summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-11drm/amdgpu: add new data types F8 and Vector for PTLPerry Yuan
Add F8 and VECTOR to amdgpu_ptl_fmt and PSP format mapping. Update PTL format strings and GFX format enum to keep PSP/KFD in sync. Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdgpu: add amdgpu.ptl module parameter for PTL controlPerry Yuan
Add a new kernel module parameter 'amdgpu.ptl' to allow users to enable or disable PTL feature at driver loading time. Parameter values: *) 0 or -1: disable PTL (default) *) 1: enable PTL *) 2: permanently disable PTL Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdgpu: Track PTL disable requests by sourcePerry Yuan
Use a bitmap to track PTL disable requests from sysfs and profiler. PTL is only re-enabled once all sources have released their disable requests, avoiding premature enablement. Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdkfd: suspend scheduler during PTL re-enablingPerry Yuan
Stop the scheduler before releasing the PTL disable request to ensure the GPU is quiescent during the PTL state transition. This prevents potential queue preemption failures and GPU resets caused by modifying PTL state while waves are executing v1->v2: only stop/start the scheduler when the PTL state actually needs to transition(Yifan) Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdkfd: Add PTL control IOCTL Option and unify refcount logicPerry Yuan
Introduce a new IOCTL option to allow userspace explicit control over the Peak Tops Limiter (PTL) state for profiling Link: https://github.com/ROCm/rocm-systems/tree/develop/projects/rocprofiler-sdk Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdgpu: add sysfs for Peak Tops Limiter (PTL)Perry Yuan
Add per-GPU sysfs files under /sys/class/drm/cardX/device/ptl to control the Peak Tops Limiter (PTL) feature. Exposes ptl_enable (enable/disable PTL), ptl_format (set/query preferred formats), and ptl_supported_formats (list supported formats) Example usage ------------- Query PTL status: `cat /sys/class/drm/card1/device/ptl/ptl_enable` Enable PTL: `sudo bash -c "echo 1 > /sys/class/drm/card1/device/ptl/ptl_enable"` Disable PTL: `sudo bash -c "echo 0 > /sys/class/drm/card1/device/ptl/ptl_enable"` Set PTL preferred formats: `sudo bash -c "echo I8,F32 > /sys/class/drm/card1/device/ptl/ptl_format"` Query supported formats: `cat /sys/class/drm/card1/device/ptl/ptl_supported_formats` v3 changes: * move N/A to previous format in format show(Alex) * fix format check for format store(Alex) * drop the ptl declarations into amdgpu_ptl.h(Alex) v2 changes: * add usage commands in commit info (Alex) * move amdgpu_ptl_fmt into kgd_kfd_interface.h (Alex) Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11Documentation/amdgpu: Add documentation for Peak Tops Limiter (PTL) sysfs ↵Perry Yuan
interface The PTL (Peak Tops Limiter) feature exposes per-GPU sysfs files under /sys/class/drm/cardX/device/ptl/ to allow users to enable or disable PTL, configure preferred data formats, and query supported formats. The usage of these sysfs files is not always obvious, so add documentation to describe their purpose and provide concrete usage examples. V3 changes: * format show will display preferred formats instead of N/A (Alex) Signed-off-by: Perry Yuan <perry.yuan@amd.com> Suggested-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdkfd: add kgd control interface for ptlPerry Yuan
Add kgd->ptl_ctrl() callback so KFD can query/enable/disable PTL state through the PSP performance monitor interface. Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdgpu: add PTL enable/query gfx control support for GC 9.4.4Perry Yuan
Introduce hardware detection, runtime state tracking and a kgd->ptl_ctrl() callback to enable/disable/query PTL via the PSP performance-monitor interface (commands 0xA0000000/1). The driver now exposes PTL capability to KFD and keeps the software state in sync with the hardware. Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdgpu: add psp interfaces for peak tops limiter driverPerry Yuan
Introduce a Peak Tops Limiter (PTL) driver that dynamically caps engine frequency to ensure delivered TOPS never exceeds a defined TOPS_limit. This initial implementation provides core data structures and kernel-space interfaces (set/get, enable/disable) to manage PTL state. PTL performs a firmware handshake to initialize its state and update predefined format types. It supports updating these format types at runtime while user-space tools automatically switch PTL state, and also allows explicitly switching PTL state via newly added commands. Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11drm/amdgpu: add new performance monitor PSP interfacesPerry Yuan
Introduce new psp interfaces and structures for performance monitoring hardware control. Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11amd/amdkfd: Add kfd_ioctl_profiler to contain profiler kernel driver changesBenjamin Welton
kfd_ioctl_profiler takes a similar approach to that of kfd_ioctl_dbg_trap (which contains debugger related IOCTL services) where kfd_ioctl_profiler will contain all profiler related IOCTL services. The IOCTL is designed to be expanded as needed to support additional profiler functionality. The current functionality of the IOCTL is to allow for profilers which need PMC counters from GPU devices to both signal to other profilers that may be on the system that the device has active PMC profiling taking place on it (multiple PMC profilers on the same device can result in corrupted counter data) and to setup the device to allow for the collection of SQ PMC data on all queues on the device. For PMC data for the SQ block (such as SQ_WAVES) to be available to a profiler, mmPERFCOUNT_ENABLE must be set on the queues. When profiling a single process, the profiler can inject PM4 packets into each queue to turn on PERFCOUNT_ENABLE. When profiling system wide, the profiler does not have this option and must have a way to turn on profiling for queues in which it cannot inject packets into directly. Accomplishing this requires a few steps: 1. Checking if the user has the necessary permissions to profile system wide on the device. This check uses the same check that linux perf uses to determine if a user has the necessary permissions to profile at this scope (primarily if the process has CAP_SYS_PERFMON or is root). 2. Locking the device for profiling. This is done by setting a lock bit on the device struct and storing the process that locked the device. 3. Iterating all queues on the device and issuing an MQD Update to enable perfcounting on the queues. 4. Actions to cleanup if the process exits or releases the lock. The IOCTL also contains a link to the existing PC Sampling IOCTL as well. This is per a suggestion that we should potentially remove the PC Sampling IOCTL to have it be a part of the profiler IOCTL. This is a future change. In addition, we do expect to expand the profiler IOCTL to include additional profiler functionality in the future (which necessitates the use of a version number). v2: sqaush in proper IOCTL number Proposed userpace support: https://github.com/ROCm/rocm-systems/commit/40abc95a6463a61bb318a67efd6d9cc3e5ee8839 Signed-off-by: Benjamin Welton <benjamin.welton@amd.com> Signed-off-by: Perry Yuan <perry.yuan@amd.com> Acked-by: Kent Russell <kent.russell@amd.com> Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-11device property: initialize the remaining fields of fwnode_handle in ↵Bartosz Golaszewski
fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure. Cc: stable@vger.kernel.org Fixes: 01bb86b380a3 ("driver core: Add fwnode_init()") Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260511074927.9473-1-bartosz.golaszewski@oss.qualcomm.com [ Fix typo in commit message. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-05-11pinctrl: imx1: Allow parsing DT without function nodesFrank Li
The old format to define pinctrl settings for imx in DT has two hierarchy levels. The first level are function device nodes. The second level are pingroups which contain a property fsl,pins. The original ntention was to define all pin functions in a single dtsi file and just reference the correct ones in the board files. The commit ("5fcdf6a7ed95e pinctrl: imx: Allow parsing DT without function nodes") already make moden i.MX chip support flatten layout. Make legacy chipes (more than 15 years) support this flatten layout also. Fixes: e948cbdc41d6f ("ARM: dts: imx: remove redundant intermediate node in pinmux hierarchy") Tested-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-05-11sched_ext: Replace tryget_task_struct() with get_task_struct()Andrea Righi
The tryget_task_struct() calls in scx_sub_disable(), scx_root_enable_workfn() and scx_sub_enable_workfn() can never fail at the points they're invoked: - scx_root_enable_workfn() iterates over scx_tasks under scx_tasks_lock and rq lock. sched_ext_dead() removes tasks from scx_tasks under the same scx_tasks_lock before put_task_struct_rcu_user() runs in finish_task_switch(). So any task observed in scx_tasks must have usage > 0; put_task_struct_rcu_user() hasn't been called and the delayed_put_task_struct() callback that decrements usage cannot have been queued. - scx_sub_disable() and scx_sub_enable_workfn() iterate via css_task_iter, which takes a reference on each task in css_task_iter_next() and holds it until the next iter_next() call, so usage > 0 is guaranteed by the iter itself. The actual filter for dead tasks is the SCX_TASK_DEAD check inside scx_task_iter_next_locked(), not tryget; tryget only fails on zero usage, a state that can't be reached for tasks visible to these iters. Commit b7d4b28db7da ("sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch") removed an analogous tryget in the class-switch loop. Convert the remaining tryget calls to plain get_task_struct() and update the comment in scx_root_enable_workfn() that suggested tasks could be observed with zero @usage waiting for an RCU grace period. Link: https://lore.kernel.org/all/agCLBxHEUqWIepx8@google.com Suggested-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-11workqueue: forbid TEST_WORKQUEUE from being built-inBreno Leitao
The benchmark drives the workqueue's affinity_scope through sysfs by filp_open()'ing /sys/bus/workqueue/devices/bench_wq/affinity_scope. When CONFIG_TEST_WORKQUEUE=y, the module_init runs during kernel init before userspace has mounted sysfs, so every open returns -ENOENT and the benchmark loop spins emitting: test_workqueue: open /sys/bus/workqueue/devices/bench_wq/affinity_scope failed: -2 Mirror the TEST_BPF pattern and add "depends on m" so Kconfig will not let this be built into the kernel image, and document the reason in the help text. Fixes: 24b2e73f9700 ("workqueue: add test_workqueue benchmark module") Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-11workqueue: drop apply_wqattrs_lock()/unlock() wrappersBreno Leitao
The apply_wqattrs_lock()/unlock() helpers were introduced by commit a0111cf6710b ("workqueue: separate out and refactor the locking of applying attrs") to encapsulate the get_online_cpus() (later cpus_read_lock()) + mutex_lock(&wq_pool_mutex) acquire pair that was duplicated across the apply-attrs paths. Since commit 19af45757383 ("workqueue: Remove cpus_read_lock() from apply_wqattrs_lock()") removed the cpus_read_lock() (pwq creation and installation now operate on wq_online_cpumask, so CPU hotplug no longer needs to be excluded), the wrappers have been one-line forwarders to mutex_lock(&wq_pool_mutex)/mutex_unlock(&wq_pool_mutex). They no longer encode any non-trivial locking rule and obscure the fact that callers just take the existing wq_pool_mutex. This align with the "unnecessary" helpers that got discussed in [1] Inline the eight call sites and remove the wrappers. No functional change. Link: https://lore.kernel.org/all/afs_44-6ToJJVZTn@gmail.com/ [1] Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-11libceph: Fix potential out-of-bounds access in osdmap_decode()Raphael Zimmer
When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds memory access if the incoming message is corrupted such that the max_osd value exceeds the actual content of the osdmap message. This patch fixes the issue by changing the corresponding part in the ceph_decode_need() check to account for map->max_osd*sizeof(*map->osd_weight). Cc: stable@vger.kernel.org Fixes: dcbc919a5dc8 ("libceph: switch osdmap decoding to use ceph_decode_entity_addr") Signed-off-by: Raphael Zimmer <raphael.zimmer@tu-ilmenau.de> Reviewed-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2026-05-11x86: Update comment about pgd_listBrendan Jackman
This venerable comment got detached from its context when the code moved in commit 394158559d4c ("x86: move all the pgd_list handling to one place"). Put it back next to its context. It was originally on pgd_list_add() but it actually describes pgd_list so put it there. While moving it, update it to strip away stale and superfluous info. pageattr.c doesn't exist any more. pgd_list is now required for all x86 architectures. Also be slightly more precise about what PGDs are in this list. [ dhansen: tweak and trim the updated comment a bit ] Signed-off-by: Brendan Jackman <jackmanb@google.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Link: https://patch.msgid.link/20260323-pgd_list-comment-v2-1-77ccf2dc77e8@google.com
2026-05-11perf tool: Fix missing schedstat delegates and dont_split_sample_group in ↵Ian Rogers
delegate_tool delegate_tool was missing the delegate overrides for schedstat_cpu and schedstat_domain. As a result, when allocated with zalloc, these callbacks defaulted to NULL, causing a segmentation fault crash if any schedstat events were delivered during event processing. Fix this by adding delegate_schedstat_cpu and delegate_schedstat_domain via the CREATE_DELEGATE_OP2 macro, and ensuring delegate_tool__init correctly registers them. Additionally, delegate_tool__init completely omitted copying the dont_split_sample_group property from the delegate. This would cause wrapper tools to default the flag to false, which corrupts piped event processing (e.g., in perf inject) by triggering duplicate event deliveries on split sample values in deliver_sample_group(). Similarly, perf_tool__init() omitted the initialization of this boolean field. On stack-allocated tools that rely on this initializer (like intel-tpebs or __cmd_evlist), this could result in uninitialized stack garbage evaluating to true—silently dropping non-leader event members in deliver_sample_group(). Fix both issues by properly copying the field in delegate_tool__init and initializing it to false in perf_tool__init. Fixes: 6331b266935916bf ("perf tool: Add a delegate_tool that just delegates actions to another tool") Fixes: 79bcd34e0f3da39f ("perf inject: Fix leader sampling inserting additional samples") Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Gabriel Marin <gmx@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: James Clark <james.clark@linaro.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf sched: Add missing mmap2 handler in timehistIan Rogers
perf_sched__timehist() registers event handlers for options using the sched->tool struct. It registers handlers for MMAP, COMM, EXIT, FORK, etc. but completely omits registering a handler for MMAP2 events. Failing to register both MMAP and MMAP2 handlers causes modern systems (which primarily output MMAP2 records) to silently drop VMA map mappings. This results in uninitialized machine/thread mapping structures, making it impossible to resolve shared library instruction pointers (IPs) to dynamic symbols/DSOs during timehist callchain analysis. Fix this by correctly registering perf_event__process_mmap2 in sched->tool inside perf_sched__timehist(). Fixes: 49394a2a24c78ce0 ("perf sched timehist: Introduce timehist command") Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: David Ahern <dsahern@gmail.com> Cc: Gabriel Marin <gmx@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: James Clark <james.clark@linaro.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdownSven Eckelmann
The receiver shutdown timer handler, batadv_tp_receiver_shutdown(), is responsible for releasing the tp_vars reference it holds. However, the existing logic for coordinating this release with batadv_tp_stop_all() was flawed. timer_shutdown_sync() guarantees the timer will not fire again after it returns, but it returns non-zero only when the timer was pending at the time of the call. If the timer had already expired (and batadv_tp_stop_all() would unsucessfully try to rearm itself), batadv_tp_stop_all() skips its batadv_tp_vars_put(), and batadv_tp_receiver_shutdown() fails to put its own reference as well. Fix this by introducing a new atomic variable receiving that is set to 1 when the receiver is initialized and cleared atomically with atomic_xchg() by whichever side claims it first. Only the side that observes the transition from 1 to 0 is responsible for releasing the tp_vars timer reference, eliminating the uncertainty. Cc: stable@kernel.org Fixes: 3d3cf6a7314a ("batman-adv: stop tp_meter sessions during mesh teardown") Signed-off-by: Sven Eckelmann <sven@narfation.org>
2026-05-11batman-adv: fix tp_meter counter underflow during shutdownLuxiao Xu
batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1. Since the sender logic treats any non-zero value as "still sending", a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active. Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once. Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Cc: stable@kernel.org Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Signed-off-by: Luxiao Xu <rakukuip@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> [sven: added missing change in batadv_tp_send] Signed-off-by: Sven Eckelmann <sven@narfation.org>
2026-05-11perf sched stats: Fix segmentation faults, memory leaks, and stale pointers ↵Ian Rogers
in diff mode The patch addresses multiple segmentation fault vectors, out-of-bounds reads, and memory leaks in perf sched stats by adding bounds checks, NULL checks, proper error propagation, and robust memory cleanup. 1. In get_all_cpu_stats(), added assert(!list_empty(head)) to prevent unsafe list_first_entry() calls on empty lists, added a missing NULL check for summary_head->cpu_data allocation, and implemented a cleanup ladder using a temporary list to prevent memory leaks on error paths. 2. In free_schedstat(), fixed memory leaks by ensuring internal domain_data and cpu_data pointers are freed. 3. In show_schedstat_data(), fixed a stale pointer issue where ds2 retained its value from a previous iteration when dptr2 became NULL, and added proper propagation of errors from get_all_cpu_stats(). 4. Propagated show_schedstat_data() errors up to perf_sched__schedstat_diff() and perf_sched__schedstat_live() to prevent output corruption on failure. 5. In show_schedstat_data(), added NULL checks for cd_map1 and cd_map2 to gracefully handle invalid or empty data files. 6. Added parallel iteration termination checks using list_is_last() in show_schedstat_data() for both domain and CPU lists to safely terminate at the end of each list when files contain a different number of CPUs or domains. 7. Added CPU bounds checks (cs1->cpu >= nr1 and cs2->cpu >= nr2) in show_schedstat_data() to prevent out-of-bounds reads from cd_map1 and cd_map2 when comparing files from machines with different CPU counts. 8. Added NULL checks for cd_info1 and cd_info2 to prevent crashes when a CPU has data samples but no corresponding domain info in the header. 9. Added domain bounds checks (ds1->domain >= cd_info1->nr_domains and ds2->domain >= cd_info2->nr_domains) to prevent out-of-bounds array accesses in the domains array. 10. Added NULL checks for dinfo1 and dinfo2 in show_schedstat_data() to prevent crashes when a domain has no corresponding domain info. 11. Zero-initialized the perf_data array in perf_sched__schedstat_diff() to prevent stack garbage from causing perf_data_file__fd() to attempt to use a NULL fptr when use_stdio happened to be non-zero. Assisted-by: Gemini:gemini-3.1-pro-preview Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Athira Rajeev <atrajeev@linux.ibm.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf test: Fix "trace summary" test for musl-based systemsMartin Kaiser
The trace summary test calls /bin/true and filters for open, read and close events. These events are coming from shared library loads. On a musl system, the loader and libc may point to the same file. true needs only libc, no further shared libraries are loaded at startup. The test fails since no open, read and close events are captured. root@host:~# ldd /bin/true /lib/ld-musl-riscv64.so.1 (0x3fb8882000) libc.so => /lib/ld-musl-riscv64.so.1 (0x3fb8882000) root@host:~# file /lib/ld-musl-riscv64.so.1 /lib/ld-musl-riscv64.so.1: symbolic link to /usr/lib/libc.so root@host:~# strace -f /bin/true execve("/bin/true", ["/bin/true", ...], ... /* 18 vars */) = 1 set_tid_address(0x3fa1f7bf70) = 330 mprotect(0x2ad6b8e000, 12288, PROT_READ) = 0 exit_group(0) = ? +++ exited with 0 +++ Run "cat /dev/null" instead of "true". This creates the required events regardless of the C library and it works for cat from busybox or from coreutils. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Acked-by: Ian Rogers <irogers@google.com> Acked-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf test: Fix sys_enter_openat event test for muslMartin Kaiser
The "syscalls:sys_enter_openat event fields" test calls openat(AT_FDCWD, "/etc/passwd", O_RDONLY | O_DIRECTORY) and verifies that the flags of the captured event are matching. This fails for musl, where the openat syscall wrapper always adds O_LARGEFILE. Update the check to allow for additional flags, the access mode flags must be unchanged. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Acked-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11perf test: Fix nanosleep check in the ftrace testMartin Kaiser
The perf ftrace test case runs: perf ftrace profile --graph-opts depth=5 sleep 0.1 and checks that the output contains a *clock_nanosleep function with a count of 1. This fails on a risc-v system that uses musl as its C library. musl's nanosleep syscall wrapper uses either the nanosleep or the clock_nanosleep syscall. Filter for sys_*nanosleep to allow both syscalls. Signed-off-by: Martin Kaiser <martin@kaiser.cx> Acked-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-11io_uring: hold uring_lock across io_kill_timeouts() in cancel pathJens Axboe
io_uring_try_cancel_requests() dropped ctx->uring_lock before calling io_kill_timeouts(), which walks each timeout's link chain via io_match_task() to test REQ_F_INFLIGHT. With chain mutation now serialized by ctx->uring_lock, that walk needs the lock too. Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-05-11io_uring: defer linked-timeout chain splice out of hrtimer contextJens Axboe
io_link_timeout_fn() is the hrtimer callback that fires when a linked timeout expires. It currently calls io_remove_next_linked(prev) under ctx->timeout_lock to splice the timeout request out of the link chain. This is the only chain-mutation site that runs without ctx->uring_lock, because hrtimer callbacks cannot take a mutex. Defer the splicing until the task_work callback. Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-05-11io_uring: hold uring_lock when walking link chain in io_wq_free_work()Jens Axboe
io_wq_free_work() calls io_req_find_next() from io-wq worker context, which reads and clears req->link without holding any lock. This can potentially race with other paths that mutate the same chain under ctx->uring_lock. Take ctx->uring_lock around the io_req_find_next() call. Only requests with IO_REQ_LINK_FLAGS reach this path, which is not the hot path. Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-05-11nvme: fix race condition between connected uevent and STARTED_ONCE flagMaurizio Lombardi
When a controller connects, nvme_start_ctrl() emits the "NVME_EVENT=connected" uevent and sets the NVME_CTRL_STARTED_ONCE flag. Currently, the uevent is emitted before the flag is set. This creates a race condition for userspace tools (like udev rules) that might rely on the "connected" event to configure other attributes. Swap the order of operations in nvme_start_ctrl() so that the NVME_CTRL_STARTED_ONCE flag is set before the uevent is sent. This guarantees that the admin_timeout can already be changed when userspace is notified. Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Reviewed-by: Hannes Reinecke <hare@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Daniel Wagner <dwagner@suse.de> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-05-11ARM: omap2: simplify allocation for omap_deviceRosen Penev
Use a flexible array member (FAM) to combine hwmods array allocation with the omap_device structure. This reduces the number of allocations from two separate calls (one for the device, one for the array) to a single allocation, improving efficiency and reducing memory fragmentation. The FAM approach also enables bounds checking through __counted_by(), which provides runtime verification that array accesses stay within the allocated size. This improves security and helps catch bugs during development. Simplify error handling by removing the unnecessary multi-label goto pattern. The new code is more straightforward: allocate, verify, copy data, and either return success or error immediately. Also removes the now-redundant kfree(od->hwmods) in omap_device_delete() since the hwmods array is now embedded in the structure rather than separately allocated. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260330213528.18187-1-rosenp@gmail.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-05-11ACPI: driver: Check ACPI_COMPANION() against NULL during probeRafael J. Wysocki
Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), platform drivers that rely on the existence of a device's ACPI companion object should verify its presence. Accordingly, add requisite ACPI_COMPANION() or ACPI_HANDLE() checks against NULL to 13 platform drivers handling core ACPI devices. Also change the value returned by the ACPI thermal zone driver when the device's ACPI companion is not present to -ENODEV for consistency with the other drivers. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/4516068.ejJDZkT8p0@rafael.j.wysocki Cc: 7.0+ <stable@vger.kernel.org> # 7.0+
2026-05-11platform/x86: thinkpad_acpi: Add debugfs entry to display HWDD rawMark Pearson
The Lenovo diagnostics and support team have requested a mechanism to get the raw data from the HWDD commands to support customer debug situations. Add a debugfs entry to display the HWDD raw data. Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca> Link: https://patch.msgid.link/20260429015210.1863316-1-mpearson-lenovo@squebb.ca Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-11platform/x86/intel/vsec: allocate res with intel_vsec_devRosen Penev
Use a flexible array member to combine allocations. Avoids having to free separately. Add __counted_by for extra runtime analysis. Move counting variable assignment to after allocations as is already done by kzalloc_flex for GCC 15 and above. Signed-off-by: Rosen Penev <rosenp@gmail.com> Tested-by: David E. Box <david.e.box@linux.intel.com> Reviewed-by: David E. Box <david.e.box@linux.intel.com> Link: https://patch.msgid.link/20260430224307.109311-1-rosenp@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-11platform/x86: panasonic-laptop: simplify allocation of sinfRosen Penev
Change to a flexible array member to allocate once instead of twice. Use __counted_by for extra runtime analysis. Move the counting variable assignment to right after allocation as done by kzalloc_flex for GCC 15 and above. Remove + 1 to allocation. It's already done in the previous line. Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20260430221555.83351-1-rosenp@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-11platform/x86: sel3350-platform: Retain LED state on load and unloadBrodie Abrew
When the platform driver is loaded or unloaded, it overwrites the existing LED states. This can cause a loss of early boot state when the driver loads, and it can cause the ALARM contact to change state or flicker. Explicitly retain the existing LED state to prevent overwriting on driver load and unload. Tested-By: Robert Joslyn <robert.joslyn@redrectangle.org> Reviewed-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Brodie Abrew <brodie_abrew@selinc.com> Link: https://patch.msgid.link/20260507004916.6710-1-brodie_abrew@selinc.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-11platform/x86: xo15-ebook: Convert ACPI driver to a platform oneRafael J. Wysocki
In all cases in which a struct acpi_driver is used for binding a driver to an ACPI device object, a corresponding platform device is created by the ACPI core and that device is regarded as a proper representation of underlying hardware. Accordingly, a struct platform_driver should be used by driver code to bind to that device. There are multiple reasons why drivers should not bind directly to ACPI device objects [1]. Overall, it is better to bind drivers to platform devices than to their ACPI companions, so convert the OLPC XO-1.5 ebook switch driver from an ACPI driver to a platform one. After this change, the input device registered by the driver will appear under the platform device used for driver binding. While this is not expected to alter functionality, it changes sysfs layout and so it will be visible to user space. Link: https://lore.kernel.org/all/2396510.ElGaqSPkdT@rafael.j.wysocki/ [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/8688586.T7Z3S40VBb@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-11platform/x86: xo15-ebook: Register ACPI notify handler directlyRafael J. Wysocki
To facilitate subsequent conversion of the driver to a platform one, make it install an ACPI notify handler directly instead of using a .notify() callback in struct acpi_driver. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3420768.aeNJFYEL58@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-11platform/x86: xo15-ebook: Fix formatting of labelsRafael J. Wysocki
Fix formatting of two labels in ebook_switch_add() to make that function follow the current kernel coding style more closely. No functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/14016199.uLZWGnKmhe@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-11platform/x86: xo15-ebook: Fix wakeup source and GPE handlingRafael J. Wysocki
The device_set_wakeup_enable() call in ebook_switch_add() doesn't actually do anything because power.can_wakeup is not set for ACPI device objects. Moreover, had it done anything, it would have registered a wakeup source object that wouldn't have been used going forward and that wakeup source would have been leaked after driver removal because ebook_switch_remove() doesn't clean it up. Accordingly, remove that call from ebook_switch_add(). Also prevent leaking an enabled ACPI GPE after removing the driver by adding appropriate cleanup code to ebook_switch_remove(). Fixes: 89ca11771a4b ("OLPC XO-1.5 ebook switch driver") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/1966125.tdWV9SEqCh@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-05-11exit: prevent preemption of oopsing TASK_DEAD taskJann Horn
When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedule(), which has a comment saying "WARNING: must be called with preemption disabled!". If an oopsing task is preempted in do_task_dead(), between becoming TASK_DEAD and entering the scheduler explicitly, bad things happen: finish_task_switch() assumes that once the scheduler has switched away from a TASK_DEAD task, the task can never run again and its stack is no longer needed; but that assumption apparently doesn't hold if the dead task was preempted (the SM_PREEMPT case). This means that the scheduler ends up repeatedly dropping references on the dead task's stack, which can lead to use-after-free or double-free of the entire task stack; in other words, two tasks can end up running on the same stack, resulting in various kinds of memory corruption. (This does not just affect "recursively oopsing" tasks; it is enough to oops once during task exit, for example in a file_operations::release handler) Fixes: 7f80a2fd7db9 ("exit: Stop poorly open coding do_task_dead in make_task_dead") Cc: stable@kernel.org Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-05-11mmc: Merge branch fixes into nextUlf Hansson
