* [PATCH 11/14 v2] ASoC: soc-acpi: fix all kernel-doc warnings
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Add missing "struct" keyword to kernel-doc for structs.
Describe @mach_params in struct snd_soc_acpi_mach.
Don't document callback parameters with '@' as though they are kernel-doc.
These changes avoid all kernel-doc warnings in this header file.
Examples:
Warning: ../include/sound/soc-acpi.h:77 cannot understand function prototype: 'struct snd_soc_acpi_mach_params'
Warning: ../include/sound/soc-acpi.h:101 cannot understand function prototype: 'struct snd_soc_acpi_endpoint'
Warning: ../include/sound/soc-acpi.h:115 cannot understand function prototype: 'struct snd_soc_acpi_adr_device'
Warning: ../include/sound/soc-acpi.h:132 cannot understand function prototype: 'struct snd_soc_acpi_link_adr'
Warning: ../include/sound/soc-acpi.h:209 cannot understand function prototype: 'struct snd_soc_acpi_mach'
Warning: include/sound/soc-acpi.h:230 struct member 'mach_params' not described in 'snd_soc_acpi_mach'
Warning: include/sound/soc-acpi.h:230 Excess struct member 'card' description in 'snd_soc_acpi_mach'
Warning: include/sound/soc-acpi.h:230 Excess struct member 'mach' description in 'snd_soc_acpi_mach'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
include/sound/soc-acpi.h | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
--- linext-2026-0710.orig/include/sound/soc-acpi.h
+++ linext-2026-0710/include/sound/soc-acpi.h
@@ -57,7 +57,7 @@ static inline struct snd_soc_acpi_mach *
#endif
/**
- * snd_soc_acpi_mach_params: interface for machine driver configuration
+ * struct snd_soc_acpi_mach_params - interface for machine driver configuration
*
* @acpi_ipc_irq_index: used for BYT-CR detection
* @platform: string used for HDAudio codec support
@@ -93,7 +93,7 @@ struct snd_soc_acpi_mach_params {
};
/**
- * snd_soc_acpi_endpoint - endpoint descriptor
+ * struct snd_soc_acpi_endpoint - endpoint descriptor
* @num: endpoint number (mandatory, unique per device)
* @aggregated: 0 (independent) or 1 (logically grouped)
* @group_position: zero-based order (only when @aggregated is 1)
@@ -107,7 +107,7 @@ struct snd_soc_acpi_endpoint {
};
/**
- * snd_soc_acpi_adr_device - descriptor for _ADR-enumerated device
+ * struct snd_soc_acpi_adr_device - descriptor for _ADR-enumerated device
* @adr: 64 bit ACPI _ADR value
* @num_endpoints: number of endpoints for this device
* @endpoints: array of endpoints
@@ -121,7 +121,7 @@ struct snd_soc_acpi_adr_device {
};
/**
- * snd_soc_acpi_link_adr - ACPI-based list of _ADR enumerated devices
+ * struct snd_soc_acpi_link_adr - ACPI-based list of _ADR enumerated devices
* @mask: one bit set indicates the link this list applies to
* @num_adr: ARRAY_SIZE of devices
* @adr_d: array of devices
@@ -167,8 +167,8 @@ struct snd_soc_acpi_link_adr {
#define SND_SOC_ACPI_TPLG_INTEL_CODEC_NAME BIT(4)
/**
- * snd_soc_acpi_mach: ACPI-based machine descriptor. Most of the fields are
- * related to the hardware, except for the firmware and topology file names.
+ * struct snd_soc_acpi_mach - ACPI-based machine descriptor. Most of the fields
+ * are related to the hardware, except for the firmware and topology file names.
* A platform supported by legacy and Sound Open Firmware (SOF) would expose
* all firmware/topology related fields.
*
@@ -192,6 +192,7 @@ struct snd_soc_acpi_link_adr {
* the initial selection in the snd_soc_acpi_mach table.
* @pdata: intended for platform data or machine specific-ops. This structure
* is not constant since this field may be updated at run-time
+ * @mach_params: machine driver configuration
* @sof_tplg_filename: Sound Open Firmware topology file name, if enabled
* @tplg_quirk_mask: quirks to select different topology files dynamically
* @get_function_tplg_files: This is an optional callback, if specified then instead of
@@ -199,11 +200,11 @@ struct snd_soc_acpi_link_adr {
* files to be loaded.
* Return value: The number of the files or negative ERRNO. 0 means that the single topology
* file should be used, no function topology split can be used on the machine.
- * @card: the pointer of the card
- * @mach: the pointer of the machine driver
- * @prefix: the prefix of the topology file name. Typically, it is the path.
- * @tplg_files: the pointer of the array of the topology file names.
- * @best_effort: ignore non supported links and try to build the card in best effort
+ * card: the pointer of the card
+ * mach: the pointer of the machine driver
+ * prefix: the prefix of the topology file name. Typically, it is the path.
+ * tplg_files: the pointer of the array of the topology file names.
+ * best_effort: ignore non supported links and try to build the card in best effort
* with supported links
*/
/* Descriptor for SST ASoC machine driver */
^ permalink raw reply
* [PATCH 12/14 v2] ASoC: Intel: Skylake: convert SKL_TKNS to kernel-doc format
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Convert enum SKL_TKNS to kernel-doc format:
- use '@' instead of '%' for enum items
- add missing enum values
- correct a few enum names in the comments
- remove the comment for %SKL_TKN_U16_PIN_INST_ID since it is undefined
- fix a few typos
Warning: include/uapi/sound/snd_sst_tokens.h:11 Cannot find identifier on line:
* %SKL_TKN_UUID: Module UUID
Warning: ../include/uapi/sound/snd_sst_tokens.h:12 Cannot find identifier on line: *
Warning: ../include/uapi/sound/snd_sst_tokens.h:13 Cannot find identifier on line:
* %SKL_TKN_U8_BLOCK_TYPE: Type of the private data block.Can be:
Warning: include/uapi/sound/snd_sst_tokens.h:14 This comment starts with '/**', but isn't a kernel-doc comment.
* tuples, bytes, short and words
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
include/uapi/sound/snd_sst_tokens.h | 165 +++++++++++++-------------
1 file changed, 87 insertions(+), 78 deletions(-)
--- linext-2026-0710.orig/include/uapi/sound/snd_sst_tokens.h
+++ linext-2026-0710/include/uapi/sound/snd_sst_tokens.h
@@ -9,43 +9,47 @@
#define __SND_SST_TOKENS_H__
/**
- * %SKL_TKN_UUID: Module UUID
+ * enum SKL_TKNS - SST tokens definitions
*
- * %SKL_TKN_U8_BLOCK_TYPE: Type of the private data block.Can be:
+ * @SKL_TKN_UUID: Module UUID
+ *
+ * @SKL_TKN_U8_BLOCK_TYPE: Type of the private data block.Can be:
* tuples, bytes, short and words
*
- * %SKL_TKN_U8_IN_PIN_TYPE: Input pin type,
+ * @SKL_TKN_U8_NUM_BLOCKS: FIXME
+ *
+ * @SKL_TKN_U8_IN_PIN_TYPE: Input pin type,
* homogenous=0, heterogenous=1
*
- * %SKL_TKN_U8_OUT_PIN_TYPE: Output pin type,
+ * @SKL_TKN_U8_OUT_PIN_TYPE: Output pin type,
* homogenous=0, heterogenous=1
- * %SKL_TKN_U8_DYN_IN_PIN: Configure Input pin dynamically
+ * @SKL_TKN_U8_DYN_IN_PIN: Configure Input pin dynamically
* if true
*
- * %SKL_TKN_U8_DYN_OUT_PIN: Configure Output pin dynamically
+ * @SKL_TKN_U8_DYN_OUT_PIN: Configure Output pin dynamically
* if true
*
- * %SKL_TKN_U8_IN_QUEUE_COUNT: Store the number of Input pins
+ * @SKL_TKN_U8_IN_QUEUE_COUNT: Store the number of Input pins
*
- * %SKL_TKN_U8_OUT_QUEUE_COUNT: Store the number of Output pins
+ * @SKL_TKN_U8_OUT_QUEUE_COUNT: Store the number of Output pins
*
- * %SKL_TKN_U8_TIME_SLOT: TDM slot number
+ * @SKL_TKN_U8_TIME_SLOT: TDM slot number
*
- * %SKL_TKN_U8_CORE_ID: Stores module affinity value.Can take
+ * @SKL_TKN_U8_CORE_ID: Stores module affinity value. Can take
* the values:
* SKL_AFFINITY_CORE_0 = 0,
* SKL_AFFINITY_CORE_1,
* SKL_AFFINITY_CORE_MAX
*
- * %SKL_TKN_U8_MOD_TYPE: Module type value.
+ * @SKL_TKN_U8_MOD_TYPE: Module type value.
*
- * %SKL_TKN_U8_CONN_TYPE: Module connection type can be a FE,
+ * @SKL_TKN_U8_CONN_TYPE: Module connection type can be a FE,
* BE or NONE as defined :
* SKL_PIPE_CONN_TYPE_NONE = 0,
* SKL_PIPE_CONN_TYPE_FE = 1 (HOST_DMA)
* SKL_PIPE_CONN_TYPE_BE = 2 (LINK_DMA)
*
- * %SKL_TKN_U8_DEV_TYPE: Type of device to which the module is
+ * @SKL_TKN_U8_DEV_TYPE: Type of device to which the module is
* connected
* Can take the values:
* SKL_DEVICE_BT = 0x0,
@@ -56,43 +60,43 @@
* SKL_DEVICE_HDAHOST = 0x5,
* SKL_DEVICE_NONE
*
- * %SKL_TKN_U8_HW_CONN_TYPE: Connection type of the HW to which the
+ * @SKL_TKN_U8_HW_CONN_TYPE: Connection type of the HW to which the
* module is connected
* SKL_CONN_NONE = 0,
* SKL_CONN_SOURCE = 1,
* SKL_CONN_SINK = 2
*
- * %SKL_TKN_U16_PIN_INST_ID: Stores the pin instance id
+ * @SKL_TKN_U16_MOD_INST_ID: Stores the module instance id
*
- * %SKL_TKN_U16_MOD_INST_ID: Stores the mdule instance id
+ * @SKL_TKN_U16_BLOCK_SIZE: FIXME
*
- * %SKL_TKN_U32_MAX_MCPS: Module max mcps value
+ * @SKL_TKN_U32_MAX_MCPS: Module max mcps value
*
- * %SKL_TKN_U32_MEM_PAGES: Module resource pages
+ * @SKL_TKN_U32_MEM_PAGES: Module resource pages
*
- * %SKL_TKN_U32_OBS: Stores Output Buffer size
+ * @SKL_TKN_U32_OBS: Stores Output Buffer size
*
- * %SKL_TKN_U32_IBS: Stores input buffer size
+ * @SKL_TKN_U32_IBS: Stores input buffer size
*
- * %SKL_TKN_U32_VBUS_ID: Module VBUS_ID. PDM=0, SSP0=0,
+ * @SKL_TKN_U32_VBUS_ID: Module VBUS_ID. PDM=0, SSP0=0,
* SSP1=1,SSP2=2,
* SSP3=3, SSP4=4,
* SSP5=5, SSP6=6,INVALID
*
- * %SKL_TKN_U32_PARAMS_FIXUP: Module Params fixup mask
- * %SKL_TKN_U32_CONVERTER: Module params converter mask
- * %SKL_TKN_U32_PIPE_ID: Stores the pipe id
+ * @SKL_TKN_U32_PARAMS_FIXUP: Module Params fixup mask
+ * @SKL_TKN_U32_CONVERTER: Module params converter mask
+ * @SKL_TKN_U32_PIPE_ID: Stores the pipe id
*
- * %SKL_TKN_U32_PIPE_CONN_TYPE: Type of the token to which the pipe is
- * connected to. It can be
+ * @SKL_TKN_U32_PIPE_CONN_TYPE: Type of the token to which the pipe is
+ * connected. It can be
* SKL_PIPE_CONN_TYPE_NONE = 0,
* SKL_PIPE_CONN_TYPE_FE = 1 (HOST_DMA),
* SKL_PIPE_CONN_TYPE_BE = 2 (LINK_DMA),
*
- * %SKL_TKN_U32_PIPE_PRIORITY: Pipe priority value
- * %SKL_TKN_U32_PIPE_MEM_PGS: Pipe resource pages
+ * @SKL_TKN_U32_PIPE_PRIORITY: Pipe priority value
+ * @SKL_TKN_U32_PIPE_MEM_PGS: Pipe resource pages
*
- * %SKL_TKN_U32_DIR_PIN_COUNT: Value for the direction to set input/output
+ * @SKL_TKN_U32_DIR_PIN_COUNT: Value for the direction to set input/output
* formats and the pin count.
