called from the VT code under console_lock(). The associated serial console driver can be converted to the NBCON API though. The situation is similar to flushing nbcon consoles in the legacy loop when some boot consoles are still registered, see nbcon_legacy_emit_next_record(). But there is a big difference though. braille_write() is not directly called from the code paths flushing registered consoles. The VT code expects that braille_write() succeeds. It does not replay the message when it can't acquire the ownership. As a result, braille_write(): + must try harder to get the ownership. + has to be synchronized only against non-printk serial console which depend nbcon_device_try_acquire() using NBCON_PRIO_NORMAL. Let's look at it from another side and try to simulate the original locking using the NBCON API: 1. Take con->device_lock(), aka the port->lock in the legacy serial console driver. 2. Acquire nbcon context to provide some synchronization for a panic() context. Use NBCON_PRIO_NORMAL because it contends only with nbcon_device_try_acquire() users. Do it in a busy loop. It should always succeed when con->device_lock() succeeded because all other users do the same. The only exception is when the context get acquired by a CPU handling panic. 3. In panic, disable interrupts and try to acquire the nbcon context. Use NBCON_PRIO_PANIC. And try even an unsafe takeover because otherwise the Braille console won't see the text shown during panic(). It is similar to the oops_in_progress/trylock handling in the legacy serial console driver. Finally, avoid the newline prepending logic in the existing serial console drivers when they are used as a Braille console. As explained above, the Braille console shows the last modified line on the terminal (VT). braille_write() is called when single characters are added. Most messages are not ended by newline. Anyway, the VT code does not have logic to reply partially printed messages. Fixes: 13189fa73afa ("printk: nbcon: Rely on kthreads for normal operation") Reviewed-by: John Ogness <john.ogness@linutronix.de> [pmladek@suse.com: Remove white space changes in braille_register_console(). Typo fix.] Link: https://patch.msgid.link/20261001140727.124398-2-pmladek@suse.com Signed-off-by: Petr Mladek <pmladek@suse.com>
2026-10-02soc/tegra: Fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-10-02rhashtable: specialize default comparison for constant parametersUsama Arif
The inline lookup and insert helpers receive the rhashtable parameters by value. With a static const parameter block, key_offset and key_len are compile-time constants at the call site. The default comparison throws that information away by reading both fields back from ht->p. Fixed-size keys consequently load the parameters and call bcmp() for every object in the bucket, even when the compiler could use scalar comparisons instead. The commit "sched_ext: Specialize the DSQ hashtable compare" [1] resulted in a 2.9x faster DSQ lookup after replacing this path for its u64 key with a scalar comparison. Doing that through obj_cmpfn requires every fixed-key user to provide its own callback. Pass the call-site parameters to rhashtable_compare(), as rht_key_get_hash() already does. Use them when key_len is a compile-time constant. Retain the ht->p path for dynamic parameter blocks. A constant zero key_len continues to take the runtime length from ht->p.key_len. This specializes the default comparison for all fixed-size users. With Clang 22 on x86-64, bcmp() disappears from sched_ext, mac80211, NFSd, TIPC, NFQUEUE, VFS superblock, pidfs, SysV IPC and hardware-breakpoint table paths. The affected build_policy.o, sta_info.o and nfsd filecache.o text shrinks by 512, 400 and 352 bytes respectively. Four- and eight-byte keys become direct scalar comparisons; six-byte MAC addresses become a four-byte and a two-byte comparison. Measure the VFS case with ustat() on a mounted ramfs. This exercises user_get_super() and its super_dev lookup. Across ten interleaved baseline and patched VM boot pairs, with five 3 million call samples per boot, the average per-boot median latency drops from 477.2 to 462.6 ns per call, or 3.0%. All ten pairs improved. No functional change intended. [1] https://lore.kernel.org/all/20260921171928.1639407-1-usama.arif@linux.dev/ Suggested-by: Mykola Lysenko <nickolay.lysenko@gmail.com> Signed-off-by: Usama Arif <usama.arif@linux.dev> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-10-02crypto: hisilicon/qm - add __counted_by_ptr to dfx_diff_registersBill Wendling
