mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,482,544 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Rodrigo Vivi
|
b2e3ca048a |
Merge drm/drm-next into drm-intel-next
Upcoming Intel display patches need DRM_COLOROP_FIXED_MATRIX present in drm-next. Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> |
||
Dave Airlie
|
14d6074f52 |
drm-misc-next for v7.4:
Cross-subsystem Changes: firmware: - sysfb: Remove obsolete quirk for Lenovo D330 sound: - ti/omap: Fix build error Core Changes: edid: - support detecting panel size from EDID Driver Changes: amd: - display: Drop obsolete KUnit tests bridge: - analogix: Support eDP lane mapping - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84 - minor cleanups gma500: - avoid unsupported ARGB formats in primary plane hibmc: - handle vblank interrupts correctly sysfb: - fix panel orientation for non-native display modes -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmqiuEwbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3ojc3QH/i6mT0PkZYmKYAqD+N2s w9uYlOWieQX8OCsojmUXbXRWLo/x8ftflNw57RCoDfmVviEgOFoMXuSBOwR0jHlM tCSTBi3EWFa2vqGBFP6jtaqyMJgXz9kQpKJkndiVZur1ATlGt4ADcDVwzgEbYRro c7cSpkKdchePycemBUmjCtPsl852+85Vv/1HcMqAOMeWxKAEnxMShURvmjbwWFt3 u3ivX6j62a5krZsYkhzyF2kRC4dTyDSN0inb4rbymIK4qNqfaVhHeJLpYKZTzaE0 cnyD6hU84GhT2HQr47as57r6bx/lsbaauwbqm6KjsyyuUedXk1eDkWApeBvACXN/ 4Rg= =C6Sc -----END PGP SIGNATURE----- Merge tag 'drm-misc-next-2026-09-10' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.4: Cross-subsystem Changes: firmware: - sysfb: Remove obsolete quirk for Lenovo D330 sound: - ti/omap: Fix build error Core Changes: edid: - support detecting panel size from EDID Driver Changes: amd: - display: Drop obsolete KUnit tests bridge: - analogix: Support eDP lane mapping - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84 - minor cleanups gma500: - avoid unsupported ARGB formats in primary plane hibmc: - handle vblank interrupts correctly sysfb: - fix panel orientation for non-native display modes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260910140343.GA404885@linux.fritz.box |
||
Thomas Zimmermann
|
75ee88dae8 |
drm/sysfb: Use preferred panel size for panel orientation quirks
Sysfb drivers currently use the given display mode for looking up the panel orientation. But the look-up table stores the native geometry of the panels, so the lookup fails if the current mode sizes differs. Get the panel's native geometry with drm_edid_detect_panel_size() from the EDID and use it for looking up the panel orientation. v2: - ofdrm: validate EDID header before using it (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Acked-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260904090850.43060-4-tzimmermann@suse.de |
||
|
Thomas Zimmermann
|
394d0759b1 |
drm/edid: Add drm_edid_detect_panel_size()
Add drm_edid_detect_panel_size() to extract the panel's preferred display resolution from a given EDID. Required for setting up DRM's panel orientation quirks in sysfb drivers. v4: - fix test for EDID PTD (Jani) v3: - mention use case in documentation (Jani) - use is_detailed_timing_descriptor() (Jani) - rename helper to drm_edid_detect_panel_size() v2: - handle EDID without pixel timing descriptor (Sashiko) - fix checks for width and height pointers Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260904090850.43060-3-tzimmermann@suse.de |
||
|
Thomas Zimmermann
|
9f8bf739ed |
firmware/sysfb: Remove rotation quirk for Lenovo D330
The Lenovo D330 is a notebook with detachable display. The display is installed in landscape orientation, but the display mode is in portrait orientation. By default, the display output is rotated to the left by 90°. The sysfb quirk breaks the display by swapping display width and height; and thus mixing up the display geometry. Fix this by keeping the display as-is. The sysfb DRM drivers, usually efidrm, will pick the correct panel orientation for the display. The exact behavior might depend on the version of the BIOS release, but the exact version numbers of broken and good releases are unknown. Users are advised to update to the latest firmware. Tested on a Lenovo D330-10IGM IdeaPad with firmware 8NCN43WW. v3: - mention possible dependency on BIOS release in commit description Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260904090850.43060-2-tzimmermann@suse.de |
||
Ville Syrjälä
|
3aef9c94c0 |
drm/i915: Perform full wedge on display reset
We lost the proper display reset deadlock handling in commit |
||
Luca Coelho
|
fe05cb9b9f |
drm/i915/display: check configuration index before shifting
The calc_allowed_config_filter() function passes the return value of
iter_pos_to_idx() directly to BIT(), but the helper can return -1 for
an invalid iterator.
The iterator already rejects negative indices before doing a
configuration, so this should not matter in normal flows. In any
case, for robustness, check the index explicitly and warn if it is
negative, avoiding an undefined shift.
Fixes:
|
||
Uma Shankar
|
9ed39b7d74 |
drm/i915/display: Gate periodic AS SDP skip frames behind a debugfs knob
Periodic AS SDP (skip frames) drives a Panel Replay panel down toward its minimum refresh rate. It is a new, panel- and platform-sensitive behaviour, so keep it opt-in rather than enabling it unconditionally. Expose it as a per-device debugfs knob, enable_periodic_assdp, rather than a module parameter. The behaviour is panel-specific, so the correct granularity is per-device, not per-module. The knob is added through the intel_display_params infrastructure (shared by i915 and xe) with a debugfs entry only. It defaults to false (feature disabled); write 1 to the debugfs file to enable periodic AS SDP at runtime. Gate the feature at its single choke point, intel_pr_as_sdp_skip_frames(): returning a zero skip count when the knob is off makes both the PR_ALPM_CTL programming (intel_alpm_configure_pr_as_sdp()) and the DC3co force-disable predicate (intel_alpm_pr_as_sdp_skip_frames_enabled()) a no-op, so AS SDP continues to be sent on every frame as before. v2: Switch to debugfs entry and drop module param Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Uma Shankar <uma.shankar@intel.com> Reviewed-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com> Tested-by: Naladala Ramanaidu <ramanaidu.naladala@intel.com> Link: https://patch.msgid.link/20260909080810.2202879-5-uma.shankar@intel.com |
||
|
Uma Shankar
|
eddf77ff1a |
drm/i915/display: Reprogram AS SDP skip frames on seamless VRR transitions
The AS SDP skip-frame count is written to PR_ALPM_CTL only from lnl_alpm_configure(), which runs from intel_psr_enable_locked() on a Panel Replay disabled->enabled transition. VRR, however, can be enabled and disabled seamlessly - without a modeset and without cycling Panel Replay (intel_crtc_vrr_enabling()/disabling() in the pipe update path). As a result, when a panel comes up with VRR off the non-zero skip count is programmed, and when VRR is later turned on seamlessly PR stays enabled, lnl_alpm_configure() is not re-invoked, and the stale skip count is left in the register. This also leaves the coupled AS SDP transmission / DC3CO idle-protocol bits inconsistent with the DC3co state, which is recomputed on every commit. Factor the PR_ALPM_CTL AS SDP programming out of lnl_alpm_configure() into intel_alpm_configure_pr_as_sdp() and expose intel_alpm_pr_as_sdp_update(), which recomputes those fields for the current VRR state. Call it from the seamless VRR enable and disable sites (non-modeset only; a modeset re-runs PR enable anyway) so the skip counter always matches whether VRR is actively driving the refresh rate. v2: Fixed Sashiko review comments Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Uma Shankar <uma.shankar@intel.com> Reviewed-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com> Tested-by: Naladala Ramanaidu <ramanaidu.naladala@intel.com> Link: https://patch.msgid.link/20260909080810.2202879-4-uma.shankar@intel.com |
||
|
Uma Shankar
|
dc0fd724e1 |
drm/i915/display: Force disable DC3co when AS SDP skip frames is enabled
Periodic AS SDP (skip frames) relies on the AS SDP still being transmitted while Panel Replay is active. DC3co uses the idle protocol which suppresses AS SDP transmission entirely, so the two are mutually exclusive: leaving DC3co enabled while skip frames is programmed breaks the periodic AS SDP and the panel never sees the slower refresh. Add intel_alpm_pr_as_sdp_skip_frames_enabled() as the single predicate for "skip frames will be programmed" (mirroring the gating in lnl_alpm_configure(), including that it only applies when VRR is not active) and use it in intel_display_power_dc3co_compute() to force the DC3co trigger to NONE. This drops the pipe onto the DC_STATE_EN_UPTO_DC6 target instead of DC3co whenever skip frames is active, without touching the DC state module parameter or the allowed DC mask, and only for the skip-frame case. v2: Fixed Sashiko review findings Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Uma Shankar <uma.shankar@intel.com> Reviewed-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com> Tested-by: Naladala Ramanaidu <ramanaidu.naladala@intel.com> Link: https://patch.msgid.link/20260909080810.2202879-3-uma.shankar@intel.com |
||
|
Uma Shankar
|
8dbe5c47ca |
drm/i915/display: Enable periodic AS SDP skip frames
When Panel Replay is active the transcoder timing generator runs at the panel's maximum refresh rate. To drive the panel down to its minimum refresh rate the Adaptive-Sync SDP (AS SDP) only needs to reach the panel once per minimum-rate frame, so transmitting it on every (maximum-rate) frame is redundant and shows up as repeated SDPs on the link. Xe3p_LPD adds a HW skip-frame counter in PR_ALPM_CTL that lets the source send a single AS SDP and then suppress it for a programmed number of frames. Program this counter so that one AS SDP is followed by (max_vrefresh / min_vrefresh - 1) idle frames, i.e. one AS SDP per slowest panel frame, allowing the link to be driven down to as low as 1Hz when the hardware supports it. The maximum and minimum refresh rates come from the panel's adaptive-sync monitor range, so the skip count is a function of the sink's capabilities and independent of the current content/flip rate. If the panel does not advertise a usable range the skip counter is left at zero, i.e. the feature is a no-op and AS SDP continues to be sent on every frame. Periodic AS SDP drives the panel down to its minimum refresh rate on its own, so it is only programmed when VRR is not actively driving the refresh rate. The skip-frame mechanism relies on the AS SDP still being transmitted (just less often) while Panel Replay is active, so when a non-zero skip-frame count is programmed both PR_ALPM_CTL_AS_SDP_TRANSMISSION_IN_ACTIVE_DISABLE and PR_ALPM_CTL_USE_DC3CO_IDLE_PROTOCOL are left cleared. The previous behaviour (honouring disable_as_sdp_when_pr_active and the DC3CO idle protocol) is retained for the non skip-frame case. v3: Fixed Sashiko review findings v2: Decoupled CMMRR dependency and using sink refresh rate range for skip frame claculations. This addresses Dibin's review feedback as well. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Uma Shankar <uma.shankar@intel.com> Reviewed-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com> Tested-by: Naladala Ramanaidu <ramanaidu.naladala@intel.com> Link: https://patch.msgid.link/20260909080810.2202879-2-uma.shankar@intel.com |
||
|
Thomas Zimmermann
|
225635a3f4 |
drm/hibmc: Set up vblank event to be send on the next vblank
Do not send the vblank event when the page flip completes, but when the vblank interrupt fires. Sending the vblank event at the wrong time can break synchronization of the display update with the vblank period. Use the vblank helper drm_crtc_vblank_atomic_flush(), which sets up the vblank event accordingly. In case of an error, it still sends out the vblank event immediately; thus not starving consumers. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Yongbang Shi <shiyongbang@huawei.com> Link: https://patch.msgid.link/20260827082915.61176-3-tzimmermann@suse.de |
||
|
Thomas Zimmermann
|
6ddd3164f6 |
drm/hibmc: Return IRQ_NONE for unhandled interrupts
Let the kernel know if hibmc did not handle an interrupt. Allows the kernel to detect spurious interrupts and maintain diagnostics. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Yongbang Shi <shiyongbang@huawei.com> Link: https://patch.msgid.link/20260827082915.61176-2-tzimmermann@suse.de |
||
Esben Haabendal
|
0878e6053d |
drm/bridge: ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
Add support for using SN65DSI84 in single-link mode with output to LVDS Channel B. Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Esben Haabendal <esben@geanix.com> Link: https://patch.msgid.link/20260831-ti-sn65dsi83-fixes-v5-2-e712765d6c4f@geanix.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> |
||
Thorsten Blum
|
9977e9d84f |
drm/i915: Fix memory leak in query_perf_config_list()
When krealloc() fails, free the original oa_config_ids before returning
to avoid a memory leak.
Fixes:
|
||
Damon Ding
|
bf63a72ea0 |
drm/bridge: analogix_dp: Add support for optional data-lanes mapping
Parse the optional 'data-lanes' device tree property to support custom physical lane mapping configuration. If no valid configuration is found, fall back to the default lane map (0, 1, 2, 3) automatically and keep the driver running. Lane mapping is mainly used for below scenarios: 1. Correct PCB lane swap and differential line routing crossover without hardware changes; 2. Adapt mismatched lane pin definitions between SoC and eDP panel; 3. Support multiple panel hardware variants on the same board by configuring data-lanes in device tree only. Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260828065153.590802-6-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> |
||
|
Damon Ding
|
4ff2f941b7 |
drm/bridge: analogix_dp: Add validation for samsung,lane-count property
Add validity check for samsung,lane-count to ensure DT-provided lane count values are specification-compliant. Suggested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Link: https://patch.msgid.link/20260828065153.590802-5-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> |
||
|
Damon Ding
|
02f569dd66 |
drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties
Revert the change that made samsung,link-rate and samsung,lane-count
optional for Exynos DP. Add error checking to fail probe early if the
required DT properties are missing.
If these properties are missing, video_info->max_link_rate and
video_info->max_lane_count remain zero, and so do link_train.link_rate
and link_train.lane_count used in the subsequent link training flow,
resulting in link training failure.
There is no way at all a device can work without these properties.
Here is the code flow when either max_link_rate or max_lane_count is 0:
analogix_dp_commit()
-> analogix_dp_full_link_train(dp, max_lanes = 0, max_rate = 0)
analogix_dp_full_link_train(max_lanes, max_rate):
// Read sink capabilities via DPCD and sanitize them
link_rate = read_dpcd(DP_MAX_LINK_RATE); // >= 0x06 after fixup
lane_count = read_dpcd(DP_MAX_LANE_COUNT); // >= 1 after fixup
// Clamp by the limits from DT
if (link_rate > max_rate) // 0x06 > 0, always true
link_rate = max_rate; // link_rate = 0
if (lane_count > max_lanes) // 1 > 0, always true
lane_count = max_lanes; // lane_count = 0
// Configure TX with the zeroed values
set_link_bandwidth(link_rate = 0)
// writel() is only executed for bwtype == 0x06/0x0a,
// so LINK_BW_SET is never written and stays at
// reset value; phy_configure() gets link_rate = 0.
set_lane_count(lane_count = 0)
// writel(0, ANALOGIX_DP_LANE_COUNT_SET) enables 0 lanes;
// phy_configure() is called with lanes = 0.
// Program sink for link training
drm_dp_dpcd_write(DP_LINK_BW_SET, {link_rate = 0/lane_count = 0})
// DP spec requires link rate in {0x06, 0x0a, 0x14} and
// lane count in {1, 2, 4}. Writing zeros is illegal, so
// the sink cannot enter the training state.
// Training loop
for (lane = 0; lane < lane_count /* 0 */; lane++)
// loop body never executes; training_lane[] stays
// uninitialized and no training register is programmed
Since the sanitized sink values are always non-zero (link_rate >= 0x06,
lane_count >= 1), the clamping with a zero maximum unconditionally
forces the training parameters to zero. Clock recovery can never be
achieved, so link training fails deterministically.
Consequently, making these properties mandatory again cannot break
any existing device: a DT without them could never have worked in
the first place. Failing probe early with a clear error message is
more helpful than a silent link training failure at runtime.
Fixes:
|
||
|
Damon Ding
|
6eac4c8bb1 |
drm/dp: Add helper to validate DP lane counts
Add a generic helper function drm_dp_lane_count_is_valid() to check if a DisplayPort lane count is valid. According to the DP specification, only 1, 2, or 4 lanes are supported. This helper avoids duplicating DP lane count validation logic across individual DisplayPort drivers. Suggested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Link: https://patch.msgid.link/20260828065153.590802-3-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> |
||
|
Damon Ding
|
af9b0fc070 |
dt-bindings: display: bridge: analogix-dp: Add data-lanes support for endpoint
Add data-lanes property support to the port@1 endpoint for physical lane mapping configuration. Lane mapping is mainly used for below scenarios: 1. Correct PCB lane swap and differential line routing crossover without hardware changes; 2. Adapt mismatched lane pin definitions between SoC and eDP panel; 3. Support multiple panel hardware variants on the same board by configuring data-lanes in device tree only. Additionally, add data-lanes setting in Rockchip eDP DT node example to show actual lane mapping usage. Acked-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Link: https://patch.msgid.link/20260828065153.590802-2-damon.ding@rock-chips.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> |
||
Shixiong Ou
|
8ce26b09f6 |
drm/gma500: Create the primary plane in the driver
drm_crtc_init() creates the primary plane from a fixed format list
that includes ARGB8888. The display engine programs the primary plane
with DISPPLANE_32BPP_NO_ALPHA, so it does not support per-pixel alpha
and must not advertise alpha formats. Since commit
|
||
Krzysztof Kozlowski
|
dfd2bd7af6 |
drm/bridge: lontium: Drop redundant vendor prefix from I2C device name
Device names for i2c_device_id are not OF compatibles and have a meaning only for in-tree users (which there are no except the driver itself), thus vendor prefix in this name is completely redundant. It is actually a discouraged pattern because for OF platforms it allows matching driver by I2C bus, instead of OF, thus hiding incomplete way of obtaining driver match data (lack of i2c_get_match_data() usage). Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260825143921.512966-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> |
||
|
Rodrigo Vivi
|
730c6d8072 |
drm/amd/display: Drop KUnit tests for removed parse_hdmi_amd_vsdb()
parse_hdmi_amd_vsdb() was removed when HDMI FreeSync detection moved to
the common EDID parser, but its declaration and KUnit tests remained,
breaking modpost:
ERROR: modpost: "parse_hdmi_amd_vsdb" [...connector_test.ko] undefined!
Remove the stale declaration and the three dead test cases.
Fixes:
|
||
|
Dave Airlie
|
f5c6fdfa1f |
Xe related:
- Some clean-ups around drm/xe/display (Jani) Display in general: - Regular clean-ups (Jani) - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path (Mitul) - Switch DG2 Multi-protocol PLL (MPLLB) to the DPLL framework (Mika) - DP-HDMI PCON DSC fixes (Ankit) - Remove duplicated call introduced by a bad cherry-pick (Chaitanya) - Limit invalid joiner combinations harder (Jani) - Fix value being written to DDI_CLK_VALFREQ (Suraj) - Harden some bit-shifting operations (Luca) - Clear SEL_FETCH_PLANE_CTL on plane disable (Nemesa) - Update CURSOR_BUF/WM masks (Suraj) - CDCLK related fixes and refactor specially around PCODE interaction (Ville) - Reduce clock_gating interface between core and display (Luca) - Gate UHBR SST SDP splitting on sink capability (Mitul) - Enable joiner cursor fast updates (Nemesa) - Cear the Panel Replay error status register (Jake) - Add HDMI TMDS audio bandwidth check (Chaitanya) - Reset use_flipq when duplicating crtc state (Mika) Beyond display: - Guard against NULL driver_data (Deepanshu) - Rename GEN6_PCODE_DATA to match spec (Michal) -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmqZldoACgkQ+mJfZA7r E8qTtAf+Mz398tlW16QLyM99L7OZY/GZhlkPi6SNAP1uk9ykb9Zg3lXJMTofeqG6 0uOhGNO5fSHN2lJo6THpPlpUbYNzkGZP8RXnU8CiAJNW4N/Fyppwe0NlbbDvo5P9 QxfnBA0C+TzIPvS9/t8GAvyyETThRKduTXheQ41XJiwM1ovsAWLfLF0UgA6UX9PV ExAwbtk/ua9SqpUhTBYkq+s66GjqtDPiMaa0G2IStEfvvpbrYGKZ9YcSPF7FvDtL RuzG9iWeX0UDQNZWtI5TEAOYgG5cNpGX+JKRoxqI9TdoVKo/dB/GOO441s/1be0U GrUKI10dZvRgJPsYeglkwZMwZm8nCw== =iQ9F -----END PGP SIGNATURE----- Merge tag 'drm-intel-next-2026-09-03' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Xe related: - Some clean-ups around drm/xe/display (Jani) Display in general: - Regular clean-ups (Jani) - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path (Mitul) - Switch DG2 Multi-protocol PLL (MPLLB) to the DPLL framework (Mika) - DP-HDMI PCON DSC fixes (Ankit) - Remove duplicated call introduced by a bad cherry-pick (Chaitanya) - Limit invalid joiner combinations harder (Jani) - Fix value being written to DDI_CLK_VALFREQ (Suraj) - Harden some bit-shifting operations (Luca) - Clear SEL_FETCH_PLANE_CTL on plane disable (Nemesa) - Update CURSOR_BUF/WM masks (Suraj) - CDCLK related fixes and refactor specially around PCODE interaction (Ville) - Reduce clock_gating interface between core and display (Luca) - Gate UHBR SST SDP splitting on sink capability (Mitul) - Enable joiner cursor fast updates (Nemesa) - Cear the Panel Replay error status register (Jake) - Add HDMI TMDS audio bandwidth check (Chaitanya) - Reset use_flipq when duplicating crtc state (Mika) Beyond display: - Guard against NULL driver_data (Deepanshu) - Rename GEN6_PCODE_DATA to match spec (Michal) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/apmWNIUJ5lmsvNzc@intel.com |
||
|
Dave Airlie
|
483ece619b |
drm-misc-next for v7.4:
UAPI Changes: colorop: - provide DRM_COLOR_OP_FIXED_MATRIX Cross-subsystem Changes: cgroups: - fix typos dma-buf: - fix typos sound: - adapt to changes in omapdrm Core Changes: atomic: - convert most of DRM from state reset callbacks to atomic_create_state - remove drm_simple_encoder_init(); update drivers buddy: - improve dirty-page tracking clients: - log: Improve vmap handling display: - export HDMI SCDC status data via debugfs edid: - parse AMD VSDB entries - parse ALLM/VRR capabilities log: - add drm_warn_ratelimited() sched: - add missing locking Driver Changes: amd: - display: Use AMD VSDB for FreeSync - display: Implement YUV-to-RGB with fixed-matrix colorop amdxdma: - various fixes ast: - support 256-byte EDID data bridge: - clean up redundant error reporting - ti-sn65dsi83: Simplify error condition logic hyperv_drm: - remove support for pre-Win10 hosts komeda: - fix usage of GLB_CORE_ID nouveau: - improve runtime PM on R570 GSP firmware - various fixes throughout the driver - dispnv50: Support 2.147 GHz pixel clock in GB20x omap: - report HDMI hotplug events to ASoC HDMI codec panel: - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions - support Ilitek ILI7836A OLED plus DT bindings - support Novatek NT36532 plus DT bindings - convert several drivers to managed cleanup - fix Kconfig selections panthor: - provide gpu_cache_flush tracepoint - improve dma_fence signalling latency - improve locking qaic: - reject BOs that exceed maximum page count - add missing include statements verisilicon: - fix hardware cursor offsets vkms: - implement YUV-to-RGB with fixed-matrix colorop -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmqZbyAbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3oj0KwIAKhga8cMi+oqZ+WIRq7i MsCI4Tdl3jukry9Yho8BIsaFpknVcYV+v3qNsR1Za0Hcu3Znd4nqL2TOv5piGESB ErUsMkn3OJoMZUuHsCxBUPtxYUhVgWYIFvFx5CXLdKhESeqLtmWsqEDu8QcikiNB Wn6eyYOyuCG5ZD9ZRrWXM7WTIVrsPVar62t8FHdtoVgms9bMxtQadSrFwpmWnESQ +a+O+K7mI6NC2oh/znvVFYmZa9INoKAJf16lPDfL7UC9GTHg52Gu+yZDj2rYkqQK p4k1zpZHU0WyyjKoQxIY9rBQ4BLuzy/JP8ZZQakLOA98mHMM9ZwvftvudH4I5PPK JMg= =4Nm4 -----END PGP SIGNATURE----- Merge tag 'drm-misc-next-2026-09-03' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.4: UAPI Changes: colorop: - provide DRM_COLOR_OP_FIXED_MATRIX Cross-subsystem Changes: cgroups: - fix typos dma-buf: - fix typos sound: - adapt to changes in omapdrm Core Changes: atomic: - convert most of DRM from state reset callbacks to atomic_create_state - remove drm_simple_encoder_init(); update drivers buddy: - improve dirty-page tracking clients: - log: Improve vmap handling display: - export HDMI SCDC status data via debugfs edid: - parse AMD VSDB entries - parse ALLM/VRR capabilities log: - add drm_warn_ratelimited() sched: - add missing locking Driver Changes: amd: - display: Use AMD VSDB for FreeSync - display: Implement YUV-to-RGB with fixed-matrix colorop amdxdma: - various fixes ast: - support 256-byte EDID data bridge: - clean up redundant error reporting - ti-sn65dsi83: Simplify error condition logic hyperv_drm: - remove support for pre-Win10 hosts komeda: - fix usage of GLB_CORE_ID nouveau: - improve runtime PM on R570 GSP firmware - various fixes throughout the driver - dispnv50: Support 2.147 GHz pixel clock in GB20x omap: - report HDMI hotplug events to ASoC HDMI codec panel: - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions - support Ilitek ILI7836A OLED plus DT bindings - support Novatek NT36532 plus DT bindings - convert several drivers to managed cleanup - fix Kconfig selections panthor: - provide gpu_cache_flush tracepoint - improve dma_fence signalling latency - improve locking qaic: - reject BOs that exceed maximum page count - add missing include statements verisilicon: - fix hardware cursor offsets vkms: - implement YUV-to-RGB with fixed-matrix colorop Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260903130548.GA91506@2a02-2455-9062-2500-3419-2212-e55c-8a45.dyn6.pyur.net |
||
Tomi Valkeinen
|
836a0bb73c |
ASoC: ti: omap-hdmi: Fix build error from a merge commit
'ad->card' was removed in commit |
||
Michał Grzelak
|
4bda5543b3 |
drm/i915/bios: remove VS/PE-O warning
There is not much use of warning when port asks to override default VS/PE since it is already logged. Remove drm_WARN() and child_device from print_ddi_port() since drm_WARN() was the only user of it. Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-9-michal.grzelak@intel.com |
||
|
Michał Grzelak
|
7fdf86e530 |
drm/i915: override Combo's VS/PE when requested
Add accessor function for Combo to read requested table from VBT #57. Parse the requested table and transform data into port's buffer. Actual data is fully stored in the lowest byte although each entry is 4 bytes wide. Thus convert u32 into u8 and store the data. For EHL, in cases when eDP encoder uses low vswing, choose 3rd table if encoder supports HBR3. Otherwise use 2nd table for eDP using low vswing. In cases when eDP encoder does not use low vswing, choose 2nd table if encoder supports mode higher or including HBR2. Otherwise use 1st table for eDP not using low vswing. For external DP follow same path and use same indices as in eDP without low vswing case. For JSL, always use 1st table for external DP. For eDPs not using low vswing use 1st table as well. In cases when eDP encoder uses low vswing, choose 1st table if encoder supports HBR3. When encoder supports HBR2 choose 3rd table. When encoder supports modes lower than HBR2 choose 2nd table. There are no changes to intel_ddi_dp_level() since selection of correct row of intel_ddi_buf_trans_entry is same as when no override request has been done. Looking from other OSes, in case when encoder does not support DP we could theoretically use 1st table. However, as of now, use default tables. v11->v12 - don't set vspeo->num_entries per PHY/platform - check for low vswing eDP for EHL (Sashiko) - reverse order of indices for JSL (Sashiko) v10->v11 - initialize local variables at declaration block (Jani) - branch with 'else` instead of initializing twice (Jani) v9->v10 - call dedicated VS/PE-O vfunc - drop deconstifying default tables (Suraj, Jani) - cache `entries` into const field after data is overwritten (Jani) v8->v9 - deconstify intel_ddi_buf_trans_entry v6->v7 - handle VS/PE-O's VBT details in intel_bios_* functions (Jani) - remove vspeo's cast to (void *) (Jani) - call encoder->get_buf_trans() once (Jani) - return NULL from intel_bios_get_* when using default (Jani) - validate VS/PE-O in intel_bios.c (Jani) - check devdata->vspeo if VS/PE-O was requested - inline {jsl,ehl}_combo_get_vspeo_buf_trans() - remove temporarily LT v4->v5 - blend index computation with table parsing - remove enums entirely - add spaces around operators (Suraj) - remove spaces after type casting (Suraj) - remove INTEL_DISPLAY_STATE_WARN (Suraj) Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260907122742.2512901-1-michal.grzelak@intel.com |
||
|
Michał Grzelak
|
e8fe5008ae |
drm/i915: override Snps's VS/PE when requested
Add accessor functions for Snps to read requested table from VBT #57. Parse the requested table and transform data into port's buffer. Actual data is fully stored in the lowest byte although each entry is 4 bytes wide. Thus convert u32 into u8 and store the data. For C20, use 6th table if encoder supports DP 2.0 or higher. Otherwise use 5th table for DP. For C20, tables 1-4 are not used at all and are most likely to be zeroed. 5th table is used for any mode below DP 2.0 (exclusive). 6th table is used for any mode above DP 2.0 (inclusive). For C10, use 2nd table for external DP if encoder supports any mode beyond or including HBR2. Use 1st table if external DP encoder supports anything lower than HBR2. For eDP, use 4th table if encoder supports HBR3. Otherwise use 3rd table for eDP. For C10, 1st table is used for external DP with modes below HBR2 (exclusive). 2nd table is used for external DP with modes higher than HBR2 (inclusive). 3rd table is used for eDP with modes lower than HBR3 (exclusive). 4th table is used for eDP with modes higher than HBR3 (inclusive). Indices for other tables have not yet been observed to be used as of now. There are no changes to intel_ddi_dp_level() since selection of correct row of intel_ddi_buf_trans_entry is same as when no override request has been done. v11->v12 - don't set vspeo->num_entries per PHY - don't refer to 1st table as fallback for non-DP for C10 (Sashiko) v10->v11 - remove no-longer-relevant check for NULL devdata (Jani) - initialize local variables at declaration block (Jani) - branch with 'else` instead of initializing twice (Jani) - use blank line before 'return` (Jani) v9->v10 - call dedicated VS/PE-O vfunc - drop deconstifying default tables (Suraj, Jani) - cache `entries` into const field after data is overwritten (Jani) v8->v9 - init vspeo before using it - deconstify intel_ddi_buf_trans_entry v7->v8 - remove comments (Suraj) - add check for LT (Suraj) v6->v7 - handle VS/PE-O's VBT details in intel_bios_* functions (Jani) - remove vspeo's cast to (void *) (Jani) - check devdata->vspeo if VS/PE-O was requested - call encoder->get_buf_trans() once (Jani) - return NULL from intel_bios_get_* when using default (Jani) - validate VS/PE-O in intel_bios.c (Jani) - inline mtl_{c10,c20}_get_vspeo_buf_trans() - remove temporarily LT v4->v5 - blend index computation with table parsing - remove enums entirely - change funcs prefix from snps_ to mtl_ (Suraj) - add spaces around operators (Suraj) - remove spaces after type casting (Suraj) - remove INTEL_DISPLAY_STATE_WARN (Suraj) v3->v4 - stick to solely changing VBT data into current structures (Jani) - move iterator declaration to declaration block (Suraj) v2->v3 - remove unnecessary braces from if block (Suraj) - return -EINVAL instead of -1 (Suraj) Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-7-michal.grzelak@intel.com |
||
|
Michał Grzelak
|
e084812de9 |
drm/i915/buf_trans: add vfunc for VS/PE-O
Choosing correct table for Vswing / Pre-emphasis Override is platform specific. It also requires different checks that are already used for choosing predefined tables. Add new get_buf_trans_override() vfunc into intel_encoder returning deparsed table from VBT#57. In next patches, set it inside already present if-ladder from intel_ddi_buf_trans_init() instead of duplicating it. Note that get_buf_trans() cannot be overwritten since there are cases when we need to rollback although VS/PE-O was requested, eg. DP is not connected or feature is not yet implemented for the platform. Assume that vfunc returns NULL on rollback and return predefined tables. Suggested-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-6-michal.grzelak@intel.com |
||
|
Michał Grzelak
|
a138a81d78 |
drm/i915/bios: de/allocate VS/PE-O buffers for each port
Every devdata needs VS/PE-O dedicated buffers since each port can
request an override. Add intel_ddi_buf_trans{,_entry} pointers into
intel_bios_encoder_data.
Allocate struct intel_ddi_buf_trans{,_entry} for the port if VS/PE-O was
requested and is supported. Keep NULL in vspeo if any allocation failed
or VS/PE-O was not requested. It will be used later for checking if
override should actually take place.
Note that we theoretically could store intel_ddi_buf_trans_entry inside
`entries` field of newly allocated intel_ddi_buf_trans. However it will
be impossible to overwrite the buffer during intel_ddi_get_buf_trans()
without discarding const qualifier of `entries` field. This would
involve either void casting or deconstifying entries field and in turn
all predefined tables as well. Thus add a separate non-const qualified
field into intel_bios_encoder_data for the buffer, which after
overwriting will be promoted to be const qualified.
Deallocate the buffer as well as entries if requested.
v11->v12
- set vspeo->num_entries once (Sashiko)
- free allocated vspeo->entries (Sashiko)
v9->v10
- add separate non-const field for `entries` caching
- cache `entries` into const field after data is overwritten (Jani)
v4->v5
- set devdata->vspeo->num_entries in intel_bios.c
Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
Acked-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://patch.msgid.link/20260904123148.2165596-5-michal.grzelak@intel.com
|
||
|
Michał Grzelak
|
1b15117625 |
drm/i915/bios: print VS/PE-O port info
Issue a debug message when port asks to override default Vswing / Preemphasis tables. Add helper intel_bios_encoder_requests_vspeo() to check if port requests for overriding default VS/PE tables. v6->v7 - expand VS/PE-O acronym in debug logging (Jani) v3->v4 - change debug message when requesting VS/PE-O (Suraj) Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-4-michal.grzelak@intel.com |
||
|
Michał Grzelak
|
c76c03dab8 |
drm/i915/bios: store VBT #57's metadata in intel_vbt_data
Store tables, number of tables, number of rows and number of columns in intel_vbt_data when search for the VBT #57 has succeeded. Structurize all VS/PE-O relevant metadata inside anonymous struct named as vspeo. Presence of C20 or newer PHY causes each table to contain 16 rows. Each table contains 10 rows in case C20 PHY is absent. Use display version to determine number of rows since there is no helper in intel_bios.c to check presence of any C20+ PHY. pre-MTL platforms should have 10 rows while MTL+ should have 16 rows. v5->v6 - add Bspec (Suraj) v3->v4 - remove unnecessary init of VS/PE-O metadata (Suraj) - add helper for computing number of rows (Suraj) - fix num_rows's type (Jani, Suraj) - declare num_rows (Suraj) Bspec: 68963 Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-3-michal.grzelak@intel.com |
||
|
Michał Grzelak
|
3018008dc1 |
drm/i915/bios: search for VBT #57 by default
Start searching for Vswing / Preemphasis Override Block during VBT parsing at init_bdb_blocks(). Check for failure since pre-ICL GOPs do not contain the block. Check also if VBT version is appropriately up-to-date. v6->v7 - parse VBT#57 before blocks dependent on child device list (Jani) - remove debug message (Suraj) v3->v4 - add Bspec (Suraj) Bspec: 32063 Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260904123148.2165596-2-michal.grzelak@intel.com |
||
|
Dave Airlie
|
94376186f2 |
Merge tag 'drm-xe-next-2026-08-31-1' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next
Cross-subsystem Changes: - MAINTAINERS: Add entries for drm_ras (Rodrigo) - alerts and controller enabling modifications (Heikki) Core Changes: - Introduce cold reset recovery method (Mallesh) - Add drm_ras netlink error event support (Riana) - Introduce error threshold to drm_ras (Raag) Driver Changes: - Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl (Lu) - match argument naming with PCODE_DATAx (Grzelak) - fix stale GGTT mappings on unmap (Tangudu) - Introduce error threshold to drm_ras (Raag) - Add debugfs knob to control GPGPU preemption granularity (Varun) - fix vecs config for powergating info (Ashutosh) - Read mailbox phase bit from hardware (Anoop) - alerts and controller enabling modifications (Heikki) - Use int instead of u32 for mailbox status (Umesh) - Reject page faults from non-fault-mode scratch VMs (Arvind) - Add CCS to the powergating info print (Balasubramani) - Do not apply WA 14025883347 to media 3503 (Daniele) - don't WARN on kernel job timeout when device already wedged (Nitin) - handle exec queue teardown after hot-unplug (Nitin) - Allow debugging PCI errors (Raag) - Add structured SIGID error logging infrastructure (Wajdeczko, Rodrigo) - Enable package and vram temperatures for CRI (Karthik) - Introduce cold reset recovery method (Mallesh) - fix error message in xe_migrate_sanity_test (Dan Carpenter) - Add drm_ras netlink error event support (Riana) - Fix a bug in pc_adjust_freq_bounds() (Vinay) - Fix xe_device_probe() failure (Raag) - Page fault cleanups (Wajdeczko) - OA memory fixes (Linmao) - document sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Move has_drm_ras check to drm_ras layer (Raag) - add termination on resume (Daniele) - Add _locked variants of some config functions (Wajdeczko) - Order ring writes before ring tail updates (Brost) - Parallel page fault handling (Brost) - handle CRI+ power interval encoding (Karthik) - allocate UM queues in a separate UC BO (Jia) - Fix boot-time ras error processing (Raag) - VF migration for multi-queue (Niranjana) - Apply RCS/CCS yield policy to SR-IOV VFs (Marcin) - Fix memory leak in exec_queue_set_hang_replay_state (Winiarski) - Use IBC v3 on PTL (Vinay) - Reduce MERT debug log spam (Lukasz, Piotr) - Validate sysctrl response (Raag) - Changes for Xe3p_HPM media (Ashutosh) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/apYbnrklyk6nNO7Q@gsse-cloud1.jf.intel.com |
||
|
Thomas Zimmermann
|
3ab04dcce4 |
Merge drm/drm-next into drm-misc-next
Backmerging to get drm-misc-next up to v7.3-rc2. Requested for
commit
|
||
Linus Torvalds
|
df2908090c | Linux 7.3-rc2 v7.3-rc2 | ||
|
Linus Torvalds
|
b1e00ffaf9 |
tracing fixes for v7.3:
- Fix several tracefs files that did not take the trace_array reference A trace instance can be created and destroyed in the tracefs "instances" directory via mkdir and rmdir respectively. The instance is represented by a trace_array descriptor. Most tracefs files pass the trace_array as the private data of the inode to the open/read/write functions. Since there is no locking between the time a task opens a file and the deletion of the instance (and the freeing of the trace_array), each open needs to get a reference to the trace_array and each close must remove it. A instance can't be removed if there's any reference taken on its trace_array. The open function uses trace_array_get() that takes a lock (preventing removal of instances) and iterates the list of all existing trace_arrays and if it finds a match, it takes the reference and releases the lock. If it doesn't find a match, it causes the open to return -ENODEV. There were some added files that did not take the trace_array reference on open that needed to be fixed. Sashiko also correctly pointed out that there were some files that took an address of an field or element of the trace_array which had a pointer back to the trace_array to take its reference on open. But this leaves a slight race between referencing this element to get the trace_array as the element itself could be freed. To solve this, some helper functions were created to look for trace_arrays with this field or element in the search so that the element did not have to be dereferenced before the trace_array's reference was taken. - Add a lock around ftrace_ops initialization When a ftrace_ops is first used by ftrace, some internal initialization is performed on the ops. But if multiple tasks were calling functions that did this initialization, it could race and perform doing the initialization more than once, corrupting the internal data. Add a lock in the initialization code to prevent this from happening. - Fix splice reads on mmapped buffers The logic in the ring buffer splice code for mmapped buffers is supposed to do a copy of the memory as the mapped buffers can't be given to splice. But there was an if statement within the copy code that would return a -1 if a request for a full page was done and it wasn't a partial read. This is because this logic was written before mmapped buffers existed and this case didn't make sense at the time. For mmapped buffers it makes perfect sense and by returning early can drop a lot of pages unnecessarily. - Have the persistent ring buffer validation check nr_subbufs Sashiko reported that the validation code was relying on the saved nr_subbufs to match the calculated nr_pages + 1 and if they were off, that the code could cause corruption. Sashiko is correct, and the saved nr_subbufs should be validated before assuming it is correct. - Do not allow more than one instance with the same name on cmdline If an admin were to add more than one trace instances with the same name they all would be created, but only the first one would be accessible via tracefs. This used to not be allowed but some restructuring of code has since made it possible. - Fix the race between subbuf resize and trace_pipe_raw readers If a task was reading trace_pipe_raw while another task was changing the ring buffer subbuf size, it could crash the reader. The trace_pipe_raw readers do get their own copy of the page from the buffer, but the code needs some restructuring to not have the resize of the subbuffers cause issues. - Cap the size of the mapped (static) ring buffer nr_pages The meta data used for ring buffer mapped buffers is 32 bit in size. A normal ring buffer could (in theory) have more than 4 billion pages. But this is not allowed by mapped buffers, so enforce it. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCap3GJRQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qtAfAP9hDPtzctAoz+IHZq+GYejhKTu99ICG vAxTOZivuG6KYAD/UPA4P7z5ayxGM5UlT+2U81+mpCd55F2oFiIxRuFYcwk= =/d+T -----END PGP SIGNATURE----- Merge tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix several tracefs files that did not take the trace_array reference A trace instance can be created and destroyed in the tracefs "instances" directory via mkdir and rmdir respectively. The instance is represented by a trace_array descriptor. Most tracefs files pass the trace_array as the private data of the inode to the open/read/write functions. Since there is no locking between the time a task opens a file and the deletion of the instance (and the freeing of the trace_array), each open needs to get a reference to the trace_array and each close must remove it. An instance can't be removed if there's any reference taken on its trace_array. The open function uses trace_array_get() that takes a lock (preventing removal of instances) and iterates the list of all existing trace_arrays and if it finds a match, it takes the reference and releases the lock. If it doesn't find a match, it causes the open to return -ENODEV. There were some added files that did not take the trace_array reference on open that needed to be fixed. Sashiko also correctly pointed out that there were some files that took an address of an field or element of the trace_array which had a pointer back to the trace_array to take its reference on open. But this leaves a slight race between referencing this element to get the trace_array as the element itself could be freed. To solve this, some helper functions were created to look for trace_arrays with this field or element in the search so that the element did not have to be dereferenced before the trace_array's reference was taken. - Add a lock around ftrace_ops initialization When a ftrace_ops is first used by ftrace, some internal initialization is performed on the ops. But if multiple tasks were calling functions that did this initialization, it could race and perform doing the initialization more than once, corrupting the internal data. Add a lock in the initialization code to prevent this from happening. - Fix splice reads on mmapped buffers The logic in the ring buffer splice code for mmapped buffers is supposed to do a copy of the memory as the mapped buffers can't be given to splice. But there was an if statement within the copy code that would return a -1 if a request for a full page was done and it wasn't a partial read. This is because this logic was written before mmapped buffers existed and this case didn't make sense at the time. For mmapped buffers it makes perfect sense and by returning early can drop a lot of pages unnecessarily. - Have the persistent ring buffer validation check nr_subbufs Sashiko reported that the validation code was relying on the saved nr_subbufs to match the calculated nr_pages + 1 and if they were off, that the code could cause corruption. Sashiko is correct, and the saved nr_subbufs should be validated before assuming it is correct. - Do not allow more than one instance with the same name on cmdline If an admin were to add more than one trace instances with the same name they all would be created, but only the first one would be accessible via tracefs. This used to not be allowed but some restructuring of code has since made it possible. - Fix the race between subbuf resize and trace_pipe_raw readers If a task was reading trace_pipe_raw while another task was changing the ring buffer subbuf size, it could crash the reader. The trace_pipe_raw readers do get their own copy of the page from the buffer, but the code needs some restructuring to not have the resize of the subbuffers cause issues. - Cap the size of the mapped (static) ring buffer nr_pages The meta data used for ring buffer mapped buffers is 32 bit in size. A normal ring buffer could (in theory) have more than 4 billion pages. But this is not allowed by mapped buffers, so enforce it. * tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Use a macro for static buffer bits tracing: Fix comment in tracing_buffers_splice_read() ring-buffer: Prevent truncation of nr_pages / nr_subbufs ring-buffer: Cap static ring buffer nr_pages tracing: Fix subbuf resize races with trace_pipe_raw readers tracing: Fix to avoid creating trace instances with duplicate names ring-buffer: Add checking nr_subbufs to persistent ring buffer validation ring-buffer: Allow splice reads on static buffers tracing: Take trace_array reference when opening options file ftrace: Synchronize the initialization of ftrace_ops ftrace: Take trace_array reference before accessing its ftrace_ops tracing: Have show_event_filters/triggers files take trace array ref |
||
|
Linus Torvalds
|
2beb1b31a1 |
bpf-fixes
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmqdhRMACgkQ6rmadz2v
bTo8vRAAnP+x1z6FBOgHawGmmBpXtazoipRFeok/+/YGQ4SbS+evvFNvmkeCyihZ
7EeNHGuWEbA6xQBAcMf0StMjmr3jkJvUA6lsHSxBiFLpHGqNt0Fz9IXvAL/8QWPg
F7+CBs5A+J61i66LEmINbWzW1ujDf7baU/1VWui9zfPxnmPu40V/74eXzm6DmH/V
oHTsCscCYNe+N+Wix6B6nLrObY537fcJU12N56uqpkaSc0+6H1fBQJmyFGpYroTX
+4g+DNzEHyIYmt6B3+oDpbT0Zh/pP6ROq5TPDNJSSa+5B/uPo5C5pH520HwXF9hJ
04uaD7y2fpE809Nwl3OEK4ozpJ+mEGU1NKZPvFAxckY6GCiBtfbGd1etFno7r+4F
mZhNBKbQVEQX4XJUlcoqn9n7T2OCDnjiuneZAjIi4vUdevnSnakr0rCTFriiHP54
jg4fEkXxvYjPiqs5SQbxoGxmYSfg9fYaSfK4HgFdlfbwp+3Vmv4BW/tcsIJ9dcPs
L3YWkUU3znjbu2BLy0CP9fGt/1ik8p4/tA8vvZwz0yqpDMJkLy1TziGMef51UQ7k
1Pe/Ln5J3C6xnWs+3TRF11y8PuuCF0y47DGPACfwPoQxca1ufJ5fgmLXRRQToZe4
RjDmoeQvvI9w9kxh6gVhTHoiiEeD0wcQqx2CMHKTrU/PbM7d4Co=
=oz4Z
-----END PGP SIGNATURE-----
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Alexei Starovoitov:
"This mainly contains verifier fixes that address bugs reported by
Nicholas Carlini.
- Fix incorrect non-NULL inference in pointer comparisons: pointer
types that may be NULL at runtime, pointers with unbounded offsets,
JMP32 comparisons with zero, and imprecise zero registers (Eduard
Zingerman)
- Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
NULL call arguments (Eduard Zingerman)
- Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
patterns entered by a jump (Eduard Zingerman)
- Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
(Hui Su)
- Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
and reject key-less BTF for hash maps (Jiayuan Chen)
- Various fixes (Kumar Kartikeya Dwivedi):
- Fix out-of-bounds access in disassembler on invalid LDSX
instruction
- mark siginfo of signal tracepoints as scalar and
sched_process_wait argument as nullable
- mark faultable stack helpers as sleepable
- reject tail calls and legacy packet loads from callbacks
- enforce rbtree callback lock restrictions for resilient locks
- require MEM_PERCPU for percpu kptr stores
- clear NON_OWN_REF after RCU protection ends
- mark NULL kptr stores precise
- preserve inner map identity in callback frames
- reject non-scalar bpf_loop() iteration counts
- Fix trampoline allocation slowdown on x86 by using
EXECMEM_MODULE_DATA (Mike Rapoport)
- Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
reject untrusted allocated-object pointers (Ning Ding)
- Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
Yuan Chen)"
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
bpf, riscv: Make arena support depend on ZACAS
selftests/bpf: Test pointer bpf_loop iteration count rejection
bpf: Reject non-scalar bpf_loop iteration counts
bpf: use mark_arg_precision() in check_mem_size_reg()
bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
selftests/bpf: precision of a NULL global subprogram BTF_ID argument
bpf: mark a NULL BTF_ID argument of a global subprogram precise
selftests/bpf: precision of a NULL kfunc argument
bpf: mark a NULL kfunc argument precise
selftests/bpf: precision of a NULL global subprogram memory argument
bpf: mark a NULL memory argument of a call precise
selftests/bpf: precision of a NULL helper argument
bpf: mark a NULL call argument precise
selftests/bpf: Test inner map identities in callbacks
bpf: Preserve inner map identity in callback frames
selftests/bpf: Test imprecise scalar kptr stores
bpf: Mark NULL kptr stores precise
selftests/bpf: Test rhtab kptr cancellation semantics
bpf: Cancel special fields when recycling rhtab elements
selftests/bpf: Test timer field on recycled rhtab element
...
|
||
|
Linus Torvalds
|
88405f0ad1 |
Miscellaneous scheduler fixes:
- Fix a timestamping bug in pick_task_fair() and
yield_task_fair() (Zhan Xusheng)
- Skip migrate-disabled tasks when picking a push
candidate in the RT and DL schedulers (Seiji Nishikawa)
- Skip rq->avg_idle update without a valid idle_stamp
(Shubhang Kaushik)
- Fix throttling bug in throttle_cfs_rq(), caused
by the recent single-runqueue conversion (Wanwu Li)
- Fix bandwidth calculation bug in distribute_cfs_runtime(),
caused by the single-runqueue conversion (Wanwu Li)
- Don't make x86 ITMT enablement depend on debugfs (Mario Limonciello)
- Avoid creating misfits during cache-aware load-balancing
on hybrid systems (Tim Chen)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdTLIRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gdURAAnjK4q2xg115VyKOvg4u4epPre1XNK4a/
RmimS/2+1fm7/5zqOXOQG3qU8z2Aj+nBIZa1d1yadV7ARHSymDINobCX+2HQ1DjU
Iysk2BqbbLnQQNKh81OBWhPMyJy4yOnig/670KR5JdFAdTKFYW/Ys+pQmO9M6rEx
hc8B4SUhOGeRnonfPMTbFW7H9eopWzst8kIpF0USl58az0mla5tkooWYJsvSuUHn
g4s9IALlRe3DxgmMT3kLKoAx2+ySnrzZNRs+M8Z/sMSDKXCMFpvX36wOqBJMHwXe
ZoAow/fJh4ysoYTR7luhDIBDQAkszf4GE9a644I/Bd0sIIYKs4+1RW1T3DAoWmKv
Sx0C29MM4Ng4R3lPx2avb+c0T0VO080/3fqRFrGrck8BIpMa9HcinOxf6etI8+vt
STnz5uQZZj3V+A5vzlKCAFGUUqK/s3EJnrT5z4VPxXmY2ZSyLLub4C5SQ8RNnqRL
u+Q9ra9DYBJh/HJTgjjcAP/HxmKK5LyQXd2DzuA1wy/wwC+s7TtPrxN5ep5EdZmv
K65zGGo28BgcCKD8jc1DfVXf8cf80fMiAr4fruGdo5TVwPyBahwZBi4sbqhahtqL
D4QwCsbOfhS+evVpx29n+V7eQzZzvSdN1tFCtZ3Tg6VvT9aJ2jLSx79aCsL/cYbr
hViB9N0yhGk=
=8l0J
-----END PGP SIGNATURE-----
Merge tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
- Fix a timestamping bug in pick_task_fair() and yield_task_fair()
(Zhan Xusheng)
- Skip migrate-disabled tasks when picking a push candidate in the
RT and DL schedulers (Seiji Nishikawa)
- Skip rq->avg_idle update without a valid idle_stamp (Shubhang
Kaushik)
- Fix throttling bug in throttle_cfs_rq(), caused by the recent
single-runqueue conversion (Wanwu Li)
- Fix bandwidth calculation bug in distribute_cfs_runtime(),
caused by the single-runqueue conversion (Wanwu Li)
- Don't make x86 ITMT enablement depend on debugfs (Mario Limonciello)
- Avoid creating misfits during cache-aware load-balancing on hybrid
systems (Tim Chen)
* tag 'sched-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/fair: Avoid creating misfits during cache-aware balancing
x86/itmt: Don't make ITMT enablement depend on debugfs
sched/fair: Use cfs_rq->h_curr in distribute_cfs_runtime()
sched/fair: Use cfs_rq->h_curr in throttle_cfs_rq()
sched/core: Skip rq->avg_idle update without a valid idle_stamp
sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers
|
||
|
Linus Torvalds
|
c4a3928e7d |
Misc perf events fixes:
- Skip empty AUX records with only format flags
(Leo Yan)
- Fix use-after-free when perf mmap() revival races with the
last munmap() (Yilin Zhang, Weiming Shi)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdSokRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gRKRAAkDxFT3BNAtAypk5CvTPeO9K530u38mqc
fIvYQYbYkqIMZaFSmIthSgsPOJD/mqkccl1sd6djlS/73mI/X8eXCwZOgjLnaCsu
jRx8atD8Q7hHeyJ78qY/hFsyHPTQel5+cniEk4BjUrYIYhHklFfpQw1AZhoJieUs
vnqkDGMY/qHQ5pGs+dnz3oI8FE6ruNU0Ps6qiBqsbsvMJI+wviCidpC6BqluyxvQ
Pp6ACwqQIiH2mPwI9WYtHKmVL5ajQJPt8fbIwIvRbX5wCY566zb79oUys2pNUh/U
zzpTNOGgqtVCTgiuMiEI2SlIIMzC36P071vBTyD8YZWUNpdYXLM20RdvAUZkqefT
Vx3cMs8rgcPnjGO4XhPJJOzfyyCi25VL/p3af9S3wSJhfQNdMF9BuqRABFMBmtDi
5adP+4p5Dw9sfc2+F2/OCT7PrXsFiNsOp+iduWJYb6i8hdSjV1mfjGLyptdBCdj2
dUYr4VrFoiYUVLPWJD5F4/dDAIljN3CEoGwHiOITNCYu0fgO7GCALf8FG5U9Ec7D
guuRGnEXDFQDCOZHm5MuVYWAR7qPhe+iVoX6Dw9ZmgecGWb4eTl4A5e8LGgbcbJ1
JMfVr3OENSyGi1dPnCX4DEsIpeXN1UTMHhrwNosWcu1OrEEUkzdQ8GQ17qU6PURG
yYSXCvhdEtY=
=Ffvz
-----END PGP SIGNATURE-----
Merge tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Skip empty AUX records with only format flags (Leo Yan)
- Fix use-after-free when perf mmap() revival races with the
last munmap() (Yilin Zhang, Weiming Shi)
* tag 'perf-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Fix use-after-free when perf mmap() revival races with the last munmap()
perf/core: Skip empty AUX records with only format flags
|
||
|
Linus Torvalds
|
c8990f3179 |
Misc locking fixes:
- Fix a softirq processing delay bug in local_interrupt_disable(),
which should mostly only affect the Rust runtime (Boqun Feng)
- Remove the hardirq_disable_count() function which caused the
previous bug and is now unused & unnecessary (Boqun Feng)
- lockdep: Invalidate stale class_cache entries for zapped classes
(Eric Dumazet)
- Fix rt_mutex specific futex scheduling helpers
(Sebastian Andrzej Siewior)
- Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdSKMRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gh6hAAtIhAm10pkx7JG4Kl+SQArmoAxNMfW9X1
grx50dn1/LFuIF0upooJwJmLMBpPMmxcpYPWbg5nTUsx+wDqcJTT0T7Aw2iZN2f+
OdODMOGNuQU4IUxDC+qX+fkgHvRFzng0zhSXYL2kGpQJHktrFMAHn90+5aO9SEgA
XcSjmDacTxfJADNk43snrlHy6t+yOXBEmIrhicnbh11GFNIXLbvdGW/0SObU0Q5o
WdwGHTZRFAM3mpX7xMSFOKypM+Gt4pXdQ/uC1PQg0B/AT35p4zsYIdcht/cBMHp0
93eTeJd9ede410t3hL1Hnsuo1zf5qHtCgBukS+UHJWoWpnSOMgT2iaBx2X3jIsev
ptPIqV5Alq8O+tnNOSDOwD2HH2drAdUBVH+gZ/yKMDbk9jfw9eZKqRw628U2P7rG
mD5CLzpmfj0mMAuqcOhhdqSQmPhjp2Y8Ju/8UAMSmcocvqjQBxvouNS3Tby9U5v+
R4CsuUwtnYpMyy5xyRrnwVsaE3le5fvneXCmCokk8FtQ8as/4ATd+cG+RROSa3vW
/AAjrB1HBQqyseE8lki4LFFmlr01Otc8u6pASy4/pxeuKMA9hSuLC3RuEfVetW6W
BcK4BCIJBy6chcsCBxv0F7FgI/y7/bpVyBmoTkW3Sb0I23xswXzTzbucn/dPJNdl
oqFj3KQygxw=
=vEuZ
-----END PGP SIGNATURE-----
Merge tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix a softirq processing delay bug in local_interrupt_disable(),
which should mostly only affect the Rust runtime (Boqun Feng)
- Remove the hardirq_disable_count() function which caused the
previous bug and is now unused & unnecessary (Boqun Feng)
- lockdep: Invalidate stale class_cache entries for zapped classes
(Eric Dumazet)
- Fix rt_mutex specific futex scheduling helpers
(Sebastian Andrzej Siewior)
- Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)
* tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Prevent rcuwait use-after-free during requeue PI
futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
locking/lockdep: Invalidate stale class_cache entries for zapped classes
preempt: Remove hardirq_disable_count()
interrupt: Disable interrupt before modifying hardirq_disable counter
|
||
|
Linus Torvalds
|
b485131995 |
Miscellaneous IRQ subsystem fixes:
- Revert a commit to the mbigen irqchip driver that caused
a regression on two-port Hi1616 chips (Caina)
- Fix a too-long-preemption-off bug in the stm32mp-exti
irqchip driver, caused by a time unit ambiguity & mismatch (Ju Nan)
- Remove the now completely unused irq_domain_add_linear()
inline function (Jiri Slaby)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqdRScRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hPZhAAtKTux+xrKNQ2AsJsVoQFpf/B3EHodf9C
7SPLROhmYYTpOTAdjB0ZP6jxssCmu+Q5NtZzXxX9QU5D3l9aIG6RYQsKd0hQ2tPm
2Gb5dwFw4Ozfh1OrJKbFTC/nFsmAZETzF8bm9gfsfWoYIcblNNJ6Fp8yya0q04/g
qupnXpY9XLZtgFVG4tgJSH5ICxCa/1vTYukU5vdDMkHRyN9ENVWTbTTUqFHiBbeO
1V2oT3q2sM3tLGHifg1RWQ9uC3Vo3M+kS/bAZFlWcu0ZuIcW0WjU4pxjQjfviB8w
zFLY+erKIUIDt6JQ8E9Iapa+EMMIR4CKqfjMoYWoYTrzXX1X6XRtnGpTDZ8t3wl9
HrvR4eO/IqiUgR54lpE/J9eysBqo3+UbN6qVAo0jCo+D+z13AOTp5Rdz5CPD2zKr
7KUURB5SvkaTMz4zoOGNI3NTARKoEac6eAZgUXfWR/+94W1f2fM+lLyC7cUiDTyA
A/eoy1Kcj5sTiTgVtR+pDKi9enSD6etJkvEeJvThZ3yjcUVPjUGDh5IFahq8dR57
J018f1q8yBZ6rAr4q0oOMkWscYIK2WBeXbdUc7+IPreFPoooRzHeNSa7abLaKiX5
MBidcgHBL7XE1HEpTz/1rL6F226IqEfAtWuMuMWyuHQ5uYTCzoJ2sELjH/++XOdV
k1qP+93K1dI=
=54qE
-----END PGP SIGNATURE-----
Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull IRQ subsystem fixes from Ingo Molnar:
- Revert a commit to the mbigen irqchip driver that caused
a regression on two-port Hi1616 chips (Caina)
- Fix a too-long-preemption-off bug in the stm32mp-exti
irqchip driver, caused by a time unit ambiguity & mismatch
(Ju Nan)
- Remove the now completely unused irq_domain_add_linear()
inline function (Jiri Slaby)
* tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
Revert "irqchip/mbigen: Fix mbigen node address layout"
irqdomain: Delete irq_domain_add_linear()
|
||
|
Linus Torvalds
|
d3cbb9af72 |
virtio console fix for 7.3-rc2
Here is a single virtio console fix for 7.3-rc2 to fix a much reported regression in 7.3-rc1, sorry about that. It's not been in linux-next, but it has been sent by many different developers to resolve the issue and is "obviously" correct. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCap0yag8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ykbSwCcDmF2b0gZnZY3LaaJjdryq8yXP8cAnjEGPEl9 OcipLpPGvj6dq+5Xv2qE =5+1N -----END PGP SIGNATURE----- Merge tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull virtio console fix from Greg KH: "Here is a single virtio console fix for 7.3-rc2 to fix a much reported regression in 7.3-rc1, sorry about that. It's not been in linux-next, but it has been sent by many different developers to resolve the issue and is 'obviously' correct" * tag 'tty-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: virtio_console: allocate the port_buffer with the caller's gfp |
||
|
Linus Torvalds
|
bf979ab8f2 |
Staging driver fixes for 7.3-rc2
Here are some small staging driver fixes to resolve some reported bugs that have been found, and tested, in a few staging drivers in 7.3-rc1. Included in here are: - OOB read problem fixes in the rtl8723bs driver - fbtft driver fix - sm750fb driver fix All of these have been in linux-next this week with no reported problems. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCap0zHA8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylsuwCfc6ycZ0QbcKpiDZpzijDTduvUh1IAnAky4xi7 rNKgULapaYP63Mt0exzR =Cajg -----END PGP SIGNATURE----- Merge tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes to resolve some reported bugs that have been found, and tested, in a few staging drivers in 7.3-rc1. Included in here are: - OOB read problem fixes in the rtl8723bs driver - fbtft driver fix - sm750fb driver fix All of these have been in linux-next this week with no reported problems" * tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() staging: fbtft: make dirty_lock IRQ-safe |
||
|
Linus Torvalds
|
65538a8f02 |
USB fixes for 7.3-rc2
Here are some small USB driver fixes for reported problems and regressions. Include in here are: - xhci driver fixes - cdns3 driver fixes - usb gadget driver fixes for syzbot found problems - typec driver fixes for broken hardware and other bugs found - kernel data leaks in mdc800 driver - usb storage driver fixes - other small USB driver fixes All of these have been in linux-next this week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCap0z6Q8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ynS5QCfbHGkxWTxkZ5dhvMn0Xs4/+ekE1QAn35xFYmZ SzXW+Kqkf7nMhxHo9yj0 =L8pK -----END PGP SIGNATURE----- Merge tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB driver fixes for reported problems and regressions. Include in here are: - xhci driver fixes - cdns3 driver fixes - usb gadget driver fixes for syzbot found problems - typec driver fixes for broken hardware and other bugs found - kernel data leaks in mdc800 driver - usb storage driver fixes - other small USB driver fixes All of these have been in linux-next this week with no reported issues" * tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits) usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop usb: gadget: fix null pointer dereference in usb_put_function_instance() usb: typec: qcom-pmic: cancel reset_work on stop usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() usb: storage: realtek_cr: fix use-after-free on disconnect usb: cdnsp: fix wakeup from S3 after controller context loss usb-storage: ene_ub6250: fix race between scan work and probe USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() usb: gadget: f_midi: initialize work in f_midi_alloc() usb: gadget: f_midi2: fix use-after-free in string attribute show path usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs usb: typec: hd3ss3220: track VBUS enable state per consumer usb: dwc3: clear forceRM when issuing EndTransfer usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES usb: typec: mux: avoid duplicated mux switches usb: typec: mux: Fix typec_switch_match() usb: image: mdc800: change kmalloc() to kzalloc() ... |
||
Chen Pei
|
536b523b40 |
bpf, riscv: Make arena support depend on ZACAS
The arena range tree allocates its nodes with kmalloc_nolock() since commit |
||
Eduard Zingerman
|
fd5348b434 |
Merge branch 'fix-bpf_loop-syzbot-report'
Kumar Kartikeya Dwivedi says: ==================== Fix bpf_loop syzbot report Needs Eduard's ack. Fix for the report in https://lore.kernel.org/bpf/6a9ad24c.b5d4176b.238c3e.0001.GAE@google.com. ==================== Link: https://patch.msgid.link/20260905014735.1452988-1-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> |
||
Kumar Kartikeya Dwivedi
|
bde8901ea1 |
selftests/bpf: Test pointer bpf_loop iteration count rejection
Add a verifier test that leaves the raw tracepoint context pointer in R1 when calling bpf_loop(). This is the smallest trigger for the incorrect precision backtracking: it reuses an existing callback and needs no maps or userspace setup. Expect an ordinary scalar-type rejection. Without the verifier fix, the test instead reaches precision backtracking and reports an internal "backtracking misuse" error. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260905014735.1452988-3-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> |
||
|
Kumar Kartikeya Dwivedi
|
c3fd8e5fd1 |
bpf: Reject non-scalar bpf_loop iteration counts
bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit |