A collection of fixes that have been accumulated recently.
The amount is still "new normal", but all small fixes.
Mostly hardware-specific quirks, but including a few core fixes, too.
ALSA Core:
- Fix potential UAF and race fixes in ALSA timer core
- Fix sequencer queue timer cleanup to prevent leaks and double-free
HD-audio:
- Fix silent streams with Intel HDMI keep-alive silent mode
- Quirks for HP laptops (Pavilion x360, EliteBook 830 G8, ZBook 8
G2a), Samsung 750XBE/730XBE, and Dell Pro QC1255, Alienware x16 R2,
Lunnen Ground 14
- Properly validate ACPI mute object in CS35L41 HDA companion driver
- Reset calibration data size on failure in TAS2781 HDA driver.
USB-audio:
- Support FIXED_RATE quirk for JBL Quantum650 Wireless USB headset
ASoC:
- Intel SOF SoundWire board driver quirks for new Dell laptops
- DMI overrides and quirks for AMD ACP/YC platforms, including new
ASUS TUF platforms and MSI Vector A16 HX laptops
- Skip sysclk reset for active DAIs in shutdown for FSL imx-card
- Fix spurious BCLK on resume by clearing BYP in FSL SAI driver
- Add playback-only quirk for H616 codec in Allwinner driver
- Fix Cirrus Logic CS35L56 potential probe deadlock
- Fix cache write-through on resume in FS210X codec
- Bound firmware description string parsing in TAS2781 codec driver
- Fix duplicate DAPM widget names for wideband DAI in BT-SCO codec
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmpfdfoOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE8GsA/8DOTRLmfsOkdCRd23LcQtmU0vLypZD1Mb4mpW
0syspvylS7RnUN+2pGOqP/k4BbOFPtoVHel0RTHqmolesA0OFTMk86nHZF/sOpno
VspMoiI9ptFjOFQdrCVt9wM+Yj9A5n/cRXuwgNJ3RxLuBPPgStzIPQqrfB2ofMIo
ox+iYu57kvm4eH+WU8gul5snxTh1g9y2CdWCvtKSCVtTpK9IoMTdPV7DWizti2eA
u3Na0wt6FuDnO74bg81Oku7u4rsfjBUEc8p6EOk+p8zWpQ12WFmH7QS+1Q2lLHqz
m8IdgLH4PwRZjqdX/k9SggNyNoGc3LIE3bhyuioFQBr+9brZluuj9rVYWARAg+wF
WZGJoY1o9Pr+lQk24Uk1kEdrOYYHUqPJj4JuPdLI9gnA5j0GyF28dke4QV2Z0849
NXnX/R0u8nV1QQQLFmyTsTm4FghfWGZTLnQnTvuG0zoEyktrGVSWpR77nN+zQGFx
gsv0hJAf8PKPEK6uyxfVzcG+vy0N/m2BDQ6CekcLQYjqKpYj9wV8Z9ftbCAKlD6w
s1Z9pR5SQgbzDLxCE4XHUgz3rox+5Tni9ulgnkhHlkTLVHmRB84rEJ1+J3VJTLYt
fxogK3LpD7pu70w+DR7byUtx8jHLD5wQCw/fY7VSf2cxbqTQpLPzJ6HyLxxR9TPY
fFEiG8A=
=Shbe
-----END PGP SIGNATURE-----
Merge tag 'sound-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of fixes that have been accumulated recently.
The amount is still "new normal", but all small fixes. Mostly
hardware-specific quirks, but including a few core fixes, too.
ALSA Core:
- Fix potential UAF and race fixes in ALSA timer core
- Fix sequencer queue timer cleanup to prevent leaks and double-free
HD-audio:
- Fix silent streams with Intel HDMI keep-alive silent mode
- Quirks for HP laptops (Pavilion x360, EliteBook 830 G8, ZBook 8
G2a), Samsung 750XBE/730XBE, and Dell Pro QC1255, Alienware x16 R2,
Lunnen Ground 14
- Properly validate ACPI mute object in CS35L41 HDA companion driver
- Reset calibration data size on failure in TAS2781 HDA driver.
USB-audio:
- Support FIXED_RATE quirk for JBL Quantum650 Wireless USB headset
ASoC:
- Intel SOF SoundWire board driver quirks for new Dell laptops
- DMI overrides and quirks for AMD ACP/YC platforms, including new
ASUS TUF platforms and MSI Vector A16 HX laptops
- Skip sysclk reset for active DAIs in shutdown for FSL imx-card
- Fix spurious BCLK on resume by clearing BYP in FSL SAI driver
- Add playback-only quirk for H616 codec in Allwinner driver
- Fix Cirrus Logic CS35L56 potential probe deadlock
- Fix cache write-through on resume in FS210X codec
- Bound firmware description string parsing in TAS2781 codec driver
- Fix duplicate DAPM widget names for wideband DAI in BT-SCO codec"
* tag 'sound-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (25 commits)
ALSA: hda/realtek - Add quirk for Dell Pro QC1255
ALSA: hda/tas2781: clear cali_data.total_sz when calibration read fails
ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE
ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
ALSA: timer: drain a slave's callback before its master detaches it
ALSA: timer: don't re-enter an instance callback that is still running
ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
ALSA: hda/realtek: Add quirk for HP Pavilion x360
ASoC: Intel: sof_sdw: Add quirks for new Dell laptops
ASoC: cs35l56: Use complete_all() to signal init_completion
ASoC: cs35l56: Fix potential probe() deadlock
ASoC: fs210x: Make cache write through again during resume
ALSA: hda/realtek: Add inverted LED quirk for HP ZBook 8 G2a
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
ALSA: hda: cs35l41: validate and free ACPI mute object
ALSA: hda/realtek: Fix speakers on Alienware x16 R2
ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
ASoC: amd: yc: Add DMI quirk for MSI Vector A16 HX A8WIG
ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
...
- Avoid redundant allocations when allocating IMSIC page tables
- Apply SBI FWFT LOCK flag only on successful set
- Bound SBI PMU counter mask scan to BITS_PER_LONG, since on RV32
the PMU SBI start/stop helper can only access 32 PMU counters.
- Skip TLB flush when G-stage PTE becomes valid if the Svvptc
extension is available.
- Always show Zicbo[m|z|p] block sizes in ONE_REG
- Inject instruction access fault on unmapped guest fetch
- Use raw spinlock for irqs_pending and irqs_pending_mask
- Fix Spectre-v1 in vector register access via ONE_REG
x86:
- Fixes to SEV selftests.
- Once free_nested() did a VMCLEAR of shadow VMCS, there's no need to VMCLEAR it
again if the kernel is preempted and thread migration happens
- Preserve nested TDP shadow page tables if they are used as roots, instead of
clearing them unnecessarily
- Fix use of stale data if out-of-memory happens after vendor module reload
- Check for invalid/obsolete root *after* making MMU pages available, because
the latter can make a page invalid
- Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
-----BEGIN PGP SIGNATURE-----
iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmpfSUwUHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroOrWQf/S8Za6t7bZbQbJHDV0NXCKufpyKyz
l6WMsLGdn4LFLNqCtKhvQf5lEZ5PKRHFTGoWrO1wQSbREHRUCnfMD5lsSKQA4Grf
0QpQ6YBjXFv6zg0M456/Q/S1oyusyqkXXBS8BxlBQyfqR+ByKx8f4PXTGazfUua3
4SPHr5TUxr6CXy8715OQUGa1Xdf0/5d3OseiAgBwqM31yZPhK0tsar77Cd9P93bs
DC+FzfphHg0gb3s/xSfuVR0BPnqHvQMDF9rS/YKgJgJdZkzHXCo7muWRQmHWK+FR
Q2zOTWSlJATQucC0+2j1yj2Wdhg1itgZTfj/8RaIDRKbmjk0S1bLc3bamg==
=Svds
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
"RISC-V:
- Avoid redundant allocations when allocating IMSIC page tables
- Apply SBI FWFT LOCK flag only on successful set
- Bound SBI PMU counter mask scan to BITS_PER_LONG, since on RV32 the
PMU SBI start/stop helper can only access 32 PMU counters.
- Skip TLB flush when G-stage PTE becomes valid if the Svvptc
extension is available.
- Always show Zicbo[m|z|p] block sizes in ONE_REG
- Inject instruction access fault on unmapped guest fetch
- Use raw spinlock for irqs_pending and irqs_pending_mask
- Fix Spectre-v1 in vector register access via ONE_REG
x86:
- Fixes to SEV selftests
- Once free_nested() did a VMCLEAR of shadow VMCS, there's no need to
VMCLEAR it again if the kernel is preempted and thread migration
happens
- Preserve nested TDP shadow page tables if they are used as roots,
instead of clearing them unnecessarily
- Fix use of stale data if out-of-memory happens after vendor module
reload
- Check for invalid/obsolete root *after* making MMU pages available,
because the latter can make a page invalid
- Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
KVM: selftests: sev_init2_tests: Derive SEV availability from KVM
KVM: selftests: sev_smoke_test: Only run VM types the host offers
KVM: x86/mmu: Fix use-after-free on vendor module reload
KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
KVM: riscv: Fix Spectre-v1 in vector register access
RISC-V: KVM: Serialize virtual interrupt pending state updates
RISC-V: KVM: Inject instruction access fault on unmapped guest fetch
RISC-V: KVM: Zicbo[m|z|p] block sizes should be always present in ONE_REG
riscv: kvm: Skip TLB flush when G-stage PTE becomes valid with Svvptc
KVM: riscv: PMU: Bound counter mask scan to BITS_PER_LONG
KVM: riscv: SBI FWFT: Apply LOCK flag only on successful set
RISC-V: KVM: Avoid redundant page-table allocations in ioremap topup
- tracing/probes: Avoid temporary buffer truncation in match_command_args()
Compare argument name, delimiter, and comm expression directly instead of
formatting into a stack buffer to prevent false matching failures.
- tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
Return early when trace_probe_log.argc is zero to prevent out-of-bounds
access when constructing the formatted error command string.
- tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
Ensure buffer length is greater than current position before subtraction
to prevent unsigned size underflow when formatting print strings.
- tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
Check system name null-termination to avoid partial prefix matching when
comparing event probe target system names.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmpfMPgbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bDm8IAJ3GuBwQOTcVyn1+7Poh
fOtXOD9yMIV2YYoe6MDD/ZF1JCCnJgzgjPOqRbZjM4uGE8QbEuGnrwwu3zRiNON3
JU1R5aOxadflNhOnY7HxPjDHTwxJ5z+Ju10wPM+YE3M9gLKia8uzCabdEgYEly01
Rx6kpGKdsNgtJ/uAbrZlx++YtJCmBI1j+SdnRgNSejbcJUBtTmt+VYA+oh7ISF0f
Fuhw6MuznpnA9JkLrPJaUI6KLiNLEoLQVS2gqhCD0PvrlDGF/h+b7Qbv9ML0C8YW
W0p38Sq0Pc9lNlukYJlkh1A4H7lbAGpdGgZVoCvMQZt1ccy+H1QYfXzrFRlYyRWk
n6g=
=pC9O
-----END PGP SIGNATURE-----
Merge tag 'probes-fixes-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes fixes from Masami Hiramatsu:
- Avoid temporary buffer truncation in match_command_args()
Compare argument name, delimiter, and comm expression directly
instead of formatting into a stack buffer to prevent false
matching failures
- Prevent out-of-bounds write in __trace_probe_log_err()
Return early when trace_probe_log.argc is zero to prevent
out-of-bounds access when constructing the formatted error
command string
- Fix potential underflow in LEN_OR_ZERO macro
Ensure buffer length is greater than current position before
subtraction to prevent unsigned size underflow when formatting
print strings
- Fix exact system name matching in eprobe_dyn_event_match()
Check system name null-termination to avoid partial prefix
matching when comparing event probe target system names
* tag 'probes-fixes-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
-----BEGIN PGP SIGNATURE-----
iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmpdukAbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg70hwQAJ78AUVnvTSwMi2w6TEx
KFYZSMPdBi9TwGC3lDCcTA/U5PqGTkKACWBLf5z+9YXAcb3By7OiSAQeko7sib0X
k0jz5SmJjMHrHe1qGQvaztLin9/Ow9K8/QUQW0qhunwF6FbmgkfWdXw4au5+zV5R
rwdyDt74nlhf3pCOpJb1JL2BFy23PXbfQIty9I+2qKUMPSgqhC6l7CBYsWZoG5ub
QC2+Go5Ygz61iKDpAZ3TKjULI58+7K3FBq+76Jr9UajPVD75637Wze3zsrgcb2LV
THxITsWTxx5CwiQF1Sf0JGo/rU+V0wU5oJqwmn4FrGeZXhnGXXcnXmG70VzvAJYX
4so+p0aejefqQnwcFbQE0+dFjrEuD+Dl8PVzlDSMygz/y1xpSlxVz+83kQFH+MV6
1bxrOJNS6sLwvqtwRa8INjqvMfk443Ub5sFUS+bav0ZUlOg3BmitkEP0H0NlQ+5p
CAMCXFSfb/1UDXMrMHAcZn3LZtDLNaVVkneCz97A72D5C6Ae4rL3/FeHvmDk1KUh
StO3ReF4JXeN3FYTzWpMIw07jGxR9ZuFVn78DAW9Gwjk658wsXBqcGPgg/GAsy6R
bvrFRkWiJGSSdUeipNwxjfTeM8NwkA7fv+DnLbp6HzpOLDKIC8pID1Eoh1nwTlas
R073SeoNHO0sC6Lz+2NcvVMb
=1jNx
-----END PGP SIGNATURE-----
Merge tag 'for-7.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba:
"I'm catching up with the fix backlog in the development branch, so
here's a number of them and will probably send one more for this or
the next rc:
- relocation fixes:
- skip attempting compression on reloc inodes
- exclude inline extents from file extent offset checks
- fix minor memory leak after error when adding reloc root
- fix root cleanup after inserting and merging
- fix clearing folio tags after writeback
- clear logging flag of extent map before splitting
- fix unsigned 32/64 type conversions when accounting dirty metadata,
leading to continually exceeding threshold
- fix regression in 32bit compat ioctl for subvolume info
- fix type of SEARCH_TREE ioctl buffer in UAPI header
- fix expression in ASSERT expression which can be unconditionally
evaluated on some compilers
- only account delalloc bytes for regular inodes"
* tag 'for-7.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
btrfs: fix GET_SUBVOL_INFO after compat refactor
btrfs: free mapping node on duplicate reloc root insert
btrfs: fix a regression where PAGECACHE_TAG_DIRTY is never cleared
btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
btrfs: fix NULL pointer deref during assertion in btrfs_backref_free_node()
btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
btrfs: reject inline file extents item in get_new_location()
btrfs: do not try compression for data reloc inodes
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
btrfs: fix reloc root cleanup in merge_reloc_roots()
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
- Avoid redundant page-table allocations in ioremap pcache topup
- Apply SBI FWFT LOCK flag only on successful set
- Bound SBI PMU counter mask scan to BITS_PER_LONG
- Skip TLB flush when G-stage PTE becomes valid with Svvptc
- Zicbo[m|z|p] block sizes should be always present in ONE_REG
- Inject instruction access fault on unmapped guest fetch
- Serialize virtual interrupt pending state updates using raw spinlock
- Fix Spectre-v1 in vector register access via ONE_REG
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEZdn75s5e6LHDQ+f/rUjsVaLHLAcFAmpbMVwACgkQrUjsVaLH
LAdENhAAi5eWE2WACOp50yy+e9/K/n7WFyGsnAg1u157HR0ywBIfOKA9Q3fGnHs/
WUeqXjtjnVLJFB/LfG3aF9O4PLyU+iZ2g7On5O4ZXQMY2wpueHBZ2fyvUFmrWKl6
JwwgluMxeX1IIhJdhSe0hUU8sxcurYtmuxMKO/2lkYcqxfn6UGpBHONkNGVBncsJ
RcaU2lQBnv+8hJ0wlCb0hep9R34YkjF1rmti71tru7XqnF3rq2Z5PBITjfBHXmeB
6iYvVnpSvPiEvxF8454dvQ9bbXmh3OS+ncI/qjS1u2fkrQrM00eZs2bKzUpW7LlG
7ZA5Rm+EQPbHoPV1EKHXXip7uSZ7U8nm9CxMCADI7zZi1K3qvKnnRtA4MahLxO2o
WSxWEW7ONHskZWz1YZUyqpPCutJQOtKaIu7ITzS0aHep9UB/3Lrs1sA9hRTEINUl
9O1Nusro+wdlG1SsycWXPNoyHvEnN1h2FjWLRpr54X9mEQtCCg0/qNvwo6CPZNwH
E9lWgx7rcFnmy24ln01fHOtTD5IKRNis2MUswqNVyc3X7gOft+w8/1QE/MHYC9cl
LF7b12xCOFp1PMkicgVYwWRQ+6qrvidFvWOWqVtcRmfMw6TjXIrB5Fr/MYg8gBL/
N6uzyk3+UmSiFehbElXww3YEiqd81KzKgeEsU74/T2yyAEflVYA=
=jcT0
-----END PGP SIGNATURE-----
Merge tag 'kvm-riscv-fixes-7.2-1' of https://github.com/kvm-riscv/linux into HEAD
KVM/riscv fixes for 7.2, take #1
- Avoid redundant page-table allocations in ioremap pcache topup
- Apply SBI FWFT LOCK flag only on successful set
- Bound SBI PMU counter mask scan to BITS_PER_LONG
- Skip TLB flush when G-stage PTE becomes valid with Svvptc
- Zicbo[m|z|p] block sizes should be always present in ONE_REG
- Inject instruction access fault on unmapped guest fetch
- Serialize virtual interrupt pending state updates using raw spinlock
- Fix Spectre-v1 in vector register access via ONE_REG
On Intel platforms with a VMX preemption timer and APICv, if a VMM
calls KVM_GET_LAPIC before KVM_GET_MSRS to save the vCPU state, it is
possible to lose a pending timer interrupt.
If the thread running these ioctls is migrated to another core after
calling KVM_GET_LAPIC but before KVM_GET_MSRS and the guest is using
their LAPIC timer in TSC-deadline mode, not only does the save LAPIC
state not carry the pending interrupt, the TSCDEADLINE MSR will be
zeroed.