mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-08 18:57:22 +00:00
1,461,726 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Ian Bridges
|
f9ab30c96b |
ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
[BUG]
A direct write over unwritten extents can panic the kernel in
ocfs2_assure_trans_credits() when the journal aborts during DIO
completion. The crash is a general protection fault from a NULL pointer
dereference.
[CAUSE]
ocfs2_dio_end_io_write() loops over a direct write's unwritten extents,
marking each written under a single journal handle. If the journal
aborts (for example after an I/O error) while the extent tree is being
updated, the handle is left aborted with its transaction pointer
cleared. The extent merge treats that failure as not critical and
reports success, so the loop keeps using the handle.
ocfs2_assure_trans_credits() reads the handle's remaining credits
without first checking whether the handle is aborted, and that read
dereferences the cleared transaction pointer.
[FIX]
A journal abort is recorded in the handle itself, so callers are
expected to test the handle rather than rely on a returned error.
Make ocfs2_assure_trans_credits() do that, as the other ocfs2 journal
helpers already do, and return -EROFS when the handle is aborted.
Link: https://lore.kernel.org/airKTsM1fRVN-Wj7@dev
Fixes:
|
||
Samuel Moelius
|
c1fff9794a |
lib: interval_tree_test: validate benchmark parameters
The interval tree runtime test accepts module parameters that are later used as divisors while generating randomized intervals and while reporting average timings. For example, max_endpoint=1 makes the generated interval end value zero and the next modulo operation divides by that zero value. Reject non-positive counts and require max_endpoint to provide at least one non-zero generated endpoint before the test allocates state or starts the benchmark. [akpm@linux-foundation.org: include printk.h for pr_warn()] Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com> Link: https://lore.kernel.org/20260609005446.1241288.1525a5964698.interval-tree-test-small-max-endpoint-div0@trailofbits.com Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
Kyle Zeng
|
22920541c3 |
ocfs2: avoid moving extents to occupied clusters
For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical me_goal. ocfs2_move_extent() initializes new_phys_cpos from that goal and expects ocfs2_probe_alloc_group() to replace it with a free run in the target block group. The probe currently leaves *phys_cpos unchanged if the scan reaches the end of the group without finding a free run. An occupied goal at the last bit can therefore survive the probe and be passed to __ocfs2_move_extent(), which copies file data into a cluster still owned by another inode before the bitmap is updated. When the probe does find a free run, it also subtracts move_len from the ending bit. The start of an N-bit run ending at i is i - N + 1, so the current calculation can report the bit immediately before the free run. Clear *phys_cpos before scanning and use the correct free-run start. Callers already treat a zero result as -ENOSPC, so failed probes no longer continue with an occupied caller-controlled goal. Link: https://lore.kernel.org/20260611213510.16956-1-kylebot@openai.com Fixes: |
||
Shardul Deshpande
|
07669b0abe |
treewide: fix transposed "sign" typos and update spelling.txt
Several comments transpose the letters in "assigned" and "unsigned", spelling them with "sing" instead of "sign". Correct all of them. Of these, the misspelling of "assigned" is not yet flagged by checkpatch, so also add it to scripts/spelling.txt. The remaining matches of `grep -ri singed` are RISINGEDGE register and enum names, not typos. Link: https://lore.kernel.org/20260612181633.734458-1-iamsharduld@gmail.com Signed-off-by: Shardul Deshpande <iamsharduld@gmail.com> Suggested-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: SeongJae Park <sj@kernel.org> Cc: Joe Perches <joe@perches.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Ian Bridges
|
452a8467be |
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
[BUG] On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. [CAUSE] ocfs2_sum_rightmost_rec() computes i = le16_to_cpu(el->l_next_free_rec) - 1 and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN. [FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds. Link: https://lore.kernel.org/ain_780qc0P4ypNd@dev Signed-off-by: Ian Bridges <icb@fastmail.org> Reported-by: syzbot+be16e33db01e6644db7a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=be16e33db01e6644db7a Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Cc: Heming Zhao <heming.zhao@suse.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
|
Samuel Moelius
|
5108f47656 |
fat: reject BPB volumes whose data area starts beyond total sectors
fat_fill_super() subtracts sbi->data_start from the BPB total sector count before computing the number of clusters. A malformed image can declare a total sector count smaller than data_start, causing the subtraction to underflow and the mount code to derive a plausible cluster count from the FAT length instead. Reject such images before the subtraction. In QEMU, a crafted FAT image with total_sectors=2 and data_start=3 mounted successfully before the fix and reading a file returned bytes stored past the BPB-declared end of the volume. With this change, the same image is rejected during mount. Assisted-by: Codex:gpt-5.5-cyber-preview Link: https://lore.kernel.org/20260605155216.2126545-1-sam.moelius@trailofbits.com Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com> Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Cc: Christian Brauner <brauner@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
Guixin Liu
|
c7fdbc2c2f |
selftests/uevent: increase __UEVENT_BUFFER_SIZE to avoid ENOBUFS on busy systems
The kselftests case uevent.uevent_filtering fails reproducibly on busy systems (e.g. Intel EMR / AMD servers) with: No buffer space available - Failed to receive uevent The listener binds the NETLINK_KOBJECT_UEVENT socket to all 32 multicast groups (nl_groups = -1) but only sets SO_RCVBUF to 4 KiB (__UEVENT_BUFFER_SIZE = 2048 * 2). On hosts with many devices, the kernel and userspace daemons (udev/systemd) constantly emit uevents on multiple groups, plus the test itself triggers 10 add events in a row. The 4 KiB receive buffer overflows before the listener can drain it, recvmsg() returns -ENOBUFS, and the test bails out as failure. Increase __UEVENT_BUFFER_SIZE to 1 MiB so the receive buffer is large enough to absorb the burst of uevents on busy systems. After this change the test passes consistently across dozens of runs on Intel EMR and AMD platforms. Link: https://lore.kernel.org/20260608053934.4059533-1-kanie@linux.alibaba.com Signed-off-by: Guixin Liu <kanie@linux.alibaba.com> Cc: Christian Brauner <brauner@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
||
Timur Kristóf
|
ba2977dcce |
drm/amdgpu: Use system unbound workqueue for soft IH ring
Allow the kernel to dispatch the soft IH work on other CPUs.
Otherwise it can happen that the soft IH ring fills up
before it actually starts processing anything, which
can easily happen with retry page faults, in which case
the CP repeatedly spams the CPU with a lot of interrupts.
This significantly improves retry page fault handling on
GPUs that don't have the filter CAM and must rely on
software based filtering.
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
|
Timur Kristóf
|
29b5def20a |
amdgpu/ih6.1: Fix minor version
Report the correct version of IH v6.1 (previously it showed v6.0).
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Gerhard Schwanzer
|
b89d58b659 |
drm/amdkfd: Use exclusive bounds for SVM split alignment checks
SVM ranges use inclusive page indices: prange->last is the last page in the range. The split-remap logic introduced by commit |
||
Jiqian Chen
|
85ed06d990 |
drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2
For Renior APU with gfx9, in some test scenarios with disabling
ring_reset, like accessing an unmapped invalid address, it can
trigger a gpu job timeout event, then driver uses Mode2 reset
to reset GPU, but after Mode2 compute Ring test and IB test fail
randomly. It because the HQDs of MECs are always active before or
after Mode2, that causes MECs use stale HQDs when MECs are unhalted
before driver restore MQDs, and causes CPC and CPF are still stuck
after Mode2, then causes compute Ring and IB tests fail.
So, add sequences to deactivate HQDs of MECs in suspend IP function
of the resetting process.
v2: Move all sequences into a new function gfx_v9_0_cp_mode2_clear_state (Ray Huang)
To check reset Mode2 method in the if condition (Ray Huang)
v3: Move all sequences before Mode2 instead of after Mode2 (Timur Kristóf)
v4: Call amdgpu_gfx_rlc_enter/exit_safe_mode int the begin and end of
gfx_v9_0_deactivate_kcq_hqd (Alex Deucher)
Signed-off-by: Jiqian Chen <Jiqian.Chen@amd.com>
Reviewed-by: Huang Rui <ray.huang@amd.com>
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
|
Timur Kristóf
|
32bd35f068 |
drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)
UVD 4.x and older can only access MSG, FEEDBACK buffers from a
specific 256M VRAM segment that the VCPU BO is also located in.
We already modify all placements of the given BO to ensure
the BO is placed within this segment.
Previously, it always assumed that the VCPU segment is
the first 256M of VRAM, even though under some conditions
the VCPU BO could be allocated outside this segment,
which made UVD non-functional as the BOs were
not inside the same segment as the UVD VCPU BO.
Solve that by using the segment where the VCPU BO actually is.
This fixes an issue with UVD failing to initialize on SI/CIK
when resizable BAR is enabled and the VCPU BO is allocated
in a different segment.
v2:
- For other BOs, keep using the same UVD segment as before.
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3851
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
|
Timur Kristóf
|
8002b744ad |
drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older
These UVD versions don't fully support GPUVM and are only
validated to work when their VCPU BO is placed in VRAM.
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
|
Timur Kristóf
|
ee94a65f19 |
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT
The UVD code relies on GTT to GTT moves in order to ensure that its BOs don't cross 256M segments. Fixes: |
||
|
Timur Kristóf
|
8882f8897e |
drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
When testing intersection and compatibility, respect the actual placement requirements. This is a pre-requisite for ensuring that UVD CS BOs do not cross 256M segments. Fixes: |
||
Cao Ruichuang
|
808c447df2 |
selftests/ftrace: Drop invalid top-level local in test_ownership
test_ownership.tc is sourced by ftracetest under /bin/sh.
The script currently declares mount_point with local at file scope,
which makes /bin/sh abort with "local: not in a function" before the
test can reach the eventfs ownership checks.
Replace the top-level local declaration with a normal shell variable so
kernels that support the gid= tracefs mount option can run the test at
all.
Link: https://lore.kernel.org/r/20260407102613.81419-1-create0818@163.com
Fixes:
|
||
Tvrtko Ursulin
|
c1dc4ccb82 |
drm/amdgpu: Fix context pstate override handling
There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Both are due amdgpu_ctx_init() not holding the adev->pm.stable_pstate_ctx_lock, which is otherwise used from both sysfs and the context code itself for modifying and clearing the stored context pointer. Second issue is that context fini can trample over the pstate configuration set via sysfs. This is due the restore state (ctx->stable_pstate) being saved at context init time, and not if, or when the context actually changes the pstate. As the context exits it will therefore incorrectly restore to what was set before the sysfs override was requested. The simplest fix is to drastically simplify how the state is tracked, by clearly defining the points at which pstate ownership is taken and released, and to handle all transitions under the correct lock. Instead of at context init time, the previous state is saved only at the point the context overrides the current state, and is restored on context exit only if the context is still the owner of the current override state. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Fixes: |
||
Xiaogang Chen
|
2321831d7e |
drm/amdkfd: Use memdup_array_user to copy data from/to user space at kfd ioctls
Several kfd ioctls need transfer array data from/to user space. Kfd driver
uses kmalloc_array with user provided size. That can oversize alloc or 32-bit
wrap with hostile value. Replace it by memdup_array_user that does overflow
checking and allocates through dedicated slab caches, also physical continuous
as kmalloc.
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
|
Xiaogang Chen
|
516bf737a5 |
drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap
If inx from find_first_zero_bit is beyond range not need set doorbell_bitmap.
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
|
Xiaogang Chen
|
8242a8d9d7 |
drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
amdkfd driver needs allocate buffer to return bo metadata to user space. The
buffer size is controlled by user currently. It is a potential security issue
that hostile value (e.g. 2 GiB) lets any render-group user trigger order-MAX
allocation/OOM in kernel context.
This patch first finds bo metadata size. If the size is smaller than user
provided value drive can safely allocate buffer in kernel space and copy to
user space buffer. If not, driver will let user know, not allocate and copy.
User will redo with new buffer in user space.
This patch lets driver decide buffer allocation size to avoid potential hostile
size from user space.
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Mikhail Gavrilov
|
7152b248dc |
drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
When dumping IB contents from a hung job, amdgpu_devcoredump_format()
acquired the VM root PD's reservation via amdgpu_vm_lock_by_pasid() and
then, for each IB, called amdgpu_bo_reserve() on the BO backing the IB.
Both reservations are reservation_ww_class_mutex objects and neither
used a ww_acquire_ctx, which trips lockdep:
WARNING: possible recursive locking detected
--------------------------------------------
kworker/u128:0 is trying to acquire lock:
ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4},
at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]
but task is already holding lock:
ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4},
at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]
Possible unsafe locking scenario:
CPU0
----
lock(reservation_ww_class_mutex);
lock(reservation_ww_class_mutex);
*** DEADLOCK ***
May be due to missing lock nesting notation
Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu]
Call Trace:
__ww_mutex_lock.constprop.0
ww_mutex_lock
amdgpu_bo_reserve
amdgpu_devcoredump_format+0x1594 [amdgpu]
amdgpu_devcoredump_deferred_work+0xea [amdgpu]
The two reservations are on different BOs in the captured trace, so the
splat is a lockdep-correctness warning, not an observed deadlock. It
becomes a real self-deadlock whenever the IB BO shares its dma_resv with
the root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()):
amdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket
and blocks forever. With amdgpu.gpu_recovery=0 the timeout handler
refires every ~2 s and each invocation produces this splat, drowning the
kernel ring buffer.
Now that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB
dumping into a separate helper that locks the root PD and every IB BO
together in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles
IB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed
by the same BO). Every lock is now a top-level acquire under one
ww_acquire_ctx, so the recursive ww_mutex condition is gone, and the
per-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO
refcount leak on the amdgpu_bo_reserve() failure path -- is removed.
Fixes:
|
||
|
Mikhail Gavrilov
|
9920249a52 |
drm/amdgpu: convert amdgpu_vm_lock_by_pasid() to drm_exec
amdgpu_vm_lock_by_pasid() looks up a VM by PASID and reserves its root
PD with a bare amdgpu_bo_reserve(), returning the still-reserved root to
the caller. A caller that then needs to reserve further BOs (for example
the devcoredump IB dump) ends up nesting reservation_ww_class_mutex
acquires without a ww_acquire_ctx, which lockdep flags as recursive
locking.
Convert the helper to take a drm_exec context and lock the root PD with
drm_exec_lock_obj(). Callers now run it inside a
drm_exec_until_all_locked() loop and can lock additional BOs in the same
ww ticket, so there is no nested ww_mutex acquire.
The drm_exec context holds its own reference on the locked root BO, so
the helper no longer hands a root reference back to the caller: the
root output parameter is dropped, and the transient reference taken
across the PASID lookup is released before returning.
The only existing caller, amdgpu_vm_handle_fault(), is updated
accordingly. Its is_compute_context path, which previously dropped the
root reservation around svm_range_restore_pages() and re-took it, now
finalises the drm_exec context and re-initialises a fresh one; behaviour
is otherwise unchanged.
No functional change intended for the page-fault path.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Uwe Kleine-König (The Capable Hub)
|
75b3e4d049 |
drm/amdgpu: Don't use UTS_RELEASE directly
UTS_RELEASE evaluates to a static string and changes quite easily (e.g.
uncommitted changes in the source tree or new commits). So when checking
if a patch introduces changes to the resulting binary each usage of
UTS_RELEASE is source of annoyance.
Instead of using UTS_RELEASE directly use init_utsname()->release which
evaluates to the same string but with that a change of UTS_RELEASE
doesn't affect amdgpu_dev_coredump.o.
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260428144704.1114562-2-u.kleine-koenig@baylibre.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Geoffrey McRae
|
d072a3f603 |
drm/amdkfd: Fix NULL deref during sysfs teardown
Move kfd_process_remove_sysfs() earlier in kfd_process_wq_release() so
that all sysfs/procfs entries are removed before tearing down PDDs and
dropping lead_thread. The per-process sysfs attributes are backed by
struct kfd_process_device, and their show/store callbacks dereference
PDD fields. Since sysfs removal waits for active callbacks to complete,
removing these entries first closes a race where userspace reads sdma_*
and stats_* files after PDD teardown.
Previously this cleanup ran after kfd_process_destroy_pdds(), which
resets p->n_pdds to 0. This meant kfd_process_remove_sysfs() could no
longer walk the PDD array, so the per-PDD sysfs cleanup did not run as
intended.
This race caused NULL pointer dereferences observed in
kfd_sdma_activity_worker and kfd_procfs_stats_show.
Also harden kfd_process_remove_sysfs() against partially
initialized or already-freed objects:
- Check kobj_queues before removing PASID and deleting it
- Guard kobj_stats and kobj_counters before use
These checks prevent invalid dereferences during cleanup.
Cc: Felix Kuehling <Felix.Kuehling@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Mario Limonciello
|
84c4c36acd |
drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and BO_HANDLES chunk types. The CP_GFX_SHADOW case previously shared a bare break with the dependency and syncobj chunk types, which do not dereference a fixed-size struct. When userspace submits this chunk with length_dw == 0, vmemdup_array_user() is called with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR() check. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct drm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the ZERO_SIZE_PTR and causing a NULL-pointer dereference. This is reachable by an unprivileged process in the render group. Reject undersized chunks with -EINVAL during pass1 so the bad submission is rejected before pass2 ever dereferences the data. Fixes: |
||
|
Mario Limonciello
|
93475c3411 |
drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO
The AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() looks up the bo_va for the buffer object in the caller's VM via amdgpu_vm_bo_find(), but uses the returned pointer without checking it. amdgpu_vm_bo_find() returns NULL when the BO has no bo_va in that VM, which is the normal case for a BO that has never been mapped. The result is fed straight into amdgpu_vm_bo_va_for_each_valid_mapping(), which expands to list_for_each_entry(mapping, &(bo_va)->valids, list) and dereferences bo_va, causing a NULL pointer dereference. This is reachable by any process able to issue the ioctl (render group) simply by requesting mapping info for an unmapped BO. Return -ENOENT when no bo_va is found, jumping to out_exec so the drm_exec context and GEM object reference are released. Fixes: |
||
Thadeu Lima de Souza Cascardo
|
a2b270c0ec |
drm/amdgpu: initialize irq.lock spinlock earlier
If there is an early failure during amdgpu probe, like missing firmware, it will end up calling amdgpu_irq_disable_all, which takes irq.lock spinlock without it being initialized. Initializing irq.lock earlier at amdgpu_device_init fixes the issue. [ 79.334079] INFO: trying to register non-static key. [ 79.334081] The code is fine but needs lockdep annotation, or maybe [ 79.334083] you didn't initialize this object before use? [ 79.334084] turning off the locking correctness validator. [ 79.334088] CPU: 2 UID: 0 PID: 1819 Comm: bash Not tainted 7.1.0-rc5-gfd06300b2348 #96 PREEMPT 8e8f461221633dae3c832d6689eaf0546c0ed4cd [ 79.334092] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0133 08/05/2024 [ 79.334094] Call Trace: [ 79.334095] <TASK> [ 79.334097] dump_stack_lvl+0x5d/0x80 [ 79.334103] register_lock_class+0x7af/0x7c0 [ 79.334109] __lock_acquire+0x416/0x2610 [ 79.334114] lock_acquire+0xcf/0x310 [ 79.334117] ? amdgpu_irq_disable_all+0x3b/0xf0 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180] [ 79.334503] ? _raw_spin_lock_irqsave+0x53/0x60 [ 79.334508] _raw_spin_lock_irqsave+0x3f/0x60 [ 79.334510] ? amdgpu_irq_disable_all+0x3b/0xf0 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180] [ 79.334881] amdgpu_irq_disable_all+0x3b/0xf0 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180] [ 79.335240] amdgpu_device_fini_hw+0x90/0x32c [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180] [ 79.335704] amdgpu_driver_load_kms.cold+0x22/0x44 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180] [ 79.336159] amdgpu_pci_probe+0x204/0x440 [amdgpu c88bab43d391d519ad0d5c8e5a099b4aceefa180] [ 79.336494] local_pci_probe+0x3c/0x80 [ 79.336500] pci_call_probe+0x55/0x2e0 [ 79.336505] ? _raw_spin_unlock+0x2d/0x50 [ 79.336508] ? pci_match_device+0x157/0x180 [ 79.336512] pci_device_probe+0x9b/0x170 [ 79.336516] really_probe+0xd5/0x370 [ 79.336521] __driver_probe_device+0x84/0x150 [ 79.336525] device_driver_attach+0x47/0xb0 [ 79.336528] bind_store+0x73/0xc0 [ 79.336531] kernfs_fop_write_iter+0x176/0x250 [ 79.336536] vfs_write+0x24d/0x560 [ 79.336542] ksys_write+0x71/0xe0 [ 79.336546] do_syscall_64+0x122/0x710 [ 79.336550] ? do_syscall_64+0xd1/0x710 [ 79.336553] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 79.336557] RIP: 0033:0x7f92fd675006 [ 79.336561] Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 [ 79.336562] RSP: 002b:00007ffe4fa867a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 79.336565] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007f92fd675006 [ 79.336567] RDX: 000000000000000d RSI: 000055b2dfce59b0 RDI: 0000000000000001 [ 79.336568] RBP: 00007ffe4fa867c0 R08: 0000000000000000 R09: 0000000000000000 [ 79.336569] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d [ 79.336570] R13: 000055b2dfce59b0 R14: 00007f92fd7ca5c0 R15: 000055b2dfdbaf70 [ 79.336574] </TASK> Fixes: |
||
|
Mario Limonciello
|
8fa5655da3 |
drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects. A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required. Add list_del() before the kfree() so the list is properly emptied. The list_for_each_entry_safe() iterator already caches the next pointer, so unlinking during the walk is safe. Fixes: |
||
Pavel Ondračka
|
f896e86273 |
drm/radeon: fix r100_copy_blit for large BOs
r100_copy_blit() copies BOs as 1024-pixel-wide ARGB8888 blits, so one
GPU page becomes one blit row. Large copies are split into chunks of at
most 8191 rows.
The kernel register header names the packet coordinate dwords SRC_Y_X
and DST_Y_X. In the BITBLT_MULTI description in
R5xx_Acceleration_v1.5.pdf docs, these correspond to [SRC_X1 | SRC_Y1]
and [DST_X1 | DST_Y1], which are signed 13-bit coordinates in the
-8192..8191 range. The old code kept SRC/DST_PITCH_OFFSET at the BO base
and used SRC_Y_X/DST_Y_X as the chunk address, so large BO moves could
exceed that coordinate range.
Compute per-chunk SRC/DST_PITCH_OFFSET bases and emit zero source and
destination coordinates. r100_copy_blit() already packs
SRC/DST_PITCH_OFFSET as pitch plus base offset, so large chunk addresses
belong there rather than in the coordinate fields.
This fixes Prison Architect corruption with 4096x4096 mipped textures
after they are evicted to GTT under memory pressure on RV530.
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/6716
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Pavel Ondračka <pavel.ondracka@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Matthew Schwartz
|
8e792f018e |
drm/amd/display: Fix mem_type change detection for async flips
[Why] amdgpu_dm_crtc_mem_type_changed() fetches the "old" and "new" plane state with two drm_atomic_get_plane_state() calls, which both return the new state. It compares a state against itself, so it never detects a mem_type change and never rejects the async flip. On DCN 3.0.1, this shows up as intermittent corruption when a single DCC plane is scanned out with immediate flips under gamescope and its buffer moves between the VRAM carveout and GTT. [How] Use drm_atomic_get_old_plane_state() and drm_atomic_get_new_plane_state() to compare the actual old and new states. These return NULL rather than an error pointer for a plane that is not part of the commit, so the IS_ERR() check becomes a NULL check that skips those planes, such as an unmodified cursor still in the CRTC's plane_mask. Fixes: |
||
James Lin
|
40f9e2f514 |
drm/amd/display: Add IN_FORMATS_ASYNC support for planes
[Why]
The DRM core exposes an IN_FORMATS_ASYNC plane property describing the
set of format/modifier pairs that are valid for asynchronous (immediate)
page flips. amdgpu already advertises async page flip support via
mode_config.async_page_flip = true, but never implemented the
.format_mod_supported_async plane callback, so the IN_FORMATS_ASYNC
property was not created.
This inconsistency (advertising async flips while exposing IN_FORMATS but
no IN_FORMATS_ASYNC) causes userspace, such as igt-gpu-tools, to emit a
repeated warning during plane initialization, which in turn demotes many
otherwise passing KMS subtests to a WARN result.
[How]
Wire up .format_mod_supported_async to the existing
amdgpu_dm_plane_format_mod_supported callback so the async format list is
populated. amdgpu does not restrict async flips at the format/modifier
level: the async flip constraints are enforced at atomic check and commit
time and only require a fast update (no change to FB pitch, DCC state,
rotation or memory type) between the old and new buffers. Therefore the
set of formats/modifiers valid for async flips is identical to the
regular IN_FORMATS set, and the same callback can be reused.
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: James Lin <PingLei.Lin@amd.com>
Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Asad Kamal
|
3e864bf2a3 |
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is 0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a kernel page fault. The IB only needs to be a minimal NOP shell to schedule the job; the cleaner shader itself is emitted on the ring via emit_cleaner_shader(). Fill 16 dwords to match the allocation. v2: Use ib_size_dw variable (Lijo) Fixes: |
||
Prike Liang
|
3d3372add0 |
drm/amdgpu: allocate lockdep mutex on the heap to fix stack overflow
Replace the stack-allocated amdgpu_lockdep mutex with a heap allocation
via kmalloc to fix a stack overflow caused by the large struct size.
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Andrew Martin
|
1142738572 |
drm/amdkfd: Fix SMI event PID reporting for containers
SMI events were reporting incorrect PIDs in containerized environments,
causing test failures where container processes expected to see their
namespace-local PIDs but instead received global host PIDs.
The issue had two root causes:
1. Event functions were called from kernel context (page fault handlers,
migration workers) where 'current' refers to the kernel worker thread,
not the userspace GPU process that triggered the event.
2. PID conversion used task_tgid_vnr() which returns the PID in the
caller's namespace (init namespace for kernel threads), not the task's
own namespace.
This patch updates the SMI event interface:
- Change 8 event function signatures to accept task_struct pointer
instead of pid_t, allowing proper namespace-aware PID conversion
- Convert PIDs using task_tgid_nr_ns(task, task_active_pid_ns(task))
which returns the PID as the process sees it via getpid()
- Update 10 call sites to pass p->lead_thread (the GPU process)
instead of p->lead_thread->pid or current (kernel worker)
This ensures SMI events report container-local PIDs, which is critical
for containerized GPU workloads to correctly correlate events with their
processes.
Tested-by: Andrew Martin <andmarti@amd.com>
Assisted-by: Claude:Sonnet 4-5
Signed-off-by: Andrew Martin <andrew.martin@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Ivan Lipski
|
5cc0f35d83 |
drm/amd/display: Restore periodic detection for DCN35
[Why&How] Periodic detection callbacks from DCN35 was removed for higher IPS residency causing some displays to fail to recover after DPMS sleep. The monitors bounces HPD ~1.2s after link training, and without periodic detection the system enters IPS with no mechanism to wake and rediscover the display. Restore the periodic detection calls in dcn35_clk_mgr for now. It should be replaced with a proper IPS-aware solution long term using DMUB. Also remove it from dcn31 and dcn314_clk_mgr.c since they do not have IPS, thus should not affect them. Fixes: |
||
Roman Li
|
fe7945d092 |
drm/amd/display: Skip PHY SSC reduction on some 8K panels
[Why] Some 8K displays cannot tolerate the reduced phy ssc value at high link utilization and show corruption or black screen. [How] Add an EDID panel-id quirk to utilize existing skip_phy_ssc_reduction flag. To pass the link into the quirk handler, change the signature of apply_edid_quirks() to take link as an argument. The dev local in dm_helpers_parse_edid_caps() becomes unused and is removed. Fixes: |
||
Yunxiang Li
|
b29aaf0a72 |
drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2
The GPU reload test (S3 / mode1 reset / module reload) triggers a WARN_ON in amdgpu_irq_put() on gfx10 when unloading amdgpu: WARNING: CPU: 0 PID: 2314 at amd/amdgpu/amdgpu_irq.c:676 amdgpu_irq_put+0xc3/0xe0 [amdgpu] Call Trace: gfx_v10_0_hw_fini+0x41/0x150 [amdgpu] amdgpu_ip_block_hw_fini+0x29/0xc0 [amdgpu] amdgpu_device_fini_hw+0x315/0x610 [amdgpu] amdgpu_driver_unload_kms+0x7c/0x90 [amdgpu] amdgpu_pci_remove+0x51/0x90 [amdgpu] amdgpu_device_ip_resume_phase2() skips IP blocks whose status.hw is already set, but amdgpu_device_ip_suspend_phase2() never had the matching guard, so a block can be suspended twice (e.g. a reset or recovery issued while the device is already suspended). The second suspend runs hw_fini again, which now releases the gfx fault IRQs unconditionally, dropping a refcount that is already zero and tripping the WARN_ON in amdgpu_irq_put(). The fault/EOP IRQ get/put were balanced through late_init/hw_fini before, which masked the double-suspend; moving the get into hw_init made the suspend/resume asymmetry visible as an IRQ refcount underflow. Honor status.hw in ip_suspend_phase2() so suspend mirrors resume and a block is only torn down once. Fixes: |
||
David Francis
|
20a5e7ffdf |
drm/amdkfd: Properly acquire queue buffers in CRIU restore
When kfd_queue_acquire_buffers() was split off from
set_queue_properties_from_user(), set_queue_properties_from_criu()
was missed. Thus, set_queue_properties_from_criu() is not
filling out the buffer fields of queue_properties, which
can come up when subsequent code expects them to be non-null.
Add the proper call to kfd_queue_acquire_buffers(), and also
use the right cast types in set_queue_properties_from_criu()
(which were missed at the same time)
Signed-off-by: David Francis <David.Francis@amd.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Shubhankar Milind Sardeshpande
|
76589bcc73 |
drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15 APUs
During smu_v15_0_0_system_features_control(), the driver sends a
PrepareMp1ForUnload message to PMFW. PMFW then performs nBIF and SYSHUB
function-level resets (FLR), disabling PCIe CFG space reset, which
clears the framebuffer enable bit to zero and disables MC (memory controller)
access from the host.
Re-enable MC access via the nbio mc_access_enable callback right after
PrepareMp1ForUnload completes in smu_v15_0_0_system_features_control().
Signed-off-by: Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande@amd.com>
Signed-off-by: Suresh Guttula <Suresh.Guttula@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
Qiang Yu
|
1c2d7a6566 |
drm/amdgpu: initialize iter.start in amdgpu_devcoredump_format
This fixes read /sys/class/drm/cardN/device/devcoredump/data
return empty content sometimes.
amdgpu_devcoredump_format() leaves struct drm_print_iterator's
.start field uninitialized on the stack before passing it to
drm_coredump_printer(). __drm_puts_coredump() compares the running
.offset against .start to decide whether to skip or copy each
chunk:
if (iterator->offset < iterator->start) {
if (iterator->offset + len <= iterator->start) {
iterator->offset += len;
return;
}
...
}
Fixes:
|
||
|
Yunxiang Li
|
3f0cc17352 |
drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpinned DOORBELL and MMIO remap BOs (which are pinned at allocation time) before checking whether the BO is still mapped to the GPU. When the BO is still mapped, the function returns -EBUSY and leaves the BO alive, but it has already been unpinned. The BO is then unpinned again when it is finally freed during process teardown, triggering a ttm_bo_unpin() underflow warning: WARNING: CPU: 18 PID: 15066 at ttm/ttm_bo.c:650 amdttm_bo_unpin+0x6d/0x80 [amdttm] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu] RIP: 0010:amdttm_bo_unpin+0x6d/0x80 [amdttm] Call Trace: amdgpu_bo_unpin+0x1a/0x90 [amdgpu] amdgpu_amdkfd_gpuvm_unpin_bo+0x31/0xb0 [amdgpu] amdgpu_amdkfd_gpuvm_free_memory_of_gpu+0x3bf/0x460 [amdgpu] kfd_process_free_outstanding_kfd_bos+0xd4/0x170 [amdgpu] kfd_process_wq_release+0x109/0x1b0 [amdgpu] process_one_work+0x1e2/0x3b0 worker_thread+0x50/0x3a0 kthread+0xdd/0x100 ret_from_fork+0x29/0x50 Move the unpin after the mapped_to_gpu_memory check so it only happens once we are committed to freeing the BO. Fixes: |
||
Linus Torvalds
|
e771677c93 |
iommufd v7.2 merge window pull request
All various fixes:
- Typo breaking the veventq uAPI for 32 bit userspace
- Several Sashiko found errors in the veventq and fault fd paths
- Fix incorrect use of dmabuf locks, and possible races with iommufd
destroy and dmabuf revoke
- Sashiko errors found in the uAPI validation for IOMMU_HWPT_INVALIDATE
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCajFgVAAKCRCFwuHvBreF
YRxvAQCAPARrvfgiO9TcXFgXIHLx4thK5+QAzQuhn8WRHhJyaQD9FV0Ps3Iueayi
hBEUbavor5dwMRRwcAZy92lsno5xvwc=
=pC91
-----END PGP SIGNATURE-----
Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
Pull iommufd updates from Jason Gunthorpe:
"All various fixes:
- Typo breaking the veventq uAPI for 32 bit userspace
- Several Sashiko found errors in the veventq and fault fd paths
- Fix incorrect use of dmabuf locks, and possible races with iommufd
destroy and dmabuf revoke
- Sashiko errors found in the uAPI validation for IOMMU_HWPT_INVALIDATE"
* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
iommu: Avoid copying the user array twice in the full-array copy helper
iommufd/selftest: Add invalidation entry_num and entry_len boundary tests
iommufd: Set upper bounds on cache invalidation entry_num and entry_len
iommufd: Clarify IOAS_MAP_FILE dma-buf support
iommufd: Destroy the pages content after detaching from dmabuf
iommufd: Take dma_resv lock before dma_buf_unpin() in release path
iommufd/selftest: Cover invalid read counts on vEVENTQ FD
iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
iommufd: Break the loop on failure in iommufd_fault_fops_read()
iommufd: Reject invalid read count in iommufd_fault_fops_read()
iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
iommufd: Reject invalid read count in iommufd_veventq_fops_read()
iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
iommufd/selftest: Add boundary tests for veventq_depth
iommufd: Set veventq_depth upper bound
iommufd: Move vevent memory allocation outside spinlock
iommufd: Fix data_len byte-count vs element-count mismatch
iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
|
||
|
Linus Torvalds
|
d076a8d3b9 |
IOMMU Updates for Linux v7.2
Including:
Core Code:
- Fix dma-iommu scatterlist length handling in the P2PDMA path.
- Extend the generic IOMMU page-table code with detailed gather
support for more precise invalidations.
- Add pending-gather tracking to generic page-table invalidation
handling.
- Add support for smaller virtual address sizes in the generic AMDv1
page-table format, including KUnit coverage.
- Fix page-size bitmap calculation for smaller VA configurations.
- Rework Arm io-pgtable allocation/freeing to consistently use the
iommu-pages API and address-conversion helpers.
- Add PCI ATS infrastructure for devices that require ATS, including
always-on ATS handling for pre-CXL devices.
AMD IOMMU:
- Fix several IOTLB invalidation details, including PDE handling,
flush-all behavior, and command address encoding.
- Honor IVINFO[VASIZE] when deriving address limits.
- Fix premature loop termination in init_iommu_one().
- Add Hygon family 18h model 4h IOAPIC support.
- Clean up legacy-mode handling, stale comments, dead IVMD
exclusion-range code, and unused address-size macros.
Arm SMMU / Arm SMMU v3:
- SMMUv2:
- Device-tree binding updates for Qualcomm Hawi, Nord and Shikra
SoCs.
- Constain the clocks which can be specified for recent Qualcomm
SoCs.
- Fix broken compatible string for Qualcomm prefetcher
configuration an add new entry for the Glymur MDSS.
- Ensure SMMU is powered-up when writing context bank for Adreno
client.
- SMMUv3:
- Fix off-by-one in queue allocation retry loop.
- Enable hardware update of access/dirty bits from the SMMU.
- Re-jig command construction to use separate inline helpers for
each command type.
Intel VT-d:
- Add the PCI segment number to DMA fault messages.
- Improve support for non-PRI mode SVA.
- Ensure atomicity during context entry teardown.
- Fix RB-tree corruption in the probe error path.
RISC-V IOMMU:
- Add NAPOT range invalidation support.
- Use detailed gather information for invalidation decisions.
- Compute the best stride for single invalidations.
- Advertise Svpbmt support to the generic page-table code.
- Add capability definitions and clean up command macro encoding.
VeriSilicon IOMMU:
- Add a new VeriSilicon IOMMU driver.
- Add devicetree binding documentation and MAINTAINERS coverage.
- Add the RK3588 VeriSilicon IOMMU node.
- Apply small cleanups and warning fixes in the new driver.
Rockchip IOMMU:
- Disable the fetch DTE time limit.
Apple DART:
- Correct a stale CONFIG_PCIE_APPLE macro name in a comment.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmoyS6IACgkQK/BELZcB
GuNS4BAAvA0o/fG6XDypkBRX/lIce2/2q+/iQCGNkyHxtzdD+gMBW+RS1HQ6lKqU
iKWhbiZIrSc9N/xK99Fi+3DSi1T5QjU6kdaNLH0nag5EwncbtlqmogsNwACJApiq
4f6hbql4rtkiwfX77L4qM5ko+lMMlA+GeHOpz46DUSAU6e/6xRJe0HECHeiJGJFo
KnE/KaZQVhbcMVPObbyCQB+J6MkrQNSVopQ7cxulnyIbddkhDmaA/q4Qna0y3/ik
ctDn5eouQF8OxhyrzGa7UFkaMjIfGCH/kY/x/avqg8q8iUelNo39OSQzKqXpR4A8
OhODTxQ3A3dVF2wAjcdxQFPCsSAd09k/t6UBM/4rsKe0P4Q06rIUwAPtJpMrontS
yQdG91F/9bIGUOa184spMxgrepr9VCx2vls+p28DavyOMjvtjshef1R+5Dl7vnW+
HibSDWbiy8VwQWy+QKCYMeFD1kKcJdaeaailbPtDOzJ8M0Ikm3nZ6+jIR9bQBfrr
NfiOSa+gkfSdCUv0SQ8Gie84gIVJOeiIHF3WsBzbpzx8rYGH7WdUGvsY2WTDcMCL
JqEQatT7u4fQGO5p3gbvmzawMMPNjhbdYFWaBs1Y3j0lS4FHqsTQlUhOKfzY2HCz
diSXFSKvurSyKPZzIrxTHIbpD7QvOoMmQYoAsjWi0PwMna2YUa8=
=hD8h
-----END PGP SIGNATURE-----
Merge tag 'iommu-updates-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu updates from Joerg Roedel:
"Core Code:
- Fix dma-iommu scatterlist length handling in the P2PDMA path
- Extend the generic IOMMU page-table code with detailed gather
support for more precise invalidations
- Add pending-gather tracking to generic page-table invalidation
handling
- Add support for smaller virtual address sizes in the generic AMDv1
page-table format, including KUnit coverage
- Fix page-size bitmap calculation for smaller VA configurations
- Rework Arm io-pgtable allocation/freeing to consistently use the
iommu-pages API and address-conversion helpers
- Add PCI ATS infrastructure for devices that require ATS, including
always-on ATS handling for pre-CXL devices
AMD IOMMU:
- Fix several IOTLB invalidation details, including PDE handling,
flush-all behavior, and command address encoding
- Honor IVINFO[VASIZE] when deriving address limits
- Fix premature loop termination in init_iommu_one()
- Add Hygon family 18h model 4h IOAPIC support
- Clean up legacy-mode handling, stale comments, dead IVMD
exclusion-range code, and unused address-size macros
Arm SMMU / Arm SMMU v3:
- SMMUv2:
- Device-tree binding updates for Qualcomm Hawi, Nord and Shikra
SoCs
- Constrain the clocks which can be specified for recent Qualcomm
SoCs
- Fix broken compatible string for Qualcomm prefetcher
configuration an add new entry for the Glymur MDSS
- Ensure SMMU is powered-up when writing context bank for Adreno
client
- SMMUv3:
- Fix off-by-one in queue allocation retry loop
- Enable hardware update of access/dirty bits from the SMMU
- Re-jig command construction to use separate inline helpers for
each command type
Intel VT-d:
- Add the PCI segment number to DMA fault messages
- Improve support for non-PRI mode SVA
- Ensure atomicity during context entry teardown
- Fix RB-tree corruption in the probe error path
RISC-V IOMMU:
- Add NAPOT range invalidation support
- Use detailed gather information for invalidation decisions
- Compute the best stride for single invalidations
- Advertise Svpbmt support to the generic page-table code
- Add capability definitions and clean up command macro encoding
VeriSilicon IOMMU:
- Add a new VeriSilicon IOMMU driver
- Add devicetree binding documentation and MAINTAINERS coverage
- Add the RK3588 VeriSilicon IOMMU node
- Apply small cleanups and warning fixes in the new driver
Rockchip IOMMU:
- Disable the fetch DTE time limit
Apple DART:
- Correct a stale CONFIG_PCIE_APPLE macro name in a comment"
* tag 'iommu-updates-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (66 commits)
iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path
iommu/amd: Control INVALIDATE_IOMMU_PAGES PDE from the gather
iommu/amd: Make CMD_INV_IOMMU_ALL_PAGES_ADDRESS match the spec
iommu/amd: Have amd_iommu_domain_flush_pages() use last
iommu/amd: Pass last in through to build_inv_address()
iommu/amd: Simplify build_inv_address()
iommu/apple-dart: correct CONFIG_PCIE_APPLE macro name in comment
iommu/vt-d: Fix RB-tree corruption in probe error path
iommu/vt-d: Improve IOMMU fault information
iommu/vt-d: Remove typo from pasid_pte_config_nested()
iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry
iommu/vt-d: Avoid WARNING in sva unbind path
dt-bindings: arm-smmu: Correct and add constraints for Hawi, Shikra and Kaanapali
dt-bindings: arm-smmu: Add compatible for Qualcomm Nord SoC
iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
iommu/rockchip: disable fetch dte time limit
iommu/arm-smmu-v3: Allow ATS to be always on
PCI: Allow ATS to be always on for pre-CXL devices
PCI: Add pci_ats_required() for CXL.cache capable devices
iommu/vsi: Use list_for_each_entry()
...
|
||
|
Linus Torvalds
|
4cc14386e3 |
dma-mapping updates for Linux 7.2:
- added more checks for DMA attributes in the debug code, especially to ensure that mappings are created and released with matching attributes (Leon Romanovsky) - better default configuration for CMA on NUMA machines (Feng Tang) - little code cleanup in dma benchmark tool (Rosen Penev) -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCajESmAAKCRCJp1EFxbsS RKEuAQCpRF+ifclSitwzKYEUX0OY+ZqBcP+L2wqQRkjqbicv7gD+OcE5BhoctdP1 sXUaoZRHHeQ+Pz5kjS2ppSmrG2tT8AQ= =t3Sk -----END PGP SIGNATURE----- Merge tag 'dma-mapping-7.2-2026-06-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping updates from Marek Szyprowski: - added checks for DMA attributes in the debug code, especially to ensure that mappings are created and released with matching attributes (Leon Romanovsky) - better default configuration for CMA on NUMA machines (Feng Tang) - code cleanup in dma benchmark tool (Rosen Penev) * tag 'dma-mapping-7.2-2026-06-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma: map_benchmark: turn dma_sg_map_param buf into a flexible array dma-contiguous: simplify numa cma area handling dma-contiguous: add kconfig option to setup numa cma area if not configured explicitly dma-debug: Ensure mappings are created and released with matching attributes dma-debug: Feed DMA attribute for unmapping flows too dma-debug: Record DMA attributes in debug entry dma-debug: Remove unused DMA attribute parameter ntb: Use consistent DMA attributes when freeing DMA mappings ntb: Store original DMA address for future release |
||
|
Linus Torvalds
|
21bd909c78 |
memblock: updates for 7.2-rc1
Small fixes and a cleanup:
* numa emulation: fix detection of under-allocated emulated nodes
* memblock tests: fix NUMA tests to properly differentiate reserved areas
with differnet flags
* mm_init: use div64_ul() instead of do_div() to better express the intent
of the division
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmoxCXEACgkQOQOGJssO
/ZGDjwgAk4an63rSlJ5tEbOsYK9Ip2yqgDOA/UQlSKsxsGUhg8c3K3A5lUQLGyNn
f2qL2QrxzYGk4a/2QtVptP2c9JNrJdPCbtlv588aZ13k7i+6WwxTtotgwNgFew0k
C0tea45PnIbUafCco4T00LnmzeyVViib33+nmFb2HUEcxENlu1V3SLQMutpNm7YK
G+i5l6Q/6tHV2QhAXOs9IIOPBXlQraDc+CL5+fsnNGKzsTFnRgn5rY17Gg69jctc
TnCj8TubWpTkfa5A/N93zQqJlnj3CthBKkpdM3mUAzqcFSr/W/TBXevc/x7Gp9bI
ox9zq11iKU2MakeTdmK72ldaNg6B+w==
=zkPI
-----END PGP SIGNATURE-----
Merge tag 'memblock-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock
Pull memblock updates from Mike Rapoport:
"Small fixes and a cleanup:
- numa emulation: fix detection of under-allocated emulated nodes
- memblock tests: fix NUMA tests to properly differentiate reserved
areas with differnet flags
- mm_init: use div64_ul() instead of do_div() to better express the
intent of the division"
* tag 'memblock-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
mm: mm_init: use div64_ul() instead of do_div()
tools/testing/memblock: fix stale NUMA reservation tests
mm/fake-numa: fix under-allocation detection in uniform split
|
||
|
Linus Torvalds
|
0839c8963b |
livepatching changes for 7.2
-----BEGIN PGP SIGNATURE----- iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmoxRegbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEFKgDEdIgJTymxUP/iJEA5aswiFZGknP07LR jQi9ooeBPaM1cnPyQ+daNXrhsXVJ9I1tUUC/jlUNIYF/RRA1EnCPHVjTaKDfMTsL doiDBEsVim3RHXvwn517Yt8RIJDMY6USn7UYqIJ35yZGZZkUn+y/VIllNF40FFV+ tXVb5JVU4825vpmdrl3pwh/Tiyx9llvMdxMdq2IwTxVcl+Ip1t5NXZ4anOQR8T2g B12IsM8cklRNdRqlGPSc1GNzevAkky8uzTpYYDjk08pOpMh2G+Ols1sK+zx6MfAM yn7IvT4HnltZPkXu7OfYxefK/DekbmlbkEoJ2uDEPfhv3qY53BKdF17XawWa9dmz 5lrhtD0Ga5jucNXq3bk/UQ3P9/q9WNtsE2u9iUvGDagVqImsPhs1st8olHyF9fha pA3cwTz9XmnxoZ5ESZi+f5M2LsuzugY75j/2YiMuPFNxTmCEdNPlQ7GkBDyPXWLn QT77ROHo8YATvxsg4Atj1h57fMh0dq77Zmsxew1SmfsmoTWPKFLzTDQttE9Vvf+s 6FR74UXzRZFsU7cPrFYULfJyekhlPQE4+W/TOe5LXz/4LnwkjERFJ5ETfsp7Cxne aJZ93BWI+SVqShN6sUKia5h8QjXponAZh31NiTbkvCBxNtBxvNeJopqHqfFsco4a vyjGwFOywFn7/fFg83vzfgrr =lQUD -----END PGP SIGNATURE----- Merge tag 'livepatching-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching updates from Petr Mladek: - Fix a potential memory leak in a selftest module - Make selftests locale independent - Allow running the selftest with older kernels back to 4.12 * tag 'livepatching-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: selftests/livepatch: fix resource leak in test_klp_syscall init error path selftests: livepatch: set LC_ALL=C to fix locale-dependent test failure selftests: livepatch: Check if stack_order sysfs attribute exists selftests: livepatch: Check if replace sysfs attribute exists selftests: livepatch: Check if patched sysfs attribute exists selftests: livepatch: Introduce does_sysfs_exist function selftests: livepatch: Replace true/false module parameter by y/n selftests: livepatch: Check for ARCH_HAS_SYSCALL_WRAPPER config |
||
|
Linus Torvalds
|
0db1496dcb |
printk changes for 7.2
-----BEGIN PGP SIGNATURE----- iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmoyRfwbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEFKgDEdIgJTycTcP/iiyiE+mkR5ruuPNwPsb 3JH6xKVmwcdC+EeyoNLDcR5aNAiY3GSuwXWo9oVX9HAbA9fC68od7ITuPmQn2j6l Rbl9ITtx+mmfhDFrYNIhUXjLlhddojRBPPzfNG68lOzlG7JG75DiIAt30BRuXlbJ njn+eeOuRsL2Y5JJn8Vvv9GnV7NyGb5lvrJzAeOv5zc7qngcu3RSUjt6NryfauRn ZDBqrhQcDpFJ8cZoLq1D9p83tDStzjHBn9VkpXX7Y4dl5fTowI85CWCgFiXLg1KQ KGPq0XXDI1Yw4UNABCxffhxa8nyQyaA35DAllpUNB6hY9QlMZLOGxZjmTtqxeQtP SA01c3RpxQAvyiuja1zzvso+Km3o9doHk7gLDq6z++YfO0u0wjh2wS4IVOKfvyIk LpK6vNQb0gjNqQmn1EYvBPpinnypSeffGGdkmkEZosr4ACAwEE+wg84422NS4gji 1erRecvHnlYIF5wIjCkzLeqGwQLSn4TblHf9/4ImaZrjf8uWaxSsBZam5OfjJpsU LP3//oeIbEnwBNgPE8bIRw5s4L+cenTeAmS8vl7qR5InshSo1FmtYWFbrmw3/Gfy ajV/f67J807XN03p220aRFm1x48aA5eye3VGI7wYnWVwRLIPjEh8nISEa/pV3jxW 4b/N7+xze8zYV9zTPPRGh1u5 =yXoT -----END PGP SIGNATURE----- Merge tag 'printk-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Add upper case flavor for printing MAC addresses (%p[mM][U]) and use it in the nintendo driver - Fix matching of hash_pointers= parameter modes - Fix size check of vsprintf() field_width and precision values - Add check of size returned by vsprintf() - Add KUnit test for restricted pointer printing (%pK) - Some code cleanup * tag 'printk-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: HID: nintendo: Use %pM format specifier for MAC addresses vsprintf: Add upper case flavour to %p[mM] lib/vsprintf: replace min_t/max_t with min/max printk: fix typos in comments lib/vsprintf: Require exact hash_pointers mode matches vsprintf: Add test for restricted kernel pointers vsprintf: Only export no_hash_pointers to test module lib/vsprintf: Limit the returning size to INT_MAX lib/vsprintf: Fix to check field_width and precision |
||
|
Linus Torvalds
|
09fb6892f3 |
Devicetree updates for v7.2:
DT core:
- Add support for handling multiple cells in "iommu-map" entries.
- Support only 1 entry in /reserved-memory "reg" entries. Support for
more than 1 entry has been broken.
- Fix a UAF on alloc_reserved_mem_array() failure
- Make "ibm,phandle" handling logic specific to PPC
- Use memcpy() instead of strcpy() for known length strings
- Ensure __of_find_n_match_cpu_property() handles malformed "reg"
entries
- Add various checks that expected strings are strings before accessing
them
- Drop redundant memset() when unflattening DT
DT bindings:
- Add a DTS style checker. Currently hooked up to dt_binding_check to
check examples.
- Convert st,nomadik platform, ti,omap-dmm, and ti,irq-crossbar
bindings to DT schema
- Add Apple System Management Controller hwmon, Qualcomm Hamoa Embedded
Controller, Qualcomm IPQ6018 PWM controller, fsl,mc1323, Samsung
SOFEF01-M DDIC panel, Freescale i.MX53 Television Encoder, Samsung S2M
series PMIC extcon, and MT6365 PMIC AuxADC schemas
- Extend bindings for QCom Maili and Nord PDC, QCom Hali fastrpc,
qcom,eliza-imem, qcom,oryon-1-5 CPU, and MT6365 Keys
- Consolidate "sram" property definitions
- Fix constraints on "nvmem" properties which only contain phandles and
no arg cells
- Another pass of fixing "phandle-array" constraints
- Add Gira vendor prefix
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmoxvkAACgkQ+vtdtY28
YcMvzhAArPeBiRXPbA10csf2S9wtNuW5SX3rtPS4v87YMNstWpEW20ZGqwpFmns5
jzAvCjqlhMxpxH43eBM3GqaieU41GxCNGsveIyOnJeIK274hLk4p3kyJ2q6xOQYr
t2eC1NOiKFnIOM0ASXmIi5orzVnxHPLvcD9bdvcOWI/LMMK3loiY/CK5Cnps/ZaM
EbCWjxTD3JM+C9P2voaa2vEnpCW0w7Xc3ZXj8S1yxSyuILPcdKJikzP3l/LuEIrL
iy36q/9+JULMS8ooCN6VO0mZPYmB3DAraepHyJxO/hIJLVkO7O1SMIIcmukaRAbC
wf6RtdP498WagPxOOmocmh0k1pkAX4KFfqt9N13vKeUmLElWoaSbpp4v/YODlAr3
w6rSS3Z9Goh6m4ZwnyakENLJjqJdOcJcU9pJHA3EJmTSemChcpQ5GKMf5Sm2fI7O
nEtsuts+WfD+V2FR9qpHYEO6hNllsneJEk4RpSsHbfZorrQTLkDrJesahWsqKl76
wMM8ZWrZIs7vPouOim8LzFANL7myRH1wiJHHZIBCKC77sVNE78d0Bs5+Z118zEq1
eMGybSkbPfLiIYmDWnfnmrRL2+38R45mCzMGdCjhjBMtf0cF88e/TDgXwXiVhpIE
CcHr0COf0mOM+HZHUt23QPEhJZV93pxiXn4913LZfqh+FIAINyk=
=0d13
-----END PGP SIGNATURE-----
Merge tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull devicetree updates from Rob Herring:
"DT core:
- Add support for handling multiple cells in "iommu-map" entries
- Support only 1 entry in /reserved-memory "reg" entries. Support for
more than 1 entry has been broken
- Fix a UAF on alloc_reserved_mem_array() failure
- Make "ibm,phandle" handling logic specific to PPC
- Use memcpy() instead of strcpy() for known length strings
- Ensure __of_find_n_match_cpu_property() handles malformed "reg"
entries
- Add various checks that expected strings are strings before
accessing them
- Drop redundant memset() when unflattening DT
DT bindings:
- Add a DTS style checker. Currently hooked up to dt_binding_check to
check examples
- Convert st,nomadik platform, ti,omap-dmm, and ti,irq-crossbar
bindings to DT schema
- Add Apple System Management Controller hwmon, Qualcomm Hamoa
Embedded Controller, Qualcomm IPQ6018 PWM controller, fsl,mc1323,
Samsung SOFEF01-M DDIC panel, Freescale i.MX53 Television Encoder,
Samsung S2M series PMIC extcon, and MT6365 PMIC AuxADC schemas
- Extend bindings for QCom Maili and Nord PDC, QCom Hali fastrpc,
qcom,eliza-imem, qcom,oryon-1-5 CPU, and MT6365 Keys
- Consolidate "sram" property definitions
- Fix constraints on "nvmem" properties which only contain phandles
and no arg cells
- Another pass of fixing "phandle-array" constraints
- Add Gira vendor prefix"
* tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (50 commits)
dt-bindings: interrupt-controller: qcom,pdc: Add Maili compatible string
dt-bindings: interrupt-controller: ti,irq-crossbar: Convert to DT schema
dt-bindings: vendor-prefixes: add Gira
dt-bindings: embedded-controller: Add Qualcomm reference device EC description
dt-bindings: pwm: add IPQ6018 binding
dt-bindings: hwmon: Add Apple System Management Controller hwmon schema
docs: dt: writing-schema: Clarify what is required in a schema
of: Respect #{iommu,msi}-cells in maps
of: Factor arguments passed to of_map_id() into a struct
of: Add convenience wrappers for of_map_id()
of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry
of: reserved_mem: handle NULL name in of_reserved_mem_lookup()
dt-bindings: cache: l2c2x0: Add missing power-domains
dt-bindings: interrupt-controller: renesas,r9a09g077-icu: Fix reg size in example
dt-bindings: nvmem: consumer: Make 'nvmem' an array of one-item entries
drivers/of/overlay: Use memcpy() to copy known length strings
dt-bindings: add self-test fixtures for style checker
dt-bindings: wire style checker into dt_binding_check
scripts/jobserver-exec: propagate child exit status
dt-bindings: add DTS style checker
...
|
||
|
Linus Torvalds
|
d44ade05aa |
virtio,vhost,vdpa: features, fixes
- new virtio CAN driver
- support for LoongArch architecture in fw_cfg
- support for firmware notifications in vdpa/octeon_ep
- support for VFs in virtio core
- fixes, cleanups all over the place, notably
- vhost: fix vhost_get_avail_idx for a non empty ring
fixing an significant old perf regression
- plus READ_ONCE annotations mean virtio ring is now
free of KCSAN warnings
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmoye9IPHG1zdEByZWRo
YXQuY29tAAoJECgfDbjSjVRpwHYIAMqFAn8OKVub093fOPYsa3dnsCI+6Y70Q7BK
XWXmEUs41Zbrye7GCVVKBdGog/v8WYcjA5yzyZDeCpAwbn8Vwiw6VbgD+t5IJFG+
iLtUlbotvod+esyKbSZdTSSIO5Lxxw0QqDdOt3qhz5aWwMX4LYZSO0BvNzFGaNT5
TiyKRpPtsbfox09YYrDYfm1vFhlR0mE3fMFsAy8dvauliy3rAh9bWg54oGeFdACD
PGWGvsVycl7Ly++yflqFNp8nPE+azL4jbFm3/SrjMhFcTpIEV692nhrSmiIKK7Cv
K5au5nvAmtt1sRyDHucFB9+pbUOYkNLkc3DrH/NqGFwUwxF3+pk=
=H7B4
-----END PGP SIGNATURE-----
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
Pull virtio updates from Michael Tsirkin:
- new virtio CAN driver
- support for LoongArch architecture in fw_cfg
- support for firmware notifications in vdpa/octeon_ep
- support for VFs in virtio core
- fixes, cleanups all over the place, notably:
- vhost: fix vhost_get_avail_idx for a non empty ring
fixing an significant old perf regression
- READ_ONCE() annotations mean virtio ring is now
free of KCSAN warnings
* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (37 commits)
can: virtio: Fix comment in UAPI header
can: virtio: Add virtio CAN driver
virtio: add num_vf callback to virtio_bus
fw_cfg: Add support for LoongArch architecture
vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
vdpa/octeon_ep: Add vDPA device event handling for firmware notifications
vdpa/octeon_ep: Use 4 bytes for mailbox signature
vdpa/octeon_ep: Fix PF->VF mailbox data address calculation
vhost_task_create: kill unnecessary .exit_signal initialization
vhost: remove unnecessary module_init/exit functions
vdpa/mlx5: Use kvzalloc_flex() for MTT command memory
vdpa_sim_net: switch to dynamic root device
vdpa_sim_blk: switch to dynamic root device
virtio-mem: Destroy mutex before freeing virtio_mem
virtio-balloon: Destroy mutex before freeing virtio_balloon
tools/virtio: fix build for kmalloc_obj API and missing stubs
virtio_ring: Add READ_ONCE annotations for device-writable fields
vduse: fix compat handling for VDUSE_IOTLB_GET_FD/VDUSE_VQ_GET_INFO
tools/virtio: check mmap return value in vringh_test
vhost/net: complete zerocopy ubufs only once
...
|
||
|
Linus Torvalds
|
3dc0df0339 |
VFIO updates for v7.2-rc1
- Fix out-of-tree vfio selftest builds with make O=. (Jason Gunthorpe)
- Allow vfio selftests to build when ARCH=x86 is used for 64-bit x86
builds. (David Matlack)
- Tighten vfio selftest infrastructure with stricter builds, safer
path handling, sysfs helpers, and reusable device/VF-token setup.
Build on that to add the SR-IOV UAPI selftest across supported
IOMMU modes. (Raghavendra Rao Ananta)
- Conclude earlier vfio PCI BAR work already taken as v7.1 fixes by
replacing vfio_pci_core_setup_barmap() and direct barmap[] access
with vfio_pci_core_get_iomap(). Fix resulting sparse warnings.
(Matt Evans)
- Simplify hisi_acc vfio-pci variant driver device-info reads by
using the mailbox's new direct command-based read helper.
(Weili Qian)
- Avoid duplicate reset handling in the Xe vfio-pci variant driver
reset-done path. (GuoHan Zhao)
- Resolve a lockdep circular dependency splat by tracking active
VFs with a private sriov_active flag rather than calling
pci_num_vf() under memory_lock. (Raghavendra Rao Ananta)
- Add CXL DVSEC-based readiness polling for Blackwell-Next in the
nvgrace-gpu vfio-pci variant driver, including interruptible,
lockless waits to support worst case spec defined timeouts.
(Ankit Agrawal)
- Prevent vfio_mig_get_next_state() from spinning forever on blocked
migration state transition. (Junrui Luo)
- Fix a qat vfio variant driver migration resume race by taking the
migration file lock before boundary checks. (Giovanni Cabiddu)
- Add explicit dependencies between vfio selftest output object files
and output directories to ensure directories are always created.
(David Matlack)
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmowfFkRHGFsZXhAc2hh
emJvdC5vcmcACgkQI5ubbjuwiyIYbRAAmBlCwGK714u3ECnkMJinYF6QwY/bW163
imY9XUidYzALebGlhwwGL88LBfdsoQdRMa+/8CGJvGKA2VYX2sC2Ffe7E3nT7N/y
IuigGaDf1U5sjU6aho1DcOmmcdHRsKJgv2WFkfatF9BTl9uM+/6fbZGimlAHvh+8
Zay31GPFp6Z9u8fC3JS1oXbhLwWv7RtBBUje3TkKqnNKRvgZYys9wcYpWOZO3Zdo
jNyQ7/LDRzcyx3/dHD29PFZh/wkX4luwt+xKAq20oLhZc+Ws74BurEC176RBTGh4
WR92+IZfq1LpMBSg6RnDIABENS6QAacLPr+iKWzbW/tcv5Z+CWHe9DXuwdVjIoe/
lRjXWTjxrINANOmeusZigJKkeGuyqpSXxzRxXJbaq1sHZKZZza/G86luYp7xUDD6
/EUAxz5UPgWLdEvo+5kgrruZwpMGBFhO94nH7r83IqeP9lz1H93msKnQbsgaDteR
1Ne9V9S3jYRpNbrl4Qu2IniiCWpkTOrutMxtchkf0cc1aEearCEdst9AZpv1dNpX
wu/5emU5oR1d0jxdlZusTRQtD5itSjAnwht7VwT5AiTvc5vHe4mJUZbKm3CotbyB
894aqaz+4AeVqmkBp9bNOT7N6m9k+sTvEvHypEXHgb9UC0YW+YTx8p0YpytHWWsu
tXqq98CXnGw=
=n16c
-----END PGP SIGNATURE-----
Merge tag 'vfio-v7.2-rc1' of https://github.com/awilliam/linux-vfio
Pull VFIO updates from Alex Williamson:
- Fix out-of-tree vfio selftest builds with make O= (Jason Gunthorpe)
- Allow vfio selftests to build when ARCH=x86 is used for 64-bit x86
builds (David Matlack)
- Tighten vfio selftest infrastructure with stricter builds, safer path
handling, sysfs helpers, and reusable device/VF-token setup. Build on
that to add the SR-IOV UAPI selftest across supported IOMMU modes
(Raghavendra Rao Ananta)
- Conclude earlier vfio PCI BAR work already taken as v7.1 fixes by
replacing vfio_pci_core_setup_barmap() and direct barmap[] access
with vfio_pci_core_get_iomap(). Fix resulting sparse warnings (Matt
Evans)
- Simplify hisi_acc vfio-pci variant driver device-info reads by using
the mailbox's new direct command-based read helper (Weili Qian)
- Avoid duplicate reset handling in the Xe vfio-pci variant driver
reset-done path (GuoHan Zhao)
- Resolve a lockdep circular dependency splat by tracking active VFs
with a private sriov_active flag rather than calling pci_num_vf()
under memory_lock (Raghavendra Rao Ananta)
- Add CXL DVSEC-based readiness polling for Blackwell-Next in the
nvgrace-gpu vfio-pci variant driver, including interruptible,
lockless waits to support worst case spec defined timeouts (Ankit
Agrawal)
- Prevent vfio_mig_get_next_state() from spinning forever on blocked
migration state transition (Junrui Luo)
- Fix a qat vfio variant driver migration resume race by taking the
migration file lock before boundary checks (Giovanni Cabiddu)
- Add explicit dependencies between vfio selftest output object files
and output directories to ensure directories are always created
(David Matlack)
* tag 'vfio-v7.2-rc1' of https://github.com/awilliam/linux-vfio:
vfio: selftests: Ensure libvfio output dirs are always created
vfio/qat: fix f_pos race in qat_vf_resume_write()
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
vfio/nvgrace-gpu: Add Blackwell-Next GPU readiness check via CXL DVSEC
vfio/pci: Use a private flag to prevent power state change with VFs
vfio/pci: Fix sparse warning in vfio_pci_core_get_iomap()
vfio/xe: avoid duplicate reset in xe_vfio_pci_reset_done
hisi_acc_vfio_pci: simplify the command for reading device information
vfio/pci: Replace vfio_pci_core_setup_barmap() with vfio_pci_core_get_iomap()
vfio: selftests: Add tests to validate SR-IOV UAPI
vfio: selftests: Add helpers to alloc/free vfio_pci_device
vfio: selftests: Add helper to set/override a vf_token
vfio: selftests: Expose more vfio_pci_device functions
vfio: selftests: Extend container/iommufd setup for passing vf_token
vfio: selftests: Introduce a sysfs lib
vfio: selftests: Introduce snprintf_assert()
vfio: selftests: Add -Wall and -Werror to the Makefile
vfio: selftests: Allow builds when ARCH=x86
vfio: selftests: Fix out-of-tree build with make O=
|