summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-06-03x86: Select ARCH_MEMORY_ORDER_TSOThomas Gleixner
The generic unsafe_atomic_store_release_user() implementation does: if (!IS_ENABLED(CONFIG_ARCH_MEMORY_ORDER_TSO)) smp_mb(); unsafe_put_user(); As x86 implements Total Store Order (TSO) which means stores imply release, select ARCH_MEMORY_ORDER_TSO to avoid the unnecessary smp_mb(). Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://patch.msgid.link/20260602090535.564499644@kernel.org
2026-06-03uaccess: Provide unsafe_atomic_store_release_user()Thomas Gleixner
The upcoming support for unlocking robust futexes in the kernel requires store release semantics. Syscalls do not imply memory ordering on all architectures so the unlock operation requires a barrier. This barrier can be avoided when stores imply release like on x86. Provide a generic version with a smp_mb() before the unsafe_put_user(), which can be overridden by architectures. Provide also a ARCH_MEMORY_ORDER_TSO Kconfig option, which can be selected by architectures with Total Store Order (TSO), where store implies release, so that the smp_mb() in the generic implementation can be avoided. If that is set a barrier() is used instead of smp_mb(), which is not required for the use case at hand, but makes it future proof for other usage to prevent the compiler from reordering. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://patch.msgid.link/20260602090535.513181528@kernel.org
2026-06-03futex: Provide UABI defines for robust list entry modifiersThomas Gleixner
The marker for PI futexes in the robust list is a hardcoded 0x1 which lacks any sensible form of documentation. Provide proper defines for the bit and the mask and fix up the usage sites. Thereby convert the boolean pi argument into a modifier argument, which allows new modifier bits to be trivially added and conveyed. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://patch.msgid.link/20260602090535.458758556@kernel.org
2026-06-03futex: Move futex related mm_struct data into a structThomas Gleixner
Having all these members in mm_struct along with the required #ifdeffery is annoying, does not allow efficient initializing of the data with memset() and makes extending it tedious. Move it into a data structure and fix up all usage sites. The extra struct for the private hash is intentional to make integration of other conditional mechanisms easier in terms of initialization and separation. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260602090535.407756793@kernel.org
2026-06-03futex: Make futex_mm_init() voidThomas Gleixner
Nothing fails there. Mop up the leftovers of the early version of this, which did an allocation. While at it clean up the stubs and the #ifdef comments to make the header file readable. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260602090535.356789395@kernel.org
2026-06-03futex: Move futex task related data into a structThomas Gleixner
Having all these members in task_struct along with the required #ifdeffery is annoying, does not allow efficient initializing of the data with memset() and makes extending it tedious. Move it into a data structure and fix up all usage sites. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://patch.msgid.link/20260602090535.308220888@kernel.org
2026-06-03percpu: Sanitize __percpu_qual include hellThomas Gleixner
Slapping __percpu_qual into the next available header is sloppy at best. It's required by __percpu which is defined in compiler_types.h and that is meant to be included without requiring a boatload of other headers so that a struct or function declaration can contain a __percpu qualifier w/o further prerequisites. This implicit dependency on linux/percpu.h makes that impossible and causes a major problem when trying to separate headers. Create asm/percpu_types.h and move it there. Include that from compiler_types.h and the whole recursion problem goes away. Fix up UM so it uses the generic header and includes it in the UM_HOST build, which pulls in compiler_types.h. The USER_CFLAGS fix was suggested by Richard. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260602090535.254874125@kernel.org
2026-06-03cleanup: Remove NULL check from unconditional guardsDmitry Ilvokhin
The unconditional guard destructors check whether the lock pointer is NULL before unlocking. This check is dead code because unconditional guards guarantee a non-NULL lock pointer at destructor time. DEFINE_GUARD() runs the lock operation unconditionally in the constructor. If the pointer were NULL, the lock operation (e.g. mutex_lock(NULL)) would crash before the constructor returns. The destructor never runs with a NULL pointer. All DEFINE_GUARD() users dereference the pointer in their lock. Verified by auditing every instance found by: git grep -n -A 1 'DEFINE_GUARD('. The only exception is xe_pm_runtime_release_only, whose constructor is a noop, but it has no callers. __DEFINE_UNLOCK_GUARD() has only a few usages outside of include/linux/cleanup.h: tty_port_tty (NULL-checks in its tty_kref_put() call), irqdesc_lock (fixed earlier) and two guards in kernel/sched/sched.h (dereference the pointer unconditionally in their lock constructors). DEFINE_LOCK_GUARD_1() sets .lock from its argument and runs the lock operation in the constructor. Same reasoning applies. All DEFINE_LOCK_GUARD_1() users dereference the pointer in their lock. Also, verified by auditing every match of: git grep -n 'DEFINE_LOCK_GUARD_1('. DEFINE_LOCK_GUARD_0() hardcodes .lock = (void *)1 in the constructor, so it is never NULL by construction. Conditional (_try) variants: DEFINE_GUARD_COND() and DEFINE_LOCK_GUARD_1_COND() use EXTEND_CLASS_COND(), whose wrapper destructor returns early when the lock was not acquired, before reaching the base destructor since commit 2deccd5c862a ("cleanup: Optimize guards"): if (_cond) return; class_##_name##_destructor(_T); As compiled by GCC-11 with defconfig on top of the locking/core: Total: Before=23889980, After=23834334, chg -0.23% Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/0503a089389b2270c478a873e095cf0a4ff26d24.1780064327.git.d@ilvokhin.com
2026-06-03cleanup: Annotate guard constructors with nonnullDmitry Ilvokhin
Add __nonnull_args() to unconditional guard constructors so the compiler warns when NULL is statically known to be passed: - DEFINE_GUARD(): re-declare the constructor with __nonnull_args(). - __DEFINE_LOCK_GUARD_1(): annotate the constructor directly. DEFINE_LOCK_GUARD_0() needs no annotation: its constructor takes no pointer arguments (.lock is hardcoded to (void *)1). Define the __nonnull_args() macro in compiler_attributes.h, following the existing convention for attribute wrappers. Deliberately not named '__nonnull', to avoid clashing with glibc's __nonnull() when kernel and userspace headers are combined (User Mode Linux for example). Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/85fee12eec20abfcf711443518e8f0caec982a86.1780064327.git.d@ilvokhin.com
2026-06-03genirq: Move NULL check into irqdesc_lock guard unlock expressionDmitry Ilvokhin
irqdesc_lock uses __DEFINE_UNLOCK_GUARD() directly with a custom constructor that can set .lock to NULL. In preparation for removing the NULL check from __DEFINE_UNLOCK_GUARD(), move the NULL check into the irqdesc_lock unlock expression, making the NULL handling explicit at the call site. No functional change. Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/ab457810653e4356e29b2d74ba616478bd9328ad.1780064327.git.d@ilvokhin.com
2026-06-03nvdimm: Convert nvdimm_bus guard to classDmitry Ilvokhin
The nvdimm_bus guard accepts NULL and skips locking when NULL is passed. Convert from DEFINE_GUARD() to DEFINE_CLASS() + DEFINE_CLASS_IS_GUARD(). This is a preparatory change for making DEFINE_GUARD() constructors __nonnull_args(). nvdimm_bus legitimately passes NULL, so it must be adjusted to avoid a compile error. No functional change. Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/8c0417904d280896ecf2e9923ffa9f20076f59b8.1780064327.git.d@ilvokhin.com
2026-06-03lockdep/selftests: Restore sched_rt_mutex state on PREEMPT_RTKarl Mehltretter
The WW-mutex selftests deliberately exercise failing lock paths. On PREEMPT_RT, some of those paths enter the RT-mutex scheduler helpers. The change referenced by the Fixes tag made those helpers track RT-mutex scheduling state in current->sched_rt_mutex. The bit is normally cleared by the matching post-schedule helper, but some WW-mutex selftests disable the runtime debug_locks flag before that happens. With debug_locks cleared, lockdep_assert() does not evaluate the expression that clears the bit, leaving stale state for the next testcase. With CONFIG_PREEMPT_RT=y and CONFIG_DEBUG_LOCKING_API_SELFTESTS=y, that stale state produces warnings such as: WARNING: kernel/sched/core.c:7557 at rt_mutex_pre_schedule+0x26/0x2d RIP: 0010:rt_mutex_pre_schedule+0x26/0x2d Save and restore current->sched_rt_mutex around each testcase, matching the existing PREEMPT_RT cleanup for task-local migration and RCU state. Fixes: d14f9e930b90 ("locking/rtmutex: Use rt_mutex specific scheduler helpers") Assisted-by: Codex:gpt-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Link: https://patch.msgid.link/20260523185123.17482-3-kmehltretter@gmail.com
