summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-09-14f2fs: describe orphan block layout dynamicallyKelvin Zhang
An on-disk orphan block contains a variable-length array of 32-bit inode numbers followed by a fixed footer at the end of the block. A compile-time whole-block structure cannot represent the footer position when the block size varies at runtime. Remove struct f2fs_orphan_block, introduce struct f2fs_orphan_block_footer, and compute sbi->orphans_per_block dynamically in init_sb_info(). Add helpers to access the inode entry array and footer from a block buffer. Update orphan inode recovery, checkpointing, and mount paths to use the parameterized helpers. This preserves the on-disk format while decoupling orphan handling from compile-time constants. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe NAT block layout dynamicallyKelvin Zhang
A NAT block is a filesystem-block-sized array of struct f2fs_nat_entry elements. The compile-time NAT_ENTRY_PER_BLOCK definition hardcodes the NAT capacity to a 4KB block size. Replace the fixed array in struct f2fs_nat_block with a C flexible array member, and calculate sbi->nat_entries_per_block dynamically in init_sb_info(). Parameterize NAT geometry helpers (NAT_ENTRY_PER_BLOCK, NAT_BLOCK_OFFSET, f2fs_start_nid, NAT_BLK_CNT, and f2fs_nat_bitmap_size) with sbi. Update call sites across node management, checkpointing, GC, and sysfs. This is a layout-only change without behavioral differences for 4KB blocks. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14f2fs: describe SIT block layout dynamicallyKelvin Zhang
An SIT block consists of an on-disk array of struct f2fs_sit_entry elements whose total capacity depends on the filesystem block size. The existing fixed SIT_ENTRY_PER_BLOCK macro hardcodes a 4KB block size. Convert the entries array in struct f2fs_sit_block into a C flexible array member, and calculate sbi->sit_entries_per_block dynamically in init_sb_info(). Parameterize SIT indexing helpers (SIT_ENTRY_PER_BLOCK, SIT_BLOCK_OFFSET, SIT_BLK_CNT, and f2fs_start_segno) to take struct f2fs_sb_info *sbi, and update all call sites across segment management, checkpointing, and mount. This is a layout-only change; valid 4KB filesystems retain identical runtime geometry and behavior. Signed-off-by: Kelvin Zhang <zhangxp1998@gmail.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2026-09-14x86,fs/resctrl: Add resctrl_arch_preconvert_bw()Dave Martin
On MPAM systems the rounding behaviour of the MBA control would be improved if the rounding in the fs/resctrl code is removed but this is not the case for x86. To allow any rounding or conversion of the bandwidth value provided by the user to be specified by the arch code a new arch hook is required. Introduce resctrl_arch_preconvert_bw(), and add its x86 implementation. This is currently unused in resctrl but when plumbed in it will replace the call to roundup() in bw_validate(). Signed-off-by: Dave Martin <dave.martin@arm.com> Signed-off-by: Ben Horgan <ben.horgan@arm.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Reinette Chatre <reinette.chatre@intel.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Link: https://patch.msgid.link/20260911163613.1131447-2-ben.horgan@arm.com
2026-09-14drm/sysfs: Remove drm_class_device_(un)register()Maíra Canal
The last usage of the functions drm_class_device_register() and drm_class_device_unregister() was removed in commit ed89fff97382 ("drm/ttm: drop sysfs directory"). Remove such functions as they are no longer used. Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260803132706.1497980-2-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-09-14ASoC: codecs: Fix resource leaks on card re-bindMark Brown
Chancel Liu <chancel.liu@oss.nxp.com> says: Several ASoC codec drivers set up per-device resources from their ASoC component probe, but the associated cleanup is tied to the underlying bus (I2C/SPI) device rather than being balanced per component probe. This is fine for a plain probe/remove, but it breaks when the sound card is unregistered and re-registered while the bus device stays bound (a card re-bind): the component probe runs again while the previous bus-level resources are still live. Two kinds of resources are affected: - Regulator disable notifiers (wm8962, wm8995, tlv320aic31xx, tlv320aic3x) The same notifier_block is re-registered on the still-registered regulator notifier chain, which triggers notifier callback ..._regulator_event_N already registered WARNING: ... at kernel/notifier.c:23 notifier_chain_register and corrupts the chain. - Beep input devices (wm8962, cs42l52, cs42l56) A new input device is allocated and registered on every component probe while the free path only clears the pointer, leaking the previous input device and its sysfs/input node. The two problems need opposite fixes: the notifiers are registered from the component probe, so the registration is moved to the bus probe so it runs once per bus bind; the beep device is freed from the component remove path, so it is switched from devm_input_allocate_device() to input_allocate_device() paired with an explicit input_unregister_device() on that same free path. Verified with wm8962. The remaining patches fix other codec drivers following the same patterns. Link: https://patch.msgid.link/20260913101531.2787654-1-chancel.liu@oss.nxp.com
2026-09-14wifi: radiotap: add S1G TLVs and channel frequencyLachlan Hodges
Add the necessary definitions to create radiotap S1G TLVs and channel flags for S1G sniffers. Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com> Link: https://patch.msgid.link/20260909073014.53344-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-09-14block,iomap: remove the old read side bounce buffering supportChristoph Hellwig
bio_iov_iter_bounce_read turned to generate suboptimal I/O sizes and isn't usable for lazy bounce buffering. Now that is has been replaced with the iomap side implementation that requires extra bounce bios, it is unused and can be removed. Change the interface so that the previously hidden write-side implementation is directly exposed. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-17-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14iomap,xfs: move integrity verification to the file systemChristoph Hellwig
Integrity support in file systems already requires file system-specific completion handling because it must be run in process context. Move the actual verification to the file system so that it can better handle errors in file system specific ways, and to support lazy bounce buffering. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-13-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14iomap: better read bounce buffering supportChristoph Hellwig
