summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-10-15ASoC: soc-component: move snd_soc_component_to_dapm() to soc-component.cKuninori Morimoto
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move snd_soc_component_to_dapm() to soc-component.c Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87ecdtyolc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move soc_{probe/remove}_component() to soc-component.cKuninori Morimoto
struct snd_soc_component will be capsuled soon, its member will not be able to access from non soc-component.c. Move soc_{probe/remove}_component() to soc-component.c It renames function name - soc_{probe/remove}_component() + snd_soc_component_{probe/remove}() Then soc-component.c had original snd_soc_component_{probe/remove}() which is wrapper function. These wil be deployed internally. Releted fucntions also be moved. It renames function name. soc_set_name_prefix() -> snd_soc_component_set_name_prefix() soc_init_component_debugfs() -> snd_soc_component_debugfs_init() soc_cleanup_component_debugfs() -> snd_soc_component_debugfs_cleanup() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87fqy9yoli.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move snd_soc_component_fixup_controls()Kuninori Morimoto
snd_soc_component_xxx_controls() are located between _probe() and _remove() in soc-component.c, and are located in scattered positions in soc-component.h. Fixup them. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87jynlyolt.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: move snd_soc_add_component_controls()Kuninori Morimoto
snd_soc_add_component_controls() is Component related function. And its parameter will be capsuled soon, will be not enable to access from soc-core.c. Move it to soc-component.c It renames function name - snd_soc_add_component_controls() + snd_soc_component_add_controls() Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87ld81yolw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: replace bool member to bit fieldKuninori Morimoto
soc-component has meny bit fields (A), no need to have bool member (B). Let's makes it as bit field, too struct snd_soc_component_driver { ... ^ unsigned int module_get_upon_open:1; (A) unsigned int idle_bias_on:1; | unsigned int suspend_bias_off:1; | ... v unsigned int legacy_dai_naming:1; ... (B) bool use_dai_pcm_id; ... } Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87mrshyom0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: soc-component: tidyup be_hw_params_fixup() define positionKuninori Morimoto
be_hw_params_fixup() is one of snd_soc_component_driver callback function, but is defined as alone in a remote location. Let's move it to the same place as other callbacks. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Alvin Šipraga <alvin.sipraga@analog.com> Link: https://patch.msgid.link/87o6cxyom4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15ASoC: Series of loose fixesMark Brown
Amadeusz Sławiński <amade@asmblr.net> says: Following current fashion of poking code with LLM to see what issues it finds. Some are minor, other more likely to cause some real issues like the one with snd_soc_limit_volume() returning positive value, while callers do simple if (ret) check. Link: https://patch.msgid.link/20261014200608.118770-1-amade@asmblr.net
2026-10-15ASoC: soc-component: Fix return type of snd_soc_pcm_component_pointer()Amadeusz Sławiński
Both caller and pointer callback expect the return value to be snd_pcm_uframes_t, however it was defined incorrectly leading to potential truncation of returned value. Fixes: 0035e2565b93 ("ASoC: soc-component: add snd_soc_pcm_component_pointer()") Signed-off-by: Amadeusz Sławiński <amade@asmblr.net> Link: https://patch.msgid.link/20261014200608.118770-8-amade@asmblr.net Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15io_uring: wake ring pollers for local task_workJosef Bacik
With IORING_SETUP_DEFER_TASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via poll() or epoll on the ring fd when it is time to do that, io_uring_poll() reports EPOLLIN if local work is pending. That only helps if the work is there at the time of the call. When DEFER_TASKRUN was added, io_req_local_work_add() did io_cqring_wake(), which took care of tasks sleeping in poll() as well. Then polling got a wait queue of its own, ->poll_wq, and the wake up in io_req_local_work_add() was replaced by waking the submitter directly. Since then ->poll_wq is only woken when CQEs are committed, which for such a ring is done by the very task that is waiting to be told to: submitter completion poll(ring_fd) io_uring_poll() // nothing yet schedule() io_req_local_work_add() // ->cq_wait_nr: nobody waits // sleeps on Wake ->poll_wq when the first entry is put on the work list. Like for the eventfd, that must not be done right away if the work is queued from a wake up handler, as the chain of wake ups could get back to the wait queue whose lock is held. Use an RCU callback in that case, with a reference to the ring. Fixes: 130bd686d9be ("io_uring: waitqueue-less cq waiting") Assisted-by: LLM Signed-off-by: Josef Bacik <josef@toxicpanda.com> Link: https://patch.msgid.link/20261015-b4-io-uring-fixes-v1-19-c1556f5d7bf5@toxicpanda.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-15Merge branch 'io_uring-7.3' into for-7.4/io_uringJens Axboe
Merge 7.3 fixes to avoid conflicts with future changes merged for the 7.4 kernel. * io_uring-7.3: io_uring/cancel: don't spin on local work the task can't run io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_uring/register: don't exempt disabled rings from task restrictions io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK io_uring: fix task_work add use-after-free with SQPOLL io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full io_uring/zcrx: requeue multishot receives stopped by a local resource io_uring: initialize task context before running the BPF loop
2026-10-15of: overlay: remove unused of_overlay_remove_all()Abdurrahman Hussain