2026-06-03lockdep/selftests: Restore migrate_disable() state on PREEMPT_RTKarl Mehltretter
The lockdep selftests deliberately run unbalanced locking patterns. dotest() restores the task state they leave behind before running the next testcase. On PREEMPT_RT, spin_lock() uses migrate_disable() instead of disabling preemption. dotest() cleans up the resulting migration-disabled state, but that cleanup is still guarded by CONFIG_SMP. That used to match the scheduler data model, where migration_disabled was also CONFIG_SMP-only. The commit referenced below made SMP scheduler state unconditional, so CONFIG_SMP=n PREEMPT_RT kernels with CONFIG_DEBUG_LOCKING_API_SELFTESTS=y report success from the selftests and then trip over stale current->migration_disabled state: releasing a pinned lock bad: scheduling from the idle thread! Kernel panic - not syncing: Fatal exception Save and restore current->migration_disabled for every PREEMPT_RT build. Fixes: cac5cefbade9 ("sched/smp: Make SMP unconditional") Assisted-by: Codex:gpt-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Link: https://patch.msgid.link/20260523185123.17482-2-kmehltretter@gmail.com
2026-06-03locking/qspinlock: Clarify pending field layoutWEI-HONG, YE
For CONFIG_NR_CPUS < 16K, _Q_PENDING_BITS is 8 and the pending field occupies bits 8-15 of the lock word. The current comment documents bit 8 as pending and bits 9-15 as unused, which describes the pending flag value rather than the field layout. Describe bits 8-15 as the pending byte so the layout description is consistent with the lock byte. Signed-off-by: WEI-HONG, YE <1234567weewee457@gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Waiman Long <longman@redhat.com> Link: https://patch.msgid.link/20260525130450.723937-1-1234567weewee457@gmail.com
2026-06-03pmdomain: sunxi: support power domain flags for pck600Yuanshen Cao
While bringing up the PowerVR GPU on the A733 (Radxa Cubie A7Z), we found that one of the GPU power domains must be configured as "always on." While the Radxa BSP device tree leaves the GPU power domain nodes commented out, the GPU driver code contains traces indicating an "always on" requirement [1]. Currently, sunxi_pck600_desc only supports specifying pd_names. This patch introduces sunxi_pck600_pd_desc, which stores both the name and its associated flags. This also (more or less) aligns the implementation with the existing sun50i PPU handling of always-on domains. With this change, individual power domains can now be configured more granularly. In particular, the GPU_CORE domain in sun60i_a733_pck600_pds can now be explicitly marked with GENPD_FLAG_ALWAYS_ON. The patch was tested on the Radxa Cubie A7Z, where the GPU now functions as expected. Thanks to Icenowy for her support and expertise on sunxi and PowerVR, and thanks to Mikhail for identifying this exact cause of the GPU bring-up issue. [1] https://github.com/radxa/allwinner-bsp/blob/cubie-aiot-v1.4.6/modules/gpu/img-bxm/linux/rogue_km/services/system/rogue/rgx_sunxi/sunxi_platform.c#L62 Signed-off-by: Yuanshen Cao <alex.caoys@gmail.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-06-03pmdomain: core: switch to dynamic root deviceJohan Hovold
Driver core expects devices to be dynamically allocated and will, for example, complain loudly if a device that lacks a release function is ever freed. Use root_device_register() to allocate and register the root device instead of open coding using a static device. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-06-03pmdomain: qcom: Unify user-visible "Qualcomm" nameKrzysztof Kozlowski
Various names for Qualcomm as a company are used in user-visible config options: QCOM, Qualcomm and Qualcomm Technologies. Switch to unified "Qualcomm" so it will be easier for users to identify the options when for example running menuconfig. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-06-03dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Nord SoCKamal Wadhwa
Document the RPMh power domain for Nord SoC, and add definitions for the new power domains present on Nord SoC. - RPMHPD_NSP3: power domain for the 4th NSP subsystem - RPMHPD_GFX1: power domain for the 2nd GFX subsystem Signed-off-by: Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com> Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-06-03dt-bindings: power: qcom,rpmhpd: Fix whitespace in RPMHPD definesShawn Guo
Some RPMHPD_* defines in the Generic RPMH Power Domain Indexes section were using spaces instead of tabs for alignment. Fix them to be consistent with the rest of the file. Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-06-03drm/i915: Fix color blob reference handling in intel_plane_stateChaitanya Kumar Borah
Take proper references for hw color blobs (degamma_lut, gamma_lut, ctm, lut_3d) in intel_plane_duplicate_state() and drop them in intel_plane_destroy_state(). v2: - handle blobs in hw state clear Cc: <stable@vger.kernel.org> #v6.19+ Fixes: 3b7476e786c2 ("drm/i915/color: Add framework to program PRE/POST CSC LUT") Fixes: a78f1b6baf4d ("drm/i915/color: Add framework to program CSC") Fixes: 65db7a1f9cf7 ("drm/i915/color: Add 3D LUT to color pipeline") Reviewed-by: Pranay Samala <pranay.samala@intel.com> #v1 Reviewed-by: Uma Shankar <uma.shankar@intel.com> Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Signed-off-by: Uma Shankar <uma.shankar@intel.com> Link: https://patch.msgid.link/20260601082953.128539-4-chaitanya.kumar.borah@intel.com (cherry picked from commit c6eea1925154b6697fe22b217faab9bb30635e6b) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
2026-06-03clocksource/drivers/timer-ti-dm: Add clockevent supportMarkus Schneider-Pargmann (TI)
Add support for using the TI Dual-Mode Timer for clockevents. The second always on device with the "ti,timer-alwon" property is selected to be used for clockevents. The first one is used as clocksource. This allows clockevents to be setup independently of the CPU. Signed-off-by: Markus Schneider-Pargmann (TI) <msp@baylibre.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Link: https://patch.msgid.link/20260508-topic-ti-dm-clkevt-v6-16-v5-3-61d546a0aff9@baylibre.com
2026-06-03clocksource/drivers/timer-ti-dm: Add clocksource supportMarkus Schneider-Pargmann (TI)
Add support for using the TI Dual-Mode Timer as a clocksource. The driver automatically picks the first timer that is marked as always-on on with the "ti,timer-alwon" property to be the clocksource. The timer can then be used for CPU independent time keeping. Signed-off-by: Markus Schneider-Pargmann (TI) <msp@baylibre.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Link: https://patch.msgid.link/20260508-topic-ti-dm-clkevt-v6-16-v5-2-61d546a0aff9@baylibre.com
2026-06-03clocksource/drivers/timer-ti-dm: Fix property name in commentMarkus Schneider-Pargmann (TI)
ti,always-on property doesn't exist. ti,timer-alwon is meant here. Fix this minor bug in the comment. Signed-off-by: Markus Schneider-Pargmann (TI) <msp@baylibre.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Kevin Hilman <khilman@baylibre.com> Reviewed-by: Dhruva Gole <d-gole@ti.com> Link: https://patch.msgid.link/20260508-topic-ti-dm-clkevt-v6-16-v5-1-61d546a0aff9@baylibre.com
2026-06-03dt-bindings: timer: arm,arch_timer: Fix requirements for interrupt descriptionMarc Zyngier
The arm,arch_timer DT binding is extremely imprecise in describing the requirements for interrupts. Follow the architecture by making it explicit that: - the EL1 secure timer irq is required if EL3 is implemented - the EL1 physical timer irq is always required - the EL1 virtual timer irq is always required - the EL2 physical timer irq is required if EL2 is implemented - the EL2 virtual timer irq is required if FEAT_VHE is implemented The consequence of the above is that the minimum number of interrupts to be described is 2, and not 1. Finally, clean up the description which made the assumption that the timers are plugged into a GIC (unfortunately, that's not always true), drop the MMIO nonsense that has long be moved to a separate binding, and use the architectural terminology to describe the various interrupts. Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260523140242.586031-5-maz@kernel.org
2026-06-03clocksource/drivers/arm_arch_timer: Default to EL2 virtual timer when ↵Marc Zyngier
running VHE When running with at EL2 with VHE enabled, the architecture provides two EL2 timer/counters, dubbed physical and virtual. Apart from their names, they are strictly identical. However, they don't get virtualised the same way, specially when it comes to adding arbitrary offsets to the timers. When running as a guest, the host CNTVOFF_EL2 does apply to the guest's view of CNTHV*_El2. This is not true for CNTPOFF_EL2 and CNTHP*_EL2, as the architecture is broken past the first level of virtualisation (it lacks some essential mechanisms to be usable, despite what the ARM ARM pretends). This means that when running as a L2 guest hypervisor, using the physical timer results in traps to L0, which are then forwarded to L1 in order to emulate the offset, leading to even worse performance due to massive trap amplification (the combination of register and ERET trapping is absolutely lethal). Switch the arch timer code to using the virtual timer when running in VHE by default, only using the physical timer if the interrupt is not correctly described in the firmware tables (which seems to be an unfortunately common case). This comes as no impact on bare-metal, and slightly improves the situation in the virtualised case. Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Link: https://patch.msgid.link/20260523140242.586031-4-maz@kernel.org
