summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-10-03sched_ext: Generate qseq from a per-task counterKuba Piecuch
finish_dispatch() uses the qseq embedded in p->scx.ops_state to tell whether the QUEUED instance of a task it's about to claim is the one scx_bpf_dsq_insert() saw. qseq is generated from rq->scx.ops_qseq, but the counters of different rqs are independent, so if a task is dequeued and re-enqueued on a different rq between scx_bpf_dsq_insert() and finish_dispatch(), the new QUEUED instance can end up with the same qseq as the old one: CPU X CPU Z ----- ----- enqueue p on rq A, qseq = N ops.dispatch() scx_bpf_dsq_insert(p) records qseq N sched_setaffinity(p) dequeue p from rq A enqueue p on rq B, qseq = N finish_dispatch(p, N) qseq matches, p is claimed The claim itself is still atomic so the core stays consistent, but an insert issued for a previous QUEUED instance gets applied to a new one which the BPF scheduler has just received through ops.enqueue(). This breaks the guarantee that dispatches targeting a stale instance are ignored. Generate qseq from a per-task counter, p->scx.ops_qseq, instead so that consecutive QUEUED instances of a task never share a qseq regardless of which rq they're on. The counter is only updated in scx_do_enqueue_task() with the task's rq locked, so no additional synchronization is needed, and it fits in an existing hole in struct sched_ext_entity on 64bit. Remove the now unused rq->scx.ops_qseq. Never generate qseq 0. NONE and DISPATCHING don't carry a qseq, so scx_bpf_dsq_insert() on a task in either state records 0. With a per-task counter, every task's first QUEUED instance would otherwise get qseq 0 and could be claimed by such an insert. Wrap the counter where the QSEQ field wraps so that it can't reach a value that shifts to 0 on 32bit either. Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class") Cc: stable@vger.kernel.org # v6.12+ Assisted-by: Claude:claude-opus-5.5 Signed-off-by: Kuba Piecuch <jpiecuch@google.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-04media: Consolidate AtomISP v2 PCI IDs in the pci_ids.hAndy Shevchenko
We have a few drivers using same pair of the PCI IDs across the kernel and there seems more to go, consolidate AtomISP v2 PCI IDs in pci_ids.h database. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Acked-by: Bjorn Helgaas <bhelgaas@google.com> # pci_ids.h Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-10-03media: ipu-bridge: Keep the clock-noncontinuous property name out of rodataFernando Rimoli
The software nodes ipu-bridge registers on a successful init are never unregistered. There is no module_exit and no remove hook, and every software_node_unregister_node_group() call sits on an error unwind label inside ipu_bridge_init(), so on success the nodes stay registered and readable after the module is unloaded, which a later rebind relies on. Nothing reachable from a registered node may therefore point into the module image. PROPERTY_ENTRY_BOOL() stores a pointer to its name, so the "clock-noncontinuous" string literal leaves the surviving node carrying a dangling property name once ipu-bridge is gone. Add the name to struct ipu_property_names, which is copied by value into each struct ipu_sensor, and use that copy, as every other endpoint property name already does. Fixes: 8e3def7bf410 ("media: ipu-bridge: Request non-continuous clock for ov5693 on IPU6") Reported-by: D. Manresa <dmanresa@gmail.com> Closes: https://lore.kernel.org/linux-media/20260905211307.542810-1-dmanresa@gmail.com/ Signed-off-by: Fernando Rimoli <fernandorimoli11@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-10-03Merge tag 'tty-7.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small tty/serial driver fixes for 7.3-rc6. Nothing major here, just lots of small fixes for reported issues, some of them very long-standing: - tty hangup fixes that have been there since the BKL days and kept tripping people up over time. - vt selection bugfix - other vt bugfixes (memory leaks and screen update fixes) - n_gsm bugfix - qcom-geni serial driver bugfix - 8250 serial driver bugfixes - other tiny serial driver fixes All of these have been in linux-next, the last few only a few days but testing here seems solid (this pull request was generated on that tree)" * tag 'tty-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (37 commits) tty: add missing driver flag kernel-doc colon vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() vt: skip screen update for DEC alignment test on backgroup consoles vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF serial: sc16is7xx: reduce TX refill rate with half-FIFO trigger serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL serial: tegra: don't clear the Tx FIFO on an Rx-only reset serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around tty: fix saved termios reset race tty: serial: mpc52xx_uart: move static declarations up. tty: serial: max3100: shut down timer before freeing port tty: add break_wait kernel-doc serial: qcom-geni: keep registered console runtime active serial: qcom-geni: Fix unbalanced runtime PM resume for no_console_suspend serial: qcom-geni: avoid unused-function warning tty: serial: qcom_geni_serial: Keep console RX functional after deep idle soc: qcom: geni-se: Correct QUP Core ICC vote constants serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() serial: vt8500: Fix clock reference leak in vt8500_serial_probe() kgdboc: Fix tty driver reference leak in configure_kgdboc() ...
2026-10-03Merge tag 'usb-7.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/Thunderbolt fixes from Greg KH: "Here is a big set of USB and Thunderbolt driver fixes for 7.3-rc6. They were delayed on my side due to conference travel, not the fault of the submitters at all. Included in here are: - lots of small thunderbolt fixes for reported issues due to more testing and devices and a few reverts as well based on that work - more usb-serial device ids added - usb-serial and cdc-acm driver hangup and other fixes - dwc3 driver fixes for reported problems - lots of usb gadget driver fixes as people again fuzz these drivers and send in fixes, which is nice to finally see - typec driver fixes for reported problems - octeon-hcd driver fixes for reported problems - more usb-storage quirks added - other small USB driver bugs resolved for reported problems All of these have been in linux-next without any reported issues" * tag 'usb-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (63 commits) usb: dwc3: gadget: fix IRQ storm on invalid event buffer count Revert "usb: dwc3: gadget: fix IRQ storm on invalid event buffer count" USB: gadget: dummy-hcd: Fix wait for outstanding request completions usb: typec: port-mapper: Only match USB4 port if host interface is available usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe usb: dwc3: gadget: fix IRQ storm on invalid event buffer count usb: typec: ucsi: Get the connector fwnode based on reg value usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd usb: core: clear both ep_in and ep_out for non-ep0 control endpoints USB: cdc-acm: skip URB restart in port_shutdown if disconnected usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC usb: gadget: aspeed-vhub: cancel wake work on device removal thunderbolt: Disable CL states for the Anker Prime TB5 dock thunderbolt: stream: Announce support for FMODE_NOWAIT usb: typec: ucsi: displayport: Current CAM OOB index fixup usb: ohci-st: disable controller wakeup on removal usb: ohci-spear: disable controller wakeup on removal usb: ohci-s3c2410: disable controller wakeup on removal usb: ohci-da8xx: disable controller wakeup on cleanup usb: cdns3: fix use-after-free in cdns3_gadget_exit() ...
2026-10-03phy: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260907062518.12810-1-hemanth.selam@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-10-03bpf: Treat load and store through a number as arena accessAlexei Starovoitov
There are no address spaces in Rust. LLVM emits plain loads and stores for arena memory, without cast_kern: r3 = 0x20 ll // R_BPF_64_64 .bss, libbpf puts it into arena r2 = *(u64 *)(r3 + 0) // R3 invalid mem access 'scalar' lock *(u64 *)(r2 + 8) += r1 Add BPF_F_ARENA_SCALAR flag of BPF_PROG_LOAD. When the program is loaded with it and has an arena treat ldx, stx, st and atomics through a number as arena access. It's as safe as access through PTR_TO_ARENA: JIT adds the base of arena to the low 32 bits of the address. The program has an arena only with CAP_BPF and CAP_PERFMON. Registers of the program are not changed, since Rust compares and stores the address after the access. bpf_do_misc_fixups() copies the low 32 bits into BPF_REG_AX and the access goes through it: r2 = *(u64 *)(r3 + 0) -> w12 = w3 r2 = *(u64 *)(r12 + 0) Constant blinding needs BPF_REG_AX for immediates and leaves insns that use BPF_REG_AX alone. So the immediate of st through a number is not blinded, the rest of the program is: *(u64 *)(r3 + 0) = 1 -> w12 = w3 *(u64 *)(r12 + 0) = 1 The same insn may see PTR_TO_ARENA on another path. It works for both. It's a flag, since a number is also what the verifier makes of a pointer that went away when the program has CAP_PERFMON: a ringbuf record after bpf_ringbuf_submit(), a pointer to the packet after bpf_skb_pull_data(). Programs in C that have an arena keep "invalid mem access 'scalar'" for such bugs. JIT tells with bpf_jit_supports_arena_scalar() that it takes BPF_REG_AX as the address of arena access. With other JITs the flag is rejected with -EOPNOTSUPP. x86 and arm64 do: - x86: the fault handler finds the register that holds the address through reg2pt_regs[]. Add BPF_REG_AX, r10 of x86, there. - arm64: nothing else is needed. The JIT takes any register as the address and the fault handler reads it by its number. Compile tested only. Any number is an address of arena, NULL and small numbers included, like it is for PTR_TO_ARENA: arena code in C dereferences NULL and relies on the fault being handled. Still rejected: - insn that sees a number on one path and a pointer that is not PTR_TO_ARENA on another. - numbers passed to helpers and kfuncs, except __arena arguments. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20261002124714.180012-4-alexei.starovoitov@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-03tracing/remotes: Add REMOTE_EVENT_CUSTOM_PRINTK() helperVincent Donnefort
The current REMOTE_EVENT() takes as a __printk argument a string format and a list of arguments, such as RE_PRINTK("foo=%d bar=%d", foo, bar). Add a REMOTE_EVENT_CUSTOM_PRINTK() where the __printk argument can be a function. This intends to support the creation of a "printk" event for the arm64 nVHE/pKVM hypervisor with a dynamic prototype and by extension a dynamic print format. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Reviewed-by: Fuad Tabba <tabba@google.com> Tested-by: Fuad Tabba <tabba@google.com> Acked-by: Steven Rostedt <rostedt@goodmis.org> Link: https://patch.msgid.link/20261001143000.3371786-4-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-10-03nvme: fix swapped ZRASF zone state values for full and read onlyKarl Bonde Torp
The Zone Management Receive command Zone Receive Action Specific (ZRASF) reporting option values for the Full and Read Only zone states are swapped compared to the NVM Express Zoned Namespace Command Set Specification, Revision 1.5, Figure 35: - 5h lists the zones in the ZSF:Full state. - 6h lists the zones in the ZSRO:Read Only state. The nvmet ZNS backend uses these constants to map the ZRASF value received from the host to a block layer zone condition when filtering zones in Report Zones. Because of the swap, a host asking for full zones was given the read only zones, and a host asking for read only zones was given the full zones. Swap the values of NVME_ZRASF_ZONE_STATE_FULL and NVME_ZRASF_ZONE_STATE_READONLY to match the specification. Fixes: aaf2e048af27 ("nvmet: add ZBD over ZNS backend support") Cc: stable@vger.kernel.org Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Signed-off-by: Karl Bonde Torp <k.torp@samsung.com> Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-10-03Merge tag 'drm-misc-next-2026-10-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.4: Cross-subsystem Changes: Documentation: - Fix indention in display-related DT bindings Core Changes: - Provide helpers for calculating absolute and relative timeouts clients: - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko display: - dp/mst: Improve DPCD compliance sched: - fix locking Driver changes: amdxdna: - Support AIE2 rev 9 - Fix UAF access in scheduler fences - Update workqueue interface bridge: - Select DRM_PANEL_BRIDGE for various drivers that require it host1x: - Support partitioning imagination - Clean up firmware interface imx: - Replace simple-display with regular atomic helpers ivpu: - Simplify NULL-pointer handling in cleanup code mxsfb: - Support bus formats plus DT bindings panel: - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization - edp: NV140WU2-M70 - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE DV215FHM-R01 plus DT bindings - Refactor struct drm_panel to contain struct drm_bridge plus fallout in various panel drivers panthor: - Validate user-space input against firmware limits renesas: - Support RZ/G3L SoC ssd130x: - ssd132x: Set correct hardware window when clearing screen host1x: - support partitioning panel: - fix fallout from bridge-related changes tegra: - improve syncobj handling on submit Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20261002120720.GA720384@linux.fritz.box
2026-10-03soc/tegra: fuse: Support revision B01Aaron Kling
Previously, all supported SoCs only used the A major revision. The Tegra210B01 SoC incremented the major revision. Add support for this. Signed-off-by: Aaron Kling <webgeek1234@gmail.com> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-10-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.3-rc5Alexei Starovoitov
Cross-merge BPF and other fixes after downstream PR. Conflicts: arch/arm64/net/bpf_jit_comp.c arch/x86/net/bpf_jit_comp.c Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-10-02Merge tag 'cifs-fixes-7.3-rc6' of https://git.manguebit.org/linuxLinus Torvalds
Pull smb client fixes from Paulo Alcantara: "Fix a series of data corruption and I/O error bugs found by running generic/363 (fsx) in a loop against Windows Server 2022 and Samba. - Stop data dirtied past EOF through an mmap from reappearing as file content once the file is extended by a write, truncate, zero range, copy range or clone range - Flush dirty data and drain in-flight I/O before operations that assume the pagecache and the server agree on the file: querying allocated ranges, the O_TRUNC open, interior zero range, and server-side copy/clone - Stop a genuine size-extending zero range or preallocate from being refused with -EOPNOTSUPP when the inode is not read caching, by querying the server's authoritative EOF instead of trusting a stale cached i_size - Zero the untransferred tail of a short read, both in the netfs read-gaps path (where stale folio content could otherwise be written back to the server) and in the DIO/unbuffered read collector, and tell a real EOF apart from a stale cached remote_i_size after a lease downgrade - Require stable pages on signed connections so a buffered write can't modify a folio whose signature has already been computed and is in flight, which the server rejected with STATUS_ACCESS_DENIED and the client surfaced as -EIO - Split several cifsFileInfo flags out of a shared bitfield byte so concurrent updates taken under different locks no longer clobber each other through a byte-level RMW" * tag 'cifs-fixes-7.3-rc6' of https://git.manguebit.org/linux: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races smb: client: require stable pages for signed connections smb: client: distinguish real EOF from a stale remote_i_size on read netfs: zero the tail of a short DIO/unbuffered read smb: client: only require read lease for size-extending preallocate netfs: zero gaps in read-gaps folio to avoid writing back stale data smb: client: only require read lease for size-extending zero range smb: client: drain and invalidate before server-side copy/clone smb: client: flush dirty data before zeroing a range smb: client: drain outstanding I/O before truncating on O_TRUNC open smb: client: flush and commit data before querying allocated ranges smb: client: discard post-EOF pagecache when extending a file via clone range smb: client: discard post-EOF pagecache when extending a file via copy range smb: client: discard post-EOF pagecache when extending a file via zero range smb: client: clear post-EOF pagecache when extending a file via truncate netfs: clear post-EOF pagecache when extending a file via write
2026-10-02dt-bindings: soc: starfive: Add StarFive JHB100 syscon modulesChanghuang Liang
Add documentation to describe StarFive JHB100 SoC System Controller Registers. Add the PLL clocks for the sys0, per0, and per1 domains under syscon, as well as the PCIe RP reset. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Alexei Starovoitov: - Fix overflow of backward jump offset in constant blinding (Alexei Starovoitov) - Fix packet range of packet pointers sharing an id when var_off tightens umax of one pointer and not the other (Alexei Starovoitov) - Fix objects stuck in free_by_rcu_ttrace list of bpf memalloc (Alexei Starovoitov) - Fix use-after-free of progs detached from busy trampolines: wait for an RCU tasks grace period before freeing trampoline progs, and patch detached progs out of trampoline images that are still in use (Florent Revest) - Hold map BTF for the memory allocator destructor record to fix UAF in deferred bpf_mem_alloc destruction (Kumar Kartikeya Dwivedi) - Fix missing migration protection in resizable hashtab lookup_and_delete batch operation (Ömer Mete Kaya) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() selftests/bpf: Add a test for objects stuck in free_by_rcu_ttrace bpf: Fix objects stuck in free_by_rcu_ttrace bpf: Factor out __do_call_rcu_ttrace() selftests/bpf: Test packet range of pointers sharing an id bpf: Fix packet range of pointers sharing an id selftests/bpf: Detach a trampoline prog while a task sleeps before it bpf: Skip detached progs in trampoline images that are still in use bpf: Wait for an RCU tasks grace period before freeing trampoline progs bpf: Hold map BTF for the memory allocator destructor record bpf: Fix overflow of jump offset in constant blinding
2026-10-02dt-bindings: clock: Add StarFive JHB100 Peripheral-3 clock and reset generatorChanghuang Liang
Add bindings for the Peripheral-3 clock and reset generator (PER3CRG) on the JHB100 RISC-V SoC by StarFive Ltd. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02dt-bindings: clock: Add StarFive JHB100 Peripheral-2 clock and reset generatorChanghuang Liang
Add bindings for the Peripheral-2 clock and reset generator (PER2CRG) on the JHB100 RISC-V SoC by StarFive Ltd. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02dt-bindings: clock: Add StarFive JHB100 Peripheral-1 clock and reset generatorChanghuang Liang
Add bindings for the Peripheral-1 clock and reset generator (PER1CRG) on the JHB100 RISC-V SoC by StarFive Ltd. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02dt-bindings: clock: Add StarFive JHB100 Peripheral-0 clock and reset generatorChanghuang Liang
Add bindings for the Peripheral-0 clock and reset generator (PER0CRG) on the JHB100 RISC-V SoC by StarFive Ltd. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02dt-bindings: clock: Add StarFive JHB100 System-2 clock and reset generatorChanghuang Liang
Add bindings for the System-2 clocks and reset generator (SYS2CRG) on JHB100 SoC. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02dt-bindings: clock: Add StarFive JHB100 System-1 clock and reset generatorChanghuang Liang
Add bindings for the System-1 clocks and reset generator (SYS1CRG) on JHB100 SoC. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02dt-bindings: clock: Add StarFive JHB100 System-0 clock and reset generatorChanghuang Liang
Add bindings for the System-0 clocks and reset generator (SYS0CRG) on JHB100 SoC. Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-02net: bridge: use net_bridge_dst for fdb destinationsNikolay Aleksandrov
Store fdb destinations in struct net_bridge_dst and access them through the destination helpers. This doesn't change their representation or behavior, fdb destinations still contain only bridge port pointers. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-3-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02Merge tag 'sound-7.3-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A fair amount of small fixes, which became much larger as a pile of pending homework during my vacation in the last weeks. The majority of changes are device-specific quirks and ASoC updates, along with a few ALSA core fixes and USB-audio hardening as well as a few regression fixes. ALSA Core: - Serialize ALSA sequencer compat port-info ioctls HD-audio: - Fix ALC235 codec headset handling - Fix regression on Tegra194 controller support - Quirks / fixes for Lenovo, ASUS, Acer, Dell, Higole, HP, and IPASON laptops USB-audio: - Hardening for line6 and ua101 drivers to deal with malformed packets - Fix input device leak on probe error in caiaq driver - Apply quirks generically for Audient and Behringer devices - Quirks for ASUS SupremeFX Hi-Fi, HiBy FC4 (native DSD), and MSI MAG B850M MORTAR WIFI ASoC: - Runtime PM fixes for SDCA class function driver - Fix uninitialized stream configs in RT1017 and MAX98363 SDW codecs - AMD ACP SoundWire support for ASUS and Lenovo models - Quirks for Intel machines (Lenovo Yoga Slim 7, Chuwi Hi8) - Qualcomm LPASS fixes for playback constraints and WSA macro volume - Codec / platform fixes for rt274/rt286, cs42l43, wm8903, Tegra ASRC Misc: - Regression fix for silent playback on Creative Titanium HD - Error handling fix at probe via auto-cleanup in ice1712" * tag 'sound-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits) spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260 ALSA: ice1712: Fix the error handling via auto-cleanup at probe ALSA: core: Define auto-cleanup for snd_card_free() ALSA: hda/realtek: Add ALC235 support for headset mode ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72 ALSA: hda/realtek: Fix mute and micmute LEDs on HP ENVY x360 15-ey0xxx ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 14-dv1001TU ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270) ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices ALSA: usb-audio: Apply boot quirk for Behringer models generically ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after enabling clocks ALSA: hda/realtek: Fix speakers on ASUS PM3406CHA ALSA: hda/realtek: Add quirk for HP Pavilion AiO 24 speaker ALSA: hda/realtek: Add mute LED quirk for HP Laptop 15-fd2xxx ASoC: amd: acp-config: Add ACP70 DMI quirk for ASUS UM5406GA ALSA: hda/realtek: Add mute LED quirks for HP Pavilion 15-eh3174nw and HP Laptop 15-dw1xxx ASoC: Intel: Add quirk to block match table for Lenovo Yoga Slim 7 ALSA: hda/realtek: Add mute LED quirk for HP Victus 15-fb2xxx ALSA: hda/realtek: Add quirk for Acer Nitro AN515-45 ALSA: hda/realtek: Add quirk for Lenovo ThinkBook G8+ ...