of_overlay_remove_all() has no in-tree callers. It is also subtly broken. It passes &ovcs->id to of_overlay_remove(), which zeroes *ovcs_id once the changeset is reverted, before calling free_overlay_changeset(). Through the aliased pointer that zeroes ovcs->id itself, so free_overlay_changeset()'s "ovcs->id > 0" guard is false and both idr_remove() and list_del() are skipped: the overlay_changeset is kfree()d while still linked in ovcs_list and registered in ovcs_idr. Rather than fix a helper nobody calls, remove it, along with its !CONFIG_OF_OVERLAY stub and the paragraph documenting it in overlay-notes.rst and in the zh_CN translation. ovcs_list itself stays: overlay_removal_is_ok() still walks it to check that a changeset is topmost. Reported-by: Sashiko AI <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/20260901014554.83A8D1F000E9@smtp.kernel.org Suggested-by: Rob Herring <robh@kernel.org> Link: https://lore.kernel.org/all/20260928182658.GA185307-robh@kernel.org/ Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai> Link: https://patch.msgid.link/20261014-b4-of-overlay-remove-all-fix-v2-1-cf5ea2cc9dc3@nexthop.ai Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-10-15Merge branch 'for-next/fw-rmi' into for-next/coreCatalin Marinas
* for-next/fw-rmi: : RMM v2.0 base RMI support firmware: arm_rmm: hotplug: Skip memory added to ZONE_MOVABLE firmware: arm_rmm: Add wrappers for Realm related RMI commands arm64: Block hibernate and kexec while RMM is active PM: hibernate: Add an arch hook for preventing hibernation firmware: arm_rmm: Ensure the RMM has GPT entries for memory firmware: arm_rmm: Activate the RMM firmware: arm_rmm: Add support for SRO firmware: arm_rmm: Configure the RMM with the host's page size firmware: arm_rmm: Check for RMI support at init firmware: arm_rmm: Add SMC definitions for calling the RMM arm64: mm: Handle Granule Protection Faults (GPFs)
2026-10-15Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', ↵Catalin Marinas
'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/secondary-boot-prep', 'for-next/sysreg' and 'for-next/gcs', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: (22 commits) drivers/perf: apple_m1: Add macOS 27 M2 Event perf/marvell: cn10k_tad: Publish the OF module alias perf: xgene: initialize lock before requesting IRQ perf: marvell: avoid large stack variables perf/dwc_pcie: Fix PCI device reference leak in probe coresight: perf: Suppress ITRACE start records perf: arm_spe: Suppress redundant ITRACE start records perf/core: Export perf_event_itrace_started() perf/cxl: Clear stale overflow status before using a counter perf/cxl: Don't log through pmu.dev in the overflow interrupt handler perf/cxl: Validate the hardware-reported counter width perf/cxl: Unfreeze counters after handling an overflow interrupt perf/cxl: Don't share the overflow interrupt, and keep it pinned cxl/pci: Add the PMUs after configuring events perf/cxl: Split the MSI vector out of info->irq perf/cxl: Accept an overflow interrupt on MSI message number 0 perf/cxl: Fix the counter overflow delta fixup perf/cxl: Clear stale event fields before reprogramming a counter perf/cxl: Program the requested event group on configurable counters drivers/perf: hisi: Add cycle event for new MN PMU ... * for-next/misc: arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code arm64: clear_page[s] using memset arm64/sve: Don't zero the SVE state buffer when the SVE state is live arm64/cpufeature: Drop redundant define(ID_AA64MMFR0..._SUPPORTED_LPA2) arm64: Use proper include variant arm64: include: fix repeated word 'to' in comment selftests: arm64: fix typo "hander" in comment arm64: fix typos in comments docs: arm64: Fix typo "initalised" in booting.rst arm64: alternative: Remove 'cfg' parameter arm64: mte-kasan: Use IS_ENABLED() rather than ALTERNATIVE() 'cfg' parameter arm64/cpufeature: Change description for ARM64_HAS_LPA2 * for-next/be-gone: drivers: Kconfig: Simplify dependencies on ARM64 && !CPU_BIG_ENDIAN arm64: Kbuild: Remove vestigial big-endian support gve: Add explicit ARM64 dependency to Kconfig crypto: hisilicon/sec2: Remove check of CONFIG_CPU_LITTLE_ENDIAN arm64: Remove all usage of __AARCH64EB__ arm64: Remove all usage of CONFIG_CPU_BIG_ENDIAN KVM: arm64: Remove support for a big-endian hypervisor object arm64: vdso32: Always build compat vDSO object as little-endian arm64: assembler: Remove endianness helper macros arm64: lib: Assume a little-endian kernel in optimised string routines arm64: lib: Assume a little-endian kernel in custom library routines arm64: crypto: Assume a little-endian kernel arm64: bpf: Remove big-endian support from the JIT compiler selftests/arm64: Remove big-endian support * for-next/smccc-bus: : Switch Arm SMCCC firmware services to an SMCCC bus arm64: rsi: Correct type of realm_config::hash_algo firmware: smccc: Pass only the required device probe arguments firmware: arm_rmm: Add SPDX and sort the Kconfig and Makefile entries coco: guest: arm64: Remove dummy CCA platform device coco: guest: arm64: Add sysfs ABI for CCA Realm guests firmware: smccc: arm-cca-guest: Bind the TSM provider to an SMCCC device virt: coco: arm-cca-guest: Rename TSM report source file arm64: realm: Move Realm memory encryption ops to RSI code firmware: arm_rmm: Move RSI support out of arch/arm64 firmware: hwrng: arm_smccc_trng: Register as an SMCCC device firmware: smccc: Add an Arm SMCCC bus * for-next/preemptible-this-cpu: : Preemptible this_cpu_*() operations arm64: percpu: Remove _pcp_protect*() wrappers arm64: percpu: Implement preemptible CMPXCHG128 ops arm64: percpu: Implement preemptible CMPXCHG ops arm64: percpu: Implement preemptible XCHG ops arm64: percpu: Implement preemptible return RMW ops arm64: percpu: Implement preemptible void RMW ops arm64: percpu: Implement preemptible read/write ops arm64: percpu: Add infrastructure for preemptible this_cpu_*() ops arm64: entry: sdei: Make 'tsk' available arm64: entry: sdei: Restore all clobberable GPRs arm64: gpr-num: add __GPR_NUM() helper arm64: gpr-num: Add wxN aliases for wN registers arm64: percpu: Factor out percpu offset asm arm64: ptrace: Always inline pt_regs_{read,write}_reg() arm64: preempt: Treat should_resched() as unlikely arm64: preempt: Simplify and optimize __preempt_count_dec_and_test() arm64: cmpxchg128: LSE: Remove redundant operands arm64: cmpxchg: LL/SC: Avoid redundant extension * for-next/cpu-errata: : Various CPU errata workarounds arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue arm64: cpufeature: Add