summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-12drm/amdkfd: kfd_ioctl.h: fix most kernel-doc warningsRandy Dunlap
Make corrections to kernel-doc comments: - use the struct keyword when describing structs - use the enum keyword when describing enums - insert colons (':') as needed in struct member descriptions - add missing short descriptions - convert some comments to kernel-doc format to prevent these warnings: Warning: include/uapi/linux/kfd_ioctl.h:708 cannot understand function prototype: 'struct kfd_ioctl_criu_args' Warning: include/uapi/linux/kfd_ioctl.h:771 cannot understand function prototype: 'enum kfd_ioctl_svm_op' Warning: include/uapi/linux/kfd_ioctl.h:805 cannot understand function prototype: 'enum kfd_ioctl_svm_attr_type' Warning: include/uapi/linux/kfd_ioctl.h:824 cannot understand function prototype: 'struct kfd_ioctl_svm_attribute' Warning: include/uapi/linux/kfd_ioctl.h:867 cannot understand function prototype: 'struct kfd_ioctl_svm_args' Warning: include/uapi/linux/kfd_ioctl.h:910 cannot understand function prototype: 'struct kfd_ioctl_set_xnack_mode_args' Warning: include/uapi/linux/kfd_ioctl.h:1075 cannot understand function prototype: 'struct kfd_ioctl_runtime_enable_args' Warning: include/uapi/linux/kfd_ioctl.h:1160 missing initial short description on line: * kfd_ioctl_dbg_trap_enable_args Warning: include/uapi/linux/kfd_ioctl.h:1182 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_enable_args' Warning: include/uapi/linux/kfd_ioctl.h:1190 missing initial short description on line: * kfd_ioctl_dbg_trap_send_runtime_event_args Warning: include/uapi/linux/kfd_ioctl.h:1208 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_send_runtime_event_args' Warning: include/uapi/linux/kfd_ioctl.h:1215 missing initial short description on line: * kfd_ioctl_dbg_trap_set_exceptions_enabled_args Warning: include/uapi/linux/kfd_ioctl.h:1225 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_set_exceptions_enabled_args' Warning: include/uapi/linux/kfd_ioctl.h:1230 missing initial short description on line: * kfd_ioctl_dbg_trap_set_wave_launch_override_args Warning: include/uapi/linux/kfd_ioctl.h:1252 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_set_wave_launch_override_args' Warning: include/uapi/linux/kfd_ioctl.h:1260 missing initial short description on line: * kfd_ioctl_dbg_trap_set_wave_launch_mode_args Warning: include/uapi/linux/kfd_ioctl.h:1270 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_set_wave_launch_mode_args' Warning: include/uapi/linux/kfd_ioctl.h:1276 missing initial short description on line: * kfd_ioctl_dbg_trap_suspend_queues_ags Warning: include/uapi/linux/kfd_ioctl.h:1305 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_suspend_queues_args' Warning: include/uapi/linux/kfd_ioctl.h:1313 missing initial short description on line: * kfd_ioctl_dbg_trap_resume_queues_args Warning: include/uapi/linux/kfd_ioctl.h:1330 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_resume_queues_args' Warning: include/uapi/linux/kfd_ioctl.h:1337 missing initial short description on line: * kfd_ioctl_dbg_trap_set_node_address_watch_args Warning: include/uapi/linux/kfd_ioctl.h:1354 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_set_node_address_watch_args' Warning: include/uapi/linux/kfd_ioctl.h:1363 missing initial short description on line: * kfd_ioctl_dbg_trap_clear_node_address_watch_args Warning: include/uapi/linux/kfd_ioctl.h:1376 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_clear_node_address_watch_args' Warning: include/uapi/linux/kfd_ioctl.h:1382 missing initial short description on line: * kfd_ioctl_dbg_trap_set_flags_args Warning: include/uapi/linux/kfd_ioctl.h:1393 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_set_flags_args' Warning: include/uapi/linux/kfd_ioctl.h:1399 missing initial short description on line: * kfd_ioctl_dbg_trap_query_debug_event_args Warning: include/uapi/linux/kfd_ioctl.h:1421 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_query_debug_event_args' Warning: include/uapi/linux/kfd_ioctl.h:1428 missing initial short description on line: * kfd_ioctl_dbg_trap_query_exception_info_args Warning: include/uapi/linux/kfd_ioctl.h:1448 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_query_exception_info_args' Warning: include/uapi/linux/kfd_ioctl.h:1457 missing initial short description on line: * kfd_ioctl_dbg_trap_get_queue_snapshot_args Warning: include/uapi/linux/kfd_ioctl.h:1485 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_queue_snapshot_args' Warning: include/uapi/linux/kfd_ioctl.h:1493 missing initial short description on line: * kfd_ioctl_dbg_trap_get_device_snapshot_args Warning: include/uapi/linux/kfd_ioctl.h:1521 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_device_snapshot_args' Warning: include/uapi/linux/kfd_ioctl.h:1529 missing initial short description on line: * kfd_ioctl_dbg_trap_args Warning: include/uapi/linux/kfd_ioctl.h:1539 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1569 This comment starts with '/**', but isn't a kernel-doc comment. * Enables/Disables GPU Specific profiler settings Warning: include/uapi/linux/kfd_ioctl.h:718 struct member 'num_bos' not described in 'kfd_ioctl_criu_args' Warning: include/uapi/linux/kfd_ioctl.h:718 struct member 'op' not described in 'kfd_ioctl_criu_args' Warning: include/uapi/linux/kfd_ioctl.h:874 struct member 'start_addr' not described in 'kfd_ioctl_svm_args' Warning: include/uapi/linux/kfd_ioctl.h:874 struct member 'size' not described in 'kfd_ioctl_svm_args' Warning: include/uapi/linux/kfd_ioctl.h:874 struct member 'op' not described in 'kfd_ioctl_svm_args' Warning: include/uapi/linux/kfd_ioctl.h:874 struct member 'nattr' not described in 'kfd_ioctl_svm_args' Warning: include/uapi/linux/kfd_ioctl.h:874 struct member 'attrs' not described in 'kfd_ioctl_svm_args' Warning: include/uapi/linux/kfd_ioctl.h:1079 struct member 'r_debug' not described in 'kfd_ioctl_runtime_enable_args' Warning: include/uapi/linux/kfd_ioctl.h:1079 struct member 'mode_mask' not described in 'kfd_ioctl_runtime_enable_args' Warning: include/uapi/linux/kfd_ioctl.h:1079 struct member 'capabilities_mask' not described in 'kfd_ioctl_runtime_enable_args' Warning: include/uapi/linux/kfd_ioctl.h:1254 struct member 'pad' not described in 'kfd_ioctl_dbg_trap_set_wave_launch_override_args' Warning: include/uapi/linux/kfd_ioctl.h:1267 cannot understand function prototype: 'struct kfd_ioctl_dbg_trap_set_wave_launch_mode_args' Warning: include/uapi/linux/kfd_ioctl.h:1308 expecting prototype for struct kfd_ioctl_dbg_trap_suspend_queues_ags. Prototype was for struct kfd_ioctl_dbg_trap_suspend_queues_args instead Warning: include/uapi/linux/kfd_ioctl.h:1332 struct member 'pad' not described in 'kfd_ioctl_dbg_trap_resume_queues_args' Warning: include/uapi/linux/kfd_ioctl.h:1488 expecting prototype for struct kfd_ioctl_dbg_trap_get_queue_snapshot_args. Prototype was for struct kfd_ioctl_dbg_trap_queue_snapshot_args instead Warning: include/uapi/linux/kfd_ioctl.h:1524 expecting prototype for struct kfd_ioctl_dbg_trap_get_device_snapshot_args. Prototype was for struct kfd_ioctl_dbg_trap_device_snapshot_args instead * This leaves the following struct members undescribed in kernel-doc comments: Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'enable' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'send_runtime_event' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'set_exceptions_enabled' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'launch_override' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'launch_mode' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'suspend_queues' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'resume_queues' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'set_node_address_watch' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'clear_node_address_watch' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'set_flags' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'query_debug_event' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'query_exception_info' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'queue_snapshot' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1555 struct member 'device_snapshot' not described in 'kfd_ioctl_dbg_trap_args' Warning: include/uapi/linux/kfd_ioctl.h:1571 struct member 'gpu_id' not described in 'kfd_ioctl_pmc_settings' Warning: include/uapi/linux/kfd_ioctl.h:1571 struct member 'lock' not described in 'kfd_ioctl_pmc_settings' Warning: include/uapi/linux/kfd_ioctl.h:1571 struct member 'perfcount_enable' not described in 'kfd_ioctl_pmc_settings' All amdgpu object files before/after compare equal after this change. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()Samuel Pitoiset
amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream is attached to it. BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu] Call Trace: drm_vblank_enable drm_vblank_get drm_crtc_get_sequence_ioctl drm_ioctl_kernel drm_ioctl Reproduced by running VKCTS with WSI tests enabled on RADV. Guard the enable path on acrtc_state->stream being non-NULL, matching the existing checks in this function. Fixes: 34d66bc7ff10 ("drm/amd/display: Fix Xorg desktop unresponsive on Replay panel") Reviewed-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: don't disable ttm buffer funcs on resetPierre-Eric Pelloux-Prayer
Access to hw is already suspended so there are no reasons to disable ttm buffer funcs. Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: validate GEM_CREATE domain combinationsCandice Li
AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON(). Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl(). v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian) Signed-off-by: Candice Li <candice.li@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdkfd: preserve VRAM MQD across hibernation via unpin/repinShikang Fan
On gfx9 ASICs with mqd_on_vram(), a compute queue MQD lives in a pinned VRAM buffer object. Pinned BOs are skipped by the VRAM eviction done at S4 suspend, so the MQD contents are lost across hibernation and the first submission after resume page-faults on a stale MQD. Unpin the MQD BO at suspend so the eviction migrates it into the hibernation image, and pin it back to VRAM on resume. The BO may return at a different VRAM address, so refresh the kernel mapping and cached GPU addresses and patch the MQD self-address via a new update_mqd_gpu_addr() mqd_manager op; skip eviction with a warning if that op is not implemented. v3: use unpin/repin instead of shadowing the MQD into a separate buffer. v4: drop the explicit VRAM->GTT placement at evict (a bare unpin is enough for the eviction pass to move the BO out of VRAM), and also repin at queue destroy. KFD queue restore runs late - user processes thaw before it, and under SR-IOV it is deferred until the VF exits full access - so once the VM has resumed an application can destroy a queue before its MQD BO is repinned, which would otherwise unpin an already-unpinned BO and touch a stale q->mqd. v5: drop support for no-HWS mode, and set q->mqd to NULL at eviction. Signed-off-by: Shikang Fan <shikang.fan@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: disallow multiple FENCE chunks in one submitJunrui Luo
amdgpu_cs_pass1() dispatches on chunk_id once per chunk without rejecting repeated ids. p->uf_bo is a single-slot field, so a submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs amdgpu_cs_p1_user_fence() twice, and the second run overwrites p->uf_bo with a freshly referenced BO without dropping the reference taken by the first. amdgpu_cs_parser_fini() only unrefs the final p->uf_bo, so every FENCE chunk but the last leaks a BO reference. The leaked BO outlives handle close and process exit. Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did for p->bo_list. Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: Enable GFXOFF functionality for SMU IP v15.0.5Shubhankar Milind Sardeshpande
Add clockgating and powergating flags for GC 11.5.6 and allow/disallow GFXOFF for SMU 15.0.5 Signed-off-by: Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Pratik Vishwakarma <Pratik.Vishwakarma@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/pm: Keep sub-degree precision in Q10 temperaturesLijo Lazar
The Q10 temperatures were rounded to whole degrees before being scaled to millidegrees, losing sub-degree precision. Convert them while preserving the fractional part. Also, use the standard MILLIDEGREE_PER_DEGREE to represent SMU_TEMPERATURE_UNITS_PER_CENTIGRADES. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/pm: Keep sub-watt precision in Q10 socket powerLijo Lazar
The Q10 socket power was rounded to whole watts before scaling to milliwatts, so the reported value lost its sub-watt precision. Add SMUQ10_TO_MILLIWATT to convert while keeping the fractional bits. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/pm: Simplify SoC power printing in debugfsLijo Lazar
Convert SoC power directly from milliwatts using MILLIWATT_PER_WATT and remove redundant variables. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12perf build: install-build-deps: add RHEL family devel package mappingArnaldo Carvalho de Melo
With the Fedora mapping in place, this patch extends it to the RHEL family (RHEL, CentOS Stream, Rocky Linux, AlmaLinux, Oracle Linux), which shares most Fedora package names and runs dnf (RHEL 8 and later). The names that differ are handled by probing the enabled repos: - zlib.h comes from zlib-ng-compat-devel on the RHEL 10 family, zlib-devel on RHEL 9 and earlier; - there is no java-latest-openjdk-devel: the JDK devel package is versioned per release, java-21-openjdk-devel on the RHEL 10 family, java-17-openjdk-devel on RHEL 9, java-11-openjdk-devel on RHEL 8; - libbpf-devel and capstone-devel live in the CRB repo on RHEL and CentOS Stream 10, in EPEL on RHEL 9 and earlier; - libbabeltrace2-devel is not packaged on the RHEL 10 family. Packages not available on the enabled repos are skipped instead of aborting the dnf transaction, and are listed at the end of the run, with the repo that provides them pointed out in the header comment and help text: a distro with CRB/EPEL enabled gets the full set, one without them still installs what it can. This also holds for the base set: e.g. 'rust' exists only as the rust-toolset AppStream module on RHEL 8 and 9, where it is not installable as a plain package, so it is skipped and noted there instead of failing the whole dnf transaction. The base set lists pkgconf-pkg-config instead of pkgconfig: both families have been on pkgconf since Fedora 26 / RHEL 8, where 'pkgconfig' lives only as a virtual Provides of that subpackage, and a minimal RHEL-family container may not have it preinstalled. Validated on a fresh CentOS Stream 10 distrobox container, with the CRB repo enabled, so the host system is not modified: distrobox create --image quay.io/centos/centos:stream10 distrobox enter centos-stream10 dnf config-manager --set-enabled crb make -C tools/perf install-build-deps which installed the 28 available mapped packages; libbabeltrace2-devel, the only mapped package with no RHEL 10 package, is reported at the end of the run. A subsequent 'make -C tools/perf feature-dump' enabled every feature with an external dependency the RHEL 10 family provides, including libbpf and libcapstone from the CRB repo, with only babeltrace2-ctf-writer left out along with the deliberately unmapped opt-in features. Re-running the target is a no-op (dnf reports "Nothing to do"); with the CRB repo disabled, the skipped packages are instead listed in the end-of-run note, whose header comment and help text point out which repo provides them. Members of the family without dnf (RHEL 7 and earlier, e.g. Oracle Linux 7, a yum-only distro) are rejected with an explicit error while the dnf-based members get the full mapping. Example of its --list: $ grep PRETTY_NAME /etc/os-release PRETTY_NAME="Fedora Linux 44 (Toolbx Container Image)" $ tools/perf/scripts/install-build-deps.sh --list --distro rhel bison capstone-devel clang-devel elfutils-debuginfod-client-devel elfutils-devel elfutils-libelf-devel flex gcc gcc-c++ glibc-devel java-latest-openjdk-devel kernel-headers libbabeltrace2-devel libbpf-devel libpfm-devel libstdc++-devel libtraceevent-devel libzstd-devel llvm-devel make numactl-devel openssl-devel pkgconf-pkg-config python3-devel python3-setuptools rust slang-devel systemtap-sdt-devel xz-devel zlib-ng-compat-devel $ Assisted-by: opencode:deepseek-v4-flash-free Assisted-by: claude:claude-opus-4-7 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12perf build: Remove leftover feature tests for removed cxx and clang supportArnaldo Carvalho de Melo
56b11a2126bf2f42 ("perf bpf: Remove support for embedding clang for compiling BPF events (-e foo.c)") removed the test-cxx.cpp and test-clang.cpp sources, but left behind their entries in the feature test FILES list, the build rules and the cxx and clang entries in FEATURE_TESTS_EXTRA. Since the sources no longer exist, those rules would always fail, making the artificial feature-cxx and feature-clang results to be perpetually disabled/absent, remove the leftover entries, making the feature test scripts list match the available sources. Fixes: 56b11a2126bf2f42 ("perf bpf: Remove support for embedding clang for compiling BPF events (-e foo.c)") Cc: Ian Rogers <irogers@google.com> Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12perf build: install-build-deps: add Debian devel package mappingArnaldo Carvalho de Melo
With the Fedora and Ubuntu mappings in place, this patch adds Debian support: Debian installs the same devel packages, under the same names, as the Ubuntu mapping, so it reuses debian_pkg_for() and debian_base_pkgs as-is, with only auto-detection in detect_distro() (and the shared apt-get install path) added, keeping the script's per-distro dispatch ready for distros with their own package names. Validated on a fresh Debian 13 (trixie) container so the host system is not modified: distrobox create --image debian:trixie distrobox enter debian-trixie make -C tools/perf install-build-deps which installed the 29 mapped packages; re-running the target is a no-op (apt-get reports "0 newly installed"). A subsequent clean build enabled the same feature set as Ubuntu: 'perf version --build-options' shows every feature with an external dependency Debian has a package for [on], including the BPF skeletons compiled with clang/llvm (libLLVM), the python binding and the C++-based features, with only the deliberately unmapped libbfd family, libperl, libunwind and the CoreSight (libopencsd) packages [OFF]. RHEL, whose package mapping is largely similar to Fedora's, is the remaining planned distro, to be enabled once that mapping is validated on it. Example of its --list: $ grep PRETTY_NAME /etc/os-release PRETTY_NAME="Fedora Linux 44 (Toolbx Container Image)" $ tools/perf/scripts/install-build-deps.sh --list --distro debian bison clang default-jdk flex g++ gcc libbabeltrace2-dev libbpf-dev libc6-dev libcapstone-dev libdebuginfod-dev libdw-dev libelf-dev liblzma-dev libnuma-dev libpfm4-dev libslang2-dev libssl-dev libtraceevent-dev libzstd-dev linux-libc-dev llvm-dev make pkg-config python3-dev python3-setuptools rustc systemtap-sdt-dev zlib1g-dev $ Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12perf build: install-build-deps: add Ubuntu devel package mappingArnaldo Carvalho de Melo
With the framework and Fedora mapping in place, this patch adds the Ubuntu (apt) mapping: same feature-to-package correspondence as the Fedora one, adapted to Debian packaging conventions (libfoo-dev), on a per-distro dispatch so future distros can pick their own mapping or reuse one of these (Debian shares the Ubuntu mapping). Notable differences from Fedora: - base set: g++ (ships libstdc++-*-dev, covering cxa-demangle), pkg-config (installed implicitly by Fedora's default toolchain metapackage, but not by Ubuntu's), linux-libc-dev and libc6-dev instead of kernel-headers and glibc-devel, and rustc for rust; - cxa-demangle maps to nothing, covered by g++'s libstdc++; - the clang-bpf-co-re test needs the clang compiler binary (Fedora's clang-devel provides it transitively), and llvm-dev, which also brings llvm-config (deps on the llvm package), used by the llvm/llvm-perf tests; - libslang maps to libslang2-dev and jvmti to default-jdk; - the install command runs 'apt-get update' first since a fresh container has no package indexes, unlike dnf. Validated on a fresh Ubuntu 26.04 distrobox container so the host system is not modified: distrobox create --image ubuntu:26.04 distrobox enter ubuntu-26-04 make -C tools/perf install-build-deps which installed the 29 mapped packages; a subsequent clean O= build enabled every feature with an external dependency Ubuntu has a package for: perf's build-options then showed all of them [on], including the BPF skeletons requiring clang/llvm, the python binding and the C++-based features, with only the deliberately unmapped (deprecated) libbfd family, libperl and libunwind [OFF], and the build linked libpfm, libbabeltrace2-ctf-writer, libcapstone, libtraceevent, libslang, libnuma, libdw and libssl. Re-running the target is a no-op (apt-get reports "0 newly installed"). Debian (trixie) is the next planned distro: it shares this Ubuntu mapping, so enabling it reuses it as-is, once it gets validated on a Debian release. Example of its --list: $ grep PRETTY_NAME /etc/os-release PRETTY_NAME="Fedora Linux 44 (Toolbx Container Image)" $ tools/perf/scripts/install-build-deps.sh --list --distro ubuntu bison clang default-jdk flex g++ gcc libbabeltrace2-dev libbpf-dev libc6-dev libcapstone-dev libdebuginfod-dev libdw-dev libelf-dev liblzma-dev libnuma-dev libpfm4-dev libslang2-dev libssl-dev libtraceevent-dev libzstd-dev linux-libc-dev llvm-dev make pkg-config python3-dev python3-setuptools rustc systemtap-sdt-dev zlib1g-dev $ Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12perf build: install-build-deps: add Fedora devel package mappingArnaldo Carvalho de Melo
With the framework from the previous commit in place, this patch adds the per-feature mapping for Fedora/dnf: for each feature test in tools/build/feature/, the Fedora devel package providing the headers or library the test compiles against, kept explicit in the script next to the test that requires it. Special cases: - test-libdebuginfod.c includes <elfutils/debuginfod.h>, provided by elfutils-debuginfod-client-devel, not elfutils-devel; - the cxa-demangle test links against libstdc++'s builtin demangler, pulling in libstdc++-devel; - the BPF-oriented features (bpf, clang-bpf-co-re) get their headers from the base packages and clang-devel. Tests with no Fedora equivalent (bionic, compile-32, compile-x32) and the opt-in/deprecated ones (libbfd disassembler family, GTK2, LIBPERL, LIBUNWIND, CoreSight, and the tests perf itself doesn't check, like libcpupower) are deliberately not mapped. Validated on a fresh Fedora 44 toolbx container, so the host OS is not modified: toolbox create fedora:44 toolbox enter fedora:44 make -C tools/perf install-build-deps which installed the 29 mapped packages; a subsequent clean O= build enabled every feature with an external dependency Fedora provides (feature tests went to 1, except bionic/compile-32/compile-x32, which have no Fedora equivalent, and the libunwind-debug-frame tests, whose symbols Fedora's libunwind does not export), linking libpfm, libbabeltrace2-ctf-writer, libcapstone, libtraceevent, libslang and libnuma, as well as building the BPF skeletons requiring clang/llvm. Re-running the target is a no-op (dnf reports "Nothing to do"). RHEL and its derivatives share most Fedora package names but are refused by the script until this mapping is validated on them. Example of its --list option: $ grep PRETTY_NAME /etc/os-release PRETTY_NAME="Fedora Linux 44 (Toolbx Container Image)" $ tools/perf/scripts/install-build-deps.sh --list bison capstone-devel clang-devel elfutils-debuginfod-client-devel elfutils-devel elfutils-libelf-devel flex gcc gcc-c++ glibc-devel java-latest-openjdk-devel kernel-headers libbabeltrace2-devel libbpf-devel libpfm-devel libstdc++-devel libtraceevent-devel libzstd-devel llvm-devel make numactl-devel openssl-devel python3-devel python3-setuptools rust slang-devel systemtap-sdt-devel xz-devel zlib-devel $ Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12perf build: Add install-build-deps framework to install devel packagesArnaldo Carvalho de Melo
Installing the development packages needed to build perf is error-prone on a fresh distro install: the packages are scattered across the feature tests in tools/build/feature/, each checking for a specific header/library, and the build only tells you what's missing after failing a check. This series adds a 'make -C tools/perf install-build-deps' target to install them in one go, deriving the package list from the feature tests themselves. This commit adds the framework, on top of the parse-time compiler probe guard from the previous commit: - the install-build-deps target in tools/perf/Makefile.perf, exempted from the config/feature detection pass, since it must run in a fresh container, before gcc or pkg-config exist, to install them; - the install-build-deps.sh script, with --list, --dry-run and --distro options, distro detection (Fedora and Ubuntu), dnf and apt-get drivers, root/passwordless-sudo handling, and the base packages common to any build: compiler, C++ compiler, make, flex, bison, libc and kernel headers, python3-setuptools (needed by the python binding) and rust (checked by the rust feature test); - the parse-time probes for optional tools, like pkg-config, use 'command -v' with stderr discarded, so a fresh container without them gets no 'which: no pkg-config in (...)' spew from make; - the script does not rely on 'set -e': its error paths are explicit, since the make target runs it via $(SHELL), where a shebang option would be ignored anyway, so direct and make-driven runs behave the same. The per-feature mappings, from each feature test to the devel package providing its headers on a given distro, are added by the follow-up patches, one per distro, together with the validation of each mapping in a fresh container: until then the target installs just the base toolchain. Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12tools build: Only probe the compiler at parse time when it is installedArnaldo Carvalho de Melo
Two parse-time probes still invoke $(CC) unconditionally: - LP64 in tools/scripts/Makefile.arch, probing with $(CC) -E -x c, pulled in twice by tools/perf/Makefile.perf; - CC_NO_CLANG in tools/scripts/Makefile.include, probing with $(CC) -dM -E -x c /dev/null. In the corner case where gcc is not yet installed, the very setup the install-build-deps target, added in the next patch of this series, is meant for, these probes make even targets that never compile parse-time spew errors like: /bin/sh: 1: gcc: not found /bin/sh: 1: gcc: not found /bin/sh: 1: gcc: not found Guard both probes with 'command -v' using the first word of CC so a missing compiler is handled silently with the same result as a failing probe (CC_NO_CLANG and LP64 unset/0), and with no behavior change when the compiler is installed. Only the first word is consulted because CC may carry arguments such as 'ccache gcc', and shell implementations differ in how 'command -v' handles multiple words (dash only checks the first, bash any of them), so validating the whole CC value would silently disable both probes on some make SHELLs. Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12backlight: Use sysfs_emit() instead of sprintf()Levente Szajko
Replace sprintf() with sysfs_emit() in the sysfs show callbacks of backlight.c and lcd.c, as recommended by Documentation/filesystems/sysfs.rst. No functional change intended. Signed-off-by: Levente Szajko <raedrimhun@proton.me> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260805135027.43890-1-raedrimhun@proton.me Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: qcom-wled: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260722065709.346072-1-panchuang@vivo.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12perf kvm: Fix memory leak in cmd_kvm()Michalis Niarchos
Set the thread private data destructor. Signed-off-by: Michalis Niarchos <michael.niarchos@gmail.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12perf kvm: Fix memory leak in process_sample_event()Michalis Niarchos
machine__resolve() indirectly acquires a thread reference via machine__findnew_thread(). Release it, as suggested by the documentation of the former. Signed-off-by: Michalis Niarchos <michael.niarchos@gmail.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-08-12ALSA: hda/conexant: Add mute LED quirk for HP ProBook 440 G5Dmytro Moroziuk
The HP ProBook 440 G5 requires the CXT_FIXUP_MUTE_LED_GPIO quirk to properly toggle the physical mute and mic-mute LEDs via the CX8200 codec. Without this quirk, the LEDs remain permanently dark. Signed-off-by: Dmytro Moroziuk <dmorozyk1@gmail.com> Link: https://patch.msgid.link/20260812121856.30353-1-dmorozyk1@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-12backlight: ktd2801: Fix unmet dependency on GPIOLIBJulian Braha
LEDS_EXPRESSWIRE depends on GPIOLIB, so its selector, BACKLIGHT_KTD2801 also needs to ensure GPIOLIB is enabled. Otherwise: WARNING: unmet direct dependencies detected for LEDS_EXPRESSWIRE Depends on [n]: NEW_LEDS [=n] && GPIOLIB [=n] Selected by [y]: - BACKLIGHT_KTD2801 [=y] && HAS_IOMEM [=y] && BACKLIGHT_CLASS_DEVICE [=y] This unmet dependency was found by kconfirm, a static analysis tool for Kconfig. Fixes: d95963e309bc ("backlight: ktd2801: Depend on GPIOLIB") Signed-off-by: Julian Braha <julianbraha@gmail.com> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Acked-by: Duje Mihanović <duje@dujemihanovic.xyz> Tested-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260719024902.151710-1-julianbraha@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: aw99706: Honor the core blank state in update_status()Junjie Cao
update_status() passes props.brightness straight to the hardware and ignores the power/blank state tracked by the core. Writing 4 to the bl_power sysfs attribute or blanking the framebuffer therefore leaves the backlight lit. Use backlight_get_brightness(), which returns 0 while the device is blanked. Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight") Cc: stable@vger.kernel.org Signed-off-by: Junjie Cao <junjie.cao@linux.dev> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260804030255.1934470-4-junjie.cao@intel.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: aw99706: Validate all DT property values consistentlyJunjie Cao
The lookup helpers for dim-mode and ramp-ctl take a shortcut when lookup_tbl is NULL: they accept any u32 value without range-checking and return success unconditionally. Out-of-range values get silently truncated by regmap_update_bits instead of triggering the dev_warn + default-fallback path that the other properties use. Add a field-width check for the NULL-table case so that values exceeding the register field maximum are rejected the same way a table-lookup miss is. The switching frequency table has a second hole: reserved slots use 0 as their marker, so "awinic,sw-freq-hz = <0>" matches slot 0 and programs a reserved encoding. Make the reserved marker U32_MAX and skip such slots during lookup. While here, also switch the error returns to -EINVAL for consistency. Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight") Signed-off-by: Junjie Cao <junjie.cao@linux.dev> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260804030255.1934470-3-junjie.cao@intel.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: aw99706: Fix DT property names to match bindingJunjie Cao
The driver reads four tuning properties without the unit suffixes that the binding mandates: "awinic,sw-freq" instead of "awinic,sw-freq-hz", "awinic,sw-ilmt" instead of "awinic,sw-ilmt-microamp", "awinic,iled-max" instead of "awinic,iled-max-microamp", and "awinic,uvlo-thres" instead of "awinic,uvlo-thres-microvolt". As a result, device_property_read_u32() never finds these properties in a binding-conformant device tree and silently falls back to the compiled-in defaults for switching frequency, switching current limit, max LED current, and UVLO threshold. Fix by aligning the property name strings in aw99706_dt_props[] with the binding. No value/range changes are needed since both sides already use the same units and enumerations. Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight") Cc: stable@vger.kernel.org Signed-off-by: Junjie Cao <junjie.cao@linux.dev> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260804030255.1934470-2-junjie.cao@intel.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12soundwire: dmi-quirks: Disable ghost Realtek on Asus ROG Zephyrus DuoCharles Keepax
The Asus ROG Zephyrus Duo also has a Realtek device in the ACPI that doesn't exist in the physical hardware. This confuses the machine driver into attempting to create DAI links for the device. Add a quirk to remove this device. Suggested-by: Bard Liao <yung-chuan.liao@linux.intel.com> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260807121425.1952003-1-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-12KVM: s390: Fix potential tiny kernel stack leakClaudio Imbrenda
In some circumstances, one bit of kernel stack could have been leaked from dat_cond_set_storage_key(). Fix by clearing prev before use. Fixes: 8e03e8316eb2 ("KVM: s390: KVM page table management functions: storage keys") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-9-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Fix kvm_s390_clear_pv_state()Claudio Imbrenda
kvm_s390_clear_pv_state() needs to also clear the dumping flag, to allow the protected VM to be started again (as non-protected, with all protected state safely destroyed) after a forced reboot while a protected dump was ongoing and not completed. Fixes: e40df9efd68a ("KVM: s390: pv: clear the state without memset") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-8-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Fix IRQ injection with SIGP Stop and Store StatusClaudio Imbrenda
When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the KVM_RUN IOCTL. If the vCPU is already stopped, the status is stored immediately. Storing the status means writing into userspace, which might fault, and __inject_sigp_stop() is called from do_inject_vcpu() which in turn is always called holding a spinlock, which is obviously an issue. Fix this by returning -EWOULDBLOCK from __inject_sigp_stop(), and adding a bool flag to indicate whether a store status is needed. The callers of do_inject_vcpu() are modified to pass the pointer to the bool flag; whenever a Store Status operation is needed, the callers can now perform it outside the spinlock. Opportunistically refactor kvm_s390_set_irq_state() to use scoped_guard() and __free(). Fixes: 6cddd432e3da ("KVM: s390: handle stop irqs without action_bits") Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> [ Added Fixes tag while picking -- Claudio ] Message-ID: <20260812104436.109741-7-imbrenda@linux.ibm.com>
2026-08-12RDMA/rxe: Fix OOB in free_rd_atomic_resources()Peiyang He
free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the free path walk past the old allocation and trigger a slab out-of-bounds write catched by KASAN: ================================================================== BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] BUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063 CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xf7/0x600 mm/kasan/report.c:482 kasan_report+0xe4/0x120 mm/kasan/report.c:595 free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fefc75a70cd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007 RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0 </TASK> Allocated by task 11063: kasan_save_stack+0x33/0x60 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5296 [inline] __kmalloc_noprof+0x32a/0x850 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] alloc_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:155 [inline] rxe_qp_from_attr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:714 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802b8ddd80 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes to the right of allocated 56-byte region [ffff88802b8ddd80, ffff88802b8dddb8) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b8dd flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff888015c418c0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4651, tgid 4651 ((udev-worker)), ts 123427165316, free_ts 123425874255 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfc/0x120 mm/page_alloc.c:1853 prep_new_page mm/page_alloc.c:1861 [inline] get_page_from_freelist+0x75b/0x3220 mm/page_alloc.c:3941 __alloc_frozen_pages_noprof+0x27e/0x2b00 mm/page_alloc.c:5221 alloc_slab_page mm/slub.c:3278 [inline] allocate_slab mm/slub.c:3467 [inline] new_slab+0xa6/0x670 mm/slub.c:3525 refill_objects+0x278/0x420 mm/slub.c:7272 refill_sheaf mm/slub.c:2816 [inline] __pcs_replace_empty_main+0x2ed/0x640 mm/slub.c:4652 alloc_from_pcs mm/slub.c:4750 [inline] slab_alloc_node mm/slub.c:4884 [inline] __do_kmalloc_node mm/slub.c:5295 [inline] __kmalloc_noprof+0x68d/0x850 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] tomoyo_encode2+0x100/0x3e0 security/tomoyo/realpath.c:45 tomoyo_encode+0x29/0x50 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x18c/0x690 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x2ab/0x3c0 security/tomoyo/file.c:776 tomoyo_file_open+0x6b/0x90 security/tomoyo/tomoyo.c:334 security_file_open+0x7a/0x1b0 security/security.c:2739 do_dentry_open+0x57e/0x1690 fs/open.c:924 vfs_open+0x82/0x3f0 fs/open.c:1079 do_open fs/namei.c:4699 [inline] path_openat+0x218a/0x3190 fs/namei.c:4858 page last free pid 1 tgid 1 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x763/0xfc0 mm/page_alloc.c:2938 selinux_genfs_get_sid security/selinux/hooks.c:1364 [inline] inode_doinit_with_dentry+0x903/0x1320 security/selinux/hooks.c:1563 selinux_d_instantiate+0x26/0x30 security/selinux/hooks.c:6658 security_d_instantiate+0x123/0x190 security/security.c:3704 d_splice_alias_ops+0x92/0x850 fs/dcache.c:3141 kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1289 lookup_open.isra.0+0x659/0x1080 fs/namei.c:4484 open_last_lookups fs/namei.c:4611 [inline] path_openat+0x17dd/0x3190 fs/namei.c:4855 do_file_open+0x20c/0x430 fs/namei.c:4887 do_sys_openat2+0x101/0x1d0 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x141/0x200 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88802b8ddc80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff88802b8ddd00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff88802b8ddd80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ^ ffff88802b8dde00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ffff88802b8dde80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc Fix the OOB by moving the assignment after free_rd_atomic_resources() so the old array is freed using the old bound. This matches the original ordering in commit 8700e3e7c485 ("Soft RoCE driver"). Closes: https://lore.kernel.org/all/365C68B4923F8214+30195a67-0b90-4b92-ab96-2ce41517793c@smail.nju.edu.cn/ Fixes: b6bbee0d2438 ("IB/rxe: Properly honor max IRD value for rd/atomic.") Cc: stable@vger.kernel.org Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-08-12m68k: Define NR_CPUS to 1Uwe Kleine-König
This fixes a Kconfig warning fs/erofs/Kconfig:137:warning: range is invalid which originates from EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS using NR_CPUS which up to now didn't exist for ARCH=m68k. All other architectures define this symbol, so fix the outlier. [geert] This also fixes: - CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS being set to the literal NR_CPUS instead of a number by automatic configs like "make allmodconfig" or "make olddefconfig", - An infinite loop in manual configs like "make oldconfig" when CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS is not present or has an invalid value in your existing .config. Fixes: c9b47e6b2311 ("erofs: cap LZMA stream pool size") Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://patch.msgid.link/20260731094950.1988084-2-ukleinek@kernel.org Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2026-08-12leds: is31fl319x: Modernize registrationAndreas Kemnade
Use _ext version to have properties parsed to avoid needing to parse them in the driver itself. More modern properties are recognized and the LEDs can be referenced via phandle. Due to the maximum current mechanics, LEDs are not registered right in the first iteration over the nodes. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260806-led-modern-v4-1-eed715baab2e@kemnade.info Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12KVM: s390: Fix pgste_get_trylock_multiple()Claudio Imbrenda
In case of failure, pgste_get_trylock_multiple() will attempt to unlock the locked PGSTEs based on whether the PCL is set. In some circumstances this can lead to unlocking PGSTEs that were locked by other threads. Fix by unlocking the amount of PGSTEs that were actually locked, ignoring the PCL bit in the array. Fixes: 94fd9b16cc67 ("KVM: s390: KVM page table management functions: lifecycle management") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-6-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Fix get_all_floating_irqs()Claudio Imbrenda
When attempting to report all pending floating interrupt to userspace, the GISA IPM bits are atomically tested and cleared, and the corresponding interrupt description is written in the output buffer. If the output buffer is too small, an error is returned to userspace, but the GISA IPM bits are now lost. Moreover, the contract of KVM_DEV_FLIC_GET_ALL_IRQS, which is the only path to get_all_floating_irqs(), states that: > All interrupts remain pending, i.e. are not deleted from the list of > currently pending interrupts. Fix by non-destructively testing for the GISA IPM bits. Fixes: 24160af6cb28 ("KVM: s390: add GISA interrupts to FLIC ioctl interface") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-4-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Use srcu in kvm_arch_vcpu_unlocked_ioctl()Claudio Imbrenda
kvm_arch_vcpu_unlocked_ioctl() is called without further locks held, but kvm_s390_inject_vcpu(), which is called from there, needs either the kvm->srcu or the slots lock. Fix by taking the kvm->srcu in kvm_arch_vcpu_unlocked_ioctl(). Fixes: ba5c1e9b6cee ("KVM: s390: interrupt subsystem, cpu timer, waitpsw") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-3-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()Claudio Imbrenda
Some callers pass NULL as oldkey. Calling page_cond_set_storage_key() will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer to a dummy local variable to avoid crashes. Fixes: 8e03e8316eb2 ("KVM: s390: KVM page table management functions: storage keys") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812104436.109741-2-imbrenda@linux.ibm.com>
2026-08-12KVM: s390: Restore sigset on error pathChristian Borntraeger
kvm_sigset_activate() installs vcpu->sigset via sigprocmask() and stashes the caller's mask in current->real_blocked; only kvm_sigset_deactivate() restores it. For KVM_RUN on a STOPPED vcpu the error path will not restore the userspace mask. Re-arrange the error handling to also restore the signal mask. Fixes: 6352e4d2dd9a3 ("KVM: s390: implement KVM_(S|G)ET_MP_STATE for user space state control") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260811153738.206885-5-borntraeger@linux.ibm.com>
2026-08-12KVM: s390: pv: Fix rc/rrc offset for PVM_DUMPChristian Borntraeger
The rc/rrc value is copied to the cmd location of the cmd in the kvm_pv_cmd structure. Fix the offset. Fixes: 8aba09588d2a ("KVM: s390: Add CPU dump functionality") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260811153738.206885-4-borntraeger@linux.ibm.com>
2026-08-12KVM: s390: vsie: zero stale crypto bitsChristian Borntraeger
When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits. Fixes: 6b79de4b056e ("KVM: s390: vsie: allow guest FORMAT-1 CRYCB on host FORMAT-2") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260811153738.206885-3-borntraeger@linux.ibm.com>
2026-08-12KVM: s390: keyop: use mmu_lock to read gmap->asceChristian Borntraeger
Every other dat_* consumer in this file (kvm_s390_get_skeys, set_skeys, get_cmma_bits, set_cmma_bits, MEM_CLR_CMMA, kvm_s390_fixup_prefix, kvm_test_age_gfn, kvm_age_gfn) reads kvm->arch.gmap->asce *inside* the mmu_lock read-side. keyop is the only outlier. gmap->asce is mutated under write_lock(mmu_lock) by gmap_set_limit() and keyop might use a stale asce value for walking as KVM_S390_KEYOP and KVM_S390_VM_MEM_LIMIT_SIZE can run concurrently. This can result in memory corruption. Fixes: 0ee4ddc1647b ("KVM: s390: Storage key manipulation IOCTL") Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260811153738.206885-2-borntraeger@linux.ibm.com>
2026-08-12mfd: cs42l43: Fix regmap defaults orderingCharles Keepax
The regmap defaults should be ordered as binary search is done on the array. A few registers were added in the wrong places, move these to be in register address order. Fixes: a6fe20d67dc7 ("mfd: cs42l43: Add support for the B variant") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805120109.4024451-1-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12dt-bindings: mfd: syscon: Allow syscon compatible for Loongson-2K0300 chip idBinbin Zhou
The Loongson-2K0300 SoC exposes its chip ID registers through a syscon interface. Add the specific compatible `loongson,ls2k0300-chipid-syscon` to the allowed list of syscon bindings so that it can be referenced from the thermal node via a phandle. Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/b76405a88b0cded91ba370139d7223fe2d6953df.1785829933.git.zhoubinbin@loongson.cn Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12pid: reject allocations through dead ancestor pid namespacesJérémy Jean
alloc_pid() checks PIDNS_ADDING only on the leaf pid namespace before making a new struct pid visible in every ancestor namespace. That is insufficient when an unborn descendant pid namespace outlives an ancestor whose init task has already exited. The descendant can still be initialized later through setns(), and the new pid is then published into the dead ancestor as well. Keep the existing ENOMEM behavior, but require PIDNS_ADDING to be set in every namespace that will receive the new pid before publishing any of them. This preserves the invariant that free_pid() never decrements pid_allocated in a namespace whose child_reaper is no longer live. Fixes: a3bdc23ba8ea ("pid_namespace: allow opening pid_for_children before init was created") Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12ASoC: es8316: Add regulator supportMark Brown
Hongyang Zhao <hongyang.zhao@thundersoft.com> says: Add regulator support for the four ES8316 power domains so board descriptions can model and control the codec supplies. The binding patch documents AVDD, CPVDD, DVDD and PVDD as optional supplies for ES8316, preserving compatibility with existing device-tree descriptions. The driver patch enables the supplies before initializing the regmap and keeps them enabled for the lifetime of the I2C device. The missing supply model was identified while reviewing the RubikPi 3 audio support: https://lore.kernel.org/linux-arm-msm/c293d9c7-bdb7-4303-80c8-404228c434d7@oss.qualcomm.com/ Link: https://patch.msgid.link/20260812-es8316-regulator-next-20260722-v2-0-e7078bc9bc9c@thundersoft.com
2026-08-12ASoC: codecs: es8316: Add regulator supportHongyang Zhao
ES8316 has separate AVDD, CPVDD, DVDD and PVDD supply inputs. Request and enable the supplies during I2C probe, before initializing the regmap. Keep them enabled for the lifetime of the I2C device so the regmap cannot access an unpowered device and its cache remains synchronized if the ASoC component is unbound and rebound. Signed-off-by: Hongyang Zhao <hongyang.zhao@thundersoft.com> Link: https://patch.msgid.link/20260812-es8316-regulator-next-20260722-v2-2-e7078bc9bc9c@thundersoft.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-12ASoC: dt-bindings: es8316: Add regulator suppliesHongyang Zhao
The ES8316 has separate AVDD, CPVDD, DVDD and PVDD supply inputs for its analog, charge pump, digital core and digital I/O domains. Describe all four inputs so boards can model the codec power topology. The binding also covers ES8311 and ES8323, whose supply inputs differ, so restrict these properties to the ES8316 compatible. Keep them optional for compatibility with existing descriptions. Signed-off-by: Hongyang Zhao <hongyang.zhao@thundersoft.com> Link: https://patch.msgid.link/20260812-es8316-regulator-next-20260722-v2-1-e7078bc9bc9c@thundersoft.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-12arm64/efi: Avoid voluntary preemption with efi_mm installedWill Deacon
Gus reports a bad kernel memory access when using software PAN (CONFIG_ARM64_SW_TTBR0_PAN=y) on a machine with support for EFI runtime services: Unable to handle kernel access to user memory outside uaccess routines at virtual address 00000000f322ff30 Mem abort info: ESR = 0x0000000096000004 FSC = 0x04: level 0 translation fault Internal error: Oops: 0000000096000004 [#1] SMP Workqueue: efi_rts_wq efi_call_rts pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : efi_call_rts+0xd8/0x288 Call trace: efi_call_rts+0xd8/0x288 (P) process_one_work+0x178/0x4f8 worker_thread+0x194/0x328 This is because the fpsimd context management code called from __efi_fpsimd_begin() can preempt voluntarily, returning later to the EFI code with an incorrect value for TTBR0_EL1 thanks to the deferred mm switching used by the software PAN implementation. Since EFI runtime services cannot preempt voluntarily and because the fpsimd switching code does not rely on the TTBR0_EL1 mappings, simply reorder the fpsimd switch so that it occurs before we change the page-table. Cc: Ard Biesheuvel <ardb@kernel.org> Reported-by: Gus Bourg <gus@bourg.net> Tested-by: Gus Bourg <gus@bourg.net> Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption") Link: https://lore.kernel.org/all/20260806000144.3388823-1-gus@bourg.net/ Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-12rust: fmt: route {:p} through HashedPtr to prevent address leaksKe Sun
Define a custom `kernel::fmt::Pointer` trait and `HashedPtr` wrapper so that `{:p}` formatting uses the kernel's `%p` hashed format instead of printing raw pointer values, preventing kernel address space leaks. Signed-off-by: Ke Sun <sunke@kylinos.cn> Reviewed-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260810-hashedptr-v15-2-eafd27d36476@kylinos.cn [ Fixed KUnit failure when the CRNG is not ready. Then, as suggested, replaced the `scnprintf` comment (with v16's), changed width to 100, replaced cast with `without_provenance`. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: fmt: fix {:p} printing stack addressesKe Sun
The `impl_fmt_adapter_forward!` macro forwards `Pointer` for `Adapter<T>` by destructuring `self` into a local `t`, causing `{:p}` to print the address of that temporary stack variable rather than the actual pointer. Remove `Pointer` from the macro and provide a manual impl for `Adapter<&T>` that passes `self.0` directly. Signed-off-by: Ke Sun <sunke@kylinos.cn> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Gary Guo <gary@garyguo.net> Tested-by: Link Mauve <linkmauve@linkmauve.fr> Cc: stable@vger.kernel.org Fixes: c5cf01ba8dfe ("rust: support formatting of foreign types") Link: https://patch.msgid.link/20260810-hashedptr-v15-1-eafd27d36476@kylinos.cn Signed-off-by: Miguel Ojeda <ojeda@kernel.org>