2026-10-02Merge tag 'random-7.3-rc6-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator fixes from Jason Donenfeld: - VMGENID memory needs to be mapped with the decrypted tag, so that SEV-SNP machines can boot - A fix for an initialization race in VMGENID, followed by a cleanup - Trivial kernel doc cleanups in siphash and random.c - A fix for a new compilation failure with recent clang on PPC and RISC-V, due to generating an out-of-line memset in the vDSO * tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: vDSO: avoid call to memset() when zeroing reserved parameter random: fix vgetrandom_opaque_params kernel-doc random: vDSO: fix repeated word 'to' in comment siphash: clean up kernel-doc comments virt: vmgenid: move to using dev_set/get_drvdata virt: vmgenid: set driver_data before registering notification handlers virt: vmgenid: remap memory as decrypted
2026-10-02firmware: arm_rmm: Add wrappers for Realm related RMI commandsSteven Price
Introduce wrappers for the RMI functions needed for creating and managing realm guests. This will be used by the KVM to manage the Realms. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Steven Price <steven.price@arm.com> Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> [catalin.marinas@arm.com: remove regs copy in rmi_smccc_invoke_once()] Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02PM: hibernate: Add an arch hook for preventing hibernationSuzuki K Poulose
Add a hook to allow arch code disable hibernation. On arm64, with an RMM active, there could be pages that are delegated to the "Realm" security state. Any access to them are fatal (e.g., hibernate save image or restoring an image to a delegated page). pKVM host also has its restrictions on enabling hibernation. Add a weak arch hook to let the architectures have a say. Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Len Brown <lenb@kernel.org> Cc: Pavel Machek <pavel@kernel.org> Cc: linux-pm@vger.kernel.org Cc: Sudeep Holla <sudeep.holla@kernel.org> Suggested-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02firmware: arm_rmm: Ensure the RMM has GPT entries for memorySteven Price
The RMM maintains the state of all the granules in the system to make sure that the host is abiding by the rules. This state can be maintained at different granularity, per page (TRACKING_FINE) or per region (TRACKING_COARSE or TRACKING_INTERMEDIATE). The region size depends on the underlying "RMI_GRANULE_SIZE". For a "coarse"/"intermediate" region, all pages in the region must be of the same state, this implies we need to have "fine" tracking for DRAM, so that we can delegate individual pages. For now we only support a statically carved out memory for tracking granules for the "fine" regions. This can be extended in the future to allow modifying the tracking granularity and remove the need for a static allocation by the firmware. Similarly, the firmware may create L0 GPT entries describing the total address space. But if we change the "PAS" (Physical Address Space) of a granule, then the firmware may need to create L1 tables to track the PAS at a finer granularity. Linux therefore checks if the platform firmware manages the PAR region. i.e., the firmware is in charge of managing the L1 GPTs (creation and the required memory for the GPT tables - via static carveouts) without host intervention. Support for dynamic GPT creation by the host will be added later. If the firmware requires us to manage the tracking or GPT memory, deactivate the RMM and reclaim any memory donated at RMM activation. Apply the same checks when hotplugged memory is brought online. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Gavin Shan <gshan@redhat.com> Signed-off-by: Steven Price <steven.price@arm.com> Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02firmware: arm_rmm: Add support for SROSteven Price
RMM v2.0 introduces the concept of "Stateful RMI Operations" (SRO). This means that an SMC can return with an operation still in progress. The host is expected to continue the operation until it reaches a conclusion (either success or failure). During this process the RMM can request additional memory ('donate') or hand memory back to the host ('reclaim'). The host can request an in progress operation is cancelled, but still continue the operation until it has completed (otherwise the incomplete operation may cause future RMM operations to fail). All memory donate operations are cancellable and if the RMM request cannot be satisfied, we cancel the request and fail the operation. (e.g., if the allocation size > MAX_PAGE_ORDER) The SRO is tracked using a struct rmi_sro_state object which keeps track of any memory which has been allocated but not yet consumed by the RMM or reclaimed from the RMM. This allows the memory to be reused in a future request within the same operation. It will also permit an operation to be done in a context where memory allocation may be difficult (e.g. atomic context) with the option to abort the operation and retry the memory allocation outside of the atomic context. The memory stored in the struct rmi_sro_state object can then be reused on the subsequent attempt. Wrappers for SRO RMI commands are also provided here because they depend on the rmi_sro_execute() implementation added by this patch. Delegate/undelegate handles are also added here because they now use the SRO/stateful command infrastructure and are also used for the memory DONATE/RECLAIM flows. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Gavin Shan <gshan@redhat.com> Signed-off-by: Steven Price <steven.price@arm.com> Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02firmware: arm_rmm: Check for RMI support at initSteven Price