* The first 4 bits have the direction
* value and the next 4 have
@@ -104,23 +108,23 @@
* and output made by reading direction
* token.
*
- * %SKL_TKN_U32_FMT_CH: Supported channel count
+ * @SKL_TKN_U32_FMT_CH: Supported channel count
*
- * %SKL_TKN_U32_FMT_FREQ: Supported frequency/sample rate
+ * @SKL_TKN_U32_FMT_FREQ: Supported frequency/sample rate
*
- * %SKL_TKN_U32_FMT_BIT_DEPTH: Supported container size
+ * @SKL_TKN_U32_FMT_BIT_DEPTH: Supported container size
*
- * %SKL_TKN_U32_FMT_SAMPLE_SIZE:Number of samples in the container
+ * @SKL_TKN_U32_FMT_SAMPLE_SIZE:Number of samples in the container
*
- * %SKL_TKN_U32_FMT_CH_CONFIG: Supported channel configurations for the
+ * @SKL_TKN_U32_FMT_CH_CONFIG: Supported channel configurations for the
* input/output.
*
- * %SKL_TKN_U32_FMT_INTERLEAVE: Interleaving style which can be per
+ * @SKL_TKN_U32_FMT_INTERLEAVE: Interleaving style which can be per
* channel or per sample. The values can be :
* SKL_INTERLEAVING_PER_CHANNEL = 0,
* SKL_INTERLEAVING_PER_SAMPLE = 1,
*
- * %SKL_TKN_U32_FMT_SAMPLE_TYPE:
+ * @SKL_TKN_U32_FMT_SAMPLE_TYPE:
* Specifies the sample type. Can take the
* values: SKL_SAMPLE_TYPE_INT_MSB = 0,
* SKL_SAMPLE_TYPE_INT_LSB = 1,
@@ -128,104 +132,109 @@
* SKL_SAMPLE_TYPE_INT_UNSIGNED = 3,
* SKL_SAMPLE_TYPE_FLOAT = 4
*
- * %SKL_TKN_U32_CH_MAP: Channel map values
- * %SKL_TKN_U32_MOD_SET_PARAMS: It can take these values:
+ * @SKL_TKN_U32_FMT_CH_MAP: Channel map values
+ * @SKL_TKN_U32_PIN_MOD_ID: FIXME
+ * @SKL_TKN_U32_PIN_INST_ID: FIXME
+ * @SKL_TKN_U32_MOD_SET_PARAMS: It can take these values:
* SKL_PARAM_DEFAULT, SKL_PARAM_INIT,
* SKL_PARAM_SET, SKL_PARAM_BIND
*
- * %SKL_TKN_U32_MOD_PARAM_ID: ID of the module params
+ * @SKL_TKN_U32_MOD_PARAM_ID: ID of the module params
*
- * %SKL_TKN_U32_CAPS_SET_PARAMS:
+ * @SKL_TKN_U32_CAPS_SET_PARAMS:
* Set params value
*
- * %SKL_TKN_U32_CAPS_PARAMS_ID: Params ID
+ * @SKL_TKN_U32_CAPS_PARAMS_ID: Params ID
*
- * %SKL_TKN_U32_CAPS_SIZE: Caps size
+ * @SKL_TKN_U32_CAPS_SIZE: Caps size
*
- * %SKL_TKN_U32_PROC_DOMAIN: Specify processing domain
+ * @SKL_TKN_U32_PROC_DOMAIN: Specify processing domain
*
- * %SKL_TKN_U32_LIB_COUNT: Specifies the number of libraries
+ * @SKL_TKN_U32_LIB_COUNT: Specifies the number of libraries
*
- * %SKL_TKN_STR_LIB_NAME: Specifies the library name
+ * @SKL_TKN_STR_LIB_NAME: Specifies the library name
*
- * %SKL_TKN_U32_PMODE: Specifies the power mode for pipe
+ * @SKL_TKN_U32_PMODE: Specifies the power mode for pipe
*
- * %SKL_TKL_U32_D0I3_CAPS: Specifies the D0i3 capability for module
+ * @SKL_TKL_U32_D0I3_CAPS: Specifies the D0i3 capability for module (typo)
+ * @SKL_TKN_U32_D0I3_CAPS: Specifies the D0i3 capability for module
*
- * %SKL_TKN_U32_DMA_BUF_SIZE: DMA buffer size in millisec
+ * @SKL_TKN_U32_DMA_BUF_SIZE: DMA buffer size in millisec
*
- * %SKL_TKN_U32_PIPE_DIR: Specifies pipe direction. Can be
+ * @SKL_TKN_U32_PIPE_DIRECTION: Specifies pipe direction. Can be
* playback/capture.
*
- * %SKL_TKN_U32_NUM_CONFIGS: Number of pipe configs
+ * @SKL_TKN_U32_NUM_CONFIGS: Number of pipe configs
*
- * %SKL_TKN_U32_PATH_MEM_PGS: Size of memory (in pages) required for pipeline
+ * @SKL_TKN_U32_PATH_MEM_PGS: Size of memory (in pages) required for pipeline
* and its data
*
- * %SKL_TKN_U32_PIPE_CONFIG_ID: Config id for the modules in the pipe
+ * @SKL_TKN_U32_PIPE_CONFIG_ID: Config id for the modules in the pipe
* and PCM params supported by that pipe
* config. This is used as index to fill
* up the pipe config and module config
* structure.
*
- * %SKL_TKN_U32_CFG_FREQ:
- * %SKL_TKN_U8_CFG_CHAN:
- * %SKL_TKN_U8_CFG_BPS: PCM params (freq, channels, bits per sample)
+ * @SKL_TKN_U32_CFG_FREQ: FIXME
+ * @SKL_TKN_U8_CFG_CHAN: FIXME
+ * @SKL_TKN_U8_CFG_BPS: PCM params (freq, channels, bits per sample)
* supported for each of the pipe configs.
*
- * %SKL_TKN_CFG_MOD_RES_ID: Module's resource index for each of the
+ * @SKL_TKN_CFG_MOD_RES_ID: Module's resource index for each of the
* pipe config
*
- * %SKL_TKN_CFG_MOD_FMT_ID: Module's interface index for each of the
+ * @SKL_TKN_CFG_MOD_FMT_ID: Module's interface index for each of the
* pipe config
*
- * %SKL_TKN_U8_NUM_MOD: Number of modules in the manifest
+ * @SKL_TKN_U8_NUM_MOD: Number of modules in the manifest
*
- * %SKL_TKN_MM_U8_MOD_IDX: Current index of the module in the manifest
+ * @SKL_TKN_MM_U8_MOD_IDX: Current index of the module in the manifest
*
- * %SKL_TKN_MM_U8_NUM_RES: Number of resources for the module
+ * @SKL_TKN_MM_U8_NUM_RES: Number of resources for the module
*
- * %SKL_TKN_MM_U8_NUM_INTF: Number of interfaces for the module
+ * @SKL_TKN_MM_U8_NUM_INTF: Number of interfaces for the module
*
- * %SKL_TKN_MM_U32_RES_ID: Resource index for the resource info to
+ * @SKL_TKN_MM_U32_RES_ID: Resource index for the resource info to
* be filled into.
* A module can support multiple resource
- * configuration and is represnted as a
+ * configuration and is represented as a
* resource table. This index is used to
* fill information into appropriate index.
*
- * %SKL_TKN_MM_U32_CPS: DSP cycles per second
+ * @SKL_TKN_MM_U32_CPS: DSP cycles per second
*
- * %SKL_TKN_MM_U32_DMA_SIZE: Allocated buffer size for gateway DMA
+ * @SKL_TKN_MM_U32_DMA_SIZE: Allocated buffer size for gateway DMA
*
- * %SKL_TKN_MM_U32_CPC: DSP cycles allocated per frame
+ * @SKL_TKN_MM_U32_CPC: DSP cycles allocated per frame
*
- * %SKL_TKN_MM_U32_RES_PIN_ID: Resource pin index in the module
+ * @SKL_TKN_MM_U32_RES_PIN_ID: Resource pin index in the module
*
- * %SKL_TKN_MM_U32_INTF_PIN_ID: Interface index in the module
+ * @SKL_TKN_MM_U32_INTF_PIN_ID: Interface index in the module
*
- * %SKL_TKN_MM_U32_PIN_BUF: Buffer size of the module pin
+ * @SKL_TKN_MM_U32_PIN_BUF: Buffer size of the module pin
*
- * %SKL_TKN_MM_U32_FMT_ID: Format index for each of the interface/
+ * @SKL_TKN_MM_U32_FMT_ID: Format index for each of the interface/
* format information to be filled into.
*
- * %SKL_TKN_MM_U32_NUM_IN_FMT: Number of input formats
- * %SKL_TKN_MM_U32_NUM_OUT_FMT: Number of output formats
+ * @SKL_TKN_MM_U32_NUM_IN_FMT: Number of input formats
+ * @SKL_TKN_MM_U32_NUM_OUT_FMT: Number of output formats
*
- * %SKL_TKN_U32_ASTATE_IDX: Table Index for the A-State entry to be filled
+ * @SKL_TKN_U32_ASTATE_IDX: Table Index for the A-State entry to be filled
* with kcps and clock source
*
- * %SKL_TKN_U32_ASTATE_COUNT: Number of valid entries in A-State table
+ * @SKL_TKN_U32_ASTATE_COUNT: Number of valid entries in A-State table
*
- * %SKL_TKN_U32_ASTATE_KCPS: Specifies the core load threshold (in kilo
+ * @SKL_TKN_U32_ASTATE_KCPS: Specifies the core load threshold (in kilo
* cycles per second) below which DSP is clocked
* from source specified by clock source.
*
- * %SKL_TKN_U32_ASTATE_CLK_SRC: Clock source for A-State entry
+ * @SKL_TKN_U32_ASTATE_CLK_SRC: Clock source for A-State entry
+ *
+ * @SKL_TKN_U32_FMT_CFG_IDX: Format config index
*
- * %SKL_TKN_U32_FMT_CFG_IDX: Format config index
+ * @SKL_TKN_MAX: Max value for enum SKL_TKNS
*
- * module_id and loadable flags dont have tokens as these values will be
+ * module_id and loadable flags don't have tokens as these values will be
* read from the DSP FW manifest
*
* Tokens defined can be used either in the manifest or widget private data.
^ permalink raw reply
* [PATCH 07/14 v2] ASoC: fsl: mpc5200_psc_i2s: avoid kernel-doc warnings
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Add missing kernel-doc for function parameters.
Use kernel-doc format for function return value descriptions.
Use the "var" keyword to describe a data definition.
These changes avoid all kernel-doc warnings in this file:
Warning: ../sound/soc/fsl/mpc5200_psc_i2s.c:123 cannot understand function prototype: 'const struct snd_soc_dai_ops psc_i2s_dai_ops ='
Warning: sound/soc/fsl/mpc5200_psc_i2s.c:87 function parameter 'cpu_dai' not described in 'psc_i2s_set_sysclk'
Warning: sound/soc/fsl/mpc5200_psc_i2s.c:87 No description found for return value of 'psc_i2s_set_sysclk'
Warning: sound/soc/fsl/mpc5200_psc_i2s.c:106 function parameter 'cpu_dai' not described in 'psc_i2s_set_fmt'
Warning: sound/soc/fsl/mpc5200_psc_i2s.c:106 No description found for return value of 'psc_i2s_set_fmt'
Warning: sound/soc/fsl/mpc5200_psc_i2s.c:123 cannot understand function prototype: 'const struct snd_soc_dai_ops psc_i2s_dai_ops ='
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Shengjiu Wang <shengjiu.wang@gmail.com>
Cc: Xiubo Li <Xiubo.Lee@gmail.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Nicolin Chen <nicoleotsuka@gmail.com>
Cc: linuxppc-dev@lists.ozlabs.org
sound/soc/fsl/mpc5200_psc_i2s.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- linext-2026-0710.orig/sound/soc/fsl/mpc5200_psc_i2s.c
+++ linext-2026-0710/sound/soc/fsl/mpc5200_psc_i2s.c
@@ -79,9 +79,12 @@ static int psc_i2s_hw_params(struct snd_
* and we don't care about the frequency. Return an error if the direction
* is not SND_SOC_CLOCK_IN.
*
+ * @cpu_dai: DAI runtime data pointer
* @clk_id: reserved, should be zero
* @freq: the frequency of the given clock ID, currently ignored
* @dir: SND_SOC_CLOCK_IN (clock slave) or SND_SOC_CLOCK_OUT (clock master)
+ *
+ * Returns: %0 on success or %-EINVAL on failure.
*/
static int psc_i2s_set_sysclk(struct snd_soc_dai *cpu_dai,
int clk_id, unsigned int freq, int dir)
@@ -101,7 +104,10 @@ static int psc_i2s_set_sysclk(struct snd
* This driver only supports I2S mode. Return an error if the format is
* not SND_SOC_DAIFMT_I2S.
*
+ * @cpu_dai: DAI runtime data pointer
* @format: one of SND_SOC_DAIFMT_xxx
+ *
+ * Returns: %0 on success or %-EINVAL on failure.
*/
static int psc_i2s_set_fmt(struct snd_soc_dai *cpu_dai, unsigned int format)
{
@@ -119,7 +125,7 @@ static int psc_i2s_set_fmt(struct snd_so
*/
/**
- * psc_i2s_dai_template: template CPU Digital Audio Interface
+ * var psc_i2s_dai_ops - template CPU Digital Audio Interface
*/
static const struct snd_soc_dai_ops psc_i2s_dai_ops = {
.hw_params = psc_i2s_hw_params,
^ permalink raw reply
* [PATCH 02/14 v2] ASoC: fsl_asrc_common: fix all kernel-doc warnings
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Add missing struct fields for struct fsl_asrc_m2m_cap.
Add the missing "struct" keyword on struct kernel-doc headings.
Warning: ../sound/soc/fsl/fsl_asrc_common.h:65 cannot understand function prototype: 'struct fsl_asrc_pair'
Warning: ../sound/soc/fsl/fsl_asrc_common.h:129 cannot understand function prototype: 'struct fsl_asrc'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Shengjiu Wang <shengjiu.wang@gmail.com>
Cc: Xiubo Li <Xiubo.Lee@gmail.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Nicolin Chen <nicoleotsuka@gmail.com>
Cc: linuxppc-dev@lists.ozlabs.org
sound/soc/fsl/fsl_asrc_common.h | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- linext-2026-0710.orig/sound/soc/fsl/fsl_asrc_common.h
+++ linext-2026-0710/sound/soc/fsl/fsl_asrc_common.h
@@ -28,7 +28,9 @@ enum asrc_pair_index {
* @chan_min: minimum channel number
* @chan_max: maximum channel number
* @rate_in: minimum rate
- * @rate_out: maximum rete
+ * @rate_in_count: number of array elements in @rate_in
+ * @rate_out: maximum rate
+ * @rate_out_count: number of array elements in @rate_out
*/
struct fsl_asrc_m2m_cap {
u64 fmt_in;
@@ -42,7 +44,7 @@ struct fsl_asrc_m2m_cap {
};
/**
- * fsl_asrc_pair: ASRC Pair common data
+ * struct fsl_asrc_pair - ASRC Pair common data
*
* @asrc: pointer to its parent module
* @error: error record
@@ -90,7 +92,7 @@ struct fsl_asrc_pair {
};
/**
- * fsl_asrc: ASRC common data
+ * struct fsl_asrc - ASRC common data
*
* @dma_params_rx: DMA parameters for receive channel
* @dma_params_tx: DMA parameters for transmit channel
^ permalink raw reply
* [PATCH 13/14 v2] ASoC: qcom: audioreach: use C-style "/*" comment
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm, Srinivas Kandagatla
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Modify the "/**" to use "/*" instead since this is not a kernel-doc
comment. This avoids all kernel-doc warnings in this header file:
Warning: include/uapi/sound/snd_ar_tokens.h:61 Cannot find identifier on line:
* %AR_TKN_U32_SUB_GRAPH_INSTANCE_ID: Sub Graph Instance Id
Warning: ../include/uapi/sound/snd_ar_tokens.h:62 Cannot find identifier on line: *
Warning: ../include/uapi/sound/snd_ar_tokens.h:63 Cannot find identifier on line:
* %AR_TKN_U32_SUB_GRAPH_PERF_MODE: Performance mode of subgraph
Warning: include/uapi/sound/snd_ar_tokens.h:64 This comment starts with '/**', but isn't a kernel-doc comment.
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
---
v2: add Rev-by: Srinivas
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Srinivas Kandagatla <srini@kernel.org>
Cc: linux-arm-msm@vger.kernel.org
include/uapi/sound/snd_ar_tokens.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linext-2026-0710.orig/include/uapi/sound/snd_ar_tokens.h
+++ linext-2026-0710/include/uapi/sound/snd_ar_tokens.h
@@ -58,7 +58,7 @@ enum ar_event_types {
#define SND_SOC_AR_TPLG_FE_BE_GRAPH_CTL_MIX 256
#define SND_SOC_AR_TPLG_VOL_CTL 257
-/**
+/*
* %AR_TKN_U32_SUB_GRAPH_INSTANCE_ID: Sub Graph Instance Id
*
* %AR_TKN_U32_SUB_GRAPH_PERF_MODE: Performance mode of subgraph
^ permalink raw reply
* [PATCH 14/14 v2] ASoC: wm8904: don't use "/**" for non-kernel-doc comments
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Modify these errant comments to use "/*" since they are not kernel-doc
comments.
Warning: include/sound/wm8904.h:119 This comment starts with '/**', but isn't a kernel-doc comment.
* DRC configurations are specified with a label and a set of register
Warning: ../include/sound/wm8904.h:134 This comment starts with '/**', but isn't a kernel-doc comment.
* ReTune Mobile configurations are specified with a label, sample
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
v2: Add Rev-by: Charles
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
include/sound/wm8904.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- linext-2026-0710.orig/include/sound/wm8904.h
+++ linext-2026-0710/include/sound/wm8904.h
@@ -116,7 +116,7 @@
#define WM8904_DRC_REGS 4
#define WM8904_EQ_REGS 24
-/**
+/*
* DRC configurations are specified with a label and a set of register
* values to write (the enable bits will be ignored). At runtime an
* enumerated control will be presented for each DRC block allowing
@@ -131,7 +131,7 @@ struct wm8904_drc_cfg {
u16 regs[WM8904_DRC_REGS];
};
-/**
+/*
* ReTune Mobile configurations are specified with a label, sample
* rate and set of values to write (the enable bits will be ignored).
*
^ permalink raw reply
* [PATCH 09/14 v2] ASoC: uniphier: don't use "/**" for non-kernel-doc comment
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Use a C-style "/*" comment to avoid multiple kernel-doc warnings:
Warning: ../sound/soc/uniphier/aio.h:159 Cannot find identifier on line:
* 'SoftWare MAPping' setting of UniPhier AIO registers.
Warning: ../sound/soc/uniphier/aio.h:160 Cannot find identifier on line: *
Warning: ../sound/soc/uniphier/aio.h:161 This comment starts with '/**', but isn't a kernel-doc comment.
* We have to setup 'virtual' register maps to access 'real' registers of AIO.
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
sound/soc/uniphier/aio.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linext-2026-0710.orig/sound/soc/uniphier/aio.h
+++ linext-2026-0710/sound/soc/uniphier/aio.h
@@ -156,7 +156,7 @@ struct uniphier_aio_selector {
int hw;
};
-/**
+/*
* 'SoftWare MAPping' setting of UniPhier AIO registers.
*
* We have to setup 'virtual' register maps to access 'real' registers of AIO.
^ permalink raw reply
* [PATCH 08/14 v2] ASoC: fsl: p1022_ds: repair kernel-doc short descriptions
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
The kernel-doc short description is assumed to be a function unless
indicated by a keyword. Add the missing keyword (struct, var) to avoid
kernel-doc warnings:
Warning: sound/soc/fsl/p1022_ds.c:62 cannot understand function prototype: 'struct machine_data'
Warning: sound/soc/fsl/p1022_ds.c:182 cannot understand function prototype: 'const struct snd_soc_ops p1022_ds_ops ='
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Shengjiu Wang <shengjiu.wang@gmail.com>
Cc: Xiubo Li <Xiubo.Lee@gmail.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Nicolin Chen <nicoleotsuka@gmail.com>
Cc: linuxppc-dev@lists.ozlabs.org
sound/soc/fsl/p1022_ds.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- linext-2026-0710.orig/sound/soc/fsl/p1022_ds.c
+++ linext-2026-0710/sound/soc/fsl/p1022_ds.c
@@ -55,7 +55,7 @@ static inline void guts_set_dmuxcr(struc
static phys_addr_t guts_phys;
/**
- * machine_data: machine-specific ASoC device data
+ * struct machine_data - machine-specific ASoC device data
*
* This structure contains data for a single sound platform device on an
* P1022 DS. Some of the data is taken from the device tree.
@@ -178,7 +178,7 @@ static int p1022_ds_machine_remove(struc
}
/**
- * p1022_ds_ops: ASoC machine driver operations
+ * var p1022_ds_ops - ASoC machine driver operations
*/
static const struct snd_soc_ops p1022_ds_ops = {
.startup = p1022_ds_startup,
^ permalink raw reply
* [PATCH 06/14 v2] ASoC: fsl: mpc5200_dma: use the struct keyword for kernel-doc comments
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Use the documented format for kernel-doc of structs and the correct
struct name to prevent kernel-doc warnings:
Warning: ../sound/soc/fsl/mpc5200_dma.h:21 cannot understand function prototype: 'struct psc_dma_stream'
Warning: ../sound/soc/fsl/mpc5200_dma.h:50 cannot understand function prototype: 'struct psc_dma'
Warning: sound/soc/fsl/mpc5200_dma.h:35 expecting prototype for struct psc_ac97_stream. Prototype was for struct psc_dma_stream instead
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Shengjiu Wang <shengjiu.wang@gmail.com>
Cc: Xiubo Li <Xiubo.Lee@gmail.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Nicolin Chen <nicoleotsuka@gmail.com>
Cc: linuxppc-dev@lists.ozlabs.org
sound/soc/fsl/mpc5200_dma.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- linext-2026-0710.orig/sound/soc/fsl/mpc5200_dma.h
+++ linext-2026-0710/sound/soc/fsl/mpc5200_dma.h
@@ -9,7 +9,7 @@
#define PSC_STREAM_NAME_LEN 32
/**
- * psc_ac97_stream - Data specific to a single stream (playback or capture)
+ * struct psc_dma_stream - Data specific to a single stream (playback or capture)
* @active: flag indicating if the stream is active
* @psc_dma: pointer back to parent psc_dma data structure
* @bcom_task: bestcomm task structure
@@ -36,7 +36,7 @@ struct psc_dma_stream {
};
/**
- * psc_dma - Private driver data
+ * struct psc_dma - Private driver data
* @name: short name for this device ("PSC0", "PSC1", etc)
* @psc_regs: pointer to the PSC's registers
* @fifo_regs: pointer to the PSC's FIFO registers
^ permalink raw reply
* [PATCH 10/14 v2] ASoC: SDCA: correct enum names and add a missing struct field
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Add a kernel-doc comment for @is_volatile in struct sdca_control.
Correct 2 malformed enum names to match the enums.
Fixes 3 warnings:
Warning: include/sound/sdca_function.h:306 expecting prototype for enum sdca_set_index_range. Prototype was for enum sdca_fdl_set_index_range instead
Warning: include/sound/sdca_function.h:829 struct member 'is_volatile' not described in 'sdca_control'
Warning: include/sound/sdca_function.h:1152 expecting prototype for enum sdca_xu_reset_machanism. Prototype was for enum sdca_xu_reset_mechanism instead
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
---
v2: add Rev-by: Charles
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
Cc: Maciej Strozek <mstrozek@opensource.cirrus.com>
Cc: Bard Liao <yung-chuan.liao@linux.intel.com>
Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Cc: patches@opensource.cirrus.com
include/sound/sdca_function.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- linext-2026-0710.orig/include/sound/sdca_function.h
+++ linext-2026-0710/include/sound/sdca_function.h
@@ -298,7 +298,7 @@ enum sdca_xu_controls {
};
/**
- * enum sdca_set_index_range - Column definitions UMP SetIndex
+ * enum sdca_fdl_set_index_range - Column definitions UMP SetIndex
*/
enum sdca_fdl_set_index_range {
SDCA_FDL_SET_INDEX_SET_NUMBER = 0,
@@ -803,6 +803,8 @@ struct sdca_control_range {
* @mode: Access mode of the Control.
* @layers: Bitmask of access layers of the Control.
* @deferrable: Indicates if the access to the Control can be deferred.
+ * @is_volatile: Indicates the Control registers are forced to be treated
+ * as volatile.
* @has_default: Indicates the Control has a default value to be written.
* @has_reset: Indicates the Control has a defined reset value.
* @has_fixed: Indicates the Control only supports a single value.
@@ -1144,7 +1146,7 @@ struct sdca_entity_hide {
};
/**
- * enum sdca_xu_reset_machanism - SDCA FDL Resets
+ * enum sdca_xu_reset_mechanism - SDCA FDL Resets
*/
enum sdca_xu_reset_mechanism {
SDCA_XU_RESET_FUNCTION = 0x0,
^ permalink raw reply
* [PATCH 03/14 v2] ASoC: fsl_asrc: avoid kernel-doc warnings
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Use the struct keyword to describe structs in kernel-doc format. This
prevents kernel-doc warnings:
Warning: ../sound/soc/fsl/fsl_asrc.h:452 cannot understand function prototype: 'struct fsl_asrc_soc_data'
Warning: ../sound/soc/fsl/fsl_asrc.h:463 cannot understand function prototype: 'struct fsl_asrc_pair_priv'
Warning: ../sound/soc/fsl/fsl_asrc.h:475 cannot understand function prototype: 'struct fsl_asrc_priv'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Shengjiu Wang <shengjiu.wang@gmail.com>
Cc: Xiubo Li <Xiubo.Lee@gmail.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Nicolin Chen <nicoleotsuka@gmail.com>
Cc: linuxppc-dev@lists.ozlabs.org
sound/soc/fsl/fsl_asrc.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- linext-2026-0710.orig/sound/soc/fsl/fsl_asrc.h
+++ linext-2026-0710/sound/soc/fsl/fsl_asrc.h
@@ -444,7 +444,7 @@ struct dma_block {
};
/**
- * fsl_asrc_soc_data: soc specific data
+ * struct fsl_asrc_soc_data - soc specific data
*
* @use_edma: using edma as dma device or not
* @channel_bits: width of ASRCNCR register for each pair
@@ -457,7 +457,7 @@ struct fsl_asrc_soc_data {
};
/**
- * fsl_asrc_pair_priv: ASRC Pair private data
+ * struct fsl_asrc_pair_priv - ASRC Pair private data
*
* @config: configuration profile
*/
@@ -466,7 +466,7 @@ struct fsl_asrc_pair_priv {
};
/**
- * fsl_asrc_priv: ASRC private data
+ * struct fsl_asrc_priv - ASRC private data
*
* @asrck_clk: clock sources to driver ASRC internal logic
* @soc: soc specific data
^ permalink raw reply
* [PATCH 00/14 v2] ASoC: clean up kernel-doc warnings
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
Clean up a bunch of kernel-doc warnings in the ASoC code.
v2: add Mark and Liam to the cover letter email
[PATCH 01/14 v2] ASoC: codecs: NeoFidelity: repair the kernel-doc format
[PATCH 02/14 v2] ASoC: fsl_asrc_common: fix all kernel-doc warnings
[PATCH 03/14 v2] ASoC: fsl_asrc: avoid kernel-doc warnings
[PATCH 04/14 v2] ASoC: fsl-dma: fix all kernel-doc warnings
[PATCH 05/14 v2] ASoC: fsl_easrc: use struct keyword on structs
[PATCH 06/14 v2] ASoC: fsl: mpc5200_dma: use the struct keyword for kernel-doc comments
[PATCH 07/14 v2] ASoC: fsl: mpc5200_psc_i2s: avoid kernel-doc warnings
[PATCH 08/14 v2] ASoC: fsl: p1022_ds: repair kernel-doc short descriptions
[PATCH 09/14 v2] ASoC: uniphier: don't use "/**" for non-kernel-doc comment
[PATCH 10/14 v2] ASoC: SDCA: correct enum names and add a missing struct field
[PATCH 11/14 v2] ASoC: soc-acpi: fix all kernel-doc warnings
[PATCH 12/14 v2] ASoC: Intel: Skylake: convert SKL_TKNS to kernel-doc format
[PATCH 13/14 v2] ASoC: qcom: audioreach: use C-style "/*" comment
[PATCH 14/14 v2] ASoC: wm8904: don't use "/**" for non-kernel-doc comments
include/sound/sdca_function.h | 6
include/sound/soc-acpi.h | 23 +--
include/sound/wm8904.h | 4
include/uapi/sound/snd_ar_tokens.h | 2
include/uapi/sound/snd_sst_tokens.h | 165 +++++++++++++-------------
sound/soc/codecs/ntpfw.h | 11 -
sound/soc/fsl/fsl_asrc.h | 6
sound/soc/fsl/fsl_asrc_common.h | 8 -
sound/soc/fsl/fsl_dma.h | 4
sound/soc/fsl/fsl_easrc.h | 4
sound/soc/fsl/mpc5200_dma.h | 4
sound/soc/fsl/mpc5200_psc_i2s.c | 8 +
sound/soc/fsl/p1022_ds.c | 4
sound/soc/uniphier/aio.h | 2
14 files changed, 136 insertions(+), 115 deletions(-)
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Shengjiu Wang <shengjiu.wang@gmail.com>
Cc: Xiubo Li <Xiubo.Lee@gmail.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Nicolin Chen <nicoleotsuka@gmail.com>
Cc: linuxppc-dev@lists.ozlabs.org
Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
Cc: Maciej Strozek <mstrozek@opensource.cirrus.com>
Cc: Bard Liao <yung-chuan.liao@linux.intel.com>
Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
Cc: patches@opensource.cirrus.com
Cc: Srinivas Kandagatla <srini@kernel.org>
Cc: linux-arm-msm@vger.kernel.org
^ permalink raw reply
* [PATCH 01/14 v2] ASoC: codecs: NeoFidelity: repair the kernel-doc format
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Don't use "/**" for a non-kernel-doc comment.
Use kernel-doc notation to document the parameters and return value of
ntpfw_load().
Fixes these warnings:
Warning: ../sound/soc/codecs/ntpfw.h:2 This comment starts with '/**', but isn't a kernel-doc comment.
* ntpfw.h - Firmware helper functions for Neofidelity codecs
Warning: sound/soc/codecs/ntpfw.h:20 function parameter 'i2c' not described in 'ntpfw_load'
Warning: sound/soc/codecs/ntpfw.h:20 function parameter 'name' not described in 'ntpfw_load'
Warning: sound/soc/codecs/ntpfw.h:20 function parameter 'magic' not described in 'ntpfw_load'
Warning: sound/soc/codecs/ntpfw.h:20 No description found for return value of 'ntpfw_load'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
sound/soc/codecs/ntpfw.h | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- linext-2026-0710.orig/sound/soc/codecs/ntpfw.h
+++ linext-2026-0710/sound/soc/codecs/ntpfw.h
@@ -1,5 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0-only */
-/**
+/*
* ntpfw.h - Firmware helper functions for Neofidelity codecs
*
* Copyright (c) 2024, SaluteDevices. All Rights Reserved.
@@ -13,10 +13,11 @@
/**
* ntpfw_load - load firmware to amplifier over i2c interface.
*
- * @i2c Pointer to amplifier's I2C client.
- * @name Firmware file name.
- * @magic Magic number to validate firmware.
- * @return 0 or error code upon error.
+ * @i2c: Pointer to amplifier's I2C client.
+ * @name: Firmware file name.
+ * @magic: Magic number to validate firmware.
+ *
+ * Returns: 0 or error code upon error.
*/
int ntpfw_load(struct i2c_client *i2c, const char *name, const u32 magic);
^ permalink raw reply
* [PATCH 04/14 v2] ASoC: fsl-dma: fix all kernel-doc warnings
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Don't use "/**" for non-kernel-doc comments to avoid kernel-doc warnings:
Warning: ../sound/soc/fsl/fsl_dma.h:95 This comment starts with '/**', but isn't a kernel-doc comment.
* List Descriptor for extended chaining mode DMA operations.
Warning: ../sound/soc/fsl/fsl_dma.h:110 This comment starts with '/**', but isn't a kernel-doc comment.
* Link Descriptor for basic and extended chaining mode DMA operations.
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Shengjiu Wang <shengjiu.wang@gmail.com>
Cc: Xiubo Li <Xiubo.Lee@gmail.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Nicolin Chen <nicoleotsuka@gmail.com>
Cc: linuxppc-dev@lists.ozlabs.org
sound/soc/fsl/fsl_dma.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- linext-2026-0710.orig/sound/soc/fsl/fsl_dma.h
+++ linext-2026-0710/sound/soc/fsl/fsl_dma.h
@@ -92,7 +92,7 @@ static inline u32 CCSR_DMA_ECLNDAR_ADDR(
#define CCSR_DMA_ATR_SNOOP 0x00050000
#define CCSR_DMA_ATR_ESAD_MASK 0x0000000F
-/**
+/*
* List Descriptor for extended chaining mode DMA operations.
*
* The CLSDAR register points to the first (in a linked-list) List
@@ -107,7 +107,7 @@ struct fsl_dma_list_descriptor {
u8 res[8]; /* Reserved */
} __attribute__ ((aligned(32), packed));
-/**
+/*
* Link Descriptor for basic and extended chaining mode DMA operations.
*
* A Link Descriptor points to a single DMA buffer. Each link descriptor
^ permalink raw reply
* [PATCH 05/14 v2] ASoC: fsl_easrc: use struct keyword on structs
From: Randy Dunlap @ 2026-07-15 0:05 UTC (permalink / raw)
To: linux-sound
Cc: Randy Dunlap, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Fabio Estevam,
Nicolin Chen, linuxppc-dev, Charles Keepax, Maciej Strozek,
Bard Liao, Pierre-Louis Bossart, patches, Srinivas Kandagatla,
linux-arm-msm
In-Reply-To: <20260715000525.739874-1-rdunlap@infradead.org>
Use the documented format for kernel-doc of structs to prevent
kernel-doc warnings:
Warning: ../sound/soc/fsl/fsl_easrc.h:606 cannot understand function prototype: 'struct fsl_easrc_ctx_priv'
Warning: ../sound/soc/fsl/fsl_easrc.h:641 cannot understand function prototype: 'struct fsl_easrc_priv'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: no change
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: linux-sound@vger.kernel.org
Cc: Shengjiu Wang <shengjiu.wang@gmail.com>
Cc: Xiubo Li <Xiubo.Lee@gmail.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Nicolin Chen <nicoleotsuka@gmail.com>
Cc: linuxppc-dev@lists.ozlabs.org
sound/soc/fsl/fsl_easrc.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- linext-2026-0710.orig/sound/soc/fsl/fsl_easrc.h
+++ linext-2026-0710/sound/soc/fsl/fsl_easrc.h
@@ -584,7 +584,7 @@ struct fsl_easrc_slot {
};
/**
- * fsl_easrc_ctx_priv: EASRC context private data
+ * struct fsl_easrc_ctx_priv - EASRC context private data
*
* @in_params: input parameter
* @out_params: output parameter
@@ -625,7 +625,7 @@ struct fsl_easrc_ctx_priv {
};
/**
- * fsl_easrc_priv: EASRC private data
+ * struct fsl_easrc_priv - EASRC private data
*
* @slot: slot setting
* @firmware_hdr: the header of firmware
^ permalink raw reply
* Re: [PATCH v3] PCI: pnv_php: Add null checks for OpenCAPI PHBs
From: Nikhil Kumar Singh @ 2026-07-14 19:08 UTC (permalink / raw)
To: linuxppc-dev
In-Reply-To: <20260609084903.1352581-1-adityag@linux.ibm.com>
[-- Attachment #1: Type: text/plain, Size: 500 bytes --]
Hi Aditya,
The added NULL checks for OpenCAPI/direct PHB slots make sense. The
patch looks overall good to me but I have one question about below change:
On 09/06/26 14:19, Aditya Gupta wrote:
> + if (!bridge) {
> + *state = 0;
> + return 0;
> + }
> +
Is returning success with an indicator state of 0 the expected behaviour
for slots without a bridge, or would returning an error such as
-EOPNOTSUPP(Operation Not Supported) or -ENODEV(No Such Device) be more
appropriate?