ARM64_CPUCAP_SOC_ERRATUM for SoC-level errata * for-next/mpam: (30 commits) : MPAM updates arm_mpam: make the mon_sel guard conditional only arm_mpam: On saving mbwu state read the monitors before clearing CFG_MBWU_CTL arm_mpam: detect and enable MPAM-Fb PCC support arm_mpam: change MPAM-Fb error IRQ to use a threaded IRQ handler arm_mpam: add MPAM-Fb MSC firmware access support arm_mpam: prepare mon_sel locking for MPAM-Fb arm_mpam: propagate MSC access errors in mpam_reset_class_locked() arm_mpam: propagate MSC access errors for interrupt control arm_mpam: propagate MSC access errors for mpam_reprogram_ris_partid() arm_mpam: propagate MSC access errors for state saving function arm_mpam: propagate MSC access errors for __ris_msmon_read() arm_mpam: propagate MSC access errors for msmon helpers arm_mpam: propagate MSC access errors for MBWU counters arm_mpam: propagate MSC access errors for hw_probe functions arm_mpam: let low level MSC accessors return an error MAINTAINERS: Use linux-arm-kernel list for the MPAM driver MAINTAINERS: Add mpam.rst to the MPAM DRIVER entry arm_mpam: resctrl: Don't stop early when tearing down a class arm_mpam: Switch to kvzmalloc_objs() for allocation of component cfg arm_mpam: Don't loop forever if there is the maximum possible amount of PARTIDs ... * for-next/kselftest: : arm64 kselftest updates kselftest/arm64: signal: copy each test binary only once kselftest/arm64/mte: Use MTE safe memory accessors kselftest/arm64/mte: Introduce MTE safe memory accessors kselftest/arm64: Extend gcs-locking to cover cases where enable is unlocked * for-next/efi: : arm64 EFI updates/fixes arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO * for-next/secondary-boot-prep: : cpuinfo cleanup in preparation for parallel secondary bring-up arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store * for-next/sysreg: : sysreg updates perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values * for-next/gcs: : GCS updates/fixes kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
2026-10-15iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVAAndrea Parri
Generally userspace is going to step the dirty bitmap through the IOVA space. However if the bitmap ends in the middle of a large PTE this is problematic. The first step will clear the dirty bit and report dirty to the end of its bitmap while the second step will see the clear'd dirty and report clean for the start of the bitmap. If it happens this ends up losing dirties. Further this function is missing bounds checking so if this does happen ther is a good chance it will write memory beyond what the userspace was expecting. Return an error code if this illegal condition happens. Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Andrea Parri <parri.andrea@gmail.com> Link: https://patch.msgid.link/20260925161142.189813-2-parri.andrea@gmail.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-10-15ALSA: core: Serialize snd_refcount put and syncTakashi Iwai
When a thread tries to sync-and-destroy the resource with snd_refcount_sync(), it might lead to a UAF in a very slight time window. Namely, snd_refount_put() calls wake_up() after atomic_dec_and_test(), but wait_event() in snd_refcount_sync() checks the condition via atomic_test() without serialization, hence the thread that called snd_refcount_sync() can continue immediately to release the resource before another thread calls wake_up(). For avoiding the race above, introduce the spinlock and take it at snd_refcount_put() and snd_refcount_sync() in order to serialize the operations. Fixes: dcca9b6064c3 ("ALSA: Add simple refcount helper functions") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20261015071838.31082-1-tiwai%40suse.de Reviewed-by: Cen Zhang <zzzccc427@gmail.com> Link: https://patch.msgid.link/20261015112256.3902-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-10-15Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/microchip/lan865x/lan865x.c 2a3f6d2a9ac3 ("microchip: lan865x: move setting of netops to fix crash") 15358c2c3dca ("net: ethernet: oa_tc6: return ERR_PTR from oa_tc6_init()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15USB: Documentation: Update description of completion callback contextAlan Stern
The existing kerneldoc documentation for URB completion callbacks is incorrect about the context in which the callbacks occur; it is not always in_interrupt. State explicitly that a callback may occur in any context with no guarantees, and likewise for the status of CPU-local interrupts. Documentation update only; no code changes. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/de582feb-a0aa-4fc8-9818-890014de32a9@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-10-15ASoC: qcom: Add QAIF driver for Shikra audio platformMark Brown
Harendra Gautam <harendra.gautam@oss.qualcomm.com> says: This series introduces the Qualcomm Audio Interface (QAIF) driver for the Shikra audio platform. Hardware IP Overview ==================== QAIF (Qualcomm Audio Interface) is a fully configurable DMA-based audio subsystem used to transmit and receive audio data over serial audio interfaces (PCM, TDM, MI2S) and to provide a DMA interface for internal codec connections. It manages two independent data paths: AIF (Audio Interface): multiple multi-lane Unified Audio Interfaces, each supporting up to 8 independent data lanes. Each lane is individually configurable as TX (output/speaker) or RX (input/mic). All lanes of an interface share a single bit clock and frame sync. Supported modes are PCM (short/long sync), TDM, and MI2S (stereo/mono). Per-interface configuration includes sync source (master/slave), sync mode, sync delay, sync inversion, slot width (8/16/24/32-bit), sample width, active slot masks (up to 32 slots), bits-per-lane frame size, lane enable/direction masks, loopback, output-enable control, and full-cycle path support for long chip-to-chip connections. CIF (Codec Interface): multiple RDDMA (playback) and WRDMA (capture) channels connecting to an internal codec over a parallel bus. Each channel supports active-channel enable mask (up to 16 channels), frame-sync selection, frame-sync delay, frame-sync output gating, dynamic clock gating, and 16-bit packing/unpacking. Note on RX/TX naming convention: in