Merge the mmc fixes for v7.1-rc[n] into the next branch, to allow them to get tested together with the mmc changes that are targeted for the next release. Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-05-11mmc: sdhci-of-k1: add comprehensive SDR tuning supportIker Pedrosa
Implement software tuning algorithm to enable UHS-I SDR modes for SD card operation and HS200 mode for eMMC. This adds both TX and RX delay line tuning based on the SpacemiT K1 controller capabilities. Algorithm features: - Add tuning register definitions (RX_CFG, DLINE_CTRL, DLINE_CFG) - Conditional tuning: only for high-speed modes (≥100MHz) - TX tuning: configure transmit delay line with optimal values (dline_reg=0, delaycode=127) to ensure optimal signal output timing - RX tuning: single-pass window detection algorithm testing full delay range (0-255) to find optimal receive timing window - Retry mechanism: multiple fallback delays within optimal window for improved reliability Tested-by: Anand Moon <linux.amoon@gmail.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Tested-by: Trevor Gamblin <tgamblin@baylibre.com> Tested-by: Vincent Legoll <legoll@online.fr> Signed-off-by: Iker Pedrosa <ikerpedrosam@gmail.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-05-11mmc: sdhci-of-k1: add regulator and pinctrl voltage switching supportIker Pedrosa
Add voltage switching infrastructure for UHS-I modes by integrating both regulator framework (for supply voltage control) and pinctrl state switching (for pin drive strength optimization). - Add regulator supply parsing and voltage switching callback - Add optional pinctrl state switching between "default" (3.3V) and "state_uhs" (1.8V) configurations - Enable coordinated voltage and pin configuration changes for UHS modes This provides complete voltage switching support while maintaining backward compatibility when pinctrl states are not defined. Tested-by: Anand Moon <linux.amoon@gmail.com> Tested-by: Trevor Gamblin <tgamblin@baylibre.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev> Tested-by: Vincent Legoll <legoll@online.fr> Signed-off-by: Iker Pedrosa <ikerpedrosam@gmail.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-05-11mmc: sdhci-of-k1: enable essential clock infrastructure for SD operationIker Pedrosa
Ensure SD card pins receive clock signals by enabling pad clock generation and overriding automatic clock gating. Required for all SD operation modes. The SDHC_GEN_PAD_CLK_ON setting in LEGACY_CTRL_REG is safe for both SD and eMMC operation as both protocols use the same physical MMC interface pins and require proper clock signal generation at the hardware level for signal integrity and timing. Additional SD-specific clock overrides (SDHC_OVRRD_CLK_OEN and SDHC_FORCE_CLK_ON) are conditionally applied only for SD-only controllers to handle removable card scenarios. Tested-by: Anand Moon <linux.amoon@gmail.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Tested-by: Trevor Gamblin <tgamblin@baylibre.com> Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev> Tested-by: Vincent Legoll <legoll@online.fr> Signed-off-by: Iker Pedrosa <ikerpedrosam@gmail.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-05-11dt-bindings: mmc: spacemit,sdhci: add pinctrl support for voltage switchingIker Pedrosa
Document pinctrl properties to support voltage-dependent pin configuration switching for UHS-I SD card modes. Add optional pinctrl-names property with two states: - "default": For 3.3V operation with standard drive strength - "state_uhs": For 1.8V operation with optimized drive strength These pinctrl states allow the SDHCI driver to coordinate voltage switching with pin configuration changes, ensuring proper signal integrity during UHS-I mode transitions. Acked-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Iker Pedrosa <ikerpedrosam@gmail.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-05-11fpga: lattice-sysconfig-spi: simplify with spi_get_device_match_data()Andy Shevchenko
Use spi_get_device_match_data() helper to simplify a bit the driver. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260510090556.1582900-1-andriy.shevchenko@linux.intel.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
2026-05-11fpga: lattice-sysconfig-spi: Don't use "proxy" headersAndy Shevchenko
Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260508082716.1156192-4-andriy.shevchenko@linux.intel.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
2026-05-11fpga: lattice-sysconfig-spi: Drop of_match_ptr() protectionAndy Shevchenko
Limiting the scope of devicetree support to CONFIG_OF prevents use of this driver with ACPI via PRP0001. Drop the dependency. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260508082716.1156192-3-andriy.shevchenko@linux.intel.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>