Add helpers to bounce buffer an upper bio into one or more lower bios using bounce buffers, and to copy the data back on completion. Compared to the existing IOMAP_DIO_BOUNCE support for read bios, this has two advantages: by removing the special bounce bio_vec it allows to the full and "round" size of a single bio, i.e., 1MiB when using 4k pages. This is important for good performance on HDD. Additionally it allows to bounce buffer a bio from completion conext, and thus implement a "lazy" bounce buffering scheme, where the data is only read into a bounce buffer after an initial checksum validation failure, thus avoiding the bounce buffering I/O for most I/O. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-11-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14block,iomap: fix protection information verification with initial bvec offsetChristoph Hellwig
When reconstructing a bvec_iter from an ioend for protection information verification, iomap currently ignores the offset into the initial bio_vec. This can't happen for buffered I/O or direct I/O to user addresses, but is exercised by splice on O_DIRECT file descriptors or when using the loop driver in direct I/O mode. Fortunately the only file system PI user (XFS) currently always bounce buffers, so this can't actually be triggered yet. But we'll want to make the bounce buffering conditional soon, for which this needs to be fixed. Store the initial offset in struct iomap_ioend, and pass a pre-constructed bvec_iter to fs_bio_integrity_verify. For the synchronous read case the fix is even simpler as this path can simply stash away the original bvec_iter. Fixes: 0bde8a12b554 ("block: add fs_bio_integrity helpers") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-10-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14iomap: add a IOMAP_IOEND_INTEGRITY flagChristoph Hellwig
This will make it easier to share code for the various submit callback provided by the file system to iomap. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-7-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14iomap: add a iomap_ioend_flags helperChristoph Hellwig
Add a helper to initialize the ioend flags to the values that can be directly derived from the iomap. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260909060924.1102037-6-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14block: pass a maxlen argument to bio_iov_iter_get_pagesChristoph Hellwig
Writes that require additional per-I/O allocations such as when using file system level protection information can be limited to a maximum size. Allow passing that to bio_iov_iter_get_pages. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-14dma-fence: Fix dma_fence_enable_signaling() reference in kernel-docKarl Mehltretter
The kernel-doc comment of dma_fence_is_signaled_locked() refers to dma_fence_enable_sw_signaling, which was renamed to dma_fence_enable_signaling by commit 9370a5c664e8 ("dma-buf: rename dma_fence_enable_sw_signaling"). Say dma_fence_enable_signaling. Fixes: 9370a5c664e8 ("dma-buf: rename dma_fence_enable_sw_signaling") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Christian König <christian.koenig@amd.com> Link: https://lore.kernel.org/r/20260911221100.7079-1-kmehltretter@gmail.com
2026-09-14tracing: Include linux/types.h in trace_remote_event.hFuad Tabba
trace_remote_event.h uses bool without including linux/types.h, so a translation unit that includes it ahead of anything else that pulls types.h in fails to build, as with nvhe/trace.h at EL2. Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Acked-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Acked-by: Steven Rostedt <rostedt@goodmis.org.> Link: https://patch.msgid.link/20260901140326.3812068-2-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Handle userspace accesses to IRS MMIO regionSascha Bischoff
As part of saving and restoring the state of a GICv5-based system, userspace must save and restore the IRS MMIO registers. These include important information such as the guest IST configuration, and KVM must present consistent state to the guest after migration. Introduce KVM_DEV_ARM_VGIC_GRP_IRS_REGS and provide accessors to read and write the virtual IRS register state. This is modelled on the GICv3 ITS register interface, as the migration requirements are broadly the same. Reuse the guest MMIO handlers where userspace and guest accesses have the same semantics. Add userspace-specific handling where restoring a register image must not trigger the operation associated with a guest MMIO write. Validate restored ID register fields against the capabilities KVM and the host can support. Restore the emulated IST configuration without allocating or freeing a host IST, and report operation status registers as idle. Accept writes to IRS_SPI_CFGR, IRS_IIDR, and IRS_AIDR without changing their state, allowing userspace to replay the values it previously read. Restoring IRS_IST_BASER.Valid recreates the guest-visible configuration, but the host LPI IST cannot be allocated until userspace supplies its contents. Track this as a pending LPI IST restore and reject guest entry until userspace restores the IST through KVM_DEV_ARM_VGIC_GRP_IST. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-33-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Mask per-vCPU PPI state in vgic_v5_finalize_ppi_state()Sascha Bischoff
Only a subset of the possible PPIs are exposed to a guest when running with a vGICv5. First of all, only the architected PPIs are considered by KVM. Secondly, only a set of those is exposed to a guest: those corresponding to devices that KVM emulates, such as the timers and PMU, and the GICv5 SW_PPI. The finalisation of exposed PPIs happens on first vCPU run, as this is the first time when the full set of exposed devices is known. At this stage a mask is calculated, and this mask is applied both to hide non-exposed PPI state from the guest and to reduce overhead when iterating over the PPIs. While preparing userspace access to the GICv5 system registers, it became apparent that restoring the GICv5 PPI registers can result in a mismatch between the state supplied by userspace and the state KVM intends to expose. Userspace can provide Enable, Active, and Pending state for PPIs that KVM has chosen to hide from the guest. Userspace must restore PPI state before any vCPU runs. The userspace access path added subsequently enforces this ordering. Rework vgic_v5_finalize_ppi_state() to calculate the mask of exposed PPIs and clear any state belonging to non-exposed PPIs. This ensures that only the state KVM intends to expose is visible to the guest. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-31-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic: Introduce set_pending_state() to irq_opsSascha Bischoff