Query the RMI version number and check if it is a compatible version. All RMM feature registers are read and exposed for future code to use. Also restrict the support to SMC conduit. We only support this for Little Endian kernels, the Big Endian kernel support is anyway marked BROKEN and is being removed. Cc: Marc Zyngier <maz@kernel.org> Cc: Oliver Upton <oupton@kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Tested-by: Gavin Shan <gshan@redhat.com> Signed-off-by: Steven Price <steven.price@arm.com> Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02arm_mpam: add MPAM-Fb MSC firmware access supportAndre Przywara
The Arm MPAM Firmware-backed (Fb) Profile document[1] describes an alternative way of accessing the "Memory System Components" (MSC) in an MPAM enabled system. Normally the MSCs are MMIO mapped, but in some implementations this might not be possible (MSC located outside of the local socket, MSC mapped secure-only) or desirable (direct MMIO access too slow or needs to be mediated through a control processor). MPAM-fb standardises a protocol to abstract MSC accesses, building on the SCMI protocol. Add functions that do an MSC read or write access by redirecting the request through a firmware interface. For now this done via an ACPI PCC shared memory and mailbox combination. Since the protocol used is only a small subset of the full SCMI spec, and the SCMI protocol has no full ACPI support anyway, open-code the (simple) SCMI message generation, for just the fields we need. [1] https://developer.arm.com/documentation/den0144/latest Signed-off-by: Andre Przywara <andre.przywara@arm.com> Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Tested-by: Ritwick Sharma <ritwick.sharma@arm.com> # on Arm AGI CPU Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Srivathsa L Rao <srivathsa.rao@oss.qualcomm.com> Reviewed-by: Ben Horgan <ben.horgan@arm.com> Signed-off-by: James Morse <james.morse@arm.com>
2026-10-02firmware: arm_rmm: Add SMC definitions for calling the RMMSteven Price
The RMM (Realm Management Monitor) provides functionality that can be accessed by SMC calls from the host. The SMC definitions are based on DEN0137[1] version 2.0-bet3 [1] https://developer.arm.com/documentation/den0137/2-0bet3/ Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Tested-by: Gavin Shan <gshan@redhat.com> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Steven Price <steven.price@arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2026-10-02ALSA: Drop unused snd_card_free_on_error()Takashi Iwai
Now that all users of snd_card_free_on_error() are gone by refactoring with auto-cleanup, let's drop the superfluous function. Also, update the documentation for reflecting the recommended error handling procedure, too. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20261002085517.693510-33-tiwai@suse.de
2026-10-02Merge branch 'for-linus' into for-nextTakashi Iwai
Pull again 7.3-devel branch for working on snd_card_free auto-clean changes. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-10-02bpf: Support per-call-site kfunc specializationEmil Tsalapatis
specialize_kfunc() currently updates the canonical kfunc descriptor in place. Different call sites therefore cannot select different specializations of the same kfunc, and the selected target depends on verification order. Keep canonical descriptors unchanged for verifier lookups. Specialize a copy for each call site, then reuse or append an immutable target descriptor and store its index in the finalized call instruction. Allow space for one canonical and one specialized target per kfunc. This is conservative because most kfuncs do not specialize. Adding specialized kfunc versions does not require resorting the array because lookups are only used for deduplication and func_model lookup. Deduplication for specialized kfuncs is handled by the specialization process itself, while all specializations of a function share the same proto and func_model. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-7-emil@etsalapatis.com
2026-10-02bpf: Directly store kfunc desc index in instruction off fieldEmil Tsalapatis
Currently, the verifier sort the kfunc desc table twice: Once during kfunc collection by function ID, useful during verification, and once by immediate address, useful during JIT bytecode lowering time. The latter sort can be removed by storing in the instruction the kfunc desc array index the desc is in and using that instead. Modify the JITs to follow the same convention. This change simplifies the subsequent patch that adds per-call site function specialization. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-6-emil@etsalapatis.com
2026-10-02bpf: Add sleepable argument to bpf_alloc_pages()Emil Tsalapatis
bpf_alloc_pages() currently decides whether it may use the blocking page allocator from the current execution context alone. Let callers further restrict that choice by passing whether their context is sleepable. Use the blocking allocator only when both the caller and runtime context allow sleeping. Add __GFP_RETRY_MAYFAIL so this path can reclaim without invoking the OOM killer when the allocation is charged to another memcg. Existing non-sleepable callers retain the no-lock allocation behavior. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-3-emil@etsalapatis.com
2026-10-02bpf: Use an llist for page allocationsEmil Tsalapatis
bpf_map_alloc_pages() does not use its map argument. Storing allocated pages in an array also forces arena callers to allocate a separate pointer array. Expose the single-page allocator as bpf_alloc_page(), rename the bulk helper to bpf_alloc_pages(), and return bulk allocations through an llist using page->pcp_llist. Add bpf_free_pages() to safely release all pages remaining on such a list. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261002105218.6171-2-emil@etsalapatis.com
2026-10-02Merge tag 'asoc-fix-v7.3-rc5' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.3 A bigger collection of fixes than usual due to your vacation but nothing hugely remarkable here, just fairly standard quirks and driver specific bugfixes.
2026-10-02slimbus: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://patch.msgid.link/20261002101506.1084743-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-02clocksource/drivers/timer-ti-dm: Register clocksource/event only for am654Markus Schneider-Pargmann (TI)
Registering clocksource/clockevent for the older platforms breaks booting them. The older platforms have their own implementation in early boot that is used to register clocksource/clockevent in timer-ti-dm-systimer.c. With am654, the timer is much more complex with more dependencies so doing this in early boot with the other driver is very difficult and gets ugly. Instead it is implemented in the platform driver for am654. However the old platforms may not register clocksource/clockevent in this driver as that would break the boot. Add a system_timer_capable flag that is only set for am654-timer that gates the clocksource/clockevent registration. Reported-by: H. Nikolaus Schaller <hns@goldelico.com> Closes: https://lore.kernel.org/r/2013A99A-0502-4128-ACFA-B04886224393@goldelico.com Fixes: b8eeeca55456 ("clocksource/drivers/timer-ti-dm: Add clocksource support") Signed-off-by: Markus Schneider-Pargmann (TI) <msp@baylibre.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Tested-by: Andreas Kemnade <andreas@kemnade.info> # OMAP3 GTA04 Tested-by: Kevin Hilman <khilman@baylibre.com> # OMAP3 Beagle XM Tested-by: H. Nikolaus Schaller <hns@goldelico.com> # OMAP3 OpenPandora Link: https://patch.msgid.link/20260828-v7-3-next-topic-ti-timer-dm-clocksource-omap-fix-v1-1-85f0e4dc6f9f@baylibre.com
2026-10-02irq: Explain better on NMI_MASK overflow conditionBoqun Feng
Currently __preempt_count_nmi_enter() uses 15 as the maximum NMI nesting level, and it's because 4 bits are used to represent the nesting level of NMI. Replace the tautological comment with a more direct mention to the 4 bits limitation to help readers understand this condition. Suggested-by: Shrikanth Hegde <sshegde@linux.ibm.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com> Link: https://patch.msgid.link/20261001082519.16195-5-boqun@kernel.org
2026-10-02irq: Add {over,under}flow detection for local_interrupt_{enable,disable}Boqun Feng
Currently there is no way to detect overflow and underflow inside the HARDIRQ_DISABLE_MASK part of preempt_count. Add these detection guarded by DEBUG_PREEMPT similar to the detection for PREEMPT_MASK {over,under}flow. Suggested-by: Shrikanth Hegde <sshegde@linux.ibm.com> Signed-off-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com> Link: https://patch.msgid.link/20261001082519.16195-3-boqun@kernel.org
2026-10-02tty: add missing driver flag kernel-doc colonJohan Hovold
A recent change adding a new TTY driver flag left out a colon required for well-formed kernel-doc. Fixes: 8df07fe93573 ("tty: fix saved termios reset race") Reported-by: Randy Dunlap <rdunlap@infradead.org> Link: https://lore.kernel.org/ec3a09d6-4ba4-41b8-abb1-b59e265f4532@infradead.org Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20261002072736.2063004-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-02KVM: Remove unused file_is_kvmSteffen Eiden
Remove the now unused file_is_kvm function. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-02KVM/vfio: Use file-based reference counting for KVMSteffen Eiden
Replace manual module reference counting with file-based reference counting for KVM integration. Previously, VFIO used symbol_get() to obtain function pointers for kvm_get_kvm_safe() and kvm_put_kvm(), then manually tracked module references through these symbols. This approach required storing the put_kvm function pointer in each device and carefully managing symbol references. Pass struct file pointers instead of struct kvm pointers throughout the VFIO-KVM interface, leveraging the kernel's existing file reference counting via get_file()/get_file_active() and fput(). Convert the x86 page-track API and update s390 vfio to use file_to_kvm_<arch>(). This simplifies the code. Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Acked-by: Alex Williamson <alex@shazbot.org> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> [borntraeger@linux.ibm.com remove _safe from vfio_device_get_kvm_safe] Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-02KVM: Add file back-pointer to struct kvmSteffen Eiden
Add kvm->file as a no-reference back-pointer to the VM file in struct kvm. The pointer is set at VM creation time and cleared under WRITE_ONCE() in kvm_vm_release() before the file is freed. Callers storing the file must take their own reference. Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-02KVM: Introduce file_to_kvm_<arch>() infrastructureSteffen Eiden
Add a macro mechanism that generates an opt-in and arch-namespaced file_to_kvm_<arch>() to convert a file reference to a kvm object if the file handle represents a kvm handle. Activate for x86 and for s390 (native KVM only). Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Acked-by: Janosch Frank <frankja@linux.ibm.com> Acked-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-02braille: nbcon: Allow to use a serial console with NBCON API as Braille consolePetr Mladek
The Braille console is not registered in console_list. Instead, it is integrated with the virtual terminal (VT) and shows what is displayed on the terminal. It writes the data using con->write*() callback of the associated serial console driver. braille_write() is called from the VT code under console_lock(). The associated serial console driver can be converted to the NBCON API though. The situation is similar to flushing nbcon consoles in the legacy loop when some boot consoles are still registered, see nbcon_legacy_emit_next_record(). But there is a big difference though. braille_write() is not directly called from the code paths flushing registered consoles. The VT code expects that braille_write() succeeds. It does not replay the message when it can't acquire the ownership. As a result, braille_write(): + must try harder to get the ownership. + has to be synchronized only against non-printk serial console which depend nbcon_device_try_acquire() using NBCON_PRIO_NORMAL. Let's look at it from another side and try to simulate the original locking using the NBCON API: 1. Take con->device_lock(), aka the port->lock in the legacy serial console driver. 2. Acquire nbcon context to provide some synchronization for a panic() context. Use NBCON_PRIO_NORMAL because it contends only with nbcon_device_try_acquire() users. Do it in a busy loop. It should always succeed when con->device_lock() succeeded because all other users do the same. The only exception is when the context get acquired by a CPU handling panic. 3. In panic, disable interrupts and try to acquire the nbcon context. Use NBCON_PRIO_PANIC. And try even an unsafe takeover because otherwise the Braille console won't see the text shown during panic(). It is similar to the oops_in_progress/trylock handling in the legacy serial console driver. Finally, avoid the newline prepending logic in the existing serial console drivers when they are used as a Braille console. As explained above, the Braille console shows the last modified line on the terminal (VT). braille_write() is called when single characters are added. Most messages are not ended by newline. Anyway, the VT code does not have logic to reply partially printed messages. Fixes: 13189fa73afa ("printk: nbcon: Rely on kthreads for normal operation") Reviewed-by: John Ogness <john.ogness@linutronix.de> [pmladek@suse.com: Remove white space changes in braille_register_console(). Typo fix.] Link: https://patch.msgid.link/20261001140727.124398-2-pmladek@suse.com Signed-off-by: Petr Mladek <pmladek@suse.com>
2026-10-02rhashtable: specialize default comparison for constant parametersUsama Arif
The inline lookup and insert helpers receive the rhashtable parameters by value. With a static const parameter block, key_offset and key_len are compile-time constants at the call site. The default comparison throws that information away by reading both fields back from ht->p. Fixed-size keys consequently load the parameters and call bcmp() for every object in the bucket, even when the compiler could use scalar comparisons instead. The commit "sched_ext: Specialize the DSQ hashtable compare" [1] resulted in a 2.9x faster DSQ lookup after replacing this path for its u64 key with a scalar comparison. Doing that through obj_cmpfn requires every fixed-key user to provide its own callback. Pass the call-site parameters to rhashtable_compare(), as rht_key_get_hash() already does. Use them when key_len is a compile-time constant. Retain the ht->p path for dynamic parameter blocks. A constant zero key_len continues to take the runtime length from ht->p.key_len. This specializes the default comparison for all fixed-size users. With Clang 22 on x86-64, bcmp() disappears from sched_ext, mac80211, NFSd, TIPC, NFQUEUE, VFS superblock, pidfs, SysV IPC and hardware-breakpoint table paths. The affected build_policy.o, sta_info.o and nfsd filecache.o text shrinks by 512, 400 and 352 bytes respectively. Four- and eight-byte keys become direct scalar comparisons; six-byte MAC addresses become a four-byte and a two-byte comparison. Measure the VFS case with ustat() on a mounted ramfs. This exercises user_get_super() and its super_dev lookup. Across ten interleaved baseline and patched VM boot pairs, with five 3 million call samples per boot, the average per-boot median latency drops from 477.2 to 462.6 ns per call, or 3.0%. All ten pairs improved. No functional change intended. [1] https://lore.kernel.org/all/20260921171928.1639407-1-usama.arif@linux.dev/ Suggested-by: Mykola Lysenko <nickolay.lysenko@gmail.com> Signed-off-by: Usama Arif <usama.arif@linux.dev> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>