Annotate the pointer field 'regs' in 'struct dfx_diff_registers' with the '__counted_by_ptr' attribute, referencing the 'reg_len' member which holds the element count of the allocated memory. In 'drivers/crypto/hisilicon/debugfs.c', the 'dfx_regs_init' function allocates the 'diff_regs' array and initializes each element's 'regs' pointer after setting its 'reg_len'. Since 'reg_len' is set before 'regs' is assigned, the compiler's bounds sanitizer can correctly associate the pointer with its allocated size. Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling <morbo@google.com> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-10-02crypto: hisilicon/qm - annotate cap_tables with __counted_by_ptrBill Wendling
Annotate the 'qm_cap_table' and 'dev_cap_table' pointer fields in 'struct hisi_qm_cap_tables' with the '__counted_by_ptr' attribute. This improves bounds checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE, allowing KASAN and compiler diagnostics to detect out-of-bounds accesses. The 'qm_cap_table' pointer is associated with 'qm_cap_size' which specifies its element count. Similarly, 'dev_cap_table' is associated with 'dev_cap_size'. To ensure safety under compiler instrumentation, the assignments in the initialization paths have been updated to set the 'size'/'count' fields prior to setting the pointer fields. This prevents any transient state where the pointer is valid but the count is 0 (or uninitialized), ensuring that subsequent accesses to these tables do not trigger false-positive bounds check panics. Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling <morbo@google.com> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Reviewed-by: Longfang Liu <liulongfang@huawei.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-10-02firmware: tegra: bpmp: Add MBWT sysfs interfaceAniruddha Rao
Different workloads can place different memory-bandwidth demands on the system. Selecting an appropriate bandwidth limit depends on the runtime workload mix and on the devices carrying that traffic, such as PCIe traffic or GPU traffic connected over the chip-to-chip link (NVCLINK). That information is not available to the kernel. BPMP firmware of some Tegra platforms provides Memory Bandwidth Throttler (MBWT) controls for PCIe and GPU traffic connected over NVCLINK on the path to DRAM. Each PCIe bandwidth group has a single shared cap for all traffic in that group. Bandwidth for a group can be set per traffic type. Describe the available bandwidth groups and traffic types in platform data. Each entry maps a sysfs name to the corresponding firmware instance and VC type so that these values can vary between platforms. Add sysfs attributes on the tegra-bpmp platform device to expose a narrow userspace interface for MBWT control. The attributes are arranged as mbwt/<bandwidth-group>/<traffic-type>/bandwidth. The directory names come from platform data. The current platform description uses pcie0 through pcie5 for bandwidth groups and pcie_read, pcie_write and nvclink for traffic types. Reading a bandwidth attribute queries firmware for the selected bandwidth group and traffic type. Writing an integer programs the target bandwidth cap in GB/s for that bandwidth group and traffic type. Register the attributes only when BPMP firmware reports support for the MBWT GET_BW and SET_BW requests through its query ABI. Signed-off-by: Aniruddha Rao <anrao@nvidia.com> [treding@nvidia.com: minor stylistic changes] Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-10-02firmware: tegra: bpmp: Add the Memory Bandwidth Throttler ABI definitionsAniruddha Rao
Different workloads can place different memory-bandwidth demands on the system. BPMP firmware of some Tegra platforms provides Memory Bandwidth Throttler (MBWT) controls for PCIe and GPU connected over chip-to-chip link (NVCLINK) traffic on the path to DRAM so software can query and program those bandwidth caps. The MBWT controls are not exposed through ordinary host MMIO and are accessible only through BPMP firmware requests. Add the ABI definitions for the MBWT message request (MRQ), including the MRQ ID, sub-command IDs, and request/response payloads needed to issue the MBWT control requests defined by BPMP firmware. Signed-off-by: Aniruddha Rao <anrao@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-10-01amt: send the relay's General Query directly from the receive pathOmar Ramadan
An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb->cb. For example, with igmp_qrv set to 1 on the relay a tunnel lives for 135s, so a netem delay of 180s on the amt device outlives it; when the tunnel expires and is freed, the subsequent dequeue triggers a use-after-free in amt_dev_xmit(). BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20 Call Trace: amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262] dev_hard_start_xmit+0x22f/0x620 sch_direct_xmit+0x12e/0xac0 netem_dequeue+0x333/0xc50 net_tx_action+0x35c/0xa60 amt_send_igmp_gq() and amt_send_mld_gq() are only called from amt_request_handler(), inside the rcu_read_lock_bh() section of amt_rcv(). amt_request_handler() already has the tunnel the query is for: it found or created it inside that section. Queuing