There are times, such as with GICv5 SPIs and LPIs, where the hardware itself manages parts of the interrupt lifecycle. This means that pending state can be directly communicated to the hardware instead of being represented only in the VGIC shadow state. In order to accommodate cases where the hardware handles pending state directly, add a new set_pending_state() function pointer to irq_ops. The intent is for this to be used after the VGIC shadow pending state has changed, allowing the backend to mirror the updated state into hardware. This new function is plumbed into kvm_vgic_inject_irq(), and is only called if irq_ops are provided and this function pointer is explicitly set. In the general case, this has no effect. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-27-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Register the IRS IODEVSascha Bischoff
Now that we have an emulated IRS, it needs to be registered, which ensures that guest accesses to the MMIO regions handled by the device are handled appropriately in KVM. Therefore, as part of vgic_map_resources, the GICv5 IRS IODEV is registered. If the address for the IRS is not provided, bail out reporting an error - this is not a supported config. As part of this change, expose setting the address of the emulated IRS via KVM_VGIC_V5_ADDR_TYPE_IRS to userspace. Also allow userspace to set the number of SPIs handled by the emulated GICv5 implementation, using a GICv5-specific SPI count rather than the legacy total interrupt count. Limit the configurable range to 32 through 1024 SPIs, in multiples of 32. KVM keeps one struct vgic_irq per SPI in a physically contiguous allocation, and allowing the full 16-bit KVM_IRQ_LINE SPI namespace would make that allocation exceed KMALLOC_MAX_SIZE on common arm64 configurations. The default routing has one IRQCHIP route per configured SPI, so size the common IRQ routing table for the largest GICv5 configuration. The model-specific routing validation retains the 988-pin limit for GICv2 and GICv3. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-23-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Add GICv5 IRS IODEV and MMIO emulationSascha Bischoff
In order to properly support GICv5-based VMs in KVM, emulate the CONFIG_FRAME for a virtual IRS. This emulation needs to handle guest accesses to the MMIO region and mimic the behaviour of a real IRS. Introduce an IODEV for the GICv5 IRS and an associated initialisation function that sets up the SPIs and initial IRS state. The MMIO emulation allows the guest to query the IRS_IDx registers, manipulate SPIs, configure ISTs, and so forth. Allow 32-bit accesses to the 64-bit IRS registers in addition to 64-bit accesses. Reconstruct IRS_IST_BASER for reads and merge partial writes so that updating either word preserves the other half. The emulation tracks selector state across MMIO accesses. For example, a guest writes IRS_PE_SELR to select a PE by IAFFID. This is the VPE ID for a VM, but the guest does not know this. If the guest reads IRS_PE_STATUSR, KVM checks whether that IAFFID selects a valid VPE and sets the V bit accordingly. IRS_PE_CR0 is accepted as write-ignored because KVM does not support 1-of-N routing. The same selector and status register model is exposed for SPIs. Track the state of IRS_CR0.IRSEN and introduce KVM_REQ_RELOAD_GICv5 to reload the GICv5 context of running vCPUs when it changes. Only make the request when the enable state changes, avoiding unnecessary IPIs for writes that leave it unchanged. The LPI IST requires KVM to perform actions on behalf of the guest. Treat changes to IRS_IST_BASER.Valid as the lifetime of the guest's IST. On an Invalid-to-Valid transition, validate IRS_IST_CFGR, allocate a shadow host IST, and assign it to the physical IRS through the VMTE. On a Valid-to-Invalid transition, invalidate and free the host IST. Ignore guest address changes while the BASER remains valid, and prevent changes to IRS_IST_CFGR during that time. As far as the guest is concerned, the IST memory it provided is being used by the hardware, but the physical IRS uses the host shadow IST instead. This change provides the core IRS IODEV and MMIO emulation, but does not plumb the device into the rest of KVM yet. The CoreSight identification registers are added separately. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-21-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Add IRS IODEV support to MMIO handlersSascha Bischoff
In order to support proper VMs (that support more than just PPIs) for GICv5, it is important to emulate the GICv5 IRS too. The IRS includes an MMIO interface which is used to interact with and configure the IRS. As part of providing the emulated IRS MMIO interface in KVM, extend enum iodev_type to include a GICv5 IRS device, and extend the MMIO code to handle reads and writes to that type of IO device. This will allow the creation of a GICv5 IRS IO Device in KVM. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-19-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Introduce struct vgic_v5_irs and IRS base addressSascha Bischoff
In order to properly emulate the operation of the IRS from KVM, we require storage for the MMIO register state. This change introduces struct vgic_v5_irs, and adds a pointer to it to the struct vgic_dist. This new data structure contains the storage for IRS MMIO state that is required for emulating the MMIO interface in KVM. This provides persistent storage, and a way to track data across MMIO writes, e.g., selecting an SPI and updating the configuration of it is two MMIO writes. Note that only a pointer to the data structure is added to struct vgic_dist as this new structure is very large, and hence it makes sense to dynamically allocate it and just provide a pointer to retrieve it in struct vgic_dist. In addition to adding a structure to store the MMIO state for the IRS, we add the base address in GPA space to struct vgic_v5_irs. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-18-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Add resident/non-resident hyp callsSascha Bischoff