2026-06-03ACPI: GTDT: Parse information related to the EL2 virtual timerMarc Zyngier
Now that we have a way to identify GTDTv3, allow the information related to the EL2 virtual timer to be retrieved by the interface used by the architected timer driver. Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Reviewed-by: Hanjun Guo <guohanjun@huawei.com> Link: https://patch.msgid.link/20260523140242.586031-3-maz@kernel.org
2026-06-03ACPI: GTDT: Account for GTDTv3 size when walking the platform timer descriptorsMarc Zyngier
Since ARMv8.1, the architecture has grown an EL2-private virtual timer. This has been described in ACPI since ACPI v6.3 and revision 3 of the GTDT table. An aditional structure was added in ACPICA, though in a rather bizarre way, and merged in v5.1 as 8f5a14d053100 ("ACPICA: ACPI 6.3: add GTDT Revision 3 support"). Finally plug the table parsing in GTDT, and correct the parsing of the platform timer subtables to account for the expanded size of the base table. This also comes with some extra sanitisation of the table, in the unlikely case someone got it wrong... Suggested-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Hanjun Guo <guohanjun@huawei.com> Reviewed-by: Sudeep Holla <sudeep.holla@kernel.org> Link: https://patch.msgid.link/20260523140242.586031-2-maz@kernel.org
2026-06-03Merge tag 'iwlwifi-fixes-2026-05-31' of ↵Johannes Berg
https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next wifi: iwlwifi: fixes - 2026-05-31 Miri Korenblit says: ==================== This contains a few fixes: - Don't grab nic access in non-fast-resume - Don't send a large hcmd than transport supports - In AP mode, don't send tx power constraints command before activating the link - Don't do sw reset handshake on older firmwares. ==================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-03wifi: fix leak if split 6 GHz scanning failsFedor Pchelkin
rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's supposed to be released at ___cfg80211_scan_done() but this doesn't happen as rdev->scan_req is NULL at that point, too, leading to the early return from the freeing function. unreferenced object 0xffff8881161d0800 (size 512): comm "wpa_supplicant", pid 379, jiffies 4294749765 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................ backtrace (crc c867fdb6): kmemleak_alloc+0x89/0x90 __kmalloc_noprof+0x2fd/0x410 cfg80211_scan+0x133/0x730 nl80211_trigger_scan+0xc69/0x1cc0 genl_family_rcv_msg_doit+0x204/0x2f0 genl_rcv_msg+0x431/0x6b0 netlink_rcv_skb+0x143/0x3f0 genl_rcv+0x27/0x40 netlink_unicast+0x4f6/0x820 netlink_sendmsg+0x797/0xce0 __sock_sendmsg+0xc4/0x160 ____sys_sendmsg+0x5e4/0x890 ___sys_sendmsg+0xf8/0x180 __sys_sendmsg+0x136/0x1e0 __x64_sys_sendmsg+0x76/0xc0 x64_sys_call+0x13f0/0x17d0 Found by Linux Verification Center (linuxtesting.org). Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Link: https://patch.msgid.link/20260601094157.92703-1-pchelkin@ispras.ru Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-06-03configfs_lookup(): don't leave ->s_dentry dangling on failureAl Viro
Normally ->s_dentry is cleared when dentry it's pointing to becomes negative (on eviction, realistically). However, that only happens if dentry gets to be positive in the first place; in case of inode allocation failure dentry never becomes positive, so ->d_iput() is not called at all. We do part of what normally would've been done by configfs_d_iput() (dropping the reference to configfs_dirent) manually, but we do not clear ->s_dentry there. Sloppy as it is, it does not matter in case of configfs_create_{dir,link}() - there configfs_dirent does not survive dropping the sole reference to it. However, for configfs_lookup() it *does* survive, with a dangling pointer to soon to be freed dentry sitting it its ->s_dentry. Subsequent getdents(2) in that directory will end up dereferencing that pointer in order to pick the inode number. Use after free... This is the minimal fix; the right approach is to set the linkage between dentry and configfs_dirent only after we know that we have an inode, but that takes more surgery and the bug had been there since 2006, so... Fixes: 3d0f89bb1694 ("configfs: Add permission and ownership to configfs objects") # 2.6.16-rc3 Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-06-03thermal/drivers/qcom/tsens: Disable wakeup interrupt setup on automotive targetsPriyansh Jain
Add a no_irq_wake flag to struct tsens_plat_data to allow platforms to control whether TSENS interrupts should be configured as wakeup sources. Create a new data_automotive structure and add compatible strings for automotive TSENS variants (SA8775P, SA8255P) with wakeup interrupts disabled. Automotive platforms can enter a low-power parking suspend state where the application processors and thermal mitigation paths are not active. In this state, waking the system due to TSENS threshold interrupts does not enable useful thermal action, but it does repeatedly break suspend residency and increase battery drain. Allow these automotive variants to keep TSENS monitoring enabled during normal runtime while opting out of TSENS wakeup interrupts during suspend, so the system can remain in low power until ignition/resume. Signed-off-by: Priyansh Jain <priyansh.jain@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Link: https://patch.msgid.link/20260601-tsens_interrupt_wake_control-v2-2-ce9570946abd@oss.qualcomm.com
2026-06-03thermal/drivers/qcom/tsens: Switch wake IRQ handling to PM callbacksPriyansh Jain
This change improves power management by using the standardized PM framework for wake IRQ handling. Move wake IRQ control to the PM suspend/resume path: - store uplow/critical IRQ numbers in struct tsens_priv - enable wake IRQs in tsens_suspend_common() when wakeup is allowed - disable wake IRQs in tsens_resume_common() - mark the device wakeup-capable during probe This aligns TSENS wake behavior with suspend flow and avoids keeping wake IRQs permanently enabled during runtime. Signed-off-by: Priyansh Jain <priyansh.jain@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Link: https://patch.msgid.link/20260601-tsens_interrupt_wake_control-v2-1-ce9570946abd@oss.qualcomm.com
2026-06-03thermal/core: Fix missing stub for devm_thermal_cooling_device_registerDaniel Lezcano
Even it is very unlikely the thermal framework is disabled, the newly added devm_thermal_cooling_device_register() function has not the stub when the thermal framework is optout in the kernel. Add it. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202605301554.S9n45bfQ-lkp@intel.com/ Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260601090152.1243983-2-daniel.lezcano@kernel.org
2026-06-03dt-bindings: thermal: cooling-devices: Update support for 3 cells cooling deviceGaurav Kohli
Extend the thermal cooling device binding to support a 3 cells specifier along with the 2 cells format. Update #cooling-cells property to enum to support both 2 and 3 arguments. Fix pwm-fan.yaml to restrict the number of cells to 'const: 2' Signed-off-by: Gaurav Kohli <gaurav.kohli@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-22-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/of: Support cooling device ID in cooling-specDaniel Lezcano
Extend the cooling device specifier parsing to support an optional cooling device identifier (cdev_id). Two formats are now supported: - Legacy format: <&cdev lower upper> - Indexed format: <&cdev cdev_id lower upper> When the indexed format is used, both the device node and the cdev_id must match in order to bind a cooling device to a thermal zone. The legacy format continues to match on the device node only, preserving backward compatibility. Update the parsing logic accordingly to handle both formats and extract the mitigation limits from the appropriate arguments. This is a preparatory step for upcoming DT bindings describing cooling devices using (device node, id) tuples instead of child nodes. No functional change for existing device trees. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-21-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/of: Pass cdev_id and introduce devm registration helperDaniel Lezcano
Extend the OF cooling device registration to support an explicit cooling device identifier (cdev_id), preparing for upcoming DT bindings where cooling devices are identified by a tuple (device node, id) instead of relying on child nodes. Introduce a new helper: devm_thermal_of_cooling_device_register() which registers a cooling device using the device's of_node and an explicit cdev_id. This complements the existing devm_thermal_of_child_cooling_device_register() helper, which remains dedicated to the legacy child-node based bindings. Internally, factorize the devm registration logic into a common helper to avoid code duplication. Existing users are unaffected, as the child-based helper continues to pass a default cdev_id of 0, preserving current behavior. This change is a preparatory step for supporting indexed cooling devices in thermal OF bindings. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-20-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/of: Add cooling device ID supportDaniel Lezcano