QAIF, TX refers to the output (speaker/playback) direction and RX refers to the input (mic/capture) direction. This applies to both AIF lane directions and CIF slot/mask properties. DMA Engine: RDDMA fetches audio from DDR/TCM/LPM into a shared SRAM latency buffer (SHRAM) and drains it to the interface. WRDMA collects data from the interface into SHRAM and writes it to memory. Each DMA owns a private SHRAM region defined by start address and length registers. Burst sizes of 1/2/4/8/16 beats (64-bit) are supported with up to 4 outstanding transactions per DMA. Two QSB master ports (QXM0 for TCM, QXM1 for DDR/LPM) provide the memory interface. Execution Environments (EE): Resources (DMAs, audio interfaces, interface groups) are partitioned among up to 5 EEs via map registers. Each EE owns a set of DMAs, audio interfaces, and interface groups, and receives its own independent interrupt output. The interrupt hierarchy has a two-level structure: a summary register identifies the event class (DMA period, underflow/overflow, error response, audio interface underflow/overflow, group done, rate detector, VFR), and per-resource status registers identify the specific channel. Interface Grouping (Bonding): Multiple AIF and CIF interfaces can be bonded into a group to start synchronously and align their DMA period interrupts within half a frame duration using the RDDMA padding feature. Up to 6 groups are supported. Rate Detector: Two rate detector blocks measure the frequency of incoming frame sync or word select signals and generate interrupts on rate change, undetected rate, or sync timeout. Block Diagram ============= System Memory (DDR / LPM / TCM) +---------------------------------+ | Circular Buffers (ping-pong) | +----------+----------+-----------+ | ^ 64-bit AXI 64-bit AXI | | +----------v----------+-----------+ | QSB Master Ports | | +----------+ +----------+ | | | QXM0 | | QXM1 | | | +----+-----+ +-----+----+ | +-------|--------------|----------+ | | +-------v--------------v----------+ | Shared RAM (SHRAM) | | +------------+ +------------+ | | | QXM0 Read | | QXM0 Write | | | | SHRAM | | SHRAM | | | +------------+ +------------+ | | +------------+ +------------+ | | | QXM1 Read | | QXM1 Write | | | | SHRAM | | SHRAM | | | +------------+ +------------+ | +---+--------+--------+-------+---+ | | | | +---v--+ +--v---+ +--v---+ +-v----+ |RDDMA | |RDDMA | |WRDMA | |WRDMA | | AIF | | CIF | | AIF | | CIF | |[0..n]| |[0..n]| |[0..n]| |[0..n]| +--+---+ +--+---+ +--+---+ +-+----+ | | ^ ^ | TX | TX | RX | RX v v | | +--+--------------------+ +----+----------+ | Unified Audio Intf | | Codec DMA | | (AIF 0..12) | | Interface | | | | (CIF) | | AUD_INTFa block: | | | | - Serializer (TX) | | RDDMA: DDR -> | | - De-serializer (RX) | | internal | | - Sync gen/detect | | codec | | - Up to 8 data lanes | | WRDMA: codec | | - PCM / TDM / MI2S | | -> DDR | | - Near Pad Logic | | Up to 16 ch | +--+--------------------+ +----+----------+ | Lane 0..7 (TX/RX) | Parallel bus | Bit clk + Frame sync | + Frame sync v v +--+--------+ +------+------+ | External | | Internal | | Serial | | Digital | | Peripherals| | Codec | | (PCM/TDM/ | | (Bolero/ | | MI2S) | | WCD) | +-----------+ +-------------+ Software Design =============== The driver follows the standard ALSA SoC split: qaif-cpu.c: CPU DAI component. Manages clocks, implements DAI ops (startup/shutdown/hw_params/trigger) for both AIF and CIF paths using direct regmap_update_bits() calls with address macros from qaif-reg.h, registers an of_xlate_dai_name callback so that sound-dai references using non-sequential DAI IDs resolve correctly, parses per-interface AIF configuration from DT child nodes, and provides runtime PM suspend/resume via pm_runtime_force_suspend/resume for power collapse. AIF child nodes use standard properties (dai-format, dai-tdm-slot-*, qcom,qaif-aif-lane-map) without a compatible string; the protocol is identified by dai-format and set_fmt() is called by the machine driver. qaif-platform.c: PCM platform component. Handles DMA buffer allocation (dma_alloc_pages()), PCM ops (open/close/hw_params/hw_free/prepare/trigger/ pointer/mmap/copy), and table-driven two-level IRQ dispatch with period-elapsed notification. qaif-shikra.c: Shikra SoC-specific variant descriptor. Provides register base addresses, DMA channel counts, SHRAM geometry, clock names and the DAI driver array. This abstraction keeps the core driver portable across future QAIF integrations. qaif.h / qaif-reg.h: Shared data structures, constants and the complete MMIO register address map consumed by both the CPU and platform drivers. soc-core.c: This series adds snd_soc_of_xlate_dai_name() as a generic ASoC helper that resolves a sound-dai phandle argument to a DAI name by searching the component DAI list by ID. Both lpass-cpu.c and qaif-cpu.c assign it directly as .of_xlate_dai_name, removing their private implementations. The series is split by functionality to aid review -- register map and data structures first, then CPU DAI ops with regmap and DT parsing, the of_xlate helper, PCM ops, IRQ handling and finally the Shikra variant glue. Link: https://patch.msgid.link/20261013-b4-qaif-shikra-audio-v9-0-f3022e28f2fd@oss.qualcomm.com
2026-10-15ASoC: soc-core: Add snd_soc_of_xlate_dai_name() generic helperHarendra Gautam
Some ASoC CPU DAI drivers need to resolve a sound-dai phandle argument to a DAI name by matching the argument against the component's DAI IDs. lpass-cpu carries a local implementation of this lookup. Add snd_soc_of_xlate_dai_name() to soc-core.c as a generic helper that can be assigned directly to the .of_xlate_dai_name component driver callback. It iterates the component's DAI list using for_each_component_dais() and matches by DAI ID. Signed-off-by: Harendra Gautam <harendra.gautam@oss.qualcomm.com> Link: https://patch.msgid.link/20261013-b4-qaif-shikra-audio-v9-5-f3022e28f2fd@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-10-15vdso/math64: Add and use __iter_div64_u64_rem()Zhan Xusheng
The vDSO basetimes for CLOCK_MONOTONIC and CLOCK_BOOTTIME are stored in the scaled nanoseconds of tkr_mono, so normalising them requires a division by NSEC_PER_SEC << shift. That divisor does not fit the u32 parameter of __iter_div_u64_rem(), so update_vdso_time_data() open-codes the same iterative division twice. Repeated subtraction is the appropriate form at these two sites because the quotient never exceeds one. accumulate_nsecs_to_secs() keeps xtime_nsec below one scaled second, and the offset added to it is a normalised timespec64 fraction, so the dividend stays below twice the divisor. That bound holds on every architecture, which matters more here than the cost of a division on any particular one. Add __iter_div64_u64_rem(), the u64-divisor counterpart of __iter_div_u64_rem(), and use it at both sites. Return the quotient as a u32 for consistency with the u32-divisor variant; the bound above leaves no use for a wider type. Store the remainder directly into the basetime, as the coarse clocks already do. The CLOCK_BOOTTIME copy of the CLOCK_MONOTONIC values then takes both fields from the same place. Folding the two open-coded loops into one inlined helper removes 16 bytes of vsyscall.o text on x86-64 with gcc 13. No functional change. Suggested-by: David Laight <david.laight.linux@gmail.com> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20261002153104.1347978-3-zhanxusheng@xiaomi.com
2026-10-15vdso/math64: Use OPTIMIZER_HIDE_VAR() in __iter_div_u64_rem()Zhan Xusheng
__iter_div_u64_rem() open-codes an empty asm() to keep the compiler from turning the subtraction loop into a modulo operation. That is what OPTIMIZER_HIDE_VAR() is for, so use it and reflow the comment. The macro lives in linux/compiler.h, which this header did not include. vdso/math64.h is reached from linux/math64.h, whose includes are linux/types.h, linux/math.h, asm/div64.h and vdso/math64.h; none of them guarantees linux/compiler.h. x86 happens to get it through asm/div64.h -> linux/log2.h, m68k's asm/div64.h only pulls in asm-generic/div64.h and linux/types.h, so the macro is undeclared there and the build fails with -Werror=implicit-function-declaration. Include linux/compiler.h so the header no longer depends on its includer. This is a no-op for the vDSO, where lib/vdso/gettimeofday.c already gets it through linux/build_bug.h, and vdso/unaligned.h sets the same precedent by including linux/compiler_types.h. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20261002153104.1347978-2-zhanxusheng@xiaomi.com Closes: https://lore.kernel.org/oe-kbuild-all/202609300626.zwNjKaO6-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202609301300.uAawkHuh-lkp@intel.com/
2026-10-15vdso: Remove __ASSEMBLER__ guards from vsyscall.hThomas Weißschuh
These headers are only used from regular C code. Remove the unnecessary guards. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-15-63ae856cc659@linutronix.de
2026-10-15vdso: Add asm-generic/vdso/vsyscall.hThomas Weißschuh
Most architectures' asm/vdso/vsyscall.h do not define any symbols. Add an empty asm-generic variant and replace the pointless architecture-specific copies. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-14-63ae856cc659@linutronix.de
2026-10-15vdso: Delete asm-generic/vdso/vsyscall.hThomas Weißschuh
Recent refactoring have made the header empty. Remove it and its mentions. Also that header was never a real asm-generic header anyways. It had no reason to be in the asm-generic directory. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-5-63ae856cc659@linutronix.de
2026-10-15vdso/vsyscall: Define fallback time synchronization functions in vsyscall.cThomas Weißschuh
__arch_update_vdso_clock() and __arch_sync_vdso_time_data() are only used in vsyscall.c. vsyscall.h has become a dumping ground for different kinds of fallbacks. Move the fallback function definitions into vsyscall.c. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-4-63ae856cc659@linutronix.de
2026-10-15vdso/getrandom: Define fallback __arch_get_vdso_u_rng_data() in getrandom.cThomas Weißschuh
__arch_get_vdso_u_rng_data() is only used in getrandom.c. vsyscall.h has become a dumping ground for different kinds of fallbacks. Move the fallback function definition into getrandom.c, similar to other fallbacks. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-3-63ae856cc659@linutronix.de
2026-10-15vdso/gettimeofday: Define fallback __arch_get_vdso_u_time_data() in ↵Thomas Weißschuh
gettimeofday.c __arch_get_vdso_u_time_data() is only used in gettimeofday.c. vsyscall.h has become a dumping ground for different kinds of fallbacks. Move the fallback function definition into gettimeofday.c, similar to other fallbacks. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-2-63ae856cc659@linutronix.de
2026-10-15vdso: Move the kernel-side time update helpers to a new headerThomas Weißschuh
The vdso/ header namespace is meant for symbols which are usable from vDSO userspace code. However vdso_update_begin() and vdso_update_end() are only usable from the kernel. Move them into a new header in the linux/ namespace. Also rename them to make clear that they are only for time-related data. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-1-63ae856cc659@linutronix.de
2026-10-15ext4: add tracepoints for EOF block zeroing and disksize-grow I/OZhang Yi
Add tracepoints to track the disksize-grow-pending lifecycle in the writeback path and the block-zero-EOF entry point: - ext4_iomap_wb_disksize_pending_submit: ioend is marked as DISKSIZE_GROW_IO in ext4_iomap_writeback_submit(). - ext4_iomap_wb_disksize_pending_complete: ioend of type DISKSIZE_GROW_IO completes in ext4_iomap_finish_ioend(). - ext4_iomap_wb_disksize_pending_wait: ioend worker waits for the pending zeroed EOF block to complete. - ext4_iomap_wb_update_disksize: i_disksize is advanced in ext4_iomap_wb_update_disksize, including the new value and whether the update is a disksize-grow completion. - ext4_block_zero_eof: ext4_block_zero_eof is called with the range and zeroing outcome, capturing the producer-side entry point. Together with the previous mark/clear/wait tracepoints, these cover the full lifetime of the disksize-grow-pending state. Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Tested-by: syzbot@syzkaller.appspotmail.com Link: https://patch.msgid.link/20261009103831.2978767-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2026-10-15ext4: add tracepoints for DISKSIZE_GROW_PENDING set, clear, and waitZhang Yi