GICv5 introduces the concept of VPE residency - a VPE can be either resident or non-resident. When the VPE is resident, the IRS is allowed to select interrupts that target that VPE (or the VM) as the HPPI (Highest Priority Pending Interrupt). As the IRS handles both SPIs and LPIs, these will only be picked as the IRS's HPPI when a VPE is resident. A GICv5 VPE is made resident by writing ICH_CONTEXTR_EL2 with ICH_CONTEXTR_EL2.V set, together with valid VM and VPE IDs. This informs the IRS that a specific VPE is running, and that it can begin HPPI selection for that VPE. Making a VPE non-resident (by making the ICH_CONTEXTR_EL2 invalid) informs the IRS that the VPE is no longer running, and it stops HPPI selection for it. This change introduces two new hyp calls - one to make a VPE resident and its counterpart to make a VPE non-resident. As part of making a VPE resident, the resulting ICH_CONTEXTR_EL2.F bit is checked to catch residency faults. Such a fault indicates a broken VM/VPE setup, so warn and mark the VM dead. Both of these new hypercalls are explicitly no-ops with pKVM as we currently don't support the combination of GICv5 and pKVM. Furthermore, this change extends vgic_v5_load() and vgic_v5_put() to make the VPEs resident and non-resident, respectively. Hence, the VPE is considered resident for the entire load-to-put interval. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-16-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Set up VMTEs and VPE doorbellsSascha Bischoff
A GICv5 VM needs a VM table entry before it can use SPIs and LPIs, which are backed by the host IRS. The VM table itself is created at probe time, but each VM still needs to claim and populate one VMTE before it can use those interrupts. VPE doorbells are allocated from the host LPI irq domain. Without that domain, KVM cannot issue IRS commands or receive doorbell wakeups. Fail the GICv5 KVM probe if the host driver did not create an LPI domain. Allocate a VM ID during vgic_v5_init(). The VM ID is also the index into the VM table, so allocating it selects the VMTE slot that will be used for the lifetime of the VM. Create a per-VM VPE doorbell irq domain, allocate one doorbell interrupt per vCPU, request the interrupts, and keep the doorbell IRQ number in the vCPU's GICv5 state. The doorbell handler marks the VPE doorbell as fired, raises KVM_REQ_IRQ_PENDING, and kicks the target vCPU so that KVM can re-evaluate pending interrupt state. The doorbell domain indexes its interrupts using the dense vcpu_idx, while GICv5 uses the userspace-provided vcpu_id as the VPE ID. Store a backpointer to the VM and use it to resolve the vCPU before issuing VPE-specific IRS commands. This preserves the userspace VPE ID when vCPU IDs are sparse. With the VM ID and doorbells in place, initialise the VMTE backing state, including the VM descriptor, VPE table, and preallocated VPED storage. The doorbells have to exist before making the VMTE valid, as they provide the IRQ-side conduit used by the IRS commands. Make the VMTE valid via the IRS, then populate the VPETE for each vCPU. Add vgic_v5_teardown() to unwind the state in the reverse order. Make the VMTE invalid, clear the per-vCPU VPETEs, release the VMTE backing state, free the doorbell IRQs and irq domain, and finally release the VM ID so that the VMTE slot can be reused by a later VM. If invalidating the VMTE, clearing a VPETE, or releasing the VMTE fails, still free the software doorbells and domain, but keep the VM ID allocated so that the VMTE slot is not reused while hardware-visible state may remain. On init failure, call the same teardown path so that partially created state is unwound consistently. As part of resetting vCPUs, mark them as valid in the VM's VPE table. This informs the IRS that a specific VPE may be made resident. Without this, the IRS will treat the VPE as invalid. Also introduce vgic_v5_send_command(), a wrapper around the VPE doorbells. It takes a struct kvm_vcpu pointer and the command to run, and invokes the function bound to that command through the vCPU's doorbell. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-15-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Implement VPE IRS MMIO OpsSascha Bischoff
Introduce interfaces to make VPEs valid, and to configure them, via the host's IRS. As with the other valid bits in the GICv5 VM tables, VPEs cannot be made valid directly, and instead are made valid via an IRS MMIO Op. Additionally, some of the VPE configuration takes place via the IRS MMIO interface too (via the IRS_VPE_CR0, IRS_VPE_DBR). VPE doorbells are, for example, configured via this interface. The existing VPE-doorbell-based commands are extended with: VPE_MAKE_VALID - Make the VPE valid in the VPET Note: There is no VPE_MAKE_INVALID as VPEs are only made invalid on teardown, at which point the whole VMTE is marked as invalid. Hence, it is not required. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-14-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: vgic: Enforce model-specific vCPU limitsSascha Bischoff
A GICv5 host with FEAT_GCIE_LEGACY can expose either a native vGICv5 or a vGICv3 device. These models do not necessarily have the same vCPU limit: the native GICv5 limit is probed from the IRS VPE capacity, while the GICv3 limit remains the fixed KVM vGICv3 limit. Keep the IRS-derived limit separately for vGICv5 creation. The pre-VGIC KVM_CAP_MAX_VCPUS value continues to expose the largest limit among the still-selectable models, and kvm_vgic_create() clamps the VM to the limit of the VGIC model userspace actually selected. Userspace can create vCPUs before creating a VGIC. Hence, checking only the number of existing vCPUs after reducing the limit is not sufficient. For example, a single vCPU with ID 500 passes the GICv2 count limit even though GICv2 can represent only eight target CPUs. The GICv2 code subsequently uses the vCPU ID in target and SGI source masks, leading to shifts beyond the width of the operand. GICv5 has a similar requirement because the userspace-provided vcpu_id is used as the index into the VPET. This means that the vcpu_id also represents the IAFFID for a VPE, and therefore is visible to the guest. After selecting the model-specific limit, validate every existing vCPU ID against it. KVM_CREATE_VCPU already enforces the same limit for vCPUs created after the VGIC, making the result independent of creation order. Link: https://lore.kernel.org/r/20260807133051.15D381F000E9@smtp.kernel.org Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-13-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Introduce guest IST alloc and managementSascha Bischoff
GICv5 guests use Interrupt State Tables (ISTs) to track and manage the interrupt state for SPIs and LPIs. These ISTs are provided to the host's IRS via the VMTE. On a host GICv5 system, SPIs do not require any up-front memory allocation prior to their use, unlike LPIs which require the OS to allocate an IST. For a GICv5 guest, the same holds from the guest's point of view: SPIs should require no explicit memory allocation by the guest. This means that KVM must provision the memory passed to the IRS for managing a guest's SPI state. Introduce the machinery needed to allocate a linear SPI IST. A later commit will allocate it as part of VM creation, before running the guest for the first time. The host is responsible for freeing this memory on guest teardown. For LPIs, the guest provisions memory for its LPI IST. KVM does not pass that memory directly to the host IRS. Instead, add support for allocating a shadow LPI IST and passing that to the IRS through the VMTE. The LPI IST may be allocated as a two-level structure when supported and required by the configured LPI ID space, as many more LPIs are expected than SPIs. The host frees this memory on guest teardown. Assigning an IST to a VM requires an IRS operation rather than writing the Valid bit directly in the VMTE. Extend the doorbell command interface with the operations needed to make SPI and LPI ISTs valid or invalid. Together with the existing VMT commands, the command set is: VMT_L2_MAP - Make a second level VM table valid VMTE_MAKE_VALID - Make a single VMTE, and hence VM, valid VMTE_MAKE_INVALID - Make a single VMTE, and hence VM, invalid SPI_VIST_MAKE_VALID - Make the SPI IST valid LPI_VIST_MAKE_VALID - Make the LPI IST valid LPI_VIST_MAKE_INVALID - Make the LPI IST invalid Once implemented, irq_set_vcpu_affinity() will act as an ioctl-like interface for issuing commands specific to either a VM or the particular VPE that the doorbell belongs to. None of these commands are plumbed through to the host IRS at this stage. There is intentionally no SPI_VIST_MAKE_INVALID command. The SPI IST will be allocated as part of VM creation and will remain valid for the lifetime of the VM. It can be freed after the VMTE has been made invalid during teardown. The LPI IST, on the other hand, is driven by the guest, which is free to invalidate and free its LPI IST at any point. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-11-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Create and manage VM and VPE tablesSascha Bischoff
GICv5 uses a set of in-memory tables to track and manage VM state. These must be allocated by the hypervisor and provided to the IRS. The VMT (Virtual Machine Table) is a linear or two-level table comprising VMT Entries (VMTEs). Each VMTE describes the state for a single VM. This state includes things such as the SPI and LPI IST configuration (coming in a future commit), an implementation-defined VM Descriptor, and a VPE Table (VPET). The VPET contains one entry per possible VPE ID belonging to a VM. It is used to mark a VPE as valid and provide the address of an implementation-defined VPE Descriptor (VPED), which the hardware uses to track and manage VPE state. Allocate each VM's VPEDs as a single dense array indexed by vcpu_idx, while the VPET remains indexed by the userspace-provided vcpu_id. This keeps VPED storage proportional to the number of vCPUs even when their IDs are sparse. The VMT and VPET are shared with the IRS. On systems with a non-coherent IRS, cache maintenance operates at cache-line granularity, while multiple entries can occupy the same cache line. Use a common lock for CPU accesses to these tables and IRS command processing so that writing back one entry cannot overwrite an IRS update to a neighbouring entry. The implementation-defined VMD and VPED storage is also visible to the IRS. Round these allocations up to whole cache lines to prevent cache maintenance from corrupting unrelated slab objects. Initialise the storage before publishing its addresses to the IRS. This commit adds support for allocating the VMT and its descriptor backing state, and for managing VMTEs. The VMTEs can be initialised or released for reuse. VM IDs are allocated with an IDA, while an XArray tracks the host-side allocations associated with populated VMTEs. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-10-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Add VPE doorbell domainSascha Bischoff
VPE doorbells allow the GICv5 hardware to notify KVM when an SPI or LPI can be signalled to a non-resident VPE. This provides the mechanism used to wake blocked vcpus once the hardware determines that the interrupt is eligible to be delivered. Add support for a per-VM VPE doorbell irq domain. The domain is created under the GICv5 LPI domain, with one doorbell allocated per VPE. Store the allocated doorbell base in the VM's GICv5 state so that later patches can request per-vcpu doorbell IRQs and use them for IRS commands and wakeups. Add the per-VPE doorbell state to the GICv5 CPU interface state. The doorbell IRQ number is populated when the IRQs are requested, and the db_fired state is used by later patches once doorbell delivery is wired up. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-9-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Cache host IRS ID registersSascha Bischoff
KVM needs access to the host IRS configuration frame to configure virtual-machine resources. The frame ID registers describe the capabilities available to KVM. Cache IRS_IDR2, IRS_IDR3, and IRS_IDR4 rather than extracting their individual fields into kvm_vgic_global_state. Accessor helpers derive the required capabilities from the cached registers. Use the cached IRS_IDR4 VPE capacity to limit the maximum number of vCPUs, while retaining VGIC_V5_MAX_CPUS as KVM's own upper bound. Keeping the raw register values lets KVM adjust the exposed capabilities when needed, as is done for ICH_VTR_EL2, and avoids tying future EL2 code to the layout of kvm_vgic_global_state. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-8-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14KVM: arm64: gic-v5: Define remaining IRS MMIO registersSascha Bischoff
Complete the set of defined IRS MMIO registers in the GICv5 header file. Up until now, the set of defined IRS MMIO registers has been driven by code requirements. However, in order to properly emulate the IRS MMIO interface in KVM, the full set of IRS MMIO registers needs to be added. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-5-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14irqchip/gic-v5: Provide OF IRS config frame attrs to KVMSascha Bischoff
KVM needs to interact with the host IRS in order to, for example, make VMs or VPEs valid. There are two potential approaches here. Either the host irqchip driver can provide an interface, or KVM can interact directly with the host IRS. The latter of these two is chosen as the set of MMIO registers that KVM needs to interact with is orthogonal to the set used by the host irqchip driver (with the exception of some of the read-only IRS_IDRx registers). Pass KVM a pointer to an IRS config frame - the config frame belonging to ANY IRS is fine as long as one IRS's config frame is used consistently - in struct gic_kvm_info. Additionally, include a flag telling KVM whether the IRS is coherent or non-coherent in order to make sure that KVM can do the correct cache state management, if required. Only OF (Device Tree) is supported with this change. ACPI is not. Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com> Link: https://patch.msgid.link/20260904113404.4051341-3-sascha.bischoff@arm.com Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-09-14thunderbolt: Add tb_ring_poll_pending()Mika Westerberg
This helper can be used to figure out whether tb_ring_poll() has a frame to be returned. This can be used without the caller needing to take its own lock. Assisted-by: LLM Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
2026-09-13Merge tag 'x86_urgent_for_7.3-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Dave Hansen: "The most notable fix is THP not silently losing user data and having been around for a couple of years. The main explanation I'd have for its longevity is that it requires a few different things to align at the same time: MADV_FREE, THP and heavy reclaim. - Fix user-space data loss with THP - Fix set_memory oopses - Fix addition of large constants in mul_u64_add_u64_div_u64() - Fix FineIBT hash offset in cfi_get_func_hash() - Fix PCI device reference counting in amd_smn_init()" * tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/amd_node: Fix PCI device reference counting in amd_smn_init() x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64() x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() x86/mm: Fix user-space data loss with MADV_FREE and THP x86/mm/pat: Allocate split page tables as kernel page tables x86/alternatives: Exclude text poking against change_page_attr() x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
2026-09-13Input: document that no new LED codes should be addedDmitry Torokhov
Add a comment to input-event-codes.h clarifying that no new LED definitions should be added to the input subsystem. The existing LED_* definitions are legacy and grandfathered for backwards compatibility with userspace via evdev. Any new LED indicators should instead use the dedicated LED subsystem. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-09-14ASoC: sdw_utils: cs_amp: Delete bogus and incorrect capture channel fixupRichard Fitzgerald
Delete the asoc_sdw_cs_spk_feedback_rtd_init(). This is not needed now that the ASoC bug it was working around has been fixed. And it was broken anyway because it didn't match the way the core SoundWire code mapped codec channels to frame bitslots. This code was added to avoid a problem where multiple codec DP outputs were mapped to the same SoundWire frame bit slot. This would allow a user to break the SoundWire bus just by enabling mixer outputs using ALSA controls. As no production system has used the capture stream, this workaround was of little consequence and the problem of conflicting DP mappings was not investigated. The ASoC bug that enabled too many channels on each codec has now been fixed. So this workaround can be completely deleted. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20260910114500.1586637-6-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-14ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_mapRichard Fitzgerald
Add a codec_ch_mask member to snd_soc_dai_link_ch_map. The CPU and codec channel masks are not necessarily the same, and are quite likely different. SoundWire and I2S/TDM both support assigning different sample slots to each codec, so for example channel 0 on each codec could map to different channels at the CPU. It is also possible for one TX channel to map to multiple RX channels. So it isn't _always_ safe to assume that the total number of set bits in the CPU ch_mask is the same as the total number of enabled channels on the codec. For example consider this mapping on a capture stream: CPU0 CODEC0 cpu_ch_mask = 0x03 CPU1 CODEC0 cpu_ch_mask = 0x03 This could be either four TX channels on the codec split across two receiving CPUs, or two TX channels on the codec duplicated to two CPUs. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20260910114500.1586637-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-14ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_maskRichard Fitzgerald
Rename the ch_mask member of snd_soc_dai_link_ch_map to cpu_ch_mask, as that is what it is used for. The CPU and codec channel masks are not necessarily the same, and are quite likely different. SoundWire and I2S/TDM both support assigning different sample slots to each codec, so for example channel 0 on each codec could map to different channels at the CPU. So it's quite normal that the channel mask at the CPU end is different for each codec, but the codec channel masks are the same for each codec. Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com> Link: https://patch.msgid.link/20260910114500.1586637-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-13Merge tag 'trace-v7.3-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Don't destroy user event fields when removal fails User event fields are destroyed before the event is removed from visibility. But that can fail leaving the still visible event with no fields. Move the destroying of the fields to after the event is successfully removed from visibility. - Initialize function graph state is fork before calling copy_exec_state() For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state. If that allocation fails, ftrace_graph_exit_task() will free the tasks ret_stack pointer. Since that pointer is still using the parent's ret_stack, it mistakenly frees the parent's pointer too. Call ftrace_graph_init() on the task first which will NULL out the new tasks's ret_stack and if the copy fails, it will not free anything. - Remove FGRAPH_MAX_INDEX The macro FGRAPH_MAX_INDEX was added but never used. Remove it. - Save ent_size in function graph printing of nested functions The function graph tracer needs to look at the next event to see if the next event is the return of the current function entry. If it is, it prints a single line: ktime_get(); Otherwise it prints it like a nested function: tick_nohz_irq_exit() { ktime_get(); kcpustat_irq_exit(); } In order to look at the next event, it must save the current event so that it has the information to print from it. It saves the event in the iterator descriptor called "ent". What it doesn't save is the ent_size of the event which is now used to know if the function graph arguments are to be printed. The peek doesn't save the size so the size used happens to be that of the size of the last event that was seen. Save the entry event size in the iterator descriptor so that the correct size is used. - Fix several errors with freeing data in the histogram code The histogram code had a lot of leaked or or incorrect accounting when failures happen. Correct them. - Fix histogram regression of .percent and .graph modifiers Up until 6.3 histogram values could have "percent" or "graph" modifiers that changed how they were printed. But a change that added restricting histograms values from being strings, stack traces and other modifiers inadvertently prevented them from using the percent and graph modifiers, which were legal use cases for values. Put back the percent and graph modifiers. - Fix various typos in the comments - Set the trace_clock before initializing a histogram with clock argument The histogram API allows the user to specific which trace clock to use via a "clock=" string. The histogram is set up first before the clock is checked. If the passed in clock is not valid, it exits without fully fixing up the histogram leaving it on the list and a use-after-free can trigger. Update the clock argument first and if it fails then exit gracefully before the histogram trigger is placed on any lists. - Restore :mod: trailer after parsing in ftrace_set_clr_event The function ftrace_set_clr_event() modifies the parse string and needs to put it back to what was passed in. It searches for ":mod:" via a strsep() but fails to put back the first ':' in the string. Add back the ':' in the passed in string. - Take trace_array reference when opening a tracer options file The options files are dynamically created and some tracers add their own options. When a tracer adds their own list of options, the trace_array holding them has an array to hold the list of options for each tracer. This array increases in size via a krealloc(), and the new entry gets a newly allocated array to hold the options of the new tracer being added. The element in each entry of the tracer's option array holds a pointer back to the trace_array, a pointer to the tracer it is associated to, a pointer to the flags of the option. The issue is that these arrays are freed when the trace_array is freed when its instance it represents is removed from the instances directory. There's a race that an open of one of these options files can happen when the instance is being removed. Add a new helper function to be called by the open function of the options file to iterate all existing trace_arrays under a lock and find the one that has the given option element in one of it's tracer arrays. If found, then update the associated trace_array's reference counter to keep it from being freed. If not found, have the open call return -ENODEV. - Disable interrupts when acquiring the lock in rb_wake_up_waiters() The function rb_wake_up_waiters() assumes it will be called in interrupt context and does not disable irqs when taking cpu_buffer->reader_lock, which can be called in hard interrupt context. The issue is in PREEMPT_RT, this function is called in thread context leaving this lock open to a deadlock. Take the lock with interrupts disabled. - Use rcu_assign_pointer() for tmp_ops filter hash The tmp_ops used in update_ftrace_direct_mod() assigns its filter_hash field directly, but that field is annotated as __rcu and sparse complains. Assign it with rcu_assign_pointer() - Fix use-after-free in enable_trigger_private_data_free() The trace_event_call is accessed through the event_trigger_data's trace_event_file pointer to put the trace_event_call on freeing. The issue is that the trace_event_file data may have been freed already causing a use-after-free. Add a field to the event_trigger_data that points directly to the trace_event_call so that it can decrement its reference directly without needing to go through the trace_event_file. - Fix accounting of buffer data remote headers trace_buffer_desc_size() and trace_remote_alloc_buffer() undercount the number of pages is needed for the asked for size as it doesn't take into account the meta data on each page. Add a helper function to do the calculation properly and use that in these functions. - Catch nr_page_va overflow in ring_buffer_desc sizing The number of pages per remote ring buffer is capped by ring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to overflow that field would silently allocate a descriptor smaller than what was asked for. - Do not resize the subbuf order if any per_cpu buffer is disabled The mmapping of ring buffers disables resizing the subbuffers, but it is done per-cpu whereas the subbuf size change is done for all the per_cpu buffers under the buffer->mutex. It could change the size of some while the mapping is happening on others. Have the resize of the subbuf order check all the per_cpu buffers under the lock to see if any of them is disabled before starting and causing an inconsistency between buffers that are being mapped. * tag 'trace-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (25 commits) ring-buffer: Check resize_disabled before publishing the new subbuf order tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing tracing/remotes: Account for ring buffer page header in size calculation tracing: Don't dereference trace_event_file in deferred trigger free ftrace: Use rcu_assign_pointer() for tmp_ops filter hash ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() tracing: Take trace_array reference when opening a tracer options file tracing: Fix ring_buffer_read_page_size() kernel-doc tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event() tracing: Fix memory corruption from a "STACKTRACE" histogram key tracing: Fix memory corruption from the histogram stacktrace modifier tracing: Undo the registration when enabling the histogram trigger fails tracing: Take the reference before publishing the named histogram trigger tracing: Set the trace clock before registering the histogram trigger tracing: Fix typo "preceeded" in comment tracing: Fix typo "availabe" in comment tracing: Let histogram values keep the percent and graph modifiers tracing: Keep the entry count when the histogram stats allocation fails tracing: Free histogram the field rejected for a bad modifier tracing: Free histogram the var ref when its initialization fails ...