Introduce an identifier (cdev_id) for cooling devices registered from device tree. This prepares support for a new DT binding where cooling devices are identified by a tuple (device node, ID), instead of relying on child nodes. Existing users are updated to pass a default ID of 0, preserving the current behavior. Future changes will extend the cooling map parsing to match cooling devices based on both the device node and the ID. No functional change intended. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-19-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/of: Rename the devm_thermal_of_cooling_device_register() functionDaniel Lezcano
To clarify that the function operates on child nodes, rename: devm_thermal_of_cooling_device_register() | v devm_thermal_of_child_cooling_device_register() Used the command: find . -type f -name '*.[ch]' -exec \ sed -i 's/devm_thermal_of_cooling_device_register/\ devm_thermal_of_child_cooling_device_register/g' {} \; Did not used clang-format-diff because it does not indent correctly and checkpatch complained. Manually reindented to make checkpatch happy This prepares for upcoming support of cooling devices identified by an ID rather than device tree child nodes. No functional change. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-18-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/core: Make cooling device OF node conditional on CONFIG_THERMAL_OFDaniel Lezcano
The device node pointer stored in struct thermal_cooling_device is only used by the OF-specific thermal code to associate cooling devices with thermal zones defined in device tree. Now that OF and non-OF registration paths are separated and non-OF users no longer rely on devm_thermal_of_cooling_device_register() with a NULL device node, the np field is no longer required for non-OF configurations. Make this field conditional on CONFIG_THERMAL_OF to reduce memory footprint and better reflect its usage. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Link: https://patch.msgid.link/20260526140802.1059293-16-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/of: Move cooling device OF helpers out of thermal coreDaniel Lezcano
The functions: - thermal_of_cooling_device_register() - devm_thermal_of_cooling_device_register() are specific to device tree usage but are currently implemented in thermal_core.c. Move them to thermal_of.c to better reflect the separation between generic thermal core code and OF-specific logic. This change is enabled by the recent split of the cooling device registration into allocation and addition phases, allowing OF-specific handling (such as device node assignment) to be isolated from the core. No functional change intended. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-17-daniel.lezcano@oss.qualcomm.com
2026-06-03hwmon: Use non-OF thermal cooling device registration APIDaniel Lezcano
Some HWMON drivers register cooling devices using the OF helper devm_thermal_of_cooling_device_register() with a NULL device node. With the introduction of a dedicated non-OF registration API, switch these users to devm_thermal_cooling_device_register() to make the intent explicit and avoid relying on OF-specific helpers. This is a pure refactoring with no functional change. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Guenter Roeck <linux@roeck-us.net> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-15-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/core: Add devm_thermal_cooling_device_register()Daniel Lezcano
Introduce a device-managed variant of the non-OF cooling device registration API. This complements devm_thermal_of_cooling_device_register() and allows non-device-tree users to register cooling devices with automatic cleanup tied to the device lifecycle. The helper relies on devm_add_action_or_reset() to release the cooling device via thermal_cooling_device_release() on driver detach or probe failure. This keeps the API consistent across OF and non-OF users and avoids manual cleanup in error paths. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-14-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/core: Introduce non-OF thermal_cooling_device_register()Daniel Lezcano
Split the cooling device registration API into OF and non-OF variants. Introduce thermal_cooling_device_register() for non-device-tree users and rework thermal_of_cooling_device_register() to use the new alloc/add split. This removes the need for the internal __thermal_cooling_device_register() helper and makes the separation between OF and non-OF users explicit. Signed-off-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Link: https://patch.msgid.link/20260526140802.1059293-13-daniel.lezcano@oss.qualcomm.com
2026-06-03thermal/drivers/samsung: Enable TMU by defaultKrzysztof Kozlowski
The SoC Thermal Management Unit (TMU) is essential for proper operation of the SoCs. Kernel should not ask users choice of drivers when that choice is obvious and known to the developers that answer should be 'yes' or 'module'. Impact of making it default: 1. arm64 defconfig: No changes, already present in defconfig. 2. arm32: No changes, the driver is already selected by MACH_EXYNOS. 3. COMPILE_TEST builds: enable by default for arm32 or arm64 builds, whenever ARCH_EXYNOS is selected. This has impact on build time and feels logical, because if one selects ARCH_EXYNOS then probably by default wants to build test it entirely. Kernels with COMPILE_TEST are not supposed to be used for booting. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Link: https://patch.msgid.link/20260526135312.8697-2-krzysztof.kozlowski@oss.qualcomm.com
2026-06-03thermal/driver/qoriq: Workaround unexpected temperature readings from tmuJacky Bai
Invalid temperature measurements may be observed across the temperature range specified in the device data sheet. The invalid temperature can be read from any remote site and from any capture or report registers. The invalid change in temperature can be positive or negative and the resulting temperature can be outside the calibrated range, in which case the TSR[ORL] or TSR[ORH] bit will be set. Workaround: Use the raising/falling edge threshold to filter out the invalid temp. Check the TIDR register to make sure no jump happens When reading the temp. i.MX93 ERR052243: (https://www.nxp.com/webapp/Download?colCode=IMX93_2P87F&appType=license) Signed-off-by: Jacky Bai <ping.bai@nxp.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Link: https://patch.msgid.link/20260430-imx93_tmu-v6-3-485459d7b54f@nxp.com
2026-06-03thermal/drivers/qoriq: Add i.MX93 tmu supportJacky Bai
For Thermal monitor unit(TMU) used on i.MX93, the HW revision info read from the ID register is the same the one used on some of the QorIQ platform, but the config has some slight differance. Add i.MX93 compatible string and corresponding code for it. Signed-off-by: Alice Guo <alice.guo@nxp.com> Signed-off-by: Jacky Bai <ping.bai@nxp.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260430-imx93_tmu-v6-2-485459d7b54f@nxp.com
2026-06-03dt-bindings: thermal: qoriq: Add compatible string for imx93Jacky Bai
Add i.MX93 compatible string 'fsl,imx93-tmu' because Thermal monitor unit(TMU) on i.MX93 has differences with QorIQ platform and not fully compatible with existing Platform, such as fsl,qoriq-tmu. Signed-off-by: Jacky Bai <ping.bai@nxp.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://patch.msgid.link/20260430-imx93_tmu-v6-1-485459d7b54f@nxp.com
2026-06-03thermal/drivers/spacemit/k1: Add thermal sensor supportShuwei Wu
The thermal sensor on K1 supports monitoring five temperature zones. The driver registers these sensors with the thermal framework and supports standard operations: - Reading temperature (millidegree Celsius) - Setting high/low thresholds for interrupts Signed-off-by: Shuwei Wu <shuwei.wu@mailbox.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Reviewed-by: Anand Moon <linux.amoon@gmail.com> Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com> Reviewed-by: Yao Zi <me@ziyao.cc> Tested-by: Anand Moon <linux.amoon@gmail.com> Tested-by: Vincent Legoll <legoll@online.fr> # OrangePi-RV2 Tested-by: Gong Shuai <gsh517025@gmail.com> Link: https://patch.msgid.link/20260427-k1-thermal-v5-2-df39187480ed@mailbox.org
2026-06-03dt-bindings: thermal: Add SpacemiT K1 thermal sensorShuwei Wu
Document the SpacemiT K1 Thermal Sensor, which supports monitoring temperatures for five zones: soc, package, gpu, cluster0, and cluster1. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Shuwei Wu <shuwei.wu@mailbox.org> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.or> Link: https://patch.msgid.link/20260427-k1-thermal-v5-1-df39187480ed@mailbox.org
2026-06-03thermal/drivers/imx: Do not split quoted string across linesMayur Kumar
The checkpatch tool warns against splitting quoted strings across multiple lines. Join the dev_info message into a single line to improve the ability to grep for the message in the source. Signed-off-by: Mayur Kumar <kmayur809@gmail.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org> Link: https://patch.msgid.link/20260511174255.215207-1-kmayur809@gmail.com