Add trace events ext4_iomap_mark_disksize_pending(), ext4_iomap_clear_disksize_pending(), and ext4_iomap_wait_disksize_pending() to track disksize-grow-pending state changes and waiting. Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Tested-by: syzbot@syzkaller.appspotmail.com Link: https://patch.msgid.link/20261009103033.2920530-29-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2026-10-15ext4: add block mapping tracepoints for iomap buffered I/O pathZhang Yi
Add tracepoints for iomap buffered read, write, partial block zeroing, and writeback operations to help debug the iomap buffered I/O path. Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com> Reviewed-by: Jan Kara <jack@suse.cz> Tested-by: syzbot@syzkaller.appspotmail.com Link: https://patch.msgid.link/20261009103033.2920530-20-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2026-10-15Merge tag 'renesas-dts-for-v7.4-tag2' of ↵Alexandre Belloni
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v7.4 (take two) - Add PCIe support for the RZ/G3L SoC, - Add ADC DMA support for the RZ/T2H and RZ/N2H SoCs, - Add initial support for the RZ/G2M v3.0 SoC and the HopeRun HiHope RZ/G2M v3.0 board stack, - Add USB support for the RZ/G3E SoC and the RZ/G3E SMARC EVK board, - Add SPI (MSIOF) and I2C support for the R-Car X5H SoC, - Add support for various SolidRun boards based on RZ/G2L, RZ/G2LC, RZ/V2L, and RZ/G2UL, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v7.4-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (34 commits) arm64: dts: renesas: Add support for solidrun rzg2ul som on hb-ripple arm64: dts: renesas: Add support for solidrun hb-ripple with rzg2lc som arm64: dts: renesas: Add support for solidrun hb-ripple with rzv2l som arm64: dts: renesas: Add support for solidrun hb-ripple with rzg2l som arm64: dts: renesas: rzg2l(c)/rzv2l hb-iiot: Add dsi panel dt overlay arm64: dts: renesas: Add support for solidrun rzg2lc som and hb-iiot evb arm64: dts: renesas: Add support for solidrun rzv2l som and hb-iiot evb arm64: dts: renesas: Add support for solidrun rzg2l som and hb-iiot evb dt-bindings: soc: renesas: Add various SolidRun RZ/G2 based boards arm64: dts: renesas: r8a779h0: Add PCIe Application/Local register reset arm64: dts: renesas: r8a779g0: Add PCIe Application/Local register reset arm64: dts: renesas: r8a779f0: Add PCIe Application/Local register reset arm64: dts: renesas: r8a78000: Add I2C nodes arm64: dts: renesas: r8a78000: Add MSIOF nodes dt-bindings: clock: renesas,r8a78000-cpg: Add MSIOF clocks arm64: dts: renesas: r9a09g047e57-smarc: Enable USB2.0 support arm64: dts: renesas: r9a09g047: Add USB2.0 support arm64: dts: renesas: r9a08g046: Add USB2.0 placeholder nodes arm64: dts: renesas: Add HiHope RZ/G2M v3.0 SoC sub board support arm64: dts: renesas: Add HiHope RZ/G2M v3.0 SoC main board support ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-15platform/x86/intel/vsec: Pass a struct device to intel_vsec_set_mapping()Kuppuswamy Sathyanarayanan
intel_vsec_set_mapping() takes an intel_vsec_device pointer and only reads the struct device out of it. A caller that has the device but no intel_vsec_device would have to build one just to make this call. Pass the struct device instead. TPMI is the only user of this interface and it is being prepared for enumeration methods other than a PCI VSEC capability, where no intel_vsec_device exists. No functional change. Co-developed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> Link: https://patch.msgid.link/20261013192935.2243291-3-sathyanarayanan.kuppuswamy@linux.intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-10-15fuse: repair lots of uapi kernel-docRandy Dunlap
Fix all (24) kernel-doc warnings in <uapi/linux/fuse.h>: - modify some instances to use common C comment style instead of kernel-doc - convert a few instances to use kernel-doc format The warnings are all of this form (list is truncated for brevity): Warning: include/uapi/linux/fuse.h:370 This comment starts with '/**', but isn't a kernel-doc comment. * Bitmasks for fuse_setattr_in.valid Warning: include/uapi/linux/fuse.h:386 This comment starts with '/**', but isn't a kernel-doc comment. * Flags returned by the OPEN request Warning: include/uapi/linux/fuse.h:414 This comment starts with '/**', but isn't a kernel-doc comment. * INIT request/reply flags Warning: include/uapi/linux/fuse.h:526 This comment starts with '/**', but isn't a kernel-doc comment. * CUSE INIT request/reply flags Warning: include/uapi/linux/fuse.h:630 This comment starts with '/**', but isn't a kernel-doc comment. * extension type Warning: include/uapi/linux/fuse.h:1307 This comment starts with '/**', but isn't a kernel-doc comment. * Header for all fuse-io-uring requests Warning: include/uapi/linux/fuse.h:1320 This comment starts with '/**', but isn't a kernel-doc comment. * sqe commands to the kernel Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2026-10-15efi: Retain the address of the LINUX_EFI_MEMRESERVE tableArd Biesheuvel
The physical address of the LINUX_EFI_MEMRESERVE configuration table is only kept in __initdata, but a kexec loader that runs the incoming kernel's EFI stub needs it in order to pass the table on, so that the persistent memory reservations made by this kernel and its predecessors (e.g., for the GICv3 LPI tables) are carried over. So move it into struct efi, alongside the addresses of the other EFI configuration tables that may be passed on in this way. Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-10-15efi: Constify sysfs attributesArd Biesheuvel
Implement Thomas's suggestions to constify sysfs kobject attributes. Cc: Thomas Weißschuh <linux@weissschuh.net> Reviewed-by: Thomas Weißschuh <linux@weissschuh.net> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-10-15ALSA: pcm: Add refcount for races between drain and unlinkTakashi Iwai