2026-09-13tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizingVincent Donnefort
The number of pages per remote ring buffer is capped by ring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to overflow that field would silently allocate a descriptor smaller than what was asked for. Return SIZE_MAX from trace_buffer_desc_size() on nr_page_va overflow. Link: https://patch.msgid.link/20260911193937.602202-3-vdonnefort@google.com Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes") Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-09-13tracing/remotes: Account for ring buffer page header in size calculationVincent Donnefort
trace_buffer_desc_size() and trace_remote_alloc_buffer() undercount the required pages because every ring buffer page contains a header (BUF_PAGE_HDR_SIZE). Account for that header to ensure allocated remote ring buffers aren't smaller than requested by the user. The newly introduced helper __calc_nr_pages_ring_buffer_desc() can return a value that overflows the descriptor nr_pages field (32 bits). Link: https://patch.msgid.link/20260911193937.602202-2-vdonnefort@google.com Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes") Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-09-13Merge tag 'sched-urgent-2026-09-13' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix EEVDF se->max_slice value on enqueueing (Vincent Guittot) - Fix EEVDF augmented rb-trees re-balancing with multiple fields (Vincent Guittot) - In proxy scheduling, account cgroup CPU time to the execution context, not the scheduling context (Hui Su) - Likewise, call wq_worker_tick() for the execution context, not the scheduling context (Hui Su) * tag 'sched-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Call wq_worker_tick() for the execution context sched: Account cgroup CPU time to the execution context sched/eevdf: Fix rb augmented with multi fields sched/eevdf: Fix augmented max_slice
2026-09-13Merge tag 'core-urgent-2026-09-13' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull entry code fix from Ingo Molnar: - Fix generic entry code cross-build failure on !CONFIG_AUDITSYSCALL kernels using older RISCV64 and S390 cross-compilers (Thomas Gleixner) * tag 'core-urgent-2026-09-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry: Guard syscall_enter_audit() invocation with CONFIG_AUDITSYSCALL
2026-09-13net/9p: fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com> Message-ID: <20260904112100.34541-1-hemanth.selam@gmail.com> Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
2026-09-12bpf: Prepare kfunc arguments for the JIT from an ABI descriptionYonghong Song
The previous patch refuses a kfunc argument of more than one eightbyte. This patch allows up to 16 byte kfunc arguments. But different architectures have different ways to map the BPF calling convention (no gap, no backfill) to the native one. Rather than have each arch open-code where it wants an argument, describe the convention with a register count and four booleans, and let each arch set what applies to it: struct bpf_jit_arg_abi { u8 nr_arg_regs; bool even_reg_align; bool even_stack_align; bool split_at_boundary; bool backfill_after_stack; }; The four booleans are meant to cover x86-64, arm64, RISC-V LP64 and PowerPC64 ELFv2, although only x86-64 and arm64 fill the struct in here. bpf_jit_place_args() and bpf_jit_plan_arg_moves() use that description to work out where each argument belongs and which slots the JIT then has to move, to be used in the JIT later on. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260912195242.989416-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-12bpf: Rename bpf_call_summary::num_params to arg_slot_cntYonghong Song
The field 'num_params' counts the argument registers and outgoing stack slots a helper or kfunc call takes. The next patch gives a 16-byte parameter two slots, so the name stops describing what the field holds. Rename 'num_params' to 'arg_slot_cnt'. No functional change. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260912195232.988528-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-12bpf: Rename bpf_subprog_info::arg_cnt to arg_slot_cntYonghong Song
Rename arg_cnt to arg_slot_cnt, as a later patch gives a parameter that takes two argument registers, an __int128 or a 16-byte aggregate, two slots. No functional change. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260912195211.986081-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-12ACPI: processor: thermal: Use more suitable cooling device dataRafael J. Wysocki
Instead of passing an ACPI device object pointer as devdata to thermal_cooling_device_create(), make acpi_processor_thermal_init() pass a pointer to the struct acpi_processor representing the given CPU to it, which allows the callback functions in processor_cooling_ops to be simplified and the second argument of acpi_processor_thermal_init() and acpi_processor_thermal_exit() to be dropped. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/6192780.MhkbZ0Pkbq@rafael.j.wysocki
2026-09-12ACPI: processor: thermal: Use thermal_cooling_device_create()Rafael J. Wysocki
Instead of using thermal_cooling_device_register() for registering a cooling device in the ACPI processor driver, make it use thermal_cooling_device_create() and pass a pointer to the processor device representing the given CPU to that function as the cooling device's parent. That will cause the cooling device's sysfs directory to be created under the parent's sysfs directory (among other things). Since creating a class device under a parent causes a "device" symbolic link from the sysfs directory of the class device to the sysfs directory of the parent to appear automatically, remove the code creating the "device" symbolic link from the sysfs directory of the cooling device in question to the sysfs directory of the parent's companion ACPI device. That ACPI device is reachable through the "firmware_node" symbolic link in the parent's sysfs directory regardless. Moreover, since the cooling device is now located in sysfs under its parent and it can be easily identified as a cooling device, there is no need to create a "thermal_cooling" symbolic link from its parent's ACPI companion to it. Accordingly, also remove the code creating that symbolic link. While at it, check for error pointer values in addition to checking for NULL in acpi_processor_thermal_exit() to avoid dereferencing them mistakenly. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> [ rjw: Corrected typo in the changelog ] Link: https://patch.msgid.link/2362345.iZASKD2KPV@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>