mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,464,522 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
filippor
|
831cb9ba54 |
drm/amdgpu: fix IP discovery v0 handling
Cyan skillfish uses IP discovery v0. This was broken when the
IP discovery was refactored for newer versions.
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5189
Fixes:
|
||
Srinivasan Shanmugam
|
a6d561a88c |
drm/amd/pm: Fix mode2 reset ACK handling on aldebaran v2
aldebaran_mode2_reset() sends a mode2 reset message and waits for
an acknowledgment from the SMU.
The current ACK handling is incorrect.
The wait loop runs only when ret is -ETIME. But after a successful
async send, ret is 0. Because of this, the loop is skipped and the
code does not wait for the reset acknowledgment.
Also, the code checks for ret != 1 after calling
smu_msg_wait_response(). However, smu_msg_wait_response() returns
0 on success and negative error codes on failure. So checking
against 1 is wrong.
Return -EOPNOTSUPP when the firmware does not support this reset
message.
Fix this by setting ret to -ETIME before entering the wait loop,
checking for ret != 0 after getting the SMU response, and returning
-EOPNOTSUPP when the firmware does not support the message.
v2:
- Update ACK check to use ret != 0 instead of ret != 1, since
smu_msg_wait_response() returns 0 on success (Feifei)
- Remove unnecessary handling for ret == 0
Fixes:
|
||
|
Srinivasan Shanmugam
|
e81a492d12 |
drm/amd/pm: smu7: Remove stale error check in smu7_hwmgr_backend_init
smu7_hwmgr_backend_init() is responsible for initializing the SMU7 power
management backend. It allocates and sets up the backend structure,
initializes voltage tables, configures dependency tables, and prepares
platform-specific power and clock parameters.
The function follows a typical pattern where each initialization step
returns a status in "result", and failures are handled via a common
"goto fail" path that performs cleanup.
Commit 2c21648bb814 ("drm/amd/pm/smu7: Remove non-functional SMU7
voltage dependency on DAL") removed a function call in this
initialization sequence, but left behind the corresponding error check.
As a result, "result" is checked twice without being updated in between:
result = smu7_init_voltage_dependency_on_display_clock_table(hwmgr);
if (result)
goto fail;
...
if (result)
goto fail;
The second check is redundant and unreachable for any new failure, since
no operation modifies "result" between the two checks. This triggers a
Smatch warning about a duplicate zero check and reduces code clarity.
Remove the stale error check to keep the control flow correct and
readable.
Fixes:
|
||
Ce Sun
|
505dcb8eea |
drm/amd/ras: Avoid ECC status update in hw_fini for VF unload
VF sends IDH_REQ_GPU_FINI_ACCESS before hw_fini during unload. PF no longer accepts requests, so skip ECC status update to prevent mailbox timeout. Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> |
||
Xiang Liu
|
b8939bd764 |
drm/amdgpu: fix CPER ring header parsing
amdgpu_cper_ring_get_ent_sz() parses CPER headers directly from the circular ring buffer to determine the current entry size. When the ring is full and the write pointer lands near the end of the buffer, the header can wrap across the ring boundary. The existing code treats the 4-byte CPER signature as a C string and uses strcmp() on in-ring binary data, then reads record_length through a direct struct pointer cast. Both assumptions are unsafe for wrapped entries and can read past the end of the ring mapping. Fix the parser by comparing the signature as raw bytes and by copying the header into a local buffer before reading record_length, handling wraparound explicitly in both cases. This avoids out-of-bounds reads in amdgpu_cper_ring_get_ent_sz() when the CPER ring is full or the current entry starts at the tail of the ring. Signed-off-by: Xiang Liu <xiang.liu@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> |
||
Vitaly Prosyak
|
d42d3012b2 |
drm/amdgpu: fix heap buffer overflow in amdgpu_coredump ring dump
The off variable in the ring content dump loop tracks a byte offset
accumulated from ring->ring_size (which is in bytes), but it is used
as an index into u32 *rings_dw. C pointer arithmetic on a u32 pointer
automatically multiplies the index by sizeof(u32) = 4, so the actual
byte address accessed is:
&rings_dw[off] == (char *)rings_dw + off * 4
This means off is effectively quadrupled, causing a 4x overshoot.
Concrete example -- two rings, each ring_size = 8 192 bytes (8 KB):
total_ring_size = 16 384 bytes
rings_dw = kzalloc(16 384) /* 16 KB buffer */
Ring 0: off = 0
memcpy(&rings_dw[0], ring0->ring, 8192)
-> writes bytes 0 .. 8 191 OK
off += ring->ring_size -> off = 8 192 (BUG)
Ring 1: off = 8 192
memcpy(&rings_dw[8192], ring1->ring, 8192)
-> actual byte offset = 8 192 * 4 = 32 768
-> writes bytes 32 768 .. 40 959
-> but buffer is only 16 384 bytes! OVERFLOW
With the fix (off += ring->ring_size / 4):
Ring 0: off = 0
memcpy(&rings_dw[0], ring0->ring, 8192) OK
off += 8 192 / 4 -> off = 2 048
Ring 1: off = 2 048
memcpy(&rings_dw[2048], ring1->ring, 8192)
-> byte offset = 2 048 * 4 = 8 192
-> writes bytes 8 192 .. 16 383 OK
KASAN catches the overflow as a slab-use-after-free when the write
lands on a quarantined slab object:
BUG: KASAN: slab-use-after-free in amdgpu_coredump+0x775/0x13c0 [amdgpu]
Write of size 8192 at addr ffff8890b2400000 by task kworker/u128:1/329
Workqueue: amdgpu-reset-dev drm_sched_job_timedout [gpu_sched]
Call Trace:
__asan_memcpy+0x3c/0x60
amdgpu_coredump+0x775/0x13c0 [amdgpu]
amdgpu_job_timedout+0xdb5/0x1420 [amdgpu]
The corrupted object was a 4 KB drm_exec buffer from a completed
amdgpu_cs_ioctl -- the ring dump memcpy overshot into this freed
slab region.
Fix by accumulating off in dword units (ring->ring_size / 4) so the
u32* indexing produces the correct byte address. The reader in
amdgpu_devcoredump_format() already consumes the stored offset as a
dword index (rings_dw[off + j / 4]), so no change is needed there.
Fixes:
|
||
|
Ce Sun
|
169a0556d9 |
drm/amdgpu: correct single device PCIe reset flow for DPC
For triggering the dpc event with a single device, we still need to set the in_link_reset flag and the dpc status. Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> |
||
|
Vitaly Prosyak
|
d91db49e97 |
drm/amdgpu: fix NULL pointer dereference in amdgpu_devcoredump_format
A race condition in the devcoredump code causes a NULL pointer
dereference in amdgpu_devcoredump_format() when multiple GPU resets
occur in quick succession.
The sequence of events:
1. First reset calls amdgpu_coredump(), creates coredump1, sets
adev->coredump = coredump1, and queues the deferred work.
2. The deferred work begins executing (work_pending() returns false
since the work is now running, not just queued).
3. A second reset calls amdgpu_coredump(). work_pending() returns
false because the work is running, so amdgpu_coredump() proceeds:
creates coredump2, overwrites adev->coredump = coredump2, and
re-queues the deferred work with queue_work().
4. The first deferred work finishes and unconditionally sets
adev->coredump = NULL, destroying the reference to coredump2.
5. The re-queued deferred work starts and reads
adev->coredump = NULL. It then passes this NULL into
amdgpu_devcoredump_format() which dereferences coredump->adev
(offset 0 in the struct), triggering:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:amdgpu_devcoredump_format+0xa6/0x36b0 [amdgpu]
This was observed during the amd_deadlock IGT test where multiple
subtests trigger rapid ring resets. The dmesg log shows four
coredumps created within 120ms (at 102.377s, 104.424s, 104.492s,
and 104.497s), with the crash occurring 13ms after the last one.
Fix this with two changes:
- Replace work_pending() with work_busy() in amdgpu_coredump() to
also reject new coredumps while the deferred work is executing,
not just when it is queued. This closes the main race window.
- Add a defensive NULL check for adev->coredump at the start of
amdgpu_devcoredump_deferred_work() to prevent the crash if the
race still occurs (work_busy() is advisory, not a full barrier).
v2: Drop the job->pasid NULL guard -- that fix was independently
submitted and merged as commit 4c1f0a162da5 ("drm/amdgpu: add
job->pasid in check as amdgpu_job could be NULL") by Sunil
Khatri, reviewed by Christian König. Integrate with that
patch as suggested by Christian.
Fixes:
|
||
Sunil Khatri
|
97284621c5 |
drm/amdgpu: add job->pasid in check as amdgpu_job could be NULL
In below stack job->pasid is accessed while job is NULL. Access it
within the check when job is non NULL.
Failure call stack.
[ 222.653622] BUG: kernel NULL pointer dereference, address: 000000000000014c
[ 222.653625] #PF: supervisor read access in kernel mode
[ 222.653628] #PF: error_code(0x0000) - not-present page
[ 222.653630] PGD 0 P4D 0
[ 222.653635] Oops: Oops: 0000 [#1] SMP NOPTI
[ 222.653639] CPU: 1 UID: 0 PID: 12 Comm: kworker/u96:0 Not tainted 6.19.0-amd-staging-drm-next #271 PREEMPT(voluntary)
[ 222.653644] Hardware name: Gigabyte Technology Co., Ltd. X570 AORUS ELITE/X570 AORUS ELITE, BIOS F37c 05/12/2022
[ 222.653646] Workqueue: amdgpu-reset-dev amdgpu_userq_reset_work [amdgpu]
[ 222.653961] RIP: 0010:amdgpu_coredump+0x8b/0x470 [amdgpu]
[ 222.654158] Code: 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 c9 31 ff 31 d2 31 f6 45 31 c0 45 31 db e9 8c a9 1a e2 88 58 48 44 88 68 49 <41> 8b b7 4c 01 00 00 89 b0 80 00 00 00 4d 85 ff 48 89 45 d0 0f 84
[ 222.654161] RSP: 0018:ffffce68c0147c00 EFLAGS: 00010282
[ 222.654165] RAX: ffff8bc337407740 RBX: 0000000000000000 RCX: 0000000000000000
[ 222.654167] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 222.654170] RBP: ffffce68c0147c48 R08: 0000000000000000 R09: 0000000000000000
[ 222.654172] R10: ffff8bc337407740 R11: ffffffffc10dda10 R12: ffff8bc2d2e00000
[ 222.654174] R13: 0000000000000001 R14: ffff8bc2d2e5b368 R15: 0000000000000000
[ 222.654176] FS: 0000000000000000(0000) GS:ffff8bc64a5fe000(0000) knlGS:0000000000000000
[ 222.654179] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 222.654182] CR2: 000000000000014c CR3: 0000000135eca000 CR4: 0000000000350ef0
[ 222.654184] Call Trace:
[ 222.654187] <TASK>
[ 222.654190] ? amdgpu_ip_block_resume+0x28/0x70 [amdgpu]
[ 222.654376] ? srso_return_thunk+0x5/0x5f
[ 222.654382] amdgpu_device_reinit_after_reset+0x184/0x320 [amdgpu]
[ 222.654552] amdgpu_do_asic_reset+0x129/0x160 [amdgpu]
[ 222.654720] amdgpu_device_asic_reset+0x92/0x710 [amdgpu]
[ 222.654890] amdgpu_device_gpu_recover+0x2ae/0x3d0 [amdgpu]
[ 222.655060] amdgpu_userq_reset_work+0x76/0xa0 [amdgpu]
[ 222.655229] process_scheduled_works+0x1f0/0x450
[ 222.655235] worker_thread+0x27f/0x370
Fixes:
|
||
Amir Shetaia
|
ad52d61d82 |
drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
KFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE but not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated VRAM with stale data from prior use observable by compute kernels. The GEM ioctl path already sets VRAM_CLEARED for all userspace allocations via amdgpu_gem_create_ioctl() and amdgpu_mode_dumb_create(). The KFD path was missing this flag, allowing stale page table remnants to leak into user buffers. This causes crashes in RCCL P2P transport where non-zero data in ptrExchange/head/tail fields corrupts the protocol handshake. Signed-off-by: Amir Shetaia <Amir.Shetaia@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org |
||
Ramalingeswara Reddy, Kanala
|
08cdf07b55 |
drm/amdgpu: Use NBIF offset for register RCC_STRAP0_RCC_DEV0_EPF0_STRAP0 .
Define and use regRCC_STRAP0_RCC_DEV0_EPF0_STRAP0_nbif_4_10, to get correct rev_id in nbif_v6_3_1_get_rev_id(). Reviewed-by: Pratik Vishwakarma <Pratik.Vishwakarma@amd.com> Signed-off-by: Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org |
||
Mario Limonciello
|
2744103f58 |
drm/amd: Add missing firmware declaration for PSP v15.0.0
PSP v15.0.0 needs both TOC and TA firmware. Without the declaration
it won't get included in initramfs and leads to following failure:
```
Direct firmware load for amdgpu/psp_15_0_0_ta.bin failed with error -2
early_init of IP block <psp> failed -19
Fatal error during GPU init
```
Fixes:
|
||
David (Ming Qiang) Wu
|
e90dc3b2d7 |
amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
PCTL0__MMHUB_DEEPSLEEP_IB is 0x69004 on MMHUB 4,1,0 and and 0x60804 on MMHUB 4,2,0. 0x62a04 is on MMHUB 1,8,0/1. The DS bits are adjusted to cover more JPEG engines and MMHUB version. Signed-off-by: David (Ming Qiang) Wu <David.Wu3@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org |
||
Chenglei Xie
|
ddda81c4d7 |
drm/amdgpu: gate VM CPU HDP flush on reset lock
During GPU reset, the application could still run CPU page table updates. Each commit called amdgpu_device_flush_hdp(), which on SR-IOV sends work through the KIQ ring. That can advance sync_seq while the GPU is being reset, leaving fence writeback out of sync and causing amdgpu_fence_emit_polling() to time out on later KIQ use. Fix: amdgpu_vm_cpu_commit(): Reset will flush HDP anyway, the HDP flush in amdgpu_vm_cpu_commit() can be skipped when a reset is ongoging. Take reset_domain->sem with down_read_trylock() before amdgpu_device_flush_hdp(). If the reset path holds the write lock, skip the HDP flush so no HDP-related HW access (including KIQ) runs during reset; state is re-established after reset. Signed-off-by: Chenglei Xie <Chenglei.Xie@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org |
||
|
Ramalingeswara Reddy, Kanala
|
574b3b14f7 |
drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
Define and use regGOLDEN_TSC_COUNT_UPPER_smu_15_0_0 and regGOLDEN_TSC_COUNT_LOWER_smu_15_0_0 for TSC upper and lower count. Acked-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Pratik Vishwakarma <Pratik.Vishwakarma@amd.com> Signed-off-by: Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org |
||
Xiaogang Chen
|
a094bcf204 |
drm/amdgpu: Remove sys file compute_partition_mem_alloc_mode at module unload
Module reload would fail when create sys file that was not removed during
module unload.
Fixes:
|
||
Yang Wang
|
504f0098eb |
drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
OverDriveTable.FanMinimumPwm and FeatureCtrlMask.PP_OD_FEATURE_FAN_LEGACY_BIT
have a hard dependency.
Invalid handling of this dependency leads to disabled thermal monitoring
and temperature boundary validation.
v2: squash in typo fix (Yang)
Fixes:
|
||
Linus Torvalds
|
59bd5ae0db |
power supply and reset changes for the 7.1 series
* power-supply drivers
- S2MU005: new battery fuel gauge driver
- macsmc-power: new driver for Apple Silicon
- qcom_battmgr: Add support for Glymur and Kaanapali
- max17042: add support for max77759
- qcom_smbx: allow disabling charging
- bd71828: add input current limit support
- multiple drivers: use new device managed workqueue allocation
function
- misc. small cleanups and fixes
* reset core
- Expose sysfs for registered reboot_modes
* reset drivers
- misc. small cleanups and fixes
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmniTwkACgkQ2O7X88g7
+pqZCA//ZETuZH1fB1/uJQocXxC6wksAaYUq4BvRlmj5e/dc42ouLbC8IfzMnAET
aMc9zHOSKdUdW0a9DpWlOZaXT4AZ5EN7Pjd5XeRjrWwaufPvvZgX0Abjb9UpT6nU
yYMbKvJeNMIVGqByboneWK0LOekijJVz8dkAe31eE+8tNNAn3Y/V8v9FiS9nG5sL
0WqnhmCNBd9vS/QYvoxSMB9UC64LxYISYlDl/v525mqFRoDdkIh9q+WO7Wdq3Mtk
tOGIRu1i001jpXxLwtIx9N1Uoq62inyuuPeBrpdKAjxKQyXQSiKrcVX1gQdbBmZm
ggAFJ5p6wWYeDXA5/9C4z0wsud+/ZbgvzJvYOqTbkJQA2c/+Sz928EjHrRre9DzU
l3Z0eVLtuekKXMhwiXRN66JjYmYjZJA5gJXKgd+8slHSXSpgp6scv5zMQYCTny5d
Jj+Ztp5k70RLrl88Y0Dihi7lKy07NhlrYMO7HPNrwEnydxPRTdLfLahZkb/SJep0
YTX/r0s/Ab+VG+qWmAlvVjwbDglmsYDMcmyJarJKvXoE7CE+jwL1447UiI0BAOjO
ZDUGojBHst36ySORWjq0LmjP6F2r582hXWzeY08Skuj05n2bBJpT89rEF+BGYwhR
KhQgH7mCvsbG8QJuTROGK/fpDZ5L7aGwJBfMchgdWmDs8r9zY5M=
=5Yic
-----END PGP SIGNATURE-----
Merge tag 'for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply
Pull power supply and reset updates from Sebastian Reichel:
"Power-supply drivers:
- S2MU005: new battery fuel gauge driver
- macsmc-power: new driver for Apple Silicon
- qcom_battmgr: Add support for Glymur and Kaanapali
- max17042: add support for max77759
- qcom_smbx: allow disabling charging
- bd71828: add input current limit support
- multiple drivers: use new device managed workqueue allocation
function
- misc small cleanups and fixes
Reset core:
- Expose sysfs for registered reboot_modes
Reset drivers
- misc small cleanups and fixes"
* tag 'for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (36 commits)
power: supply: qcom_smbx: allow disabling charging
power: reset: drop unneeded dependencies on OF_GPIO
power: supply: bd71828: add input current limit property
dt-bindings: power: reset: cortina,gemini-power-controller: convert to DT schema
power: supply: add support for S2MU005 battery fuel gauge device
dt-bindings: power: supply: document Samsung S2MU005 battery fuel gauge
power: reset: reboot-mode: fix -Wformat-security warning
power: supply: ipaq_micro: Simplify with devm
power: supply: mt6370: Simplify with devm_alloc_ordered_workqueue()
power: supply: max77705: Free allocated workqueue and fix removal order
power: supply: max77705: Drop duplicated IRQ error message
power: supply: cw2015: Free allocated workqueue
power: reset: keystone: Use register_sys_off_handler(SYS_OFF_MODE_RESTART)
power: supply: twl4030_madc: Drop unused header includes
power: supply: bq24190: Avoid rescheduling after cancelling work
power: supply: axp288_charger: Simplify returns of dev_err_probe()
power: supply: axp288_charger: Do not cancel work before initializing it
power: supply: cpcap-battery: pass static battery cell data from device tree
dt-bindings: power: supply: cpcap-battery: document monitored-battery property
power: supply: qcom_battmgr: Add support for Glymur and Kaanapali
...
|
||
Zhao Mengmeng
|
5425abc222 |
sched_ext: Print sub-scheduler disabled log and reason
Take scx_qmap for example, when sub scheduler is attached, there is 'BPF sub-scheduler "qmap" enabled' message, but when detached, the log is missing. Add a new function to do the log thing, it can be used by both root scheduler and sub scheduler. Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn> Reviewed-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org> |
||
|
Zhao Mengmeng
|
26fb937c7b |
tools/sched_ext: Add missing -c option in scx_qmap help
The sub-scheduler api has been added to scx_qmap, but the new -c option is missing in help, which is hard to understand and use. Add it in help. V2: add [-c CG_PATH] to the usage synopsis. Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn> Reviewed-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org> |
||
Cheng-Yang Chou
|
7c7bb206e8 |
tools/sched_ext: Handle migration-disabled tasks in scx_central
When a task calls migrate_disable(), p->cpus_ptr is not updated until migrate_disable_switch() runs during context switch, so dispatch_to_cpu() may dequeue such a task and dispatch it to a CPU it cannot run on. Extend the mismatch check in dispatch_to_cpu() to also test is_migration_disabled() alongside the cpumask check, so tasks in this window are bounced to the fallback DSQ. Suggested-by: Andrea Righi <arighi@nvidia.com> Suggested-by: Tejun Heo <tj@kernel.org> Suggested-by: Kuba Piecuch <jpiecuch@google.com> Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Reviewed-by: Kuba Piecuch <jpiecuch@google.com> Signed-off-by: Tejun Heo <tj@kernel.org> |
||
|
Linus Torvalds
|
e0dcd2b2a0 |
HSI changes for the 7.1 series
* core: use flexible array member for hsi_port in hsi_controller * misc. small fixes -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmnheVoACgkQ2O7X88g7 +pqzjA//RYSY5xZGDqgKXmuXUb3U9dHsk4kDOGP7UnAhH4mJixRAd4+GvBt/Hy1F XutMKmJGEDAGV3nMQbez6PJdbXMLczHoo6PkYJMHNAoW2RWJZnskny+E3foZdofJ frOXGl/ERFo0KxUqhvZROYUq+h7ajs8dYLef3KRZXEaSmRxUln9CwUBNxW3a7Cf1 3gJCbH5JhoUu93E0qttctKcv/hKCwqv9zHk7Cixz2xYB7nWWimehlADH6yFwYz6E cQOyAlB8Lxz03f4t9TL2axSS2Y+/0JrOCVd8CtK1EiTiHt/ANmYZVW9IabdLopJX tEVM5P7S3o6gWRebjgmT6q7OWWop0W4UVNAoiWRmrv9BCF+OH4RMrnIwXgRz0DDY r2e4i6SaO7bKh36FCW/depv2uCKh+oyNI5eKIE7aLf+P7qwq2+fO47qDT/xIwjCw TP5M4FgHZCLKKSFnNJzLzvtgCtz4K6yCeA7JU1o8wNZ0yHmnvQQ7nU8JmRyUJm+d cd3desS9J61L8W6Kg1IC2cnAGs1u+ITKkd80c+aN7TSdnN0+hcKwINut9MjmOxx6 pWiPZQm4DlgXe5FH5cDOJg2NMrHenMns0FL6DmSLtICYQyHd6kcVIBPCB8H81kFf 72CgtPRvP5KArb+e1t6uLkqrcGSJkWdijYNxnP2gtBdE5JBJgyI= =uQXI -----END PGP SIGNATURE----- Merge tag 'hsi-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI updates from Sebastian Reichel: - use flexible array member for hsi_port in hsi_controller - misc small fixes * tag 'hsi-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: omap_ssi_port: remove depends on ARM HSI: omap_ssi_port: remove set but unused variables HSI: cmt_speech: fix wrong printf format HSI: omap_ssi_port: remove null check from FAM hsi: hsi_core: use kzalloc_flex |
||
Karthik Poosa
|
c973f7a672 |
drm/xe/hwmon: Enable energy attributes for CRI
Enable HWMON energy attributes for CRI, which are available through MMIO registers. Although these attributes can also be accessed via PMT, MMIO is preferred as it avoids dependency on ocode firmware load in late binding scenario. v2: Rephrase commit message. (Anshuman) Signed-off-by: Karthik Poosa <karthik.poosa@intel.com> Reviewed-by: Soham Purkait <soham.purkait@intel.com> Link: https://patch.msgid.link/20260417041456.818668-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> |
||
|
Linus Torvalds
|
d97e7d7c30 |
hid-for-linus-2026041601
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmnhNL4ACgkQpmLzj2vt
YEmEyQ/+LTJ8CLjONWfamsF2XK2vcOWa9E41ot9vnaUZon4IKbGSFzpKxLGWO3zu
gnu0wKvRtK4NZwN/T2M24pOgfAMzYh9YZ5oP4kdo3ZrJnw9GcBriY0KF1D10N+Ij
qMz/8rzhOjM6GkINYZfR6iX3/vstFpavuVcHru2TBN5IPNTWOVS5ALAAp2WjRN7c
da8XazEzk+xt2z7/Iv6t2Y/Bi826CS16vuXjYa5/2wM7kRH/y+It35MpwXK/KHol
Foeor166Q2b6LPpvavusf1A6YWvagPyDvWvJssWw5Mi3heyq9YeOU0qZApJmTVRz
neS9NYUFaZ+1YuZ/vRkJuvbqH9M6xYHXYXatXBmUJK2V18wHgD9X/Et4Crud8mmj
thw3WNLWOCl5rtOQ3rKjy/o/QQfsjNHeb9XBfF4lmyY6ASeXQcJmVEK/XEQGVSJr
71v7Q8ONFHgw44WJbIPeZcWRqcVGgnH08s/aQS890tZUyMBHAOzUqbNX5pBWlfnf
btSMdK4KNikldgKBxZXQfIFRq8gpHjMVUfzhdGQ+IiZAqjipEipjlz/uS432oybR
Nhukw8Lfr+LlwRvfzeCdV7/2qqLER+LFfJP8Q1jPb0fa/ET3A36Mwrd1ew3lMcLm
+24BUDNUhcKSUMIMEeHZKnbW3/UnuRu8EMh0htdviB+08hKW9z4=
=w455
-----END PGP SIGNATURE-----
Merge tag 'hid-for-linus-2026041601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID updates from Jiri Kosina:
"Core:
- fixed handling of 0-sized reports (Dmitry Torokhov)
- convert core code to __free() (Dmitry Torokhov)
- support for multiple batteries per HID device (Lucas Zampieri)
Drivers:
- support for rumble effects in winwing driver (Ivan Gorinov)
- new support for a variety of Sony Rock Band and Sony DJ Hero
Turntable devices (Rosalie Wanders)
- new driver for Lenovo Legion Go / S devices (Derek J. Clark)
- power management improvements to intel-thc-hid driver (Even Xu)
... other assorted cleanups, fixes and device-specific quirks"
* tag 'hid-for-linus-2026041601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (73 commits)
HID: core: clamp report_size in s32ton() to avoid undefined shift
HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
HID: logitech-hidpp: fix race condition when accessing stale stack pointer
HID: winwing: Enable rumble effects
HID: core: do not allow parsing 0-sized reports
HID: usbhid: refactor endpoint lookup
HID: huawei: fix CD30 keyboard report descriptor issue
HID: playstation: validate num_touch_reports in DualShock 4 reports
HID: drop 'default !EXPERT' from tristate symbols
HID: usbhid: fix deadlock in hid_post_reset()
HID: apple: ensure the keyboard backlight is off if suspending
HID: quirks: Set ALWAYS_POLL for LOGITECH_BOLT_RECEIVER
HID: alps: fix NULL pointer dereference in alps_raw_event()
HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
HID: logitech-dj: Standardise hid_report_enum variable nomenclature
HID: sony: update module description
HID: logitech-hidpp: Check bounds when deleting force-feedback effects
HID: sony: add battery status support for Rock Band 4 PS5 guitars
HID: sony: fix style issues
HID: quirks: update hid-sony supported devices
...
|
||
|
Linus Torvalds
|
87768582a4 |
dma-mapping updates for Linux 7.0:
- added support for batched cache sync, what improves performance of
dma_map/unmap_sg() operations on ARM64 architecture (Barry Song)
- introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory
used in confidential computing (Jiri Pirko)
- refactored spaghetti-like code in drivers/of/of_reserved_mem.c and its
clients (Marek Szyprowski, shared branch with device-tree updates to
avoid merge conflicts)
- prepared Contiguous Memory Allocator related code for making dma-buf
drivers modularized (Maxime Ripard)
- added support for benchmarking dma_map_sg() calls to tools/dma utility
(Qinxin Xia)
-----BEGIN PGP SIGNATURE-----
iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaeCbdQAKCRCJp1EFxbsS
RHbWAQCt70dzrU0lu0omTR1HdDP4GTYfuM6nZR91e8/itGN1+QD/XH4I/0wuybzk
v5uxbIC6lR3abQRc3YNRXfi+i5j26A4=
=Oee2
-----END PGP SIGNATURE-----
Merge tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
Pull dma-mapping updates from Marek Szyprowski:
- added support for batched cache sync, what improves performance of
dma_map/unmap_sg() operations on ARM64 architecture (Barry Song)
- introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory
used in confidential computing (Jiri Pirko)
- refactored spaghetti-like code in drivers/of/of_reserved_mem.c and
its clients (Marek Szyprowski, shared branch with device-tree updates
to avoid merge conflicts)
- prepared Contiguous Memory Allocator related code for making dma-buf
drivers modularized (Maxime Ripard)
- added support for benchmarking dma_map_sg() calls to tools/dma
utility (Qinxin Xia)
* tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: (24 commits)
dma-buf: heaps: system: document system_cc_shared heap
dma-buf: heaps: system: add system_cc_shared heap for explicitly shared memory
dma-mapping: introduce DMA_ATTR_CC_SHARED for shared memory
mm: cma: Export cma_alloc(), cma_release() and cma_get_name()
dma: contiguous: Export dev_get_cma_area()
dma: contiguous: Make dma_contiguous_default_area static
dma: contiguous: Make dev_get_cma_area() a proper function
dma: contiguous: Turn heap registration logic around
of: reserved_mem: rework fdt_init_reserved_mem_node()
of: reserved_mem: clarify fdt_scan_reserved_mem*() functions
of: reserved_mem: rearrange code a bit
of: reserved_mem: replace CMA quirks by generic methods
of: reserved_mem: switch to ops based OF_DECLARE()
of: reserved_mem: use -ENODEV instead of -ENOENT
of: reserved_mem: remove fdt node from the structure
dma-mapping: fix false kernel-doc comment marker
dma-mapping: Support batch mode for dma_direct_{map,unmap}_sg
dma-mapping: Separate DMA sync issuing and completion waiting
arm64: Provide dcache_inval_poc_nosync helper
arm64: Provide dcache_clean_poc_nosync helper
...
|
||
Mark Brown
|
83ef26f911 |
selftests: Fix duplicated test number reporting
Commit |
||
|
Linus Torvalds
|
d662a710c6 |
dmaengine updates for v7.1
Core:
- New devm_of_dma_controller_register() API
New Support:
- Support for RZ/G3L SoC
- Loongson Multi-Channel DMA controller support
- Conversion of Xilinx AXI DMA binding
- DW AXI CV1800B DMA support
- Switchtec DMA engine driver
Updates:
- AMD MDB Endpoint and non-LL mode support
- DW edma virtual IRQ for interrupt-emulation, cyclic transfers support
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh8XgACgkQfBQHDyUj
g0e7WQ//d6UvT8cv+2OUtbM3I3OeqhiHJvTYvuLLWkxG1vm5vCj3h8gvaeI+2GiP
dN6UhKTMZz0fn3lacCaYBDL3ebR2P3z9HuXPljz5kxr+akM58r9ehevbzY0Vgivg
jh+zw/sNYAv1Cwld75jglPaBotS2Qmne3a28WIioeGSp1QqO2veWRqFOFzL2P6Fc
EEWGB45UkgrKp4tiG8GZf3plOFu+S46oYOAsRyT26IkS/DxNlEXbLaI62XBThr5Z
4q1xJ0wLJRzFt9fMyBJ3Uz/pPui1TXb8R1060Vx1TPXgKF0g2qtMLmEoJ1rw1u4t
8w49po1YvDHV7NuC6ZuXdQTb7J9X8+q5/IyK3794pKKz+2jM1CS3FN6Z0VEYvvQQ
nhFnLAvtW0ziKL1+U3P9FJnI7ztbgMpltvQ3NGuNC0bp3JMoOaVcMr01M7sMMzpl
gX0qtWZO94jTO5dYjFvLUQU9HtM1rG/3p7o99RtGfe1EKudF7w209LLYC5g6OSm/
s2I4MNOirViKUhweEU2PbFxTgaPWbIlp/UewEvKQrnmxmikgzzYDVoMTjq8fGt3X
uyxaAudFBMVWrAHlk3RLjTgYew8njqahjNzTR05atWLRpawbULQKHKHW1UFuxJTI
apsjbbrlZCT4tIyYZT0XSt3KzEtB+4KwYMBzV2S5b0q0DQuvGJQ=
=uoUT
-----END PGP SIGNATURE-----
Merge tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine updates from Vinod Koul:
"Core:
- New devm_of_dma_controller_register() API
New Support:
- Support for RZ/G3L SoC
- Loongson Multi-Channel DMA controller support
- Conversion of Xilinx AXI DMA binding
- DW AXI CV1800B DMA support
- Switchtec DMA engine driver
Updates:
- AMD MDB Endpoint and non-LL mode support
- DW edma virtual IRQ for interrupt-emulation, cyclic transfers support"
* tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (65 commits)
dmaengine: dw-edma: Add non-LL mode
dmaengine: dw-edma: Add AMD MDB Endpoint Support
dt-bindings: dmaengine: Fix spelling mistake "Looongson" -> "Looogson"
dmaengine: loongson: Fix spelling mistake "Looongson" -> "Looogson"
dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller
dt-bindings: dmaengine: Add Loongson Multi-Channel DMA controller
dmaengine: loongson: loongson2-apb: Simplify locking with guard() and scoped_guard()
dmaengine: loongson: loongson2-apb: Convert to devm_clk_get_enabled()
dmaengine: loongson: loongson2-apb: Convert to dmaenginem_async_device_register()
dmaengine: loongson: New directory for Loongson DMA controllers drivers
dt-bindings: dma: xlnx,axi-dma: Convert to DT schema
dt-bindings: dma: rz-dmac: Add conditional schema for RZ/G3L
dmaengine: sh: rz-dmac: Add device_{pause,resume}() callbacks
dmaengine: sh: rz-dmac: Add device_tx_status() callback
dmaengine: sh: rz-dmac: Use rz_lmdesc_setup() to invalidate descriptors
dmaengine: sh: rz-dmac: Drop unnecessary local_irq_save() call
dmaengine: sh: rz-dmac: Drop goto instruction and label
dmaengine: sh: rz-dmac: Drop read of CHCTRL register
dmaengine: sh: rz_dmac: add RZ/{T2H,N2H} support
dt-bindings: dma: renesas,rz-dmac: document RZ/{T2H,N2H}
...
|
||
cuitao
|
c802f460dd |
cgroup/rdma: fix integer overflow in rdmacg_try_charge()
The expression `rpool->resources[index].usage + 1` is computed in int
arithmetic before being assigned to s64 variable `new`. When usage equals
INT_MAX (the default "max" value), the addition overflows to INT_MIN.
This negative value then passes the `new > max` check incorrectly,
allowing a charge that should be rejected and corrupting usage to
negative.
Fix by casting usage to s64 before the addition so the arithmetic is
done in 64-bit.
Fixes:
|
||
Edward Adam Davis
|
a5b98009f1 |
sched/psi: fix race between file release and pressure write
A potential race condition exists between pressure write and cgroup file
release regarding the priv member of struct kernfs_open_file, which
triggers the uaf reported in [1].
Consider the following scenario involving execution on two separate CPUs:
CPU0 CPU1
==== ====
vfs_rmdir()
kernfs_iop_rmdir()
cgroup_rmdir()
cgroup_kn_lock_live()
cgroup_destroy_locked()
cgroup_addrm_files()
cgroup_rm_file()
kernfs_remove_by_name()
kernfs_remove_by_name_ns()
vfs_write() __kernfs_remove()
new_sync_write() kernfs_drain()
kernfs_fop_write_iter() kernfs_drain_open_files()
cgroup_file_write() kernfs_release_file()
pressure_write() cgroup_file_release()
ctx = of->priv;
kfree(ctx);
of->priv = NULL;
cgroup_kn_unlock()
cgroup_kn_lock_live()
cgroup_get(cgrp)
cgroup_kn_unlock()
if (ctx->psi.trigger) // here, trigger uaf for ctx, that is of->priv
The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards
the memory deallocation of of->priv performed within cgroup_file_release().
However, the operations involving of->priv executed within pressure_write()
are not entirely covered by the protection of cgroup_mutex. Consequently,
if the code in pressure_write(), specifically the section handling the
ctx variable executes after cgroup_file_release() has completed, a uaf
vulnerability involving of->priv is triggered.
Therefore, the issue can be resolved by extending the scope of the
cgroup_mutex lock within pressure_write() to encompass all code paths
involving of->priv, thereby properly synchronizing the race condition
occurring between cgroup_file_release() and pressure_write().
And, if an live kn lock can be successfully acquired while executing
the pressure write operation, it indicates that the cgroup deletion
process has not yet reached its final stage; consequently, the priv
pointer within open_file cannot be NULL. Therefore, the operation to
retrieve the ctx value must be moved to a point *after* the live kn
lock has been successfully acquired.
In another situation, specifically after entering cgroup_kn_lock_live()
but before acquiring cgroup_mutex, there exists a different class of
race condition:
CPU0: write memory.pressure CPU1: write cgroup.pressure=0
=========================== =============================
kernfs_fop_write_iter()
kernfs_get_active_of(of)
pressure_write()
cgroup_kn_lock_live(memory.pressure)
cgroup_tryget(cgrp)
kernfs_break_active_protection(kn)
... blocks on cgroup_mutex
cgroup_pressure_write()
cgroup_kn_lock_live(cgroup.pressure)
cgroup_file_show(memory.pressure, false)
kernfs_show(false)
kernfs_drain_open_files()
cgroup_file_release(of)
kfree(ctx)
of->priv = NULL
cgroup_kn_unlock()
... acquires cgroup_mutex
ctx = of->priv; // may now be NULL
if (ctx->psi.trigger) // NULL dereference
Consequently, there is a possibility that of->priv is NULL, the pressure
write needs to check for this.
Now that the scope of the cgroup_mutex has been expanded, the original
explicit cgroup_get/put operations are no longer necessary, this is
because acquiring/releasing the live kn lock inherently executes a
cgroup get/put operation.
[1]
BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011
Call Trace:
pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011
cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:4311
kernfs_fop_write_iter+0x3b0/0x540 fs/kernfs/file.c:352
Allocated by task 9352:
cgroup_file_open+0x90/0x3a0 kernel/cgroup/cgroup.c:4256
kernfs_fop_open+0x9eb/0xcb0 fs/kernfs/file.c:724
do_dentry_open+0x83d/0x13e0 fs/open.c:949
Freed by task 9353:
cgroup_file_release+0xd6/0x100 kernel/cgroup/cgroup.c:4283
kernfs_release_file fs/kernfs/file.c:764 [inline]
kernfs_drain_open_files+0x392/0x720 fs/kernfs/file.c:834
kernfs_drain+0x470/0x600 fs/kernfs/dir.c:525
Fixes:
|
||
|
Linus Torvalds
|
3f887edd35 |
phy-for-7.1
- New Support - Qualcomm Eliza QMP UFS PHY - Canaan K230 USB 2.0 PHY driver - Mediatek mt8167 dsi-phy - Eswin EIC7700 SATA PHY driver - Updates - Sorted subsytem Makefile/Kconfig and some kernel-doc udpates -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh4msACgkQfBQHDyUj g0ctew/+K/rVLCUu/UgbvnV1hPH3q/OCytwcymurSp5+lZ2TGsHcwjzGNKrGxCAp nxgzffHwukyuRGq/FHDc1QQa+i5bDzf6dlE3CuZYnZWka8mxbqcBetMQvLb93LXL 9MEQ8YQgjh96AyX87sP0r5IhBVLl3LiGHj2+L6VXoTzMsJeqT6Kx2rABHgFjXM97 gjurp1PbHwi2EGQowa9zjsoQnRnN2C4O2xlZsXeNljzS2KPpToQ+sjADwHSau8nw b9idowJlJMlN+RFrNKJWgja7ro/E17IGQptJT9Hz89j2dXg0QiWIY/uok25o6XAn h0yYWpXP6gaQH1mnpS5Meb8d+ljTL4SNLv/64pYSGPzqXUbuJXVx2Rn7ZBuB3R/H +pmVbrdWSUwhXcgXDyVCMLguhCxns4M/SmaYrjVayrogDiz9gqHlGMTfsSmYCnbI UDqHyFSa6HRZIFnba0pBkb3eyrKE9qMK0FFgQURQp8GCOJu8waeNyCZ4fTCjXo6v MULhauFWDC267LNogt6KGgTC6sFmsitsI8jymMQGfb3g6FdhJUFpQLmNvwYpoHXH AofeTHrzdXWRVNiVKO01J2tPskVCczx5R5q5dfDGTM0mIRXMaHCuzT2RNdRmBpNk rgBlCvIiiE9VbusN+zybPQfTJAQa2eVMTvBRzjwkdLUYeMUJS0I= =qz0Z -----END PGP SIGNATURE----- Merge tag 'phy-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "New Support: - Qualcomm Eliza QMP UFS PHY - Canaan K230 USB 2.0 PHY driver - Mediatek mt8167 dsi-phy - Eswin EIC7700 SATA PHY driver Updates: - Sorted subsytem Makefile/Kconfig and some kernel-doc udpates" * tag 'phy-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: document the Eliza QMP UFS PHY phy: qcom: m31-eusb2: clear PLL_EN during init phy: eswin: Create eswin directory and add EIC7700 SATA PHY driver dt-bindings: phy: eswin: Document the EIC7700 SoC SATA PHY phy: apple: apple: Use local variable for ioremap return value phy: qcom: qmp-usbc: Simplify check for non-NULL pointer phy: marvell: mmp3-hsic: Avoid re-casting __iomem phy: apple: atc: Make atcphy_dwc3_reset_ops variable static dt-bindings: phy: mediatek,dsi-phy: Add support for mt8167 phy: usb: Add driver for Canaan K230 USB 2.0 PHY dt-bindings: phy: Add Canaan K230 USB PHY phy: phy-mtk-tphy: Update names and format of kernel-doc comments phy: Sort the subsystem Kconfig phy: Sort the subsystem Makefile phy: move spacemit pcie driver to its subfolder |
||
|
Linus Torvalds
|
65bec0c4ea |
soundwire updates for 7.1
- Core: DP prepare polling for avoiding interrupt deadlock - AMD clock init and bandwidth refactoring - Intel more codecs to wake list, clear message on before signaling waiting thread -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh3twACgkQfBQHDyUj g0eZwhAApdSFRhk43yNAMWr33Vxb+IFjRylNaJb6h5IWS7+0Z3yfq6zOuM3tW7Yh C9804L0RkncHwq6th0T5pi3neAwm/dVi1zmnzXiAe5Kgzl/Eru4ZNMh59VD8aNwQ K/emES6AJR6ulezYHNDE5Y74kjQHzMQUWiUo1DoAapoqr+WnZvfK+ZYAYh7I/ctY FxzBxx13yIHInDHsl3WQ+r1CSinDEe3RiQHW5+5DWdmmw8LfHLGUBBFIJQcVxRN/ 8NlNYr1wvRxUij11cZMPc3TetPfSsIGFpa7eOKezX1P9GxwY7qWvPvPmO0kzgLvH AsbFXOHZKYbtPy87agF1QdGq0Seym9x6OhNFucXs1yXIk1t/isv9bOrrOOmnSbR2 U3ycbMCUmJEUKhd7MWPWRaFUCEM2j/CRugFwpIbeE7AgJ5hZIUXlfWykDdlFxDTM e9IQ1jMTSnwyXs705FLLF3hxjIIAWS1kHIgEPWrxuSkAD9/Xx6sbD2fca7Ca6qrm W90TlprDAj/KiisEvje0tjEfZ8fTUanLC67d2sbxtrpzwpus4u8GzD62RAgsLlYP y9qGeAE1I5FMtJB83dewiYPCIofoez4DizM5wemojI+TtmvZwEWYfeXievD3ibad xN3uXtX6fqZ6BWUVIaxjdhSEB2FYdaZjTWPSmcUIwKlApOso0dY= =0cvn -----END PGP SIGNATURE----- Merge tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: - Core: DP prepare polling for avoiding interrupt deadlock - AMD clock init and bandwidth refactoring - Intel more codecs to wake list, clear message on before signaling waiting thread * tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: intel_auxdevice: Add cs42l49 to wake_capable_list soundwire: cadence: Clear message complete before signaling waiting thread soundwire: Intel: test bus.bpt_stream before assigning it soundwire: bus: demote UNATTACHED state warnings to dev_dbg() soundwire: stream: Poll for DP prepare to avoid interrupt deadlock soundwire: amd: refactor bandwidth calculation logic soundwire: amd: add clock init control function soundwire: intel_auxdevice: Add CS47L47 to wake_capable_list soundwire: slave: Don't register devices that are disabled in ACPI soundwire: sdw.h: repair names and format of kernel-doc comments |
||
Puranjay Mohan
|
2845989f2e |
bpf: Validate node_id in arena_alloc_pages()
arena_alloc_pages() accepts a plain int node_id and forwards it through
the entire allocation chain without any bounds checking.
Validate node_id before passing it down the allocation chain in
arena_alloc_pages().
Fixes:
|
||
|
Linus Torvalds
|
0b6bc3dbe6 |
tracing latency updates for 7.1:
- Add TIMERLAT_ALIGN osnoise option Add a timer alignment option for timerlat that makes it work like the cyclictest -A option. timelat creates threads to test the latency of the kernel. The alignment option will have these threads trigger at the alignment offsets from each other. Instead of having each thread wake up at the exact same time, if the alignment is set to "20" each thread will wake up at 20 microseconds from the previous one. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaeIBaBQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qqM8AQCyz4uL1lCLQtJb5thG8V9QFRkYh5F3 +DyuRNoht3ijyAD+K4nZPAu4F09feWuHkssONtSZECKEuN6EhiHE4XX6Pgc= =WYYW -----END PGP SIGNATURE----- Merge tag 'trace-latency-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing latency update from Steven Rostedt: - Add TIMERLAT_ALIGN osnoise option Add a timer alignment option for timerlat that makes it work like the cyclictest -A option. timelat creates threads to test the latency of the kernel. The alignment option will have these threads trigger at the alignment offsets from each other. Instead of having each thread wake up at the exact same time, if the alignment is set to "20" each thread will wake up at 20 microseconds from the previous one. * tag 'trace-latency-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/osnoise: Add option to align tlat threads |
||
Ben Horgan
|
4d5bbbafc1 |
arm_mpam: resctrl: Make resctrl_mon_ctx_waiters static
resctrl_mon_ctx_waiters is not used outside of this file, so make it
static. This fixes the sparse warning:
drivers/resctrl/mpam_resctrl.c:25:1: warning: symbol 'resctrl_mon_ctx_waiters' was not declared. Should it be static?
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202603281842.c2K96tJA-lkp@intel.com/
Fixes:
|
||
|
Ben Horgan
|
67c0a487ef |
arm_mpam: resctrl: Fix the check for no monitor components found
Dan Carpenter reports that, in mpam_resctrl_alloc_domain(), any_mon_comp is
used in an 'if' condition when it may be uninitialized. Initialize it to
NULL so that the check behaves correctly when no monitor components are
found.
Reported-by: Dan Carpenter <error27@gmail.com>
Fixes:
|
||
Zeng Heng
|
f758340da5 |
arm_mpam: resctrl: Fix MBA CDP alloc_capable handling on unmount
The code to set MBA's alloc_capable to true appears to be trying to
restore alloc_capable on unmount. This can never work because
resctrl_arch_set_cdp_enabled() is never invoked with RDT_RESOURCE_MBA
as the rid parameter. Consequently,
mpam_resctrl_controls[RDT_RESOURCE_MBA].cdp_enabled always remains false.
The alloc_capable setting in resctrl_arch_set_cdp_enabled() is to
re-enable MBA if the caller opts in to separate control values using
CDP for this resource. This doesn't happen today.
Add a comment to describe this.
However a bug remains where MBA allocation is permanently disabled after
the mount with CDP option. Remounting without CDP cannot restore the MBA
partition capability.
Add a check to re-enable MBA when CDP is disabled, which happens on
unmount.
Fixes:
|
||
|
Linus Torvalds
|
cb30bf881c |
tracing updates for v7.1:
- Fix printf format warning for bprintf
sunrpc uses a trace_printk() that triggers a printf warning during the
compile. Move the __printf() attribute around for when debugging is not
enabled the warning will go away.
- Remove redundant check for EVENT_FILE_FL_FREED in event_filter_write()
The FREED flag is checked in the call to event_file_file() and then
checked again right afterward, which is unneeded.
- Clean up event_file_file() and event_file_data() helpers
These helper functions played a different role in the past, but now with
eventfs, the READ_ONCE() isn't needed. Simplify the code a bit and also
add a warning to event_file_data() if the file or its data is not present.
- Remove updating file->private_data in tracing open
All access to the file private data is handled by the helper functions,
which do not use file->private_data. Stop updating it on open.
- Show ENUM names in function arguments via BTF in function tracing
When showing the function arguments when func-args option is set for
function tracing, if one of the arguments is found to be an enum, show the
name of the enum instead of its number.
- Add new trace_call__##name() API for tracepoints
Tracepoints are enabled via static_branch() blocks, where when not
enabled, there's only a nop that is in the code where the execution will
just skip over it. When tracing is enabled, the nop is converted to a
direct jump to the tracepoint code. Sometimes more calculations are
required to be performed to update the parameters of the tracepoint. In
this case, trace_##name##_enabled() is called which is a static_branch()
that gets enabled only when the tracepoint is enabled. This allows the
extra calculations to also be skipped by the nop:
if (trace_foo_enabled()) {
x = bar();
trace_foo(x);
}
Where the x=bar() is only performed when foo is enabled. The problem with
this approach is that there's now two static_branch() calls. One for
checking if the tracepoint is enabled, and then again to know if the
tracepoint should be called. The second one is redundant.
Introduce trace_call__foo() that will call the foo() tracepoint directly
without doing a static_branch():
if (trace_foo_enabled()) {
x = bar();
trace_call__foo();
}
- Update various locations to use the new trace_call__##name() API
- Move snapshot code out of trace.c
Cleaning up trace.c to not be a "dump all", move the snapshot code out of
it and into a new trace_snapshot.c file.
- Clean up some "%*.s" to "%*s"
- Allow boot kernel command line options to be called multiple times
Have options like:
ftrace_filter=foo ftrace_filter=bar ftrace_filter=zoo
Equal to:
ftrace_filter=foo,bar,zoo
- Fix ipi_raise event CPU field to be a CPU field
The ipi_raise target_cpus field is defined as a __bitmask(). There is now a
__cpumask() field definition. Update the field to use that.
- Have hist_field_name() use a snprintf() and not a series of strcat()
It's safer to use snprintf() that a series of strcat().
- Fix tracepoint regfunc balancing
A tracepoint can define a "reg" and "unreg" function that gets called
before the tracepoint is enabled, and after it is disabled respectively.
But on error, after the "reg" func is called and the tracepoint is not
enabled, the "unreg" function is not called to tear down what the "reg"
function performed.
- Fix output that shows what histograms are enabled
Event variables are displayed incorrectly in the histogram output.
Instead of "sched.sched_wakeup.$var", it is showing
"$sched.sched_wakeup.var" where the '$' is in the incorrect location.
- Some other simple cleanups.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaeCpvxQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qt2WAP44m85BbAjBqJe4WR103eOXV+bREBta
dRoReKJOMe519gEAp0rK/HoCvHgHhIGe3gaGdIsNhnaxoFyNWMG/wokoLAY=
=Hg6+
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing updates from Steven Rostedt:
- Fix printf format warning for bprintf
sunrpc uses a trace_printk() that triggers a printf warning during
the compile. Move the __printf() attribute around for when debugging
is not enabled the warning will go away
- Remove redundant check for EVENT_FILE_FL_FREED in
event_filter_write()
The FREED flag is checked in the call to event_file_file() and then
checked again right afterward, which is unneeded
- Clean up event_file_file() and event_file_data() helpers
These helper functions played a different role in the past, but now
with eventfs, the READ_ONCE() isn't needed. Simplify the code a bit
and also add a warning to event_file_data() if the file or its data
is not present
- Remove updating file->private_data in tracing open
All access to the file private data is handled by the helper
functions, which do not use file->private_data. Stop updating it on
open
- Show ENUM names in function arguments via BTF in function tracing
When showing the function arguments when func-args option is set for
function tracing, if one of the arguments is found to be an enum,
show the name of the enum instead of its number
- Add new trace_call__##name() API for tracepoints
Tracepoints are enabled via static_branch() blocks, where when not
enabled, there's only a nop that is in the code where the execution
will just skip over it. When tracing is enabled, the nop is converted
to a direct jump to the tracepoint code. Sometimes more calculations
are required to be performed to update the parameters of the
tracepoint. In this case, trace_##name##_enabled() is called which is
a static_branch() that gets enabled only when the tracepoint is
enabled. This allows the extra calculations to also be skipped by the
nop:
if (trace_foo_enabled()) {
x = bar();
trace_foo(x);
}
Where the x=bar() is only performed when foo is enabled. The problem
with this approach is that there's now two static_branch() calls. One
for checking if the tracepoint is enabled, and then again to know if
the tracepoint should be called. The second one is redundant
Introduce trace_call__foo() that will call the foo() tracepoint
directly without doing a static_branch():
if (trace_foo_enabled()) {
x = bar();
trace_call__foo();
}
- Update various locations to use the new trace_call__##name() API
- Move snapshot code out of trace.c
Cleaning up trace.c to not be a "dump all", move the snapshot code
out of it and into a new trace_snapshot.c file
- Clean up some "%*.s" to "%*s"
- Allow boot kernel command line options to be called multiple times
Have options like:
ftrace_filter=foo ftrace_filter=bar ftrace_filter=zoo
Equal to:
ftrace_filter=foo,bar,zoo
- Fix ipi_raise event CPU field to be a CPU field
The ipi_raise target_cpus field is defined as a __bitmask(). There is
now a __cpumask() field definition. Update the field to use that
- Have hist_field_name() use a snprintf() and not a series of strcat()
It's safer to use snprintf() that a series of strcat()
- Fix tracepoint regfunc balancing
A tracepoint can define a "reg" and "unreg" function that gets called
before the tracepoint is enabled, and after it is disabled
respectively. But on error, after the "reg" func is called and the
tracepoint is not enabled, the "unreg" function is not called to tear
down what the "reg" function performed
- Fix output that shows what histograms are enabled
Event variables are displayed incorrectly in the histogram output
Instead of "sched.sched_wakeup.$var", it is showing
"$sched.sched_wakeup.var" where the '$' is in the incorrect location
- Some other simple cleanups
* tag 'trace-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (24 commits)
selftests/ftrace: Add test case for fully-qualified variable references
tracing: Fix fully-qualified variable reference printing in histograms
tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
tracing: Rebuild full_name on each hist_field_name() call
tracing: Report ipi_raise target CPUs as cpumask
tracing: Remove duplicate latency_fsnotify() stub
tracing: Preserve repeated trace_trigger boot parameters
tracing: Append repeated boot-time tracing parameters
tracing: Remove spurious default precision from show_event_trigger/filter formats
cpufreq: Use trace_call__##name() at guarded tracepoint call sites
tracing: Remove tracing_alloc_snapshot() when snapshot isn't defined
tracing: Move snapshot code out of trace.c and into trace_snapshot.c
mm: damon: Use trace_call__##name() at guarded tracepoint call sites
btrfs: Use trace_call__##name() at guarded tracepoint call sites
spi: Use trace_call__##name() at guarded tracepoint call sites
i2c: Use trace_call__##name() at guarded tracepoint call sites
kernel: Use trace_call__##name() at guarded tracepoint call sites
tracepoint: Add trace_call__##name() API
tracing: trace_mmap.h: fix a kernel-doc warning
tracing: Pretty-print enum parameters in function arguments
...
|
||
|
Linus Torvalds
|
c9e03d5948 |
Probes updates for v7.1
- fprobe: do not zero out unused fgraph_data. This removes unneeded memset of fgraph_data in fprobe entry handler. -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmnhhjEbHG1hc2FtaS5o aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bfBMH/21EM4dL2oDrsR3Ud7G+ R1LYB959jkztJlIKQ9xGBdUpyMd97JYszknpTG4QHb7XW4FrcvZMiHeT9AW6ZBzw zJkWVbSCst7sNYpjmqFcf/p3uUJp3/jHNG6byQ2/oWW9bilWPitY1LDL8u/VwzWN ZN35B09bw2IgKXbxCNoNlASdV8w/nnVI+CEjKSbLJBVQffBzU9losLt5Qu1i5w/A Q5O5ZLkeawQhRzilxVAqae7U949MzRvn28EiLyMJ4rJA0vWH+ijg7vFYmC4hnFde GNzJ7q7S87BmApTsSVT+QBCpIGd2XjLYfiYZBBoZIZE2wXI4fxgF+cd05XE51hrG mTs= =ycSD -----END PGP SIGNATURE----- Merge tag 'probes-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull fprobe update from Masami Hiramatsu: - do not zero out unused fgraph_data. This removes unneeded memset of fgraph_data in fprobe entry handler. * tag 'probes-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: fprobe: do not zero out unused fgraph_data |
||
|
Linus Torvalds
|
829000f789 |
Bootconfig for v7.1:
- bootconfig: Minor fixes for handling errors, which includes
the following commits:
. fix off-by-one in xbc_verify_tree() next node check
. increment xbc_node_num after node init succeeds
. validate child node index in xbc_verify_tree()
- bootconfig: Code cleanups (mainly type/attribute changes), which
includes the following commits.
. clean up comment typos and bracing
. drop redundant memset of xbc_nodes
. replace linux/kernel.h with specific includes
. narrow flag parameter type from uint32_t to uint16_t
. constify xbc_calc_checksum() data parameter
. fix signed comparison in xbc_node_get_data()
. use size_t for strlen result in xbc_node_match_prefix()
. use signed type for offset in xbc_init_node()
. use size_t for key length tracking in xbc_verify_tree()
. change xbc_node_index() return type to uint16_t
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmncYnAbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bYZoH/2/lHKTucvTYAcyz039Z
73l8IPz8aIQPTLaqrQ0JBVRD0FnT0lZZRla+p4mZFMFu+gek5kd6y2wj5seEkgR1
tKhdY3YNP5c0NNpN5fsft4hCO9rShEdS0B3NsIiZ62onFAAKOgDd9ON2CQw4LlkJ
cv3Y3Ax0y0EYDNqh+OuV2sDkEv74sR7NpekxnC+RBi/v+cF8q5uSHusnRYs6PQng
zRnjluKT0Ahfmzi80WRinSfj+wNcCMoDKngxwNu+VZ14w8lGfYV4G318QCNH24IB
+8bb3Uu/LZ47kxbcCdW5yYzC2KgJbnhp7HWhyw7bPx8ANoRHM8VlFU9qJzODI7JN
eLw=
=1AAh
-----END PGP SIGNATURE-----
Merge tag 'bootconfig-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig updates from Masami Hiramatsu:
"Minor fixes for handling errors:
- fix off-by-one in xbc_verify_tree() next node check
- increment xbc_node_num after node init succeeds
- validate child node index in xbc_verify_tree()
Code cleanups (mainly type/attribute changes):
- clean up comment typos and bracing
- drop redundant memset of xbc_nodes
- replace linux/kernel.h with specific includes
- narrow flag parameter type from uint32_t to uint16_t
- constify xbc_calc_checksum() data parameter
- fix signed comparison in xbc_node_get_data()
- use size_t for strlen result in xbc_node_match_prefix()
- use signed type for offset in xbc_init_node()
- use size_t for key length tracking in xbc_verify_tree()
- change xbc_node_index() return type to uint16_t"
* tag 'bootconfig-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
lib/bootconfig: change xbc_node_index() return type to uint16_t
lib/bootconfig: use size_t for key length tracking in xbc_verify_tree()
lib/bootconfig: use signed type for offset in xbc_init_node()
lib/bootconfig: use size_t for strlen result in xbc_node_match_prefix()
lib/bootconfig: fix signed comparison in xbc_node_get_data()
lib/bootconfig: validate child node index in xbc_verify_tree()
lib/bootconfig: replace linux/kernel.h with specific includes
bootconfig: constify xbc_calc_checksum() data parameter
lib/bootconfig: drop redundant memset of xbc_nodes
lib/bootconfig: increment xbc_node_num after node init succeeds
lib/bootconfig: fix off-by-one in xbc_verify_tree() next node check
lib/bootconfig: narrow flag parameter type from uint32_t to uint16_t
lib/bootconfig: clean up comment typos and bracing
|
||
Max Zhen
|
506255d46b |
accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer
The management mailbox channel cleanup helpers can be called from
error handling paths when mgmt_chann has already been destroyed.
Add NULL checks to xdna_mailbox_free_channel() and
xdna_mailbox_stop_channel() so the cleanup path safely returns instead
of dereferencing a NULL mailbox channel pointer.
Fixes:
|
||
|
Max Zhen
|
d8c33b9c4b |
accel/amdxdna: Get device revision to derive VBNV string
Add support for querying the device revision from firmware. Use the returned revision to look up the VBNV string during device initialization, and fall back to the default VBNV when the revision query is not supported or no mapping is found. This allows the driver to report the accurate VBNV for devices that share the same vendor/device ID but differ by hardware revision. Signed-off-by: Max Zhen <max.zhen@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> [Lizhi: Revise amdxdna_vbnv_init()] Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260416190150.1040067-1-lizhi.hou@amd.com |
||
|
Linus Torvalds
|
d730905bc3 |
Support for Mobileye EyeQ6Lplus
Cleanups and fixes -----BEGIN PGP SIGNATURE----- iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmniNBwaHHRzYm9nZW5k QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHB2QA//U53JZYmmOxKxwbYwLvK9 Z8MuVgkvA/v7WktwL2PoMO0AlhQsteM5VtupddHhuhUiIr7gPy6Z7pEE9sDqM3gj p1d6vrg5XiWlh1fURdSqvzufKsm/etpElbvc2JjkcqD0sMGJUwlkP3ncZk/DCus6 zhcvya7jVxyvzbCBgJSM8QHvOoj/g3EV4hsx8Ymru8XSdLVEegodZtvUHVx4Q29U fmHCf1u/v+rJVbe2T3nuqsqzQhmaWkC+WyeVJIDUNecjclPoGNOeg8duICNfOu9q dtkzOua7v6rRsUA9GDbMcR44PWzL4LqGTOffzwF7uvYakOAp6nQWsymAUIfkQbE6 +I8heGaYPEQLjSHgCPI2WdJ4urbPdgsd5W2pC8s6WaHPdRlSMapH16I0DxmmNZlV CzW7o2ore5b8H4Mu5mboMjFzMY+A/0zC5S7twOpX+mvgPz+MTf1g0vD3hCSL+N7c LSW7rSZyd2smcgaHJBDpHceRHNZbVqloeO007DiJtrx+IWTBhvhFt2q/aqGG51xM 2P/lRZrA8vAMaTR1hZKLmxUPZpSekezoWC8GbWNeIg5NUUTOJoTAtQvT5vU40GZA 22o3s1a6rgz5KngV9rMWYERSV2yflvloYVo0ASVqgy1ijzzlsin/fbO976GdGD2I 7vrch6tajmTSBYeG0SuKiFY= =jKsJ -----END PGP SIGNATURE----- Merge tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - Support for Mobileye EyeQ6Lplus - Cleanups and fixes * tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits) MIPS/mtd: Handle READY GPIO in generic NAND platform data MIPS/input: Move RB532 button to GPIO descriptors MIPS: validate DT bootargs before appending them MIPS: Alchemy: Remove unused forward declaration MAINTAINERS: Mobileye: Add EyeQ6Lplus files MIPS: config: add eyeq6lplus_defconfig MIPS: Add Mobileye EyeQ6Lplus evaluation board dts MIPS: Add Mobileye EyeQ6Lplus SoC dtsi clk: eyeq: Add Mobileye EyeQ6Lplus OLB clk: eyeq: Adjust PLL accuracy computation clk: eyeq: Skip post-divisor when computing PLL frequency pinctrl: eyeq5: Add Mobileye EyeQ6Lplus OLB pinctrl: eyeq5: Use match data reset: eyeq: Add Mobileye EyeQ6Lplus OLB MIPS: Add Mobileye EyeQ6Lplus support dt-bindings: soc: mobileye: Add EyeQ6Lplus OLB dt-bindings: mips: Add Mobileye EyeQ6Lplus SoC MIPS: dts: loongson64g-package: Switch to Loongson UART driver mips: pci-mt7620: rework initialization procedure mips: pci-mt7620: add more register init values ... |
||
Cássio Gabriel
|
a3542d1b30 |
ALSA: caiaq: Fix control_put() result and cache rollback
control_put() always returns 1 and updates cdev->control_state[]
before sending the USB command. It also ignores transport errors
from usb_bulk_msg(), snd_usb_caiaq_send_command(), and
snd_usb_caiaq_send_command_bank().
That breaks the ALSA .put() contract and can leave control_get()
reporting a cached value the device never accepted.
Return 0 for unchanged values, propagate transport failures,
and restore the cached byte when the write fails.
Fixes:
|
||
|
Karthik Poosa
|
ffc2f7fd1c |
drm/xe/hwmon: Read accepted power limit for CRI
Update xe_hwmon_pcode_read_power_limit() and xe_hwmon_pcode_rmw_power_limit() to read the accepted power limit for discrete platforms post CRI. For platforms before CRI only the last written pcode value was available. From CRI onwards, pcode exposes a new param2 value 2 that allows reading the accepted power limit by the hardware. v2: - Read resolved power limit in xe_hwmon_pcode_rmw_power_limit() as well. (Badal) - Rephrase commit message. (Badal) - Add prepare_power_limit_param2() to prepare param2 for mailbox power limit read. Signed-off-by: Karthik Poosa <karthik.poosa@intel.com> Reviewed-by: Badal Nilawar <badal.nilawar@intel.com> Link: https://patch.msgid.link/20260323115836.3737300-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> |
||
|
Linus Torvalds
|
a10e80be63 |
alpha updates for v7.1
- alpha: Define pgprot_modify to silence tautological comparison warnings - alpha: add support for SECCOMP and SECCOMP_FILTER -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTIw07U9ivnHy+tugnaDr6nZQzE/AUCaeEX/gAKCRDaDr6nZQzE /FjpAPwMQssCV12H9JczlcTxcqUoBVCTDczxOEUxLwdhXA5UKQEAu/cxICAyaul7 6gNqwffhpOWpehGa8T8BNZeJr5wJ+Ag= =g5Lf -----END PGP SIGNATURE----- Merge tag 'alpha-for-v7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha Pull alpha updates from Magnus Lindholm: "One fix to silence pgprot_modify() compiler warnings, and one patch adding SECCOMP/SECCOMP_FILTER support together with the syscall and ptrace fixes needed for it" * tag 'alpha-for-v7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/lindholm/alpha: alpha: Define pgprot_modify to silence tautological comparison warnings alpha: add support for SECCOMP and SECCOMP_FILTER |
||
Michael Margolin
|
9091e3b59f |
RDMA/core: Fix user CQ creation for drivers without create_cq
CQ creation is failing for drivers that only implement create_user_cq
(e.g. EFA), when buffer isn't provided by userspace. This because of a
leftover check that requires create_cq existence in such case.
Remove the create_cq existence check from the no-buffer path. The
buffer is optional and drivers that handle their own memory should work
through create_user_cq regardless.
Fixes:
|
||
Matt Roper
|
ae314535c2 |
drm/xe: Drop skip_mtcfg descriptor flag
The skip_mtcfg descriptor flag is unused and expected to remain that way. Drop it. Single-tile platforms are already identified by a zero/unset value for max_remote_tiles and don't need/use this flag to avoid trying to read out multi-tile configuration. PVC is currently the only multi-tile platform, and PVC uses MTCFG so this flag is not set. The current expectation is that if/when future multi-tile platforms show up, they will also use the MTCFG register in the same manner as PVC, meaning that they won't have any need to set 'skip_mtcfg' either. Even if a future platform does change how multi-tile configuration gets probed (e.g., using some different register), simply doing an early return from xe_info_probe_tile_count() would probably not be the correct logic to handle that anyway. Bspec: 53146 Reviewed-by: Xin Wang <x.wang@intel.com> Link: https://patch.msgid.link/20260416-no-skip-mtcfg-v1-1-c8ea26d81530@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> |
||
Vincent Donnefort
|
ccab51d69b |
KVM: arm64: Re-allow hyp tracing HVCs for [nh]VHE
The introduction of __KVM_HOST_SMCCC_FUNC_MAX_NO_PKVM excluded hyp tracing HVCs from the common [nh]VHE/pKVM list. Re-allow them. Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Link: https://patch.msgid.link/20260414100231.1859687-1-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org> |
||
|
Linus Torvalds
|
01f492e181 |
Arm:
- Add support for tracing in the standalone EL2 hypervisor code, which should help both debugging and performance analysis. This uses the new infrastructure for 'remote' trace buffers that can be exposed by non-kernel entities such as firmware, and which came through the tracing tree. - Add support for GICv5 Per Processor Interrupts (PPIs), as the starting point for supporting the new GIC architecture in KVM. - Finally add support for pKVM protected guests, where pages are unmapped from the host as they are faulted into the guest and can be shared back from the guest using pKVM hypercalls. Protected guests are created using a new machine type identifier. As the elusive guestmem has not yet delivered on its promises, anonymous memory is also supported. This is only a first step towards full isolation from the host; for example, the CPU register state and DMA accesses are not yet isolated. Because this does not really yet bring fully what it promises, it is hidden behind CONFIG_ARM_PKVM_GUEST + 'kvm-arm.mode=protected', and also triggers TAINT_USER when a VM is created. Caveat emptor. - Rework the dreaded user_mem_abort() function to make it more maintainable, reducing the amount of state being exposed to the various helpers and rendering a substantial amount of state immutable. - Expand the Stage-2 page table dumper to support NV shadow page tables on a per-VM basis. - Tidy up the pKVM PSCI proxy code to be slightly less hard to follow. - Fix both SPE and TRBE in non-VHE configurations so that they do not generate spurious, out of context table walks that ultimately lead to very bad HW lockups. - A small set of patches fixing the Stage-2 MMU freeing in error cases. - Tighten-up accepted SMC immediate value to be only #0 for host SMCCC calls. - The usual cleanups and other selftest churn. LoongArch: - Use CSR_CRMD_PLV for kvm_arch_vcpu_in_kernel(). - Add DMSINTC irqchip in kernel support. RISC-V: - Fix steal time shared memory alignment checks - Fix vector context allocation leak - Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi() - Fix double-free of sdata in kvm_pmu_clear_snapshot_area() - Fix integer overflow in kvm_pmu_validate_counter_mask() - Fix shift-out-of-bounds in make_xfence_request() - Fix lost write protection on huge pages during dirty logging - Split huge pages during fault handling for dirty logging - Skip CSR restore if VCPU is reloaded on the same core - Implement kvm_arch_has_default_irqchip() for KVM selftests - Factored-out ISA checks into separate sources - Added hideleg to struct kvm_vcpu_config - Factored-out VCPU config into separate sources - Support configuration of per-VM HGATP mode from KVM user space s390: - Support for ESA (31-bit) guests inside nested hypervisors. - Remove restriction on memslot alignment, which is not needed anymore with the new gmap code. - Fix LPSW/E to update the bear (which of course is the breaking event address register). x86: - Shut up various UBSAN warnings on reading module parameter before they were initialized. - Don't zero-allocate page tables that are used for splitting hugepages in the TDP MMU, as KVM is guaranteed to set all SPTEs in the page table and thus write all bytes. - As an optimization, bail early when trying to unsync 4KiB mappings if the target gfn can just be mapped with a 2MiB hugepage. x86 generic: - Copy single-chunk MMIO write values into struct kvm_vcpu (more precisely struct kvm_mmio_fragment) to fix use-after-free stack bugs where KVM would dereference stack pointer after an exit to userspace. - Clean up and comment the emulated MMIO code to try to make it easier to maintain (not necessarily "easy", but "easier"). - Move VMXON+VMXOFF and EFER.SVME toggling out of KVM (not *all* of VMX and SVM enabling) as it is needed for trusted I/O. - Advertise support for AVX512 Bit Matrix Multiply (BMM) instructions - Immediately fail the build if a required #define is missing in one of KVM's headers that is included multiple times. - Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected exception, mostly to prevent syzkaller from abusing the uAPI to trigger WARNs, but also because it can help prevent userspace from unintentionally crashing the VM. - Exempt SMM from CPUID faulting on Intel, as per the spec. - Misc hardening and cleanup changes. x86 (AMD): - Fix and optimize IRQ window inhibit handling for AVIC; make it per-vCPU so that KVM doesn't prematurely re-enable AVIC if multiple vCPUs have to-be-injected IRQs. - Clean up and optimize the OSVW handling, avoiding a bug in which KVM would overwrite state when enabling virtualization on multiple CPUs in parallel. This should not be a problem because OSVW should usually be the same for all CPUs. - Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains about a "too large" size based purely on user input. - Clean up and harden the pinning code for KVM_MEMORY_ENCRYPT_REG_REGION. - Disallow synchronizing a VMSA of an already-launched/encrypted vCPU, as doing so for an SNP guest will crash the host due to an RMP violation page fault. - Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped queries are required to hold kvm->lock, and enforce it by lockdep. Fix various bugs where sev_guest() was not ensured to be stable for the whole duration of a function or ioctl. - Convert a pile of kvm->lock SEV code to guard(). - Play nicer with userspace that does not enable KVM_CAP_EXCEPTION_PAYLOAD, for which KVM needs to set CR2 and DR6 as a response to ioctls such as KVM_GET_VCPU_EVENTS (even if the payload would end up in EXITINFO2 rather than CR2, for example). Only set CR2 and DR6 when consumption of the payload is imminent, but on the other hand force delivery of the payload in all paths where userspace retrieves CR2 or DR6. - Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT instead of vmcb02->save.cr2. The value is out of sync after a save/restore or after a #PF is injected into L2. - Fix a class of nSVM bugs where some fields written by the CPU are not synchronized from vmcb02 to cached vmcb12 after VMRUN, and so are not up-to-date when saved by KVM_GET_NESTED_STATE. - Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE and KVM_SET_{S}REGS could cause vmcb02 to be incorrectly initialized after save+restore. - Add a variety of missing nSVM consistency checks. - Fix several bugs where KVM failed to correctly update VMCB fields on nested #VMEXIT. - Fix several bugs where KVM failed to correctly synthesize #UD or #GP for SVM-related instructions. - Add support for save+restore of virtualized LBRs (on SVM). - Refactor various helpers and macros to improve clarity and (hopefully) make the code easier to maintain. - Aggressively sanitize fields when copying from vmcb12, to guard against unintentionally allowing L1 to utilize yet-to-be-defined features. - Fix several bugs where KVM botched rAX legality checks when emulating SVM instructions. There are remaining issues in that KVM doesn't handle size prefix overrides for 64-bit guests. - Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails instead of somewhat arbitrarily synthesizing #GP (i.e. don't double down on AMD's architectural but sketchy behavior of generating #GP for "unsupported" addresses). - Cache all used vmcb12 fields to further harden against TOCTOU bugs. x86 (Intel): - Drop obsolete branch hint prefixes from the VMX instruction macros. - Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a register input when appropriate. - Code cleanups. guest_memfd: - Don't mark guest_memfd folios as accessed, as guest_memfd doesn't support reclaim, the memory is unevictable, and there is no storage to write back to. LoongArch selftests: - Add KVM PMU test cases s390 selftests: - Enable more memory selftests. x86 selftests: - Add support for Hygon CPUs in KVM selftests. - Fix a bug in the MSR test where it would get false failures on AMD/Hygon CPUs with exactly one of RDPID or RDTSCP. - Add an MADV_COLLAPSE testcase for guest_memfd as a regression test for a bug where the kernel would attempt to collapse guest_memfd folios against KVM's will. -----BEGIN PGP SIGNATURE----- iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmnftRQUHHBib256aW5p QHJlZGhhdC5jb20ACgkQv/vSX3jHroPAzwf+NKO4Ktv+7A22ImN0SBl0nlUuulsz vTcw3+hxdRoIw83GdNS+hG5js0wrpMDnbv3t4+VliDNBSSxrBzcSWX2wpilW0Xtw qGo1MWhs2lKPy1NlaRVOwPS6j7uF3AR0TQ1iQLGMedQuCU9WpiKJxyhNXJdbLrt3 8EgFzsvtEsv+jKNRUNDf9+d0j4gZsFyIe+Brhianbw+u3/UCiUClLCdsKPc4+5ZX 08otYXytacGNIf/5Ev1vT4pHkHL0yqKXAtX7LEtaS3+0KrPuLjV4slemivzE9vf5 Evafm5AhA4wpaNMb1ZerhY3T94lsMaJpWxotjR//0Q7C9B59pCQnXCm8mg== =CcE0 -----END PGP SIGNATURE----- Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "Arm: - Add support for tracing in the standalone EL2 hypervisor code, which should help both debugging and performance analysis. This uses the new infrastructure for 'remote' trace buffers that can be exposed by non-kernel entities such as firmware, and which came through the tracing tree - Add support for GICv5 Per Processor Interrupts (PPIs), as the starting point for supporting the new GIC architecture in KVM - Finally add support for pKVM protected guests, where pages are unmapped from the host as they are faulted into the guest and can be shared back from the guest using pKVM hypercalls. Protected guests are created using a new machine type identifier. As the elusive guestmem has not yet delivered on its promises, anonymous memory is also supported This is only a first step towards full isolation from the host; for example, the CPU register state and DMA accesses are not yet isolated. Because this does not really yet bring fully what it promises, it is hidden behind CONFIG_ARM_PKVM_GUEST + 'kvm-arm.mode=protected', and also triggers TAINT_USER when a VM is created. Caveat emptor - Rework the dreaded user_mem_abort() function to make it more maintainable, reducing the amount of state being exposed to the various helpers and rendering a substantial amount of state immutable - Expand the Stage-2 page table dumper to support NV shadow page tables on a per-VM basis - Tidy up the pKVM PSCI proxy code to be slightly less hard to follow - Fix both SPE and TRBE in non-VHE configurations so that they do not generate spurious, out of context table walks that ultimately lead to very bad HW lockups - A small set of patches fixing the Stage-2 MMU freeing in error cases - Tighten-up accepted SMC immediate value to be only #0 for host SMCCC calls - The usual cleanups and other selftest churn LoongArch: - Use CSR_CRMD_PLV for kvm_arch_vcpu_in_kernel() - Add DMSINTC irqchip in kernel support RISC-V: - Fix steal time shared memory alignment checks - Fix vector context allocation leak - Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi() - Fix double-free of sdata in kvm_pmu_clear_snapshot_area() - Fix integer overflow in kvm_pmu_validate_counter_mask() - Fix shift-out-of-bounds in make_xfence_request() - Fix lost write protection on huge pages during dirty logging - Split huge pages during fault handling for dirty logging - Skip CSR restore if VCPU is reloaded on the same core - Implement kvm_arch_has_default_irqchip() for KVM selftests - Factored-out ISA checks into separate sources - Added hideleg to struct kvm_vcpu_config - Factored-out VCPU config into separate sources - Support configuration of per-VM HGATP mode from KVM user space s390: - Support for ESA (31-bit) guests inside nested hypervisors - Remove restriction on memslot alignment, which is not needed anymore with the new gmap code - Fix LPSW/E to update the bear (which of course is the breaking event address register) x86: - Shut up various UBSAN warnings on reading module parameter before they were initialized - Don't zero-allocate page tables that are used for splitting hugepages in the TDP MMU, as KVM is guaranteed to set all SPTEs in the page table and thus write all bytes - As an optimization, bail early when trying to unsync 4KiB mappings if the target gfn can just be mapped with a 2MiB hugepage x86 generic: - Copy single-chunk MMIO write values into struct kvm_vcpu (more precisely struct kvm_mmio_fragment) to fix use-after-free stack bugs where KVM would dereference stack pointer after an exit to userspace - Clean up and comment the emulated MMIO code to try to make it easier to maintain (not necessarily "easy", but "easier") - Move VMXON+VMXOFF and EFER.SVME toggling out of KVM (not *all* of VMX and SVM enabling) as it is needed for trusted I/O - Advertise support for AVX512 Bit Matrix Multiply (BMM) instructions - Immediately fail the build if a required #define is missing in one of KVM's headers that is included multiple times - Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected exception, mostly to prevent syzkaller from abusing the uAPI to trigger WARNs, but also because it can help prevent userspace from unintentionally crashing the VM - Exempt SMM from CPUID faulting on Intel, as per the spec - Misc hardening and cleanup changes x86 (AMD): - Fix and optimize IRQ window inhibit handling for AVIC; make it per-vCPU so that KVM doesn't prematurely re-enable AVIC if multiple vCPUs have to-be-injected IRQs - Clean up and optimize the OSVW handling, avoiding a bug in which KVM would overwrite state when enabling virtualization on multiple CPUs in parallel. This should not be a problem because OSVW should usually be the same for all CPUs - Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains about a "too large" size based purely on user input - Clean up and harden the pinning code for KVM_MEMORY_ENCRYPT_REG_REGION - Disallow synchronizing a VMSA of an already-launched/encrypted vCPU, as doing so for an SNP guest will crash the host due to an RMP violation page fault - Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped queries are required to hold kvm->lock, and enforce it by lockdep. Fix various bugs where sev_guest() was not ensured to be stable for the whole duration of a function or ioctl - Convert a pile of kvm->lock SEV code to guard() - Play nicer with userspace that does not enable KVM_CAP_EXCEPTION_PAYLOAD, for which KVM needs to set CR2 and DR6 as a response to ioctls such as KVM_GET_VCPU_EVENTS (even if the payload would end up in EXITINFO2 rather than CR2, for example). Only set CR2 and DR6 when consumption of the payload is imminent, but on the other hand force delivery of the payload in all paths where userspace retrieves CR2 or DR6 - Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT instead of vmcb02->save.cr2. The value is out of sync after a save/restore or after a #PF is injected into L2 - Fix a class of nSVM bugs where some fields written by the CPU are not synchronized from vmcb02 to cached vmcb12 after VMRUN, and so are not up-to-date when saved by KVM_GET_NESTED_STATE - Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE and KVM_SET_{S}REGS could cause vmcb02 to be incorrectly initialized after save+restore - Add a variety of missing nSVM consistency checks - Fix several bugs where KVM failed to correctly update VMCB fields on nested #VMEXIT - Fix several bugs where KVM failed to correctly synthesize #UD or #GP for SVM-related instructions - Add support for save+restore of virtualized LBRs (on SVM) - Refactor various helpers and macros to improve clarity and (hopefully) make the code easier to maintain - Aggressively sanitize fields when copying from vmcb12, to guard against unintentionally allowing L1 to utilize yet-to-be-defined features - Fix several bugs where KVM botched rAX legality checks when emulating SVM instructions. There are remaining issues in that KVM doesn't handle size prefix overrides for 64-bit guests - Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails instead of somewhat arbitrarily synthesizing #GP (i.e. don't double down on AMD's architectural but sketchy behavior of generating #GP for "unsupported" addresses) - Cache all used vmcb12 fields to further harden against TOCTOU bugs x86 (Intel): - Drop obsolete branch hint prefixes from the VMX instruction macros - Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a register input when appropriate - Code cleanups guest_memfd: - Don't mark guest_memfd folios as accessed, as guest_memfd doesn't support reclaim, the memory is unevictable, and there is no storage to write back to LoongArch selftests: - Add KVM PMU test cases s390 selftests: - Enable more memory selftests x86 selftests: - Add support for Hygon CPUs in KVM selftests - Fix a bug in the MSR test where it would get false failures on AMD/Hygon CPUs with exactly one of RDPID or RDTSCP - Add an MADV_COLLAPSE testcase for guest_memfd as a regression test for a bug where the kernel would attempt to collapse guest_memfd folios against KVM's will" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (373 commits) KVM: x86: use inlines instead of macros for is_sev_*guest x86/virt: Treat SVM as unsupported when running as an SEV+ guest KVM: SEV: Goto an existing error label if charging misc_cg for an ASID fails KVM: SVM: Move lock-protected allocation of SEV ASID into a separate helper KVM: SEV: use mutex guard in snp_handle_guest_req() KVM: SEV: use mutex guard in sev_mem_enc_unregister_region() KVM: SEV: use mutex guard in sev_mem_enc_ioctl() KVM: SEV: use mutex guard in snp_launch_update() KVM: SEV: Assert that kvm->lock is held when querying SEV+ support KVM: SEV: Document that checking for SEV+ guests when reclaiming memory is "safe" KVM: SEV: Hide "struct kvm_sev_info" behind CONFIG_KVM_AMD_SEV=y KVM: SEV: WARN on unhandled VM type when initializing VM KVM: LoongArch: selftests: Add PMU overflow interrupt test KVM: LoongArch: selftests: Add basic PMU event counting test KVM: LoongArch: selftests: Add cpucfg read/write helpers LoongArch: KVM: Add DMSINTC inject msi to vCPU LoongArch: KVM: Add DMSINTC device support LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function LoongArch: KVM: Move host CSR_GSTAT save and restore in context switch LoongArch: KVM: Move host CSR_EENTRY save and restore in context switch ... |
||
Guido Günther
|
4a92ef0c57 |
drm/panel: visionox-rm69299: Make use of prepare_prev_first
The DSI link must be powered up to let panel driver to talk to the panel
during prepare() callback execution. Set the prepare_prev_first flag to
guarantee this.
Fixes:
|