The main change this time is a cleanup series from Krzysztof Kozlowski
that updates the defconfig files to be more in sync with changes to
the Kconfig files that moved options around or removed the completely.
In addition, a number of drivers get enabled, in order to support
more hardware out of the box, as usual.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmovyaAACgkQmmx57+YA
GNm7uw/+J91Gu+fM30dCblf4j5LgdbZAaMC3JNbVgznHBcBRUQcA/vTgzBZHP9x7
ihDjG+3KDVbJqqzMMIAsXtZzkWJzjQ/zK5qsLSFGeUC8aKtJiHo57kSaZbYrlU+9
UqdB4juV7CtMJwWQHfafm3hEarIvY+vrGGDRicfwDt6DcWAwgFMzkuLxXBdsHj/l
BMMTX+2bn9uIk6GBu+hHJFDP+74wIFVQy3xJzVEA989ETawLP7xyd+2sFKlca2k/
wH76UJF8fxeXdET1sqnhMSnPSGKzbhcnBho8J5MmRUF4mRFikYN8g7io+L7wuGUd
V477v2V+JGruoq19dWo/X2EXQtNE5dk17wqiMPsgEyYds1FRUhFOjnJSrrjEUp+e
vyMx2j0zTnyW/J309aZ8htkkFoW+gUUtEaeAnI0Cm6twTuI4ZyERCrJDGM61bPmi
2MzBvNvd3n94h/vnxGUvIiz0ZLEnzmkhXPWOBi2eG1TuLkZamilwvKUgQM+KKvAN
R/4WP2j9MJ9DQY+rw2n7w6/QEn6EQkcC9rpA3HLFu/o0It1Sfrs4WHlZWrekOBA6
ej/UxsZhQuJg/iHdQkwPVRDGE+NOMvpjLIyiZgWlEFsOiPDIFoV6lWRZzXNvsV79
FUh2A9p5q6Z9ShTPeKw4kEP2r++v2vMokMbtgzbJTAozDzchMTg=
=56zC
-----END PGP SIGNATURE-----
Merge tag 'soc-defconfig-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC defconfig updates from Arnd Bergmann:
"The main change this time is a cleanup series from Krzysztof Kozlowski
that updates the defconfig files to be more in sync with changes to
the Kconfig files that moved options around or removed the completely.
In addition, a number of drivers get enabled, in order to support more
hardware out of the box, as usual"
* tag 'soc-defconfig-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
arm64: defconfig: enable BST SDHCI controller
arm64: configs: Update defconfig for AST2700 platform support
ARM: multi_v7_defconfig: Enable dma-buf heaps
ARM: configs: Drop duplicated CONFIG_EXT4_FS
arm64: defconfig: Enable DP83822 PHY driver
ARM: configs: at91: sama7: add sama7d65 i3c-hci
arm64: defconfig: Enable PCI M.2 power sequencing driver
arm64: defconfig: Enable CIX Sky1 pinctrl, PCIe host, and Cadence GPIO
ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD
ARM: multi_v7_defconfig: Cleanup redundant options
ARM: configs: Drop redundant SND_ATMEL_SOC
ARM: configs: Drop redundant I2C_DESIGNWARE_PLATFORM
ARM: multi_v7_defconfig: Move entries to match savedefconfig
arm64: defconfig: Switch Ethernet drivers to modules
arm64: defconfig: Drop unused Ethernet vendors
arm64: defconfig: Drop default or selected drivers
arm64: defconfig: Drop unused legacy netfilter options
arm64: defconfig: Move entries to match savedefconfig
pinctrl: qcom: Make important drivers default (2)
There are a few added drivers, but mostly the normal maintenance to drivers
for firmware, memory controller and other soc specific hadware:
- The NXP QuickEngine gets modern MSI support, which allows some cleanups to
the GICv3 irqchip chip driver
- A new SoC specific driver for the Renesas R-Car MFIS unit is added,
encapsulating support for the on-chip mailbox and hwspinlock
implementations that are not easily separated into individual
drivers
- The Qualcomm SoC drivers add support for additional SoC implementations,
and flexiblity around power managedment for the serial-engine driver
as well as probing the LLCC driver using custom hardware descriptions
inside of the device itself.
- Added support for the Samsung thermal management unit
- A cleanup to the Tegra 'PMC' driver interfaces to remove legacy
APIs and allow multiple PMC instances everywhere.
- Updates to the TI SCI and KNAS drivers to improve suspend/resume
support.
- Minor driver changes for mediatek, xilinx, allwinner, aspeed, tegra,
broadcom, amd, microchip and starfive specific drivers
- Memory controller updates for Tegra and Renesas for additional SoC
types and other improvements.
- Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces,
to update driver probing, object lifetimes and address minor bugs.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmow8HMACgkQmmx57+YA
GNmV4A//WYorQo+qes020w70BAc67/CCVsYpDLDz0mWD5G/uQoQkmyqJTA/b2VnM
iBzrxJ5lGRP7xkhfDVCfb3wsMNsJV9X4QRLGB13XkXA/vRMZxBd3xKV0K/CWUJYo
0YJV/BeFDonhbIjTyeZ0ddUvkdOtqn7tua+YiVpRLL4lqV0JzwzQ1mrqKuJ1EFk0
LWw/oLf+xhcY9X6lae0kranLcR6wauGVu9FLXu2nMtGnn1ErkUfywmd8C1mZ8yLk
QCEjSNdvjXQKSAFhNhAcNPxEDFqvNqKQEXfa62i3m8rM8mX1/ZJUd49NCEQaOnXm
ZbeZVHLATf8ut6WKvAwOdtcmvY2HAvBy9xyU7mdiYw3+3hDHQWU068bqYcEbfY6O
04vhYjnvYnYCZNifH3MvsdMteILN5Eja+dNq7Li2LbnMqbSUHr4gJm0nQcbvsbs0
x42GsuqtmPy1PL4/9hlwN/eDj+Bce4O2x1ZXl8VoChGRUD1JJXzr4NGDumBv03hA
eqja4VdMWb9Z/w7y6nlXkx48DibpBJJCgotbYl6DSfJjfGX+jnYrHHcZg5BCIvUc
X1Fy6236sWBQsj1crNcm2QZ2JWJE28HRYcDq3JGDDGvWkcrkB4c1H0N/rIkO4H5F
nTW5LgJDTd/KEzq3WOKN+gcHoLjXWl0wKJpb4WQ7sdvcYUTdHx8=
=27+M
-----END PGP SIGNATURE-----
Merge tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC driver updates from Arnd Bergmann:
"There are a few added drivers, but mostly the normal maintenance to
drivers for firmware, memory controller and other soc specific
hardware:
- The NXP QuickEngine gets modern MSI support, which allows some
cleanups to the GICv3 irqchip chip driver
- A new SoC specific driver for the Renesas R-Car MFIS unit is added,
encapsulating support for the on-chip mailbox and hwspinlock
implementations that are not easily separated into individual
drivers
- The Qualcomm SoC drivers add support for additional SoC
implementations, and flexibility around power management for the
serial-engine driver as well as probing the LLCC driver using
custom hardware descriptions inside of the device itself.
- Added support for the Samsung thermal management unit
- A cleanup to the Tegra 'PMC' driver interfaces to remove legacy
APIs and allow multiple PMC instances everywhere.
- Updates to the TI SCI and KNAS drivers to improve suspend/resume
support.
- Minor driver changes for mediatek, xilinx, allwinner, aspeed,
tegra, broadcom, amd, microchip and starfive specific drivers
- Memory controller updates for Tegra and Renesas for additional SoC
types and other improvements.
- Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces, to
update driver probing, object lifetimes and address minor bugs"
* tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (189 commits)
Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface"
Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers"
memory: tegra234: drop dead NULL check in tegra234_mc_icc_aggregate()
memory: tegra264: drop redundant tegra264_mc_icc_aggregate()
memory: tegra186-emc: stop borrowing MC aggregate hook for EMC
soc: aspeed: cleanup dead default for ASPEED_SOCINFO
firmware: tegra: bpmp: Add support for multi-socket platforms
firmware: tegra: bpmp: Propagate debugfs errors
soc/tegra: pmc: Add Tegra238 support
soc/tegra: pmc: Restrict power-off handler to Nexus 7
soc/tegra: pmc: Populate powergate debugfs only when needed
soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard
soc/tegra: pmc: Remove unused legacy functions
soc/tegra: pmc: Create PMC context dynamically
firmware: samsung: acpm: remove compile-testing stubs
firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper
firmware: samsung: acpm: Add TMU protocol support
firmware: samsung: acpm: Make acpm_ops const and access via pointer
firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members
firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr
...
There are fewer devicetree updates this time that the last few ones, with
five SoC types getting added:
- Qualcomm Dragonwing IPQ9650 is a new wireless networking SoC using
four Cortex-A55 and one Cortex-A78 core, which is a significant
upgrade from older generations
- ZTE zx297520v3 is an older low-end wireless SoC using a single
Cortex-A53 core, which so far can only run 32-bit kernels. This brings
back the ZX family of chips that was removed in 2021 after support
for the original zx296702 and zx296718 chips was never completed.
- Renesas R-Car M3Le (R8A779MD) is a variant of the R-Car M3-N (R8A77965)
automotive SoC.
- Apple t8122 (M3) is the 2023 generation of their laptop SoCs,
which has now been reverse-engineered to the point of having initial
kernel support for five laptop models.
- ASPEED AST27xx is their first baseboard managment controller using
a 64-bit core, the Cortex-A35, following earlier generations using
ARMv5/v6/v7 CPUs.
These all come with one or more initial boards, and in total there
are 39 new boards getting added across SoC families, including:
- Two NAS boxes using the old Cortina Systems Gemini SoC based on
an ARMv4 FA526 CPU core
- 18 industrial embedded boards using NXP i.MX6/8/9 and LX2160A
SoCs from Variscite, Toradex and SolidRun, plus a number of
overlays for combinations with additional boards
- One new carrier board and SoM using TI K3 AM62x, in addition to
new overlays for older SoMs
- Two new boards using Spacemit K3 (no relation with TI) RISC-V
SoCs.
- Three phones from Google, Nothing and Motorola, all using Qualcomm
Snapdragon SoCs
- AST26xx BMC support for two server boards
While there is still a significant number of patches improving hardware
support for the existing boards across vendors (NXP, Qualcomm, Renesas,
Rockchips, Mediatek, ...), a much smaller number of cleanups and warning
fixes have made it in this time.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmovyQ0ACgkQmmx57+YA
GNmE2hAAk4UguDtXr6fCYcIiBGqEtKhPmuvD98edmRyemg1x3ZbHIZn52rUqKFoz
HDi1BL7NkKdDuIWJ5DvqyHGLMg6kCEbiYSsjdkjN2Hcsx+I8NtokCR0hRtteNPQ9
f6kgDj9+VsWvXTsYKFU87qkK1bC5nVrLS7xxIuuCIYxULvSEX5GGJbHQ93qxNUam
6GrFcDHnozh9OfETSBw9bME16FiMxapgghPxMaAmVzuB+iGr4xyrEHmyu9gThsuJ
O2P04LIhu9j9CZOjaJ54+v41AtMIVE7xG1+MUC5JcWBc7OMVLE30uGgsW9jBKaii
Wsxa3D08+m1JYeFbhJR6tWAf4HbIEpudEoJmlSdwRhvYte15kU90f917aTNFYBow
sBf6G09t4ZLsDr9NzCx+cWUnoVLdlYv4auRGNxoWsxe4ed9G6c+yiZN2pBaFNXuT
wNJqrFstS9mszBaPItgt4e5Tck+IB0uKNqhbSWa3rFyKrXQ9SpZOKVN6cPlwFjhT
wWYZcAzUL8n2Sz71l/U/QqjN6hqnZWFghe9B3wr81/XQ4sPjWHWoTeRfnees+vFM
LtE77TGPW2KdZpRI38qfyKWWH3PwKaTtZ07ne8NOvh60zmhK+uUFGzzWAhKlO/Z2
a3tX8evXRTOb5NrvWzGlwpPwtE0R71oRIwxG1MlmFdlJzddI4Xc=
=EhYX
-----END PGP SIGNATURE-----
Merge tag 'soc-dt-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC devicetree updates from Arnd Bergmann:
"There are fewer devicetree updates this time that the last few ones,
with five SoC types getting added:
- Qualcomm Dragonwing IPQ9650 is a new wireless networking SoC using
four Cortex-A55 and one Cortex-A78 core, which is a significant
upgrade from older generations
- ZTE zx297520v3 is an older low-end wireless SoC using a single
Cortex-A53 core, which so far can only run 32-bit kernels. This
brings back the ZX family of chips that was removed in 2021 after
support for the original zx296702 and zx296718 chips was never
completed.
- Renesas R-Car M3Le (R8A779MD) is a variant of the R-Car M3-N
(R8A77965) automotive SoC.
- Apple t8122 (M3) is the 2023 generation of their laptop SoCs, which
has now been reverse-engineered to the point of having initial
kernel support for five laptop models.
- ASPEED AST27xx is their first baseboard managment controller using
a 64-bit core, the Cortex-A35, following earlier generations using
ARMv5/v6/v7 CPUs.
These all come with one or more initial boards, and in total there are
39 new boards getting added across SoC families, including:
- Two NAS boxes using the old Cortina Systems Gemini SoC based on an
ARMv4 FA526 CPU core
- 18 industrial embedded boards using NXP i.MX6/8/9 and LX2160A SoCs
from Variscite, Toradex and SolidRun, plus a number of overlays for
combinations with additional boards
- One new carrier board and SoM using TI K3 AM62x, in addition to new
overlays for older SoMs
- Two new boards using Spacemit K3 (no relation with TI) RISC-V SoCs.
- Three phones from Google, Nothing and Motorola, all using Qualcomm
Snapdragon SoCs
- AST26xx BMC support for two server boards
While there is still a significant number of patches improving
hardware support for the existing boards across vendors (NXP,
Qualcomm, Renesas, Rockchips, Mediatek, ...), a much smaller number
of cleanups and warning fixes have made it in this time"
* tag 'soc-dt-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (665 commits)
arm64: dts: aspeed: Fix duplicate pinctrl labels and address scheme
arm64: dts: bst: enable eMMC controller in C1200
dt-bindings: display/lvds-codec: add ti,sn65lvds93
arm64: dts: allwinner: a523: Add missing GPIO interrupt
arm64: dts: lx2160a-rev2: avoid 32-bit pcie window system ram overlap
arm64: dts: aspeed: Add initial AST27xx SoC device tree
arm64: Kconfig: Add ASPEED SoC family Kconfig support
dt-bindings: arm: aspeed: Add AST2700 board compatible
arm64: dts: allwinner: a523: add gpadc node
arm64: dts: allwinner: Add EL2 virtual timer interrupt
ARM: dts: sun8i: a83t: Add MIPI CSI-2 controller node
dt-bindings: media: sun6i-a31-isp: Add optional interconnect properties
dt-bindings: media: sun6i-a31-csi: Add optional interconnect properties
arm64: dts: imx{91,93}-phyboard-segin: Add peb-av-18 overlays
arm64: dts: imx93-var-som-symphony: enable ADC
arm64: dts: imx93-var-som-symphony: enable TPM3 PWM
arm64: dts: imx93-var-som-symphony: keep RGB_SEL low
arm64: dts: imx93-var-som-symphony: enable UART7
arm64: dts: imx93-var-som-symphony: add TPM support
arm64: dts: imx91-var-som-symphony: fix RGB_SEL handling
...
The need_freq_update flag makes sugov_should_update_freq() return true
regardless of the rate_limit_us throttling, and is cleared in
sugov_update_next_freq(). sugov_update_single_freq() and
sugov_update_shared() go through that helper, so the flag does not
persist there.
However, sugov_update_single_perf(), used by drivers implementing the
.adjust_perf() callback (e.g. intel_pstate or amd-pstate in passive
mode) calls cpufreq_driver_adjust_perf() directly and never goes through
sugov_update_next_freq(), so the need_freq_update flag is not cleared in
that path.
Before commit 75da043d8f ("cpufreq/sched: Set need_freq_update in
ignore_dl_rate_limit()"), this was effectively harmless because
sugov_should_update_freq() still honored the rate limit even when
need_freq_update was set. After that change, the flag forces
sugov_should_update_freq() to always return true, so once set, it
stays effective indefinitely on the .adjust_perf() path.
As a result, cpufreq_driver_adjust_perf() gets called on every scheduler
utilization update (with the runqueue lock held) rather than being
throttled by rate_limit_us, even if the driver itself may skip redundant
hardware updates.
Clear need_freq_update at the end of the adjust_perf path as well.
Fixes: 75da043d8f ("cpufreq/sched: Set need_freq_update in ignore_dl_rate_limit()")
Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Reviewed-by: Hongyan Xia <hongyan.xia@transsion.com>
Reviewed-by: Christian Loehle <christian.loehle@arm.com>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Subject and changelog edits ]
Link: https://patch.msgid.link/20260616154733.2405236-1-zhongqiu.han@oss.qualcomm.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Use an additional label so that a bit of exception handling can be better
reused at the end of this function implementation.
This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
It was overlooked to call ida_free() after a failed nfs_alloc_iostats() call.
Thus add the missed function call in an if branch.
Fixes: 1c7251187d ("NFS: add superblock sysfs entries")
Cc: stable@vger.kernel.org
Reported-by: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
Closes: https://lore.kernel.org/linux-nfs/1c8e10c9-def7-4f0d-8aa1-23c8035a38c8@wanadoo.fr/
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
I have been working on KVM/arm64 for a couple of years, mostly on
pKVM, and am currently upstreaming protected guest support, with more
to come later. I already review KVM/arm64 patches more broadly, and
am happy to continue doing so in an official capacity.
Add myself to the KVM/arm64 reviewer list.
Signed-off-by: Fuad Tabba <tabba@google.com>
Acked-by: Oliver Upton <oupton@kernel.org>
Link: https://patch.msgid.link/20260617131237.2842619-1-tabba@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
kvm_check_illegal_exception_return() sourced the flags {N,Z,C,V} and
masks {D,A,I,F} of the resulting PSTATE from the current PSTATE, but
R_VWJHB takes them from the SPSR being returned to and leaves
PSTATE.{EL,SP,nRW} (and EXLOCK when FEAT_GCS) unchanged. PAN, ALLINT
and PM were not applied at all.
Build the PSTATE by taking those fields from the SPSR while preserving
EL, SP, nRW and EXLOCK from the current PSTATE, then set IL.
Fixes: 47f3a2fc76 ("KVM: arm64: nv: Support virtual EL2 exceptions")
Suggested-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/all/86wlvxs5r0.wl-maz@kernel.org/
Signed-off-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260617144907.2972095-1-tabba@google.com
[maz: tidied things a bit]
Signed-off-by: Marc Zyngier <maz@kernel.org>
A comment in kernel/time/hrtimer.c incorrectly refers to
CONFIG_NOHZ_COMMON instead of CONFIG_NO_HZ_COMMON. Correct it.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260609034314.25029-1-enelsonmoore@gmail.com
update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with
u64 nsecs = rlim_new * NSEC_PER_SEC;
On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC
(1000000000L) are 32-bit, so the multiplication is performed in unsigned
long and truncated for rlim_new > 4 seconds before being widened to u64.
The same file already casts to u64 for the matching computation in
check_process_timers():
u64 softns = (u64)soft * NSEC_PER_SEC;
As a result, the truncated value is installed into the CPUCLOCK_PROF
expiry cache (nextevt), causing the process CPU timer to be programmed
to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The
actual SIGXCPU/SIGKILL decision in check_process_timers() already casts
to u64 and is therefore correct, so limit enforcement is not broken;
only the expiry-cache programming is wrong. Apply the same cast here so
both paths convert rlim_cur identically.
64-bit kernels are unaffected.
Fixes: 858cf3a8c5 ("timers/itimer: Convert internal cputime_t units to nsec")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616112017.1681372-1-zhanxusheng@xiaomi.com
Commit f24df84cbe ("time/jiffies: Register jiffies clocksource before
usage") moved the jiffies clocksource registration into
clocksource_default_clock(), so that it is registered lazily on the first
call. __clocksource_register() acquires clocksource_mutex, but the first
caller is timekeeping_init(), which invokes clocksource_default_clock()
while holding tk_core.lock, a raw spinlock.
Acquiring a sleeping mutex while holding a raw spinlock is invalid.
The default clocksource only has to be registered before
tk_setup_internals() consumes its mult/shift/maxadj. Neither
clocksource_default_clock(), the ->enable() callback, nor the registration
itself need tk_core.lock, so fetch and enable the clock before acquiring
the lock. This preserves the "register before usage" ordering while
keeping clocksource_mutex out of the raw spinlock section.
clocksource_default_clock() has a second caller,
clocksource_done_booting(), which invokes it with clocksource_mutex already
held. That path avoids a recursive lock because timekeeping_init() has
already run and set cs_jiffies_registered, so the registration is skipped
there. This change does not alter that; it only fixes the invalid wait
context in timekeeping_init().
Fixes: f24df84cbe ("time/jiffies: Register jiffies clocksource before usage")
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reported-by: Breno Leitao <leitao@debian.org>
Reported-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616070914.65818-1-mikhail.v.gavrilov@gmail.com
Multiple runtime tests in RTLA rely on the get_workload_pids() shell
helper function to get the PIDs of both kernel and user workloads.
On some systems (e.g. Fedora 43), pgrep matches kernel thread names
including square brackets: "[osnoise/0]"; on other systems (e.g.
RHEL 9.8), brackets are not included: "osnoise/0".
Accept both as valid workload PIDs rather that just the non-bracket form
to make the tests work on all systems.
Fixes: a98dad63cd ("rtla/tests: Add runtime test for -k and -u options")
Reported-by: Crystal Wood <crwood@redhat.com>
Link: https://lore.kernel.org/r/20260604140547.3616495-1-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
.gitignore includes several entries prone to unwanted matches in
subdirectories. One of them, the recently added "lib/", matches the
recently added directory "tests/scripts/lib/" in addition to the
intended top-level "lib/", which contains object files built from
sources in tools/lib.
Add "/" to all .gitignore entries that are intended to only match
top-level files or directories: rtla, rtla_static, unit_tests,
libsubcmd/.
Remove .gitignore entries that are not needed at all:
- lib/ (contains only object files, ignored by top-level .gitignore
already).
- .txt rtla output files added to .gitignore in commit 02689ae385
("rtla: Add generated output files to gitignore"). Since commit
ad5b50a095 ("rtla/tests: Run runtime tests in temporary directory"),
those are created in a temporary directory, not in tools/tracing/rtla.
Keeping libsubcmd/ as that contains other generated files (headers,
archives, etc.).
Fixes: 48209d763c ("rtla: Add libsubcmd dependency")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202605291919.eszupseg-lkp@intel.com/
Closes: https://lore.kernel.org/oe-kbuild-all/202605300436.PqQ0Bc8q-lkp@intel.com/
Link: https://lore.kernel.org/r/20260601091835.3118094-1-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
We do unneeded "double free" (emptying an empty list) in one case.
This is not a critical issue at all, the fix just makes code robust
against any possible future changes in the flow.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260617092406.2649384-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This patch adjusts several default settings to ensure
the speaker protection function can be enabled safely.
Signed-off-by: Shuming Fan <shumingf@realtek.com>
Link: https://patch.msgid.link/20260615091012.718168-1-shumingf@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The datasheet documents that when the PLL is disabled and dual-rate mode
is enabled, only Q values {4, 8, 9, 12, 16} are valid for the CLKDIV
bypass path; all other Q values produce invalid bitclock output.
The existing loop iterates Q from 2 to 17 without this restriction,
causing silent audio failure when an out-of-spec Q is picked.
Restrict the Q search to the allowed set in dual-rate mode.
Fixes: 4f9c16ccfa ("[ALSA] soc - tlv320aic3x - revisit clock setup")
Suggested-by: Mir Jeffres <m-jeffres@ti.com>
Signed-off-by: Sen Wang <sen@ti.com>
Link: https://patch.msgid.link/20260616233322.873081-1-sen@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This reverts commit f7fe9f7073 ("ASoC: rockchip: rockchip_sai: Use
guard() for spin locks").
This is very noisy pointless churn that was not tested by the submitter,
nor was it addressed to the driver's maintainer. It mixes unrelated
whitespace changes (eliminating the blank line between the includes -
why?) with hard to review diffs that add a whole indentation level to
the function for no benefit, while also not following kernel code style
by doing stuff like "ret == 0".
The driver is better off without these changes, and they're not worth
the time to validate whether they really do make no functional changes.
Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Link: https://patch.msgid.link/20260617-sai-revert-v1-1-e46adda2213b@collabora.com
Signed-off-by: Mark Brown <broonie@kernel.org>
When a driver specifies a beneficial order, TTM should make a reasonable
effort to allocate pages at that order.
Use __GFP_RETRY_MAYFAIL instead of __GFP_NORETRY when allocating at the
beneficial order. This allows reclaim to try harder before falling back to
smaller orders, at the cost of longer allocation setup time.
That tradeoff is acceptable for beneficial-order allocations: higher-order
backing pages can improve TLB hit rates and reduce the number of TLB
invalidations needed when moving memory.
Cc: Christian Koenig <christian.koenig@amd.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patch.msgid.link/20260617022248.1165101-1-matthew.brost@intel.com
The GspHal trait methods boot() and post_boot() accept a long list of
individual parameters (dev, bar, chipset, gsp_falcon, sec2_falcon) that
are threaded through the entire GSP boot call chain. This makes the
signatures unwieldy and difficult to extend as new boot-time context
(e.g. vGPU state) is introduced.
Introduce a GspBootContext struct that bundles the common boot
parameters into a single object, and refactor the GspHal trait to accept
&GspBootContext instead of individual arguments. The struct also exposes
a dev() helper with proper lifetime annotation so that HAL
implementations can extract the device reference without reborrowing
constraints.
Update both TU102 and GH100 HAL implementations to extract their
required parameters from the context struct, and simplify the call sites
in Gsp::boot() accordingly.
Signed-off-by: Zhi Wang <zhiw@nvidia.com>
Link: https://patch.msgid.link/20260604114339.1565660-7-zhiw@nvidia.com
[acourbot: pass `GspBootContext` by value to `Gsp::boot`.]
[acourbot: deconstruct `GspBootContext` in `Gsp::boot` to simplify diff.]
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
When q6apm_free_fragments() is called it frees rx_data.buf/tx_data.buf
and sets them to NULL under graph->lock. A late DSP buffer-done response
can race with this: graph_callback() passes the !graph->ar_graph guard
(not yet NULL), acquires the lock, but then dereferences a now-NULL buf
pointer to read buf[token].phys, crashing at virtual address 0x10.
Add a NULL check for buf inside the mutex-protected section in both the
write-done (DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2) and
read-done (DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2) handlers and bail
out cleanly if buffers have already been freed.
This problem is only shown up recently while apr bus was updated to
process the commands per service rather from single global queue.
Fixes: 5477518b8a ("ASoC: qdsp6: audioreach: add q6apm support")
Cc: Stable@vger.kernel.org
Assisted-by: Claude:claude-4-6-sonnet
Reported-by: Val Packett <val@packett.cool>
Closes: https://lore.kernel.org/all/133ced18-1aa9-475d-80d8-6120678bdde4@packett.cool/
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260616170257.9381-1-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The DC_STATE_EN register has read-only status bits that are set by
hardware on some platforms. These bits may cause the read-back
verification loop in gen9_write_dc_state() to spuriously retry.
Mask the RO bits from the read-back comparison to prevent
unnecessary retries.
Changes in v2:
- Rename patch from
"drm/i915/display: Use rmw in gen9_write_dc_state() to preserve non-DC
bits"
to
"drm/i915/display: Mask RO bits in gen9_write_dc_state()"
- Mask only RO bits rather than masking all non DC state bits
in DC_STATE_EN. As the register has also some clear-on-write flags,
like 'Display DC*CO State Status DSI'(Imre Deak)
Changes in v3:
- Limit ro mask to read-back comparison.
Changes in v4:
- Add bit definitions (Jani Nikula)
BSpec: 49437,69115
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Imre Deak <imre.deak@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260605155359.4116572-1-dibin.moolakadan.subrahmanian@intel.com
Enable DC3CO mask in get_allowed_dc_mask().
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-17-dibin.moolakadan.subrahmanian@intel.com
Check if DC3CO is allowed before calling CMTG
functions in intel_atomic_commit_tail() as CMTG is only used
by DC3CO DC state.
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-16-dibin.moolakadan.subrahmanian@intel.com
Expose DC3CO count and residency for xe3lp platforms via debugfs.
Changes in v2:
- Keep dc5_reg register initialization to avoid any
invalid access (sashiko)
Changes in v3:
- Change XE3P_DMC_DC3CO_COUNT address to lower case (Manna Animesh).
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-15-dibin.moolakadan.subrahmanian@intel.com
When pKVM injects a synchronous exception into a protected guest, it
re-enters without restoring the guest's EL1 sysregs and writes the EL1
exception registers to hardware by hand: ESR_EL1 and ELR_EL1, but not
SPSR_EL1. enter_exception64() sets SPSR_EL1 (the interrupted PSTATE)
only in memory, so the guest's handler reads a stale SPSR_EL1 and
restores the wrong PSTATE on eret.
Write SPSR_EL1 alongside the other exception registers.
Fixes: 6c30bfb18d ("KVM: arm64: Add handlers for protected VM System Registers")
Reported-by: sashiko <sashiko@sashiko.dev>
Signed-off-by: Fuad Tabba <tabba@google.com>
Acked-by: Will Deacon <will@kernel.org>
Link: https://patch.msgid.link/20260612113414.1022901-1-tabba@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Add xe3lpd_enable_dc_count() to enable the DC_COUNT_EN register.
Also define DC_STATE_DC3CO_RESIDENCY to read DC3CO residency.
Needed to retrieve DC residency for DC3CO.
v2:
- Add a guard to xe3lpd_enable_dc_count() instead of relying
on caller. [Animesh]
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-14-dibin.moolakadan.subrahmanian@intel.com
For DC3CO, idle_frames is programmed to 0, so PSR does not
enter deep sleep. Add delayed work to schedule DC3CO exit
after an idle duration derived from frame time (minimum
equivalent of 6 frames).
The work is re-armed from the PSR flush path on relevant frontbuffer
activity. Once the display remains idle, DC3CO is disabled, idle frames
are reprogrammed to their normal value, and DC6 is enabled to allow
deeper power savings.
Changes in v2:
- Squash "PSR set idle frames while exit from DC3CO"
into this patch (Uma Shankar)
- Add cancel_delayed_work() in intel_psr_disable_locked()
before clearing dc3co_eligible (Uma Shankar)
Changes in v3:
- Re-arm cancelled DC3CO work in psr resume
- Schedule DC3CO work from intel_psr_post_plane_update(). This is to
make sure DC3CO work scheduling will happen even without psr flush,
which may be a valid scenario.
Changes in v4:
- Remove unused function parameter enum fb_op_origin origin
that is never used in the function body. (Animesh)
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-13-dibin.moolakadan.subrahmanian@intel.com
Add PR_ALPM_CTL_USE_DC3CO_IDLE_PROTOCOL bit definition and set it
when DC3CO is allowed.
Changes in v2:
- Squash "Define DC3CO idle protocol bit in PR_ALPM_CTL"
into this patch (Uma Shankar)
- Use intel_display_power_dc3co_allowed(display)
instead of intel_dc3co_allowed(state)
Changes in v3:
- check only intel_display_power_dc3co_allowed()
before wiriting PR_ALPM_CTL_USE_DC3CO_IDLE_PROTOCOL (Jani Nikula)
BSpec: 75253
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-12-dibin.moolakadan.subrahmanian@intel.com
Force idle_frames to 0 when DC3CO is eligible.
Changes in v2:
- Extend existing Wa_16025596647 condition
instead of adding a new if block (Uma Shankar)
BSpec: 75253
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-11-dibin.moolakadan.subrahmanian@intel.com
Store DC3CO eligibility in intel_dp->psr during
intel_psr_post_plane_update() so PSR configuration
can take DC3CO into account.
This will be used to control PSR2 parameters such as idle frames.
Changes in v2:
- Use intel_display_power_dc3co_allowed(display) instead
of intel_dc3co_allowed(state)
Changes in v3:
- Update psr.dc3co_eligible before
intel_psr_enable_locked() call (sashiko)
Changes in v4:
- rename eligible to allowed (Jani Nikula)
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-10-dibin.moolakadan.subrahmanian@intel.com
Compute if dc3co is allowed in intel_atomic_commit_tail()
based on pipe/port constraints and runtime triggers and store
result in display->power.dc3co.
When DC3CO can be enabled, request DC_STATE_EN_UPTO_DC3CO and
reduce the DC entry delay. Otherwise, retain the existing
delay and set default DC_STATE_EN_UPTO_DC6.
Changes in v2:
- Move DC3CO compute logic from intel_atomic_check()
to intel_atomic_commit_tail as it is not advisable to
change persistent state in atomic check (Jani Nikula)
- Add psr2 deep sleep check in dc3co compute.
- Move allowed computation logic inside dc3co update (Jani Nikula).
- Add dc3co support check in dc3co allowed function (Jani Nikula)
- Move all dc3co functions to intel_display_power.c and
rename functions accordingly (Jani Nikula)
- Clean up dc3co/dc6 power async delay in
intel_atomic_commit_tail() (Jani Nikula)
Changes in v3:
- Remove debug print from intel_display_power_dc3co_update()
BSpec: 75253
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-9-dibin.moolakadan.subrahmanian@intel.com
Add intel_psr2_in_deep_sleep() to check whether PSR2 is currently in
DEEP_SLEEP state. Will be used in subsequent patches.
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-8-dibin.moolakadan.subrahmanian@intel.com
Add intel_display_power_dc3co_supported() helper to query DC3CO
support from allowed_dc_mask.
Changes in v2:
- Add HAS_DC3CO() check to intel_display_power_dc3co_supported().
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-7-dibin.moolakadan.subrahmanian@intel.com
Add HAS_DC3CO() to identify platforms supporting DC3CO.
DC3CO is supported from display version 35 onwards.
BSpec: 75253
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-6-dibin.moolakadan.subrahmanian@intel.com
Add DC3CO handling to the dc_off power well sequencing and disable the
DMC wakelock when exiting DC3CO.
Changes in v2:
- Call assert_can_enable_dc3co() before dc3co enable (Manna Animesh)
BSpec: 75253
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-5-dibin.moolakadan.subrahmanian@intel.com
Replace open-coded shifts with REG_GENMASK() and REG_FIELD_PREP()
for the DC state enable field.
Suggested-by: Jani Nikula <jani.nikula@linux.intel.com>
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-4-dibin.moolakadan.subrahmanian@intel.com
On platforms prior to xe3, DC3CO was controlled via a standalone enable
bit. Starting with xe3, DC3CO is encoded as part of the existing
DC_STATE_EN_UPTO_DC* field.
No functional change, as DC3CO is not enabled on platforms prior to xe3.
Changes in v2:
- Update commit header (Uma Shankar)
Changes in v3:
- Update bit mask to reflect DC3CO (Manna Animesh)
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-3-dibin.moolakadan.subrahmanian@intel.com
Remove all Tiger Lake DC3CO-related functions from intel_psr.c and
intel_display_power_well.c, as the feature is not enabled and not used.
Also remove the TGL/DG1 DC3CO count debugfs entry from intel_dmc.c,
as DC3CO is not active on those platforms. A new debugfs entry for
Xe3LP will be added in a subsequent patch.
Remove the unused dc3co_exitline field from struct intel_psr and
struct intel_crtc_state, along with the corresponding EXITLINE register
read in intel_psr_get_config().
Changes in v2:
- Squash "Remove unused PSR dc3co_exitline field" and
"Remove unused dc3co_exitline from crtc_state" into this patch
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Reviewed-by: Animesh Manna <animesh.manna@intel.com>
Signed-off-by: Animesh Manna <animesh.manna@intel.com>
Link: https://patch.msgid.link/20260616162154.2630995-2-dibin.moolakadan.subrahmanian@intel.com
Add documentation for the Foundation Security Processor (FSP) interface
covering the simplified Hopper/Blackwell boot flow, the Chain of Trust
(COT) message protocol, the MCTP/NVDM message format, and the Product
Reconfiguration Control (PRC) protocol used to query device configuration
knobs such as vGPU mode.
Signed-off-by: Zhi Wang <zhiw@nvidia.com>
Link: https://patch.msgid.link/20260604114339.1565660-6-zhiw@nvidia.com
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
dso__get_filename() sets errno to a negative custom DSO_LOAD_ERRNO
value when kernel module decompression fails:
errno = *dso__load_errno(dso); /* e.g. -9996 */
The caller __open_dso() then computes fd = -errno, producing a large
positive value (9996) that looks like a valid file descriptor. This
can cause close_data_fd() to close an unrelated fd used by another
subsystem.
Set errno to EIO instead. The detailed error code is already stored
in dso__load_errno(dso) for diagnostic messages.
Fixes: 1d6b3c9ba7 ("perf tools: Decompress kernel module when reading DSO data")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Several functions cast bpf_prog_info fields (jited_ksyms,
jited_func_lens, jited_prog_insns) from u64 to pointers and
dereference them. These fields are only valid pointers if
bpil_offs_to_addr() converted their file offsets to addresses, which
only happens when the corresponding PERF_BPIL_* bits are set in
info_linear->arrays.
A crafted perf.data can leave these bits unset while setting non-zero
counts and offset values, causing the functions to dereference raw file
offsets as pointers.
Add array bitmask validation to all perf.data processing paths:
- __bpf_event__print_bpf_prog_info(): check JITED_KSYMS and
JITED_FUNC_LENS (changed to take struct perf_bpil *)
- machine__process_bpf_event_load(): check JITED_KSYMS
- bpf_read(): check JITED_INSNS before memcpy from jited_prog_insns
- dso__disassemble_filename(): check JITED_INSNS before returning
jited_prog_insns pointer
Fixes: f8dfeae009 ("perf bpf: Show more BPF program info in print_bpf_prog_info()")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
c2c_he_free() calls hists__delete_entries() which only walks the
output-sorted entries tree. During c2c resort, when cacheline entries
are merged and the redundant entry is freed, the inner hists have not
been output-resorted yet, so hists->entries is empty. The actual inner
hist_entry objects live in entries_in_array[] and entries_collapsed,
which are never walked, leaking all inner hist_entry objects for every
merged cacheline.
Additionally, the dynamically allocated format entries on hists->list
are never unregistered or freed.
Fix both issues by switching to hists__delete_all_entries() which walks
all rb_root trees, and calling perf_hpp__reset_output_field() to clean
up format entries.
Fixes: bf0e0d407ea09ce5 ("perf c2c report: Add sample processing")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
When c2c_hists__init() fails partway through hpp_list__parse(),
dynamically allocated format structures that were already added to
hists->list are leaked because he__get_c2c_hists() frees the hists
container without first unregistering the format entries.
Call perf_hpp__reset_output_field() before freeing the hists container
on the error path, matching what c2c_he_free() already does on the
normal destruction path.
Fixes: 17a7c5946d79a12c ("perf c2c report: Decode c2c_stats for hist entries")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
cs_etm__get_queue() indexes etm->queues.queue_array[cpu] without
validating that cpu is within nr_queues. When processing
AUX_OUTPUT_HW_ID events, the cpu value comes from untrusted perf.data
trace payload and flows through cs_etm__process_trace_id_v0_1() and
cs_etm__queue_aux_fragment() without bounds checking, allowing an
out-of-bounds read with a crafted file.
Add a bounds check in cs_etm__get_queue() and NULL checks in all
callers.
Also add NULL checks for queue_array[i].priv in the queue iteration
loops in cs_etm__map_trace_id_v0() and cs_etm__process_trace_id_v0_1()
— after auxtrace_queues__grow() new entries are zero-initialized so
.priv can be NULL. Add a get_cpu_data() NULL check in
cs_etm__process_trace_id_v0_1(), matching the existing check in
cs_etm__process_trace_id_v0().
Fixes: 77c123f53e ("perf: cs-etm: Move traceid_list to each queue")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: James Clark <james.clark@arm.com>
Cc: Leo Yan <leo.yan@linaro.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
cs_etm__process_auxtrace_info() checks that header.size covers
event_header_size + INFO_HEADER_SIZE (16 bytes total), but then
accesses ptr[CS_PMU_TYPE_CPUS] at offset 24 from the start of the
event. A crafted 16-byte auxtrace_info event passes the size check
but reads out-of-bounds.
Include CS_ETM_HEADER_SIZE in the minimum size check so that the
global header entries (version, pmu_type_cpus, snapshot) are
guaranteed to fit within the event.
Fixes: 55c1de9973 ("perf cs-etm: Print auxtrace info even if OpenCSD isn't linked")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: James Clark <james.clark@arm.com>
Cc: Leo Yan <leo.yan@linaro.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
cs_etm__process_auxtrace_info_full() reads num_cpu from untrusted
perf.data and uses it to allocate the metadata pointer array:
metadata = zalloc(sizeof(*metadata) * num_cpu);
On 32-bit, sizeof(*metadata) is 4, so num_cpu = 0x40000000 overflows
the multiplication to 0, causing zalloc(0) to return a valid zero-sized
allocation followed by out-of-bounds writes in the population loop.
Fix by computing priv_size early and using it to bound num_cpu: each
CPU needs at least one u64 metadata entry, so num_cpu cannot exceed
the total number of u64 entries in the event's private data area.
Fixes: cd8bfd8c97 ("perf tools: Add processing of coresight metadata")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: James Clark <james.clark@arm.com>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Tor Jeremiassen <tor@ti.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
machines__findnew() and machines__create_guest_kernel_maps() use
sprintf() to build paths by prepending symbol_conf.guestmount.
Both write into PATH_MAX stack buffers, but guestmount comes from
user configuration and is not length-checked. A guestmount path
at or near PATH_MAX causes a stack buffer overflow.
Switch to snprintf() with sizeof() to prevent overflow. The
subsequent access()/fopen() calls will fail on a truncated path.
Fixes: a1645ce12a ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
machine__init() always returns 0 even when memory allocation fails,
because commit 81f981d7ec ("perf machine: Free root_dir in
machine__init() error path") introduced 'int err = -ENOMEM' and an
error cleanup path but left the final 'return 0' instead of
'return err'.
Fix by returning err, check the return value in __machine__new_host()
which was ignoring it, and change machines__init() from void to int so
it too can propagate the error to perf_session__new(), aslr_tool__init()
and test callers.
The error cleanup also used zfree(&machine->kmaps), but kmaps is a
refcounted maps structure — use maps__zput() to properly drop the
reference, matching machine__exit().
Move dsos__init() and threads__init() before the first fallible
allocation (maps__new) so that machine__exit() is safe to call on
any machine struct that machine__init() touched, even on early failure.
Fixes: 81f981d7ec ("perf machine: Free root_dir in machine__init() error path")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
kvm_inject_el2_exception() writes ESR_EL2 for synchronous exceptions
but not for SError. enter_exception64() does not write ESR_ELx for any
exception type, so the constructed syndrome is dropped. A guest L2
hypervisor taking a nested SError observes stale ESR_EL2.
This affects both kvm_inject_nested_serror() and the EASE path in
kvm_inject_nested_sea().
Write ESR_EL2 for except_type_serror, matching except_type_sync.
Fixes: 77ee70a073 ("KVM: arm64: nv: Honor SError exception routing / masking")
Reported-by: sashiko <sashiko@sashiko.dev>
Signed-off-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260615131116.390977-1-tabba@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmowqboUHHBhdWxAcGF1
bC1tb29yZS5jb20ACgkQ6iDy2pc3iXOVWhAAurksqggNN38womlfvPEVsKshcmYL
2AyOkw8v7SzUUugAmDPFgcEv38MY8/7BJm0J2h39FAu2UDXVwBt1v3xBVMr95AMU
NrS6/z9UWwsJabGPs8L8rqISKMJBqbhZKye7zMSSAqNDZhmqGsGORoTz03t0vhyc
/6fS3TsEbdiFHQ/VKR3mItlIdEU6NO5n3AsTzuvP5xc8vZ1xpQcsXkitKR/86HMW
v9KZqSGpdauZ4QP/NlLLRz99nFaxSUkzrFGj22g1hukwsyKwRe31sbUkLU5c4f9a
EBFI18i2SQ0VTPkpJlo/tIrdJrUDDNTLE69zSXnvdHRZJ4/ZZ08Vw1AifUwA8r+R
oNNzkTDcZn7DtRD8Usk7keFOaQmboFI3rx+NdvA6Sw26076ao2Xx3MTrsEm4lnC8
Q9l406M93sFM1DREnPyFSETdohsAVzAnwwCe/R62xpfnZgIiYTjbWFvYRoMjjrkA
1fC0YgAXcYia8p53tBeKGypC4z3LK3PMgB9O5bxKOI0q8EViISdKfqcj9B+Dlm7P
grCe/RETTAznm+MP11MucO4eh1E4ckBH+tPLNhDMJrC7cVMbh2I1uVoUjXkPiaG2
PILKWCMuc1mO4hXlo5ro+yEvYzmd9qdq/VFXOzCNXw+4KAsmQPrktpz+YMo/Lb8E
pAKr83vdLfw+bVU=
=d85R
-----END PGP SIGNATURE-----
Merge tag 'audit-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
Pull audit updates from Paul Moore:
- Fix a recursive deadlock when duplicating executable file rules
Avoid multiple lookups and attempted I_MUTEX_PARENT locks when moving
watched files by passing the already resolved inodes through the
audit code.
- Fix removal of executable watch rules after the file is deleted
Prior to this fix we were unable to remove an executable file watch
where the file had been previously deleted due to a negative dentry
check in the code that performs the lookup on the file watches.
- Convert our basic "unsigned" type usage to "unsigned int".
* tag 'audit-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: fix recursive locking deadlock in audit_dupe_exe()
audit: fix removal of dangling executable rules
audit: use 'unsigned int' instead of 'unsigned'