We added a workaround for the case where a linked substream gets unlinked during the drain operation by another substream of the same linked group in the commit 9b1dbd69ba6f ("ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()"). There, we just cached the parameters of the draining substream for avoiding UAF. Then, we check the draining substream (to_check) again in the loop and remove it from the queue only when it's still present. It means, however, that the wait queue entry won't be removed if the substream went out of the link beforehand, hence a stale wq entry remains. Later on, this can be woken up, and this may hit a UAF, too. The problem surfaced more due to the recent change to call snd_pcm_unlink() earlier. For properly handling both cases above, in this patch, we introduce a refcount to the snd_pcm_runtime that indicates the substream is being accessed / used, then at snd_pcm_release_substream(), it's synced before the actual resource release via snd_refcount_sync(). This guarantees that the accessors are finished, and safe to release memories. Along with the introduction of a refcount, the comments and the code changes by the former fix were partially reverted as they don't fit with the updated code flow any longer. Last but not least, the setup of wait queue entry and prepare_to_wait() call are moved before the group unref. With this change, we can avoid the race between the enqueue and the wakeup, too. Fixes: 9b1dbd69ba6f ("ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()") Link: https://patch.msgid.link/20261015071838.31082-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-10-15irqchip/riscv-imsic: Expose the fwnode via the global configPrajwal N
The fwnode describes a global property of the IMSIC interrupt controller that is equally relevant to external consumers of imsic_global_config as it is to the imsic_priv itself. Keeping it in imsic_priv forces the external drivers to access the private structure rather than using the already exported imsic_get_global_config() interface. Moving the fwnode into imsic_global_config makes the public API self-contained and eliminates the need for callers to access imsic_priv internals directly. Signed-off-by: Prajwal N <prajwal.n@oss.qualcomm.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20261002120417.2708979-1-prajwal.n@oss.qualcomm.com
2026-10-15rxrpc: Fix aborting in rxperf test serverDavid Howells
Fix rxperf_process_call() to always abort if it gets a send error rather than only aborting on ENOMEM. Fixes: 75bfdbf2fca3 ("rxrpc: Implement an in-kernel rxperf server for testing purposes") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.415423-1-dhowells%40redhat.com Signed-off-by: David Howells <dhowells@redhat.com> cc: Marc Dionne <marc.dionne@auristor.com> cc: Eric Dumazet <edumazet@google.com> cc: "David S. Miller" <davem@davemloft.net> cc: Jakub Kicinski <kuba@kernel.org> cc: Paolo Abeni <pabeni@redhat.com> cc: Simon Horman <horms@kernel.org> cc: linux-afs@lists.infradead.org Link: https://patch.msgid.link/20261006133011.531806-7-dhowells@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-15afs: Fix afs to abort the rxrpc call on send errorDavid Howells
Fix afs_send_empty_reply() and afs_send_simple_reply() to always try to abort the rxrpc call rather than just aborting on -ENOMEM and otherwise abandoning it. If the call is already complete due to network failure or a received abort, this will do nothing. Also make afs_make_call() always abort on send error; again, it does nothing if the rxrpc call is already dead. Fixes: 08e0e7c82eea ("[AF_RXRPC]: Make the in-kernel AFS filesystem use AF_RXRPC.") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.415423-1-dhowells%40redhat.com Signed-off-by: David Howells <dhowells@redhat.com> cc: Marc Dionne <marc.dionne@auristor.com> cc: Eric Dumazet <edumazet@google.com> cc: "David S. Miller" <davem@davemloft.net> cc: Jakub Kicinski <kuba@kernel.org> cc: Paolo Abeni <pabeni@redhat.com> cc: Simon Horman <horms@kernel.org> cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261006133011.531806-6-dhowells@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-15rxrpc: Fix lack of short-send handling in rxrpc_kernel_send_data()David Howells
Fix rxrpc_kernel_send_data() to loop around if it detects a short send. David Laight suggested doing it here rather than wrapping all the calls in loops. Further, remove the len argument and use the iterator count instead and return 0 on success, not the amount copied. Note this is also a prerequisite for changing the way rxrpc_send_data() works to return a short send rather than an error if some data was buffered. Fixes: 651350d10f93 ("[AF_RXRPC]: Add an interface to the AF_RXRPC module for the AFS filesystem to use") Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824091645.415423-1-dhowells%40redhat.com Suggested-by: David Laight <david.laight.linux@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Marc Dionne <marc.dionne@auristor.com> cc: Eric Dumazet <edumazet@google.com> cc: "David S. Miller" <davem@davemloft.net> cc: Jakub Kicinski <kuba@kernel.org> cc: Paolo Abeni <pabeni@redhat.com> cc: Simon Horman <horms@kernel.org> cc: linux-afs@lists.infradead.org cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261006133011.531806-5-dhowells@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-15USB: serial: add generic write control callbacksCrescent Hsieh
Some USB serial devices use device-specific flow control to determine whether write submission may proceed. The generic write path currently provides no way to pause submission based on driver-specific state. It also provides no way for a driver to restore its state if URB submission fails. Add an optional write_ready() callback to struct usb_serial_driver. Call it with port->lock held after confirming that data is queued and a write URB is available. If the callback returns false, stop write processing and leave the data in the FIFO. The driver must call usb_serial_generic_write_start() when writes may proceed again. Add an optional write_rollback() callback for restoring driver-specific state after usb_submit_urb() fails. Call it with port->lock held after restoring the generic transmit accounting, and pass it the length of the prepared transfer. Drivers which do not provide these callbacks retain the existing generic write behaviour. Signed-off-by: Crescent Hsieh <crescentcy.hsieh@moxa.com> Signed-off-by: Johan Hovold <johan@kernel.org>
2026-10-15Merge tag 'loongarch-kvm-7.4' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v7.4 1. Add separate vmid support. 2. Simplify MSI interrupt injection. 3. Add crash hypercall support. 4. Allow to set pv_feature until vCPU run. 5. Enable HW page table walk automatically in selftests.
2026-10-14spmi: Add helper to get a parent SPMI deviceAngeloGioacchino Del Regno
Drivers that register a SPMI sub-device as a platform_driver are not guaranteed to have a SPMI device as their parent: add a new helper `spmi_get_parent_spmi_device()` that takes a struct device and checks if there's a parent, and if that parent is actually a SPMI device by checking if its device type matches with SPMI: if so, returns a pointer to the relative struct spmi_device without incrementing any refcount. As a note, in the specific case of using this helper to retrieve a SPMI subdevice's parent, the spmi_subdevice_alloc_and_add() function does actually call device_add(), which will already take care of raising the refcount of the associated parent device. Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-10-14spmi: Implement spmi_subdevice_alloc_and_add() and devm variantAngeloGioacchino Del Regno
Some devices connected over the SPMI bus may be big, in the sense that those may be a complex of devices managed by a single chip over the SPMI bus, reachable through a single SID. Add new functions aimed at managing sub-devices of a SPMI device spmi_subdevice_alloc_and_add() and a spmi_subdevice_remove() for adding a new subdevice and removing it respectively, and also add their devm_* variants. The need for such functions comes from the existence of those complex Power Management ICs (PMICs), which feature one or many sub-devices, in some cases with these being even addressable on the chip in form of SPMI register ranges. Examples of those devices can be found in both Qualcomm platforms with their PMICs having PON, RTC, SDAM, GPIO controller, and other sub-devices, and in newer MediaTek platforms showing similar HW features and a similar layout with those also having many subdevs. Also, instead of generally exporting symbols, export them with a new "SPMI" namespace: all users will have to import this namespace to make use of the newly introduced exports. Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com> Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD Acked-by: Stephen Boyd <sboyd@kernel.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-10-14scsi: libiscsi: Prepare for enabling lock context analysisBart Van Assche
Document locking requirements with __must_hold(). Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/7097a65b503cbf8d3a49c26f87293dd871080ea6.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-10-14scsi: libiscsi: Pass the session pointer directly to several functionsBart Van Assche
Pass the struct iscsi_session pointer directly to all functions that must be called with an iscsi_session synchronization object held. Update the callers of the modified functions in the iSER, be2iscsi, bnx2i, cxgbi, libiscsi, qedi and qla4xxx drivers. This patch prepares for enabling compile-time lock context analysis in libiscsi. No functionality has been changed. Cc: Lee Duncan <lduncan@suse.com> Cc: Chris Leech <cleech@redhat.com> Cc: Mike Christie <michael.christie@oracle.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/f717adbc1d64a4ddb457d4878d704999922bf1d0.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-10-14scsi: PCI: Convert to_pci_dev() into an inline functionBart Van Assche
Clang's context analysis checker performs alias analysis on expressions passed to annotations like __acquires(). Clang's alias analysis does not support container_of(). Convert to_pci_dev() from a macro into an inline function such that Clang recognizes multiple to_pci_dev() expressions as identical if the 'dev' argument is the same. It is on purpose that to_pci_dev() accepts a const pointer and returns a pointer that is not const. Any other choice, e.g. accepting a non-const pointer or returning a const pointer, triggers compiler errors in code that uses the to_pci_dev() macro. While _Generic() could be used to support const and non-const struct device pointers in a more elegant way, Clang's alias analysis does not support _Generic(). Acked-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://patch.msgid.link/f147ad227b85439d56183e60e0332547b84441bc.1790360262.git.bvanassche@acm.org Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-10-14scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB repliesStanley Jhu
bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per job, but struct ufs_rpmb_reply is 104 bytes: a 40-byte struct ufs_bsg_reply followed by a 64-byte EHS. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() copies it right after the 40-byte header and writes 8 bytes past the end of the buffer. Let each BSG transport pass its reply buffer size to bsg_setup_queue() and have ufs_bsg request sizeof(struct ufs_rpmb_reply), so the full reply reaches user space. Other transports keep SCSI_SENSE_BUFFERSIZE. Fixes: 6ff265fc5ef6 ("scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg") Cc: stable@vger.kernel.org Signed-off-by: Stanley Jhu <stanleyjhu@google.com> Link: https://patch.msgid.link/20261013132708.1669415-1-stanleyjhu@google.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-10-14overflow: Match arithmetic in both parts of __builtin_choose_exprBill Wendling
The two parts of '__builtin_choose_expr()' had different arithmetic expressions. This patch corrects it so that both parts calculate: COUNT * sizeof(*MEMBER) + __must_be_array(MEMBER) In practice, '__must_be_array' is meant to assert if 'MEMBER' isn't an array and return '0' otherwise. However, symmetry is less prone to subtle errors (and far more satisfying). Signed-off-by: Bill Wendling <morbo@google.com> Link: https://patch.msgid.link/20261013203146.387344-1-morbo@google.com Signed-off-by: Kees Cook <kees@kernel.org>