Thanks,
~ Nikhil
[-- Attachment #2: Type: text/html, Size: 985 bytes --]
^ permalink raw reply
* [PATCH 6.16.y 6/6] bpf: Prefer dirty packs for eBPF allocations
From: Pawan Gupta @ 2026-07-14 18:59 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman, Sasha Levin
Cc: bpf, linux-arm-kernel, loongarch, linuxppc-dev, linux-riscv, x86,
Alexei Starovoitov, Daniel Borkmann
In-Reply-To: <20260714-cbpf-jit-spray-hardening-6-16-y-v1-0-2fc3e16263ac@linux.intel.com>
commit b72e29e0f7ee329d89f86db8700c8ea99b4a370a upstream.
The pack allocator only flushes predictors when reusing a dirty pack for
cBPF, eBPF allocations never trigger a flush. Currently, eBPF picks the
first free pack, which could be a clean pack. As an optimization, leaving
a clean pack for cBPF can avoid flushes.
Prefer dirty packs for eBPF and keep clean packs free for cBPF. This
mirrors the existing cBPF preference for clean packs: each program kind
prefers the pack that avoids an extra flush, and falls back to the other
kind only when no preferred pack has room. eBPF reuse of a dirty pack is
harmless since eBPF being privileged does not flush.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
kernel/bpf/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 81ba423d0f8e..0bed7fe9821e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -998,10 +998,10 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool
goto found_free_area;
/*
* cBPF reuse of a dirty pack triggers a flush, so prefer a
- * clean pack for cBPF. eBPF never flushes, so pick the first
- * free pack, dirty or clean.
+ * clean pack for cBPF. eBPF never flushes, so steer it to a
+ * dirty pack and keep clean packs free for cBPF.
*/
- if (!was_classic || !pack->arch_flush_needed)
+ if (was_classic ^ pack->arch_flush_needed)
goto found_free_area;
if (!fallback_pack) {
fallback_pack = pack;
--
2.43.0
^ permalink raw reply related
* [PATCH 6.16.y 5/6] bpf: Prefer packs that won't trigger an IBPB flush on allocation
From: Pawan Gupta @ 2026-07-14 18:59 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman, Sasha Levin
Cc: bpf, linux-arm-kernel, loongarch, linuxppc-dev, linux-riscv, x86,
Alexei Starovoitov, Daniel Borkmann
In-Reply-To: <20260714-cbpf-jit-spray-hardening-6-16-y-v1-0-2fc3e16263ac@linux.intel.com>
commit a9b1f19a6a673ba06820898d0f1ad02883ea1639 upstream.
Currently BPF pack allocator picks the chunks from the first available
pack. While this is okay, it naturally leads to more frequent flushes
when there are multiple packs in the system that weren't used since the
last flush.
As an optimization prefer allocating the new programs from packs that
are unused since last flush. When all packs are dirty, allocation forces
a flush and marks all packs clean.
Below are some future optimizations ideas:
1. Currently, the "dirty" tracking is only done at the pack-level.
Flush frequency can further be reduced with chunk-level tracking.
This requires a new bitmap per-pack to track the dirty state.
2. IBPB flush is done on all CPUs, even if only a single CPU ran the
BPF program. On a system with hundreds of CPUs this could be a
major bottleneck forcing hundreds of IPIs to deliver the flush.
The solution is to track the CPUs where a BPF program ran, and
issue IBPB only on those CPUs.
3. Avoid IBPB when flush is already done at other sources (e.g.
context switch).
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
kernel/bpf/core.c | 27 ++++++++++++++++++++++++---
1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 9fc2decac07d..81ba423d0f8e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -958,8 +958,8 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins
void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic)
{
unsigned int nbits = BPF_PROG_SIZE_TO_NBITS(size);
- struct bpf_prog_pack *pack;
- unsigned long pos;
+ struct bpf_prog_pack *pack, *fallback_pack = NULL;
+ unsigned long pos, fallback_pos = 0;
void *ptr = NULL;
mutex_lock(&pack_mutex);
@@ -991,8 +991,29 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool
list_for_each_entry(pack, &pack_list, list) {
pos = bitmap_find_next_zero_area(pack->bitmap, BPF_PROG_CHUNK_COUNT, 0,
nbits, 0);
- if (pos < BPF_PROG_CHUNK_COUNT)
+ if (pos >= BPF_PROG_CHUNK_COUNT)
+ continue;
+ /* Flush not enabled, use any pack */
+ if (!static_branch_unlikely(&bpf_pred_flush_enabled))
goto found_free_area;
+ /*
+ * cBPF reuse of a dirty pack triggers a flush, so prefer a
+ * clean pack for cBPF. eBPF never flushes, so pick the first
+ * free pack, dirty or clean.
+ */
+ if (!was_classic || !pack->arch_flush_needed)
+ goto found_free_area;
+ if (!fallback_pack) {
+ fallback_pack = pack;
+ fallback_pos = pos;
+ }
+ }
+
+ /* No preferred pack found */
+ if (fallback_pack) {
+ pack = fallback_pack;
+ pos = fallback_pos;
+ goto found_free_area;
}
pack = alloc_new_pack(bpf_fill_ill_insns);
--
2.43.0
^ permalink raw reply related
* [PATCH 6.16.y 4/6] bpf: Skip redundant IBPB in pack allocator
From: Pawan Gupta @ 2026-07-14 18:59 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman, Sasha Levin
Cc: bpf, linux-arm-kernel, loongarch, linuxppc-dev, linux-riscv, x86,
Alexei Starovoitov, Daniel Borkmann
In-Reply-To: <20260714-cbpf-jit-spray-hardening-6-16-y-v1-0-2fc3e16263ac@linux.intel.com>
commit a23c1c5396a91680703360d1ee28a44657c503c4 upstream.
bpf_prog_pack_alloc() issues IBPB on all CPUs on every cBPF allocation,
even when reusing chunks from an existing pack where no new memory was
touched since the last IBPB.
Since IBPB on all CPUs is heavy, Dave Hansen suggested to track allocation
since last IBPB, and only issue IBPB at reuse for the chunks that have not
seen an IBPB since they were last freed.
Track per-pack whether an IBPB is needed via arch_flush_needed. Set it when
allocating a chunk, reset on IBPB flush. On reuse, conditionally issue the
flush. Since IBPB invalidates all BTB entries, clear the flag on all packs
after flushing.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
kernel/bpf/core.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 63569d23cfa0..9fc2decac07d 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -885,6 +885,7 @@ int bpf_jit_add_poke_descriptor(struct bpf_prog *prog,
struct bpf_prog_pack {
struct list_head list;
void *ptr;
+ bool arch_flush_needed;
unsigned long bitmap[];
};
@@ -938,6 +939,8 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins
bpf_fill_ill_insns(pack->ptr, BPF_PROG_PACK_SIZE);
bitmap_zero(pack->bitmap, BPF_PROG_PACK_SIZE / BPF_PROG_CHUNK_SIZE);
+ if (static_branch_unlikely(&bpf_pred_flush_enabled))
+ pack->arch_flush_needed = true;
set_vm_flush_reset_perms(pack->ptr);
err = set_memory_rox((unsigned long)pack->ptr,
BPF_PROG_PACK_SIZE / PAGE_SIZE);
@@ -1000,8 +1003,15 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool
found_free_area:
/* Flush only for cBPF as it may contain a crafted gadget */
- if (static_branch_unlikely(&bpf_pred_flush_enabled) && was_classic)
+ if (static_branch_unlikely(&bpf_pred_flush_enabled) &&
+ pack->arch_flush_needed &&
+ was_classic) {
+ struct bpf_prog_pack *p;
+
static_call_cond(bpf_arch_pred_flush)();
+ list_for_each_entry(p, &pack_list, list)
+ p->arch_flush_needed = false;
+ }
bitmap_set(pack->bitmap, pos, nbits);
ptr = (void *)(pack->ptr) + (pos << BPF_PROG_CHUNK_SHIFT);
@@ -1039,6 +1049,9 @@ void bpf_prog_pack_free(void *ptr, u32 size)
"bpf_prog_pack bug: missing bpf_arch_text_invalidate?\n");
bitmap_clear(pack->bitmap, pos, nbits);
+
+ if (static_branch_unlikely(&bpf_pred_flush_enabled))
+ pack->arch_flush_needed = true;
if (bitmap_find_next_zero_area(pack->bitmap, BPF_PROG_CHUNK_COUNT, 0,
BPF_PROG_CHUNK_COUNT, 0) == 0) {
list_del(&pack->list);
--
2.43.0
^ permalink raw reply related
* [PATCH 6.16.y 3/6] bpf: Restrict JIT predictor flush to cBPF
From: Pawan Gupta @ 2026-07-14 18:59 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman, Sasha Levin
Cc: bpf, linux-arm-kernel, loongarch, linuxppc-dev, linux-riscv, x86,
Alexei Starovoitov, Daniel Borkmann
In-Reply-To: <20260714-cbpf-jit-spray-hardening-6-16-y-v1-0-2fc3e16263ac@linux.intel.com>
commit 0bb99f2cfaae6822d734d69722de30af823efdf3 upstream.
Currently predictor flush on memory reuse is done for all BPF JIT
allocations, but only cBPF programs can be loaded by an unprivileged user.
eBPF is privileged by default, and flushing predictors for all CPUs on
every eBPF reuse penalizes the common case for no security benefit.
eBPF allocations can be frequent on busy systems, only flush predictors
for cBPF programs. Trampoline and dispatcher allocations also skip the
flush as they are eBPF-only.