the query with dev_queue_xmit() only leads back into amt_dev_xmit(), which strips the Ethernet header and calls amt_send_membership_query() for that tunnel. Make that call directly from the two senders instead, the same way amt_send_advertisement() transmits from the receive path. The query never waits in a qdisc, the tunnel is only dereferenced inside the RCU section that found or created it, and nothing is stored in skb->cb, so no lookup or refcount is needed. Remove the query branch of amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no users left. Behaviour changes: - The relay's own General Queries no longer pass through the amt device's egress path: its qdisc, tc egress (clsact/tcx), the netfilter egress hook and packet taps. They are still visible as UDP on the underlay. - A query that is sent successfully is no longer counted as tx_dropped. The old query branch left through the unlock label, which counted every sent query as dropped. - A query that reaches amt_dev_xmit() on a relay from elsewhere, such as a userspace querier, is now dropped at the IGMP/MLD type switch. Before, it trusted whatever skb->cb held, and a NULL tunnel hit the WARN_ON(1). Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") Reported-by: AutonomousCodeSecurity@microsoft.com Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu> Reported-by: Cen Zhang (Microsoft Security FORGE Labs) <cenzhang@linux.microsoft.com> Signed-off-by: Omar Ramadan <omar@blockcast.net> Link: https://patch.msgid.link/20260928202312.74574-2-omar@blockcast.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-01srcu: Make Tiny call_srcu() safe to call from any contextPuranjay Mohan
Give Tiny call_srcu() the same treatment as Tree SRCU. When interrupts are disabled and the scheduler is up, stage the callback on the srcu_struct's lockless list for an irq_work to re-issue later. Tiny SRCU is uniprocessor, so there is no CPU-offline drain. A draining flag drops a deferring call_srcu() that re-enters mid-drain (unless from an NMI), as in Tree SRCU; such a drop can strand state the caller tied to the callback, not just the callback itself. Interrupts stay off for the whole batch. TINY_SRCU implies !SMP, where arch_irq_work_has_interrupt() is false, so the drain always waits for the tick and a batch is whatever one tick's worth of interrupts-disabled call_srcu()s staged. Unlike the other three flavors srcu_do_enqueue() here has no debug_rcu_head_queue(), so nothing reports a double call_srcu(); termination of the drain rests on srcu_do_enqueue() clearing ->next, and the callback list self-links at the tail exactly as a double call_srcu() made it before. srcu_barrier() (now out of line) and cleanup_srcu_struct() drain the deferred list first, so a deferred callback is re-issued onto the callback list and invoked by the grace-period work that cleanup_srcu_struct() flushes, rather than stranded on a soon-to-be-freed srcu_struct. cleanup_srcu_struct() also syncs ->defer_iw, since that irq_work is embedded in the srcu_struct the caller is about to free. The draining flag is global rather than per-srcu_struct: a re-entrant call_srcu(B) inside a drain of A raises B's own ->defer_iw, whose drain can stage back onto A, so a per-srcu_struct flag would not break the chain. The cost is that a drain of A also drops a non-NMI call_srcu() to any other srcu_struct for its duration. Gated by CONFIG_RCU_DEFER like Tree SRCU, though the srcu_struct members are unconditional. Suggested-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-01srcu: Make call_srcu() safe to call from any contextPuranjay Mohan
call_srcu() has the same constraint as call_rcu(): srcu_gp_start_if_needed() enqueues under raw_spin_lock_irqsave() and may walk the srcu_node tree, as do callback invocation and grace-period work, so a call_srcu() with interrupts already disabled can race an operation in flight on this CPU. call_rcu_tasks_trace() is call_srcu() under the hood, so a sleepable BPF program freeing an object can reach this. Defer as call_rcu() does: stage the callback on the srcu_data's ->defer_cbs, chain that srcu_data onto a per-CPU list, and raise a per-CPU irq_work that re-issues it straight to the enqueue helper, never back through __call_srcu(). The irqs-enabled path is unchanged; as for call_rcu() the gate is bare irqs_disabled(), so callers that merely hold interrupts off are deferred too and pay one irq_work hop, including call_rcu_tasks_trace() from the BPF memalloc irq_work. The irq_work is per-CPU rather than per-srcu_struct and statically initialized, so deferral never runs check_init_srcu_struct(); it is IRQ_WORK_INIT_HARD as for call_rcu(). srcu_barrier() flushes it first, and rcutree_migrate_callbacks() calls srcu_offline_drain() for an outgoing CPU. cleanup_srcu_struct() drains before its "just leak it" early returns, and srcu_module_going() before freeing any ->sda, since a staged srcu_data left chained on a per-CPU list would dangle. Staging is two steps, the callback onto ->defer_cbs and then the srcu_data onto the per-CPU list, so a flusher can find the per-CPU list empty while a callback whose call_srcu() has not returned sits on ->defer_cbs; the staging CPU's own irq_work takes that one. The per-CPU srcu_defer ->lock, not any srcu_data's, is held with interrupts off across the whole nested drain: the chain of srcu_datas staged on that CPU and, for each, its callbacks, with srcu_do_enqueue() taking that srcu_data's ->lock and possibly starting a grace period for every one. That is what serializes the drainers. The bound is as for call_rcu(): what one interrupts-disabled region could stage, normally a single callback, or whatever accumulates before the tick where arch_irq_work_has_interrupt() is false. Both lists are drained newest-first; nothing depends on call_srcu() ordering. The drain clears ->next before re-issuing, which bounds a node self-linked by a double call_srcu(); a longer cycle is not bounded, and a double call_srcu() stays undefined, as for call_rcu(). A callback deferred past the CPUHP_AP_SMPCFD_DYING irq_work flush leaves that CPU's srcu_defer ->iw claimed with its self-IPI lost, as for call_rcu(). srcu_offline_drain() still re-issues the callback, but the irq_work cannot be un-queued, and here the claim is shared by every srcu_struct on the CPU. As in call_rcu(), the re-issue runs with interrupts disabled and can be re-entered by instrumentation, so a per-CPU flag, set only while that CPU is inside its own irq_work drain, drops a deferring call_srcu() seen mid-drain unless it comes from an NMI. Such a drop can strand state the caller associated with the callback, not just the callback itself. Staging records only the callback, so a deferred expedited call_srcu() completes as a normal grace period. Only srcu_expedite_current() can hit that, and only when invoked with interrupts already disabled. Gated by CONFIG_RCU_DEFER, though the srcu_data members and the per-CPU srcu_defer are unconditional. Under CONFIG_PROVE_RCU, warn if the direct path is reached from an NMI. Suggested-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-10-02drm/tegra: Wait for syncpoint syncobj_in fences in hardwareMikko Perttunen
Currently all syncobj_in fences are waited synchronously on the CPU. However, since Host1x channels are capable of waiting for syncpoint fences on the hardware, let's use that capability. This filters the any non-syncpoint (or different host1x instance) fences in syncobj_in, waits only those on the CPU, and adds the rest as waits to the channel before the actual job contents. Also make minor clarifications to the doc comments in the UAPI header. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260730-b4-host1x-syncobj-wait-v1-6-afa730410392@nvidia.com
2026-10-02gpu: host1x: Add host1x_fence_extract()Mikko Perttunen
Syncpoint fences are backed by a hardware syncpoint / threshold, which various hardware is capable of waiting for directly without CPU intervention. Add a function to allow drivers for such devices to extract the details to allow programming the hardware accordingly. The function also provides the host1x instance corresponding to the syncpoint since a system may contain multiple instances of host1x with separate sets of syncpoints. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260730-b4-host1x-syncobj-wait-v1-5-afa730410392@nvidia.com
2026-10-02gpu: host1x: Add option for disabling context stealingMikko Perttunen
Add kernel module parameter to allow disabling context stealing in cases where reliability and consistency is preferred. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260710-b4-host1x-ctxsteal-v1-2-b1f8f6b37cc5@nvidia.com
2026-10-02gpu: host1x: Memory context stealingMikko Perttunen
Currently, each process holding an open TegraDRM channel reserves for itself one of the limited number of hardware memory contexts. Attempting to allocate a channel when all contexts are in use results in failure. While we cannot have more contexts than the hardware supports in active use, idle channels don't necessarily need to have a backing memory context. As such, in this patch, we add another layer to allow hardware memory contexts to be "stolen away" by channels that are in active use, from idle processes. The way this is implemented, is by keeping track of memory mappings on each abstracted memory context. If we need to steal that memory context's backing hardware context, we unmap everything from it and give it away. When that abstracted memory context is needed again (re-activated), we attempt to allocate or steal another hardware context and re-map the previously unmapped buffers. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260710-b4-host1x-ctxsteal-v1-1-b1f8f6b37cc5@nvidia.com