[pawan: backport had various conflicts in arches bpf_int_jit_compile().
loongarch bpf_int_jit_compile() doesn't use pack allocator,
dropped "was_classic" hunk. Also for arch_alloc_bpf_trampoline()]
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
arch/arm64/net/bpf_jit_comp.c | 4 ++--
arch/powerpc/net/bpf_jit_comp.c | 4 ++--
arch/riscv/net/bpf_jit_comp64.c | 2 +-
arch/riscv/net/bpf_jit_core.c | 3 ++-
arch/x86/net/bpf_jit_comp.c | 5 +++--
include/linux/filter.h | 5 +++--
kernel/bpf/core.c | 13 ++++++++-----
kernel/bpf/dispatcher.c | 2 +-
8 files changed, 22 insertions(+), 16 deletions(-)
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 58f838b310bc..fec93c352f35 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -1962,7 +1962,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
image_size = extable_offset + extable_size;
ro_header = bpf_jit_binary_pack_alloc(image_size, &ro_image_ptr,
sizeof(u32), &header, &image_ptr,
- jit_fill_hole);
+ jit_fill_hole, was_classic);
if (!ro_header) {
prog = orig_prog;
goto out_off;
@@ -2594,7 +2594,7 @@ int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags,
void *arch_alloc_bpf_trampoline(unsigned int size)
{
- return bpf_prog_pack_alloc(size, jit_fill_hole);
+ return bpf_prog_pack_alloc(size, jit_fill_hole, false);
}
void arch_free_bpf_trampoline(void *image, unsigned int size)
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index c0684733e9d6..ea64203f768f 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -244,7 +244,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
alloclen = proglen + FUNCTION_DESCR_SIZE + fixup_len + extable_len;
fhdr = bpf_jit_binary_pack_alloc(alloclen, &fimage, 4, &hdr, &image,
- bpf_jit_fill_ill_insns);
+ bpf_jit_fill_ill_insns, bpf_prog_was_classic(fp));
if (!fhdr) {
fp = org_fp;
goto out_addrs;
@@ -442,7 +442,7 @@ bool bpf_jit_supports_far_kfunc_call(void)
void *arch_alloc_bpf_trampoline(unsigned int size)
{
- return bpf_prog_pack_alloc(size, bpf_jit_fill_ill_insns);
+ return bpf_prog_pack_alloc(size, bpf_jit_fill_ill_insns, false);
}
void arch_free_bpf_trampoline(void *image, unsigned int size)
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index 9883a55d61b5..f67533a7ef3d 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -1280,7 +1280,7 @@ int arch_bpf_trampoline_size(const struct btf_func_model *m, u32 flags,
void *arch_alloc_bpf_trampoline(unsigned int size)
{
- return bpf_prog_pack_alloc(size, bpf_fill_ill_insns);
+ return bpf_prog_pack_alloc(size, bpf_fill_ill_insns, false);
}
void arch_free_bpf_trampoline(void *image, unsigned int size)
diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
index f6ca5cfa6b2f..a2eed555ed96 100644
--- a/arch/riscv/net/bpf_jit_core.c
+++ b/arch/riscv/net/bpf_jit_core.c
@@ -125,7 +125,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_jit_binary_pack_alloc(prog_size + extable_size,
&jit_data->ro_image, sizeof(u32),
&jit_data->header, &jit_data->image,
- bpf_fill_ill_insns);
+ bpf_fill_ill_insns,
+ bpf_prog_was_classic(prog));
if (!jit_data->ro_header) {
prog = orig_prog;
goto out_offset;
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 15672cb926fc..e8034c3d9599 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -3347,7 +3347,7 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
void *arch_alloc_bpf_trampoline(unsigned int size)
{
- return bpf_prog_pack_alloc(size, jit_fill_hole);
+ return bpf_prog_pack_alloc(size, jit_fill_hole, false);
}
void arch_free_bpf_trampoline(void *image, unsigned int size)
@@ -3687,7 +3687,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
/* allocate module memory for x86 insns and extable */
header = bpf_jit_binary_pack_alloc(roundup(proglen, align) + extable_size,
&image, align, &rw_header, &rw_image,
- jit_fill_hole);
+ jit_fill_hole,
+ bpf_prog_was_classic(prog));
if (!header) {
prog = orig_prog;
goto out_addrs;
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 65e2e804a5cd..8a2285db0866 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1261,7 +1261,7 @@ void bpf_jit_free(struct bpf_prog *fp);
struct bpf_binary_header *
bpf_jit_binary_pack_hdr(const struct bpf_prog *fp);
-void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns);
+void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic);
void bpf_prog_pack_free(void *ptr, u32 size);
static inline bool bpf_prog_kallsyms_verify_off(const struct bpf_prog *fp)
@@ -1275,7 +1275,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **ro_image,
unsigned int alignment,
struct bpf_binary_header **rw_hdr,
u8 **rw_image,
- bpf_jit_fill_hole_t bpf_fill_ill_insns);
+ bpf_jit_fill_hole_t bpf_fill_ill_insns,
+ bool was_classic);
int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,
struct bpf_binary_header *rw_header);
void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header,
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 48208c3f5814..63569d23cfa0 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -952,7 +952,7 @@ static struct bpf_prog_pack *alloc_new_pack(bpf_jit_fill_hole_t bpf_fill_ill_ins
return NULL;
}
-void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
+void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic)
{
unsigned int nbits = BPF_PROG_SIZE_TO_NBITS(size);
struct bpf_prog_pack *pack;
@@ -967,7 +967,7 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
* safe because cBPF programs (the unprivileged attack surface)
* are bounded well below a pack size.
*/
- if (static_branch_unlikely(&bpf_pred_flush_enabled))
+ if (was_classic && static_branch_unlikely(&bpf_pred_flush_enabled))
pr_warn_once("BPF: Predictors not flushed for allocations greater than BPF_PROG_PACK_SIZE\n");
size = round_up(size, PAGE_SIZE);
ptr = bpf_jit_alloc_exec(size);
@@ -999,7 +999,9 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
pos = 0;
found_free_area:
- static_call_cond(bpf_arch_pred_flush)();
+ /* Flush only for cBPF as it may contain a crafted gadget */
+ if (static_branch_unlikely(&bpf_pred_flush_enabled) && was_classic)
+ static_call_cond(bpf_arch_pred_flush)();
bitmap_set(pack->bitmap, pos, nbits);
ptr = (void *)(pack->ptr) + (pos << BPF_PROG_CHUNK_SHIFT);
@@ -1159,7 +1161,8 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr,
unsigned int alignment,
struct bpf_binary_header **rw_header,
u8 **rw_image,
- bpf_jit_fill_hole_t bpf_fill_ill_insns)
+ bpf_jit_fill_hole_t bpf_fill_ill_insns,
+ bool was_classic)
{
struct bpf_binary_header *ro_header;
u32 size, hole, start;
@@ -1172,7 +1175,7 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr,
if (bpf_jit_charge_modmem(size))
return NULL;
- ro_header = bpf_prog_pack_alloc(size, bpf_fill_ill_insns);
+ ro_header = bpf_prog_pack_alloc(size, bpf_fill_ill_insns, was_classic);
if (!ro_header) {
bpf_jit_uncharge_modmem(size);
return NULL;
diff --git a/kernel/bpf/dispatcher.c b/kernel/bpf/dispatcher.c
index b77db7413f8c..ea2d60dc1fee 100644
--- a/kernel/bpf/dispatcher.c
+++ b/kernel/bpf/dispatcher.c
@@ -145,7 +145,7 @@ void bpf_dispatcher_change_prog(struct bpf_dispatcher *d, struct bpf_prog *from,
mutex_lock(&d->mutex);
if (!d->image) {
- d->image = bpf_prog_pack_alloc(PAGE_SIZE, bpf_jit_fill_hole_with_zero);
+ d->image = bpf_prog_pack_alloc(PAGE_SIZE, bpf_jit_fill_hole_with_zero, false);
if (!d->image)
goto out;
d->rw_image = bpf_jit_alloc_exec(PAGE_SIZE);
--
2.43.0
^ permalink raw reply related
* [PATCH 6.16.y 2/6] x86/bugs: Enable IBPB flush on BPF JIT allocation
From: Pawan Gupta @ 2026-07-14 18:58 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman, Sasha Levin
Cc: bpf, linux-arm-kernel, loongarch, linuxppc-dev, linux-riscv, x86,
Alexei Starovoitov, Daniel Borkmann, Dave Hansen
In-Reply-To: <20260714-cbpf-jit-spray-hardening-6-16-y-v1-0-2fc3e16263ac@linux.intel.com>
commit a3af84b0fa00ead01fcd0e28b5d773ff25990a0d upstream.
Enable hardening against JIT spraying when Spectre-v2 mitigations are in
use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip
enabling the IBPB flush if the BPF dispatcher is already using a retpoline
sequence.
This hardening applies only when BPF-JIT is in use. Guard the enabling
under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
arch/x86/include/asm/nospec-branch.h | 4 +++
arch/x86/kernel/cpu/bugs.c | 50 ++++++++++++++++++++++++++++++++----
2 files changed, 49 insertions(+), 5 deletions(-)
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index e29f82466f43..0c95f6ac5c99 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -386,6 +386,10 @@ extern void srso_alias_return_thunk(void);
extern void entry_untrain_ret(void);
extern void write_ibpb(void);
+#ifdef CONFIG_BPF_JIT
+extern void bpf_arch_ibpb(void);
+#endif
+
#ifdef CONFIG_X86_64
extern void clear_bhb_loop(void);
#endif
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 65e253ef5218..512d58d6040c 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -16,6 +16,7 @@
#include <linux/sched/smt.h>
#include <linux/pgtable.h>
#include <linux/bpf.h>
+#include <linux/filter.h>
#include <asm/spec-ctrl.h>
#include <asm/cmdline.h>
@@ -1625,8 +1626,21 @@ static inline const char *spectre_v2_module_string(void)
{
return spectre_v2_bad_module ? " - vulnerable module loaded" : "";
}
+
+/*
+ * The "retpoline sequence" is the "call;mov;ret" sequence that
+ * replaces normal indirect branch instructions. Differentiate
+ * *the* retpoline sequence from the LFENCE-prefixed indirect
+ * branches that simply use the retpoline infrastructure.
+ */
+static inline bool retpoline_seq_enabled(void)
+{
+ return boot_cpu_has(X86_FEATURE_RETPOLINE) && !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE);
+}
+
#else
static inline const char *spectre_v2_module_string(void) { return ""; }
+static inline bool retpoline_seq_enabled(void) { return false; }
#endif
#define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n"
@@ -2138,8 +2152,7 @@ static void __init bhi_apply_mitigation(void)
return;
/* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */
- if (boot_cpu_has(X86_FEATURE_RETPOLINE) &&
- !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) {
+ if (retpoline_seq_enabled()) {
spec_ctrl_disable_kernel_rrsba();
if (rrsba_disabled)
return;
@@ -2234,6 +2247,27 @@ static void __init spectre_v2_update_mitigation(void)
pr_info("%s\n", spectre_v2_strings[spectre_v2_enabled]);
}
+#ifdef CONFIG_BPF_JIT
+static void __bpf_arch_ibpb(void *unused)
+{
+ write_ibpb();
+}
+
+void bpf_arch_ibpb(void)
+{
+ on_each_cpu(__bpf_arch_ibpb, NULL, 1);
+}
+
+static bool __init cpu_wants_ibpb_bpf(void)
+{
+ /* A genuine retpoline already neutralizes ring0 indirect predictions */
+ if (retpoline_seq_enabled())
+ return false;
+
+ return boot_cpu_has(X86_FEATURE_IBPB);
+}
+#endif
+
static void __init spectre_v2_apply_mitigation(void)
{
if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
@@ -2310,6 +2344,14 @@ static void __init spectre_v2_apply_mitigation(void)
setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
pr_info("Enabling Restricted Speculation for firmware calls\n");
}
+
+#ifdef CONFIG_BPF_JIT
+ if (cpu_wants_ibpb_bpf()) {
+ static_call_update(bpf_arch_pred_flush, bpf_arch_ibpb);
+ static_branch_enable(&bpf_pred_flush_enabled);
+ pr_info("Enabling IBPB for BPF\n");
+ }
+#endif
}
static void update_stibp_msr(void * __unused)
@@ -3421,9 +3463,7 @@ static const char *spectre_bhi_state(void)
return "; BHI: BHI_DIS_S";
else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP))
return "; BHI: SW loop, KVM: SW loop";
- else if (boot_cpu_has(X86_FEATURE_RETPOLINE) &&
- !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE) &&
- rrsba_disabled)
+ else if (retpoline_seq_enabled() && rrsba_disabled)
return "; BHI: Retpoline";
else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_VMEXIT))
return "; BHI: Vulnerable, KVM: SW loop";
--
2.43.0
^ permalink raw reply related
* [PATCH 6.16.y 1/6] bpf: Support for hardening against JIT spraying
From: Pawan Gupta @ 2026-07-14 18:58 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman, Sasha Levin
Cc: bpf, linux-arm-kernel, loongarch, linuxppc-dev, linux-riscv, x86,
Alexei Starovoitov, Daniel Borkmann
In-Reply-To: <20260714-cbpf-jit-spray-hardening-6-16-y-v1-0-2fc3e16263ac@linux.intel.com>
commit 96cce16e26dd02a8678f1e87f88a4b5cdb63b995 upstream.
The BPF JIT allocator packs many small programs into larger executable
allocations and reuses space within those allocations as programs are
loaded and freed. When fresh code is written into space that a previous
program occupied, an indirect jump into the new program can reuse a branch
prediction left behind by the old one.
Flush the indirect branch predictors before reusing JIT memory so that
indirect jumps into a newly written program don't reuse predictions from an
old program that occupied the same space.
Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush
static call for flushing the branch predictors on JIT memory reuse.
Architectures that need a flush, can update it to a predictor flush
function. By default, its a NOP and does not emit any CALL.
Allocations larger than a pack are not covered by this flush. That is safe
because cBPF programs (the unprivileged attack surface) are bounded well
below a pack size. Issue a warning if this assumption is ever violated
while the flush is active.
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
include/linux/filter.h | 10 ++++++++++
kernel/bpf/core.c | 19 +++++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index f5cf4d35d83e..65e2e804a5cd 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -22,6 +22,7 @@
#include <linux/vmalloc.h>
#include <linux/sockptr.h>
#include <crypto/sha1.h>
+#include <linux/static_call.h>
#include <linux/u64_stats_sync.h>
#include <net/sch_generic.h>
@@ -1237,6 +1238,15 @@ extern long bpf_jit_limit_max;
typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
+/*
+ * Flush the indirect branch predictors before reusing JIT memory, so that
+ * indirect jumps into a newly written program don't reuse predictions left
+ * behind by an old program that occupied the same space.
+ */
+void bpf_arch_pred_flush(void);
+DECLARE_STATIC_CALL(bpf_arch_pred_flush, bpf_arch_pred_flush);
+DECLARE_STATIC_KEY_FALSE(bpf_pred_flush_enabled);
+
void bpf_jit_fill_hole_with_zero(void *area, unsigned int size);
struct bpf_binary_header *
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 17e5cf18da1e..48208c3f5814 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -38,6 +38,7 @@
#include <linux/bpf_mem_alloc.h>
#include <linux/memcontrol.h>
#include <linux/execmem.h>
+#include <linux/static_call.h>
#include <asm/barrier.h>
#include <linux/unaligned.h>
@@ -892,6 +893,15 @@ void bpf_jit_fill_hole_with_zero(void *area, unsigned int size)
memset(area, 0, size);
}
+DEFINE_STATIC_CALL_NULL(bpf_arch_pred_flush, bpf_arch_pred_flush);
+
+/*
+ * Enabled once bpf_arch_pred_flush points at a real flush routine. Lets the
+ * pack allocator test "is a predictor flush wired up at all" with a cheap
+ * static branch instead of repeatedly querying the static call target.
+ */
+DEFINE_STATIC_KEY_FALSE(bpf_pred_flush_enabled);
+
#define BPF_PROG_SIZE_TO_NBITS(size) (round_up(size, BPF_PROG_CHUNK_SIZE) / BPF_PROG_CHUNK_SIZE)
static DEFINE_MUTEX(pack_mutex);
@@ -951,6 +961,14 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
mutex_lock(&pack_mutex);
if (size > BPF_PROG_PACK_SIZE) {
+ /*
+ * Allocations larger than a pack get their own pages, and
+ * predictors are not flushed for such allocation. This is only
+ * safe because cBPF programs (the unprivileged attack surface)
+ * are bounded well below a pack size.
+ */
+ if (static_branch_unlikely(&bpf_pred_flush_enabled))
+ pr_warn_once("BPF: Predictors not flushed for allocations greater than BPF_PROG_PACK_SIZE\n");
size = round_up(size, PAGE_SIZE);
ptr = bpf_jit_alloc_exec(size);
if (ptr) {
@@ -981,6 +999,7 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
pos = 0;
found_free_area:
+ static_call_cond(bpf_arch_pred_flush)();
bitmap_set(pack->bitmap, pos, nbits);
ptr = (void *)(pack->ptr) + (pos << BPF_PROG_CHUNK_SHIFT);
--
2.43.0
^ permalink raw reply related
* [PATCH 6.16.y 0/6] cBPF JIT spray hardening
From: Pawan Gupta @ 2026-07-14 18:58 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman, Sasha Levin
Cc: bpf, linux-arm-kernel, loongarch, linuxppc-dev, linux-riscv, x86,
Alexei Starovoitov, Daniel Borkmann, Dave Hansen
Hi,
These backports harden BPF JIT against spectre-v2 class of attacks. Without
a predictor flush, execution of new BPF program may use stale prediction
left behind by the freed one.
To avoid this, issue an IBPB flush on all CPUs on JIT program allocation.
The flush is conditional to spectre-v2 mitigation applied.
Patch 1-2: Adds the predictor flush hook and enables it on x86 via IBPB.
bpf: Support for hardening against JIT spraying
x86/bugs: Enable IBPB flush on BPF JIT allocation
Patch 3-6: Narrow the flush to only unprivileged JIT allocations
to avoid redundant flushes. Also adds pack-selection changes
that minimizes flushes.
bpf: Restrict JIT predictor flush to cBPF
bpf: Skip redundant IBPB in pack allocator
bpf: Prefer packs that won't trigger an IBPB flush on allocation
bpf: Prefer dirty packs for eBPF allocations
This one is mostly similar to 6.18:
https://lore.kernel.org/all/20260713-cbpf-jit-spray-hardening-6-18-y-v1-0-755f60c55705@linux.intel.com/
---
Pawan Gupta (6):
bpf: Support for hardening against JIT spraying
x86/bugs: Enable IBPB flush on BPF JIT allocation
bpf: Restrict JIT predictor flush to cBPF
bpf: Skip redundant IBPB in pack allocator
bpf: Prefer packs that won't trigger an IBPB flush on allocation
bpf: Prefer dirty packs for eBPF allocations
arch/arm64/net/bpf_jit_comp.c | 4 +--
arch/powerpc/net/bpf_jit_comp.c | 4 +--
arch/riscv/net/bpf_jit_comp64.c | 2 +-
arch/riscv/net/bpf_jit_core.c | 3 +-
arch/x86/include/asm/nospec-branch.h | 4 +++
arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++---
arch/x86/net/bpf_jit_comp.c | 5 +--
include/linux/filter.h | 15 ++++++--
kernel/bpf/core.c | 68 ++++++++++++++++++++++++++++++++----
kernel/bpf/dispatcher.c | 2 +-
10 files changed, 135 insertions(+), 22 deletions(-)
---
base-commit: d997d33eb340e2add100eac1222e107cc1396e76
change-id: 20260714-cbpf-jit-spray-hardening-6-16-y-5c50449f820c
Best regards,
--
Pawan
^ permalink raw reply
* Re: [patch 4/4] entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution
From: Radu Rendec @ 2026-07-14 18:57 UTC (permalink / raw)
To: Thomas Gleixner, LKML
Cc: Michal Suchánek, Michael Ellerman, Shrikanth Hegde,
linuxppc-dev, Huacai Chen, loongarch, Paul Walmsley,
Palmer Dabbelt, linux-riscv, Sven Schnelle, linux-s390, x86,
Mark Rutland, Jinjie Ruan, Magnus Lindholm,
Mukesh Kumar Chaurasiya (IBM), Jonathan Corbet
In-Reply-To: <20260712141346.772209074@kernel.org>
On Sun, 2026-07-12 at 23:25 +0200, Thomas Gleixner wrote:
> The return values of syscall_enter_from_user_mode[_work]() are
> non-intuitive. Both functions return the syscall number which should be
> invoked by the architecture specific syscall entry code. The returned
> number can be:
>
> - the unmodified syscall number which was handed in by the caller
>
> - a modified syscall number (ptrace, seccomp, trace/probe/bpf)
>
> That has an additional twist. If the return value is -1L then the caller is
> not allowed to modify the return value as that indicates that the modifying
> entity requests to abort the syscall and set the return value already. That
> can obviously not be differentiated from a syscall which handed in -1 as
> syscall number.
>
> The most trivial way to deal with that is:
>
> set_return_value(regs, -ENOSYS);
> nr = syscall_enter_from_user_mode(regs, nr);
> if (valid(nr))
> handle_syscall(regs, nr);
>
> That's what LOONGARCH, RISCV, and X86 do. But PowerPC and S390 do not
> preset the return value, so when user space hands in -1 and there is
> nothing setting the return value in the entry work code, then the syscall
> is skipped but the return value is whatever random data has been in the
> return value register.
>
> Change the return values of syscall_enter_from_user_mode[_work]() to
> boolean and return false, when either ptrace or seccomp request to skip the
> syscall. If they return true, update the syscall number as it might have
> been changed.
>
> That results in slightly different behaviour of the architectures versus
> tracing.
>
> If the syscall tracepoint has probe/BPF attached, those might set the
> syscall number to -1 and also set the return value. PowerPC and S390 will
> then overwrite that value with -ENOSYS. The other architectures will just
> ignore it like any other invalid syscall and use the modified one.
>
> Originally-by: Michal Suchánek <msuchanek@suse.de>
> Signed-off-by: Thomas Gleixner <tglx@kernel.org>
> ---
> V2: Change the return logic so Power and S390 can insist on being special.
> ---
> Documentation/core-api/entry.rst | 45 ++++++++++++++++++++++++++++++---------
> arch/loongarch/kernel/syscall.c | 14 ++++++------
> arch/powerpc/kernel/syscall.c | 3 +-
> arch/riscv/kernel/traps.c | 11 ++++-----
> arch/s390/kernel/syscall.c | 7 ++++--
> arch/x86/entry/syscall_32.c | 25 ++++++++++-----------
> arch/x86/entry/syscall_64.c | 12 +++++-----
> include/linux/entry-common.h | 32 +++++++++++++--------------
> 8 files changed, 88 insertions(+), 61 deletions(-)
I've been staring at this for a while. My only concern is that for
powerpc and s390, which do not set a default return value, the return
value is no longer forced to -ENOSYS for the cases when
syscall_trace_enter() returns False. Previously, it was turned into a -
1 in syscall_enter_from_user_mode_work() and interpreted as a syscall
number, so the architecture specific code took the invalid syscall
number path where it set the return value to -ENOSYS explicitly.
That implies that in all 3 cases when syscall_trace_enter() returns
False, the underlying function that denied the syscall *must* also set
the syscall return value (or deliver a signal or rollback the syscall),
or else the return value would be junk. That *seems* to be the case as
far as I can tell, but the ramifications are quite deep, and I must
admit I don't fully understand everything.
With that said,
Reviewed-by: Radu Rendec <radu@rendec.net>
> --- a/Documentation/core-api/entry.rst
> +++ b/Documentation/core-api/entry.rst
> @@ -58,26 +58,51 @@ state transitions must run with interrup
> Syscalls
> --------
>
> -Syscall-entry code starts in assembly code and calls out into low-level C code
> -after establishing low-level architecture-specific state and stack frames. This
> -low-level C code must not be instrumented. A typical syscall handling function
> -invoked from low-level assembly code looks like this:
> +Syscall-entry code starts in assembly code and calls out into low-level C
> +code after establishing low-level architecture-specific state and stack
> +frames. This low-level C code must not be instrumented. The recommended
> +syscall handling function invoked from low-level assembly code looks like
> +this:
>
> .. code-block:: c
>
> - noinstr void syscall(struct pt_regs *regs, int nr)
> + noinstr void syscall(struct pt_regs *regs, long nr)
> {
> arch_syscall_enter(regs);
> - nr = syscall_enter_from_user_mode_randomize_stack(regs, nr);
> + result_reg(regs) = -ENOSYS;
> + if (syscall_enter_from_user_mode_randomize_stack(regs, &nr)) {
> + instrumentation_begin();
> + if (valid(nr)
> + result_reg(regs) = invoke_syscall(regs, nr);
> + instrumentation_end();
> + }
> + syscall_exit_to_user_mode(regs);
> + }
>
> - instrumentation_begin();
> - if (!invoke_syscall(regs, nr) && nr != -1)
> - result_reg(regs) = __sys_ni_syscall(regs);
> - instrumentation_end();
> +This is the most resilent variant as it has always a guaranteed valid
> +return code. The alternative variant is:
> +
> +.. code-block:: c
>
> + noinstr void syscall(struct pt_regs *regs, long nr)
> + {
> + arch_syscall_enter(regs);
> + if (syscall_enter_from_user_mode_randomize_stack(regs, &nr)) {
> + instrumentation_begin();
> + if (valid(nr)
> + result_reg(regs) = invoke_syscall(regs, nr);
> + else
> + result_reg(regs) = -ENOSYS;
> + instrumentation_end();
> + }
> syscall_exit_to_user_mode(regs);
> }
>
> +That works for most situations except when a probe/BPF attached to the
> +syscall tracepoint sets an invalid syscall number e.g. -1 and also modifies
> +the result register. So this variant will obviously overwrite the modified
> +result with -ENOSYS.
> +
> syscall_enter_from_user_mode_randomize_stack() first invokes
> enter_from_user_mode_randomize_stack() which establishes state in the
> following order:
> --- a/arch/loongarch/kernel/syscall.c
> +++ b/arch/loongarch/kernel/syscall.c
> @@ -57,8 +57,8 @@ typedef long (*sys_call_fn)(unsigned lon
>
> void noinstr __no_stack_protector do_syscall(struct pt_regs *regs)
> {
> - unsigned long nr;
> sys_call_fn syscall_fn;
> + unsigned long nr;
>
> nr = regs->regs[11];
> /* Set for syscall restarting */
> @@ -69,12 +69,12 @@ void noinstr __no_stack_protector do_sys
> regs->orig_a0 = regs->regs[4];
> regs->regs[4] = -ENOSYS;
>
> - nr = syscall_enter_from_user_mode_randomize_stack(regs, nr);
> -
> - if (nr < NR_syscalls) {
> - syscall_fn = sys_call_table[array_index_nospec(nr, NR_syscalls)];
> - regs->regs[4] = syscall_fn(regs->orig_a0, regs->regs[5], regs->regs[6],
> - regs->regs[7], regs->regs[8], regs->regs[9]);
> + if (likely(syscall_enter_from_user_mode_randomize_stack(regs, &nr))) {
> + if (nr < NR_syscalls) {
> + syscall_fn = sys_call_table[array_index_nospec(nr, NR_syscalls)];
> + regs->regs[4] = syscall_fn(regs->orig_a0, regs->regs[5], regs->regs[6],
> + regs->regs[7], regs->regs[8], regs->regs[9]);
> + }
> }
>
> syscall_exit_to_user_mode(regs);
> --- a/arch/powerpc/kernel/syscall.c
> +++ b/arch/powerpc/kernel/syscall.c
> @@ -18,7 +18,8 @@ notrace long system_call_exception(struc
> long ret;
> syscall_fn f;
>
> - r0 = syscall_enter_from_user_mode_randomize_stack(regs, r0);
> + if (unlikely(!syscall_enter_from_user_mode_randomize_stack(regs, &r0)))
> + return syscall_get_error(current, regs);
>
> if (unlikely(r0 >= NR_syscalls)) {
> if (unlikely(trap_is_unsupported_scv(regs))) {
> --- a/arch/riscv/kernel/traps.c
> +++ b/arch/riscv/kernel/traps.c
> @@ -332,13 +332,12 @@ void do_trap_ecall_u(struct pt_regs *reg
>
> riscv_v_vstate_discard(regs);
>
> - syscall = syscall_enter_from_user_mode_randomize_stack(regs, syscall);
> -
> - if (syscall >= 0 && syscall < NR_syscalls) {
> - syscall = array_index_nospec(syscall, NR_syscalls);
> - syscall_handler(regs, syscall);
> + if (likely(syscall_enter_from_user_mode_randomize_stack(regs, &syscall))) {
> + if (syscall >= 0 && syscall < NR_syscalls) {
> + syscall = array_index_nospec(syscall, NR_syscalls);
> + syscall_handler(regs, syscall);
> + }
> }
> -
> syscall_exit_to_user_mode(regs);
> } else {
> irqentry_state_t state = irqentry_nmi_enter(regs);
> --- a/arch/s390/kernel/syscall.c
> +++ b/arch/s390/kernel/syscall.c
> @@ -96,6 +96,7 @@ SYSCALL_DEFINE0(ni_syscall)
> void noinstr __do_syscall(struct pt_regs *regs, int per_trap)
> {
> unsigned long nr;
> + bool permit;
>
> enter_from_user_mode_randomize_stack(regs);
>
> @@ -121,7 +122,9 @@ void noinstr __do_syscall(struct pt_regs
> regs->psw.addr = current->restart_block.arch_data;
> current->restart_block.arch_data = 1;
> }
> - nr = syscall_enter_from_user_mode_work(regs, nr);
> +
> + permit = syscall_enter_from_user_mode_work(regs, &nr);
> +
> /*
> * In the s390 ptrace ABI, both the syscall number and the return value
> * use gpr2. However, userspace puts the syscall number either in the
> @@ -129,7 +132,7 @@ void noinstr __do_syscall(struct pt_regs
> * work, the ptrace code sets PIF_SYSCALL_RET_SET, which is checked here
> * and if set, the syscall will be skipped.
> */
> - if (unlikely(test_and_clear_pt_regs_flag(regs, PIF_SYSCALL_RET_SET)))
> + if (unlikely(test_and_clear_pt_regs_flag(regs, PIF_SYSCALL_RET_SET) || !permit))
> goto out;
> regs->gprs[2] = -ENOSYS;
> if (likely(nr < NR_syscalls)) {
> --- a/arch/x86/entry/syscall_32.c
> +++ b/arch/x86/entry/syscall_32.c
> @@ -161,8 +161,9 @@ static __always_inline bool int80_is_ext
> nr = syscall_32_enter(regs);
>
> local_irq_enable();
> - nr = syscall_enter_from_user_mode_work(regs, nr);
> - do_syscall_32_irqs_on(regs, nr);
> +
> + if (likely(syscall_enter_from_user_mode_work(regs, &nr)))
> + do_syscall_32_irqs_on(regs, nr);
>
> instrumentation_end();
> syscall_exit_to_user_mode(regs);
> @@ -223,8 +224,8 @@ DEFINE_FREDENTRY_RAW(int80_emulation)
> nr = syscall_32_enter(regs);
>
> local_irq_enable();
> - nr = syscall_enter_from_user_mode_work(regs, nr);
> - do_syscall_32_irqs_on(regs, nr);
> + if (likely(syscall_enter_from_user_mode_work(regs, &nr)))
> + do_syscall_32_irqs_on(regs, nr);
>
> instrumentation_end();
> syscall_exit_to_user_mode(regs);
> @@ -243,13 +244,13 @@ DEFINE_FREDENTRY_RAW(int80_emulation)
> * orig_ax, the int return value truncates it. This matches
> * the semantics of syscall_get_nr().
> */
> - nr = syscall_enter_from_user_mode_randomize_stack(regs, nr);
> -
> - instrumentation_begin();
> + if (likely(syscall_enter_from_user_mode_randomize_stack(regs, &nr))) {
> + instrumentation_begin();
>
> - do_syscall_32_irqs_on(regs, nr);
> + do_syscall_32_irqs_on(regs, nr);
>
> - instrumentation_end();
> + instrumentation_end();
> + }
> syscall_exit_to_user_mode(regs);
> }
> #endif /* !CONFIG_IA32_EMULATION */
> @@ -286,10 +287,8 @@ static noinstr bool __do_fast_syscall_32
> return false;
> }
>
> - nr = syscall_enter_from_user_mode_work(regs, nr);
> -
> - /* Now this is just like a normal syscall. */
> - do_syscall_32_irqs_on(regs, nr);
> + if (likely(syscall_enter_from_user_mode_work(regs, &nr)))
> + do_syscall_32_irqs_on(regs, nr);
>
> instrumentation_end();
> syscall_exit_to_user_mode(regs);
> --- a/arch/x86/entry/syscall_64.c
> +++ b/arch/x86/entry/syscall_64.c
> @@ -78,14 +78,14 @@ static __always_inline void do_syscall_x
> /* Returns true to return using SYSRET, or false to use IRET */
> __visible noinstr bool do_syscall_64(struct pt_regs *regs, long nr)
> {
> - nr = syscall_enter_from_user_mode_randomize_stack(regs, nr);
> + if (likely(syscall_enter_from_user_mode_randomize_stack(regs, &nr))) {
> + instrumentation_begin();
>
> - instrumentation_begin();
> + if (!do_syscall_x64(regs, nr))
> + do_syscall_x32(regs, nr);
>
> - if (!do_syscall_x64(regs, nr))
> - do_syscall_x32(regs, nr);
> -
> - instrumentation_end();
> + instrumentation_end();
> + }
> syscall_exit_to_user_mode(regs);
>
> /*
> --- a/include/linux/entry-common.h
> +++ b/include/linux/entry-common.h
> @@ -111,16 +111,15 @@ static __always_inline long syscall_trac
> * @regs: Pointer to currents pt_regs
> * @syscall: The syscall number
> *
> - * Invoked from architecture specific syscall entry code with interrupts
> - * enabled after invoking enter_from_user_mode(), enabling interrupts and
> - * extra architecture specific work.
> + * Invoked from architecture specific syscall entry code with interrupts enabled
> + * after invoking enter_from_user_mode(), enabling interrupts and extra
> + * architecture specific work with the syscall return value preset to -ENOSYS.
> *
> - * Returns: The original or a modified syscall number
> + * Returns: True if the syscall should be invoked, False otherwise.
> *
> - * If the returned syscall number is -1 then the syscall should be
> - * skipped. In this case the caller may invoke syscall_set_error() or
> - * syscall_set_return_value() first. If neither of those are called and -1
> - * is returned, then the syscall will fail with ENOSYS.
> + * If the return value is false, the caller must skip the syscall and leave the
> + * syscall return value unmodified as it might have been set by one of the entry
> + * work functions.
> *
> * It handles the following work items:
> *
> @@ -128,19 +127,20 @@ static __always_inline long syscall_trac
> * ptrace_report_syscall_permit_entry(), __seccomp_permit_syscall(), trace_sys_enter()
> * 2) Invocation of audit_syscall_entry()
> */
> -static __always_inline long syscall_enter_from_user_mode_work(struct pt_regs *regs, long syscall)
> +static __always_inline bool syscall_enter_from_user_mode_work(struct pt_regs *regs, long *syscall)
> {
> unsigned long work = READ_ONCE(current_thread_info()->syscall_work);
>
> - if (work & SYSCALL_WORK_ENTER) {
> - if (!syscall_trace_enter(regs, work, syscall))
> - return -1L;
> + if (!(work & SYSCALL_WORK_ENTER))
> + return true;
>
> - /* Reread the syscall number as it might have been modified */
> - syscall = syscall_get_nr(current, regs);
> - }
> + if (unlikely(!syscall_trace_enter(regs, work, *syscall)))
> + return false;
>
> - return syscall;
> + /* Reread the syscall number as it might have been modified */
> + *syscall = syscall_get_nr(current, regs);
> +
> + return true;
> }
>
> /**
^ permalink raw reply
* Re: [PATCH] KVM: Nullify irqfd->producer when add_producer() fails
From: Sean Christopherson @ 2026-07-14 18:41 UTC (permalink / raw)
To: Sean Christopherson, leixiang
Cc: stable, Madhavan Srinivasan, Nicholas Piggin, Michael Ellerman,
Christophe Leroy (CS GROUP), Paolo Bonzini, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
Paul Mackerras, Suresh Warrier, linuxppc-dev, kvm, linux-kernel
In-Reply-To: <1782119051448443.14545.seg@mailgw.kylinos.cn>
On Mon, 22 Jun 2026 15:51:01 +0800, leixiang wrote:
> The x86 and powerpc add_producer() callbacks set irqfd->producer before the
> fallible setup and never clear it on error. The bypass manager doesn't
> register a producer whose add_producer() failed -- producer->eventfd is
> left NULL, so the later unregister early-returns and del_producer() is
> never called -- so nothing ever drops the pointer.
>
> For VFIO PCI the producer is embedded in struct vfio_pci_irq_ctx and freed
> when the vector is disabled, after which a routing update dereferences the
> dangling pointer via kvm_arch_update_irqfd_routing().
>
> [...]
Applied to kvm-x86 fixes, thanks!
[1/1] KVM: Nullify irqfd->producer when add_producer() fails
https://github.com/kvm-x86/linux/commit/ed446e8aa894
--
https://github.com/kvm-x86/linux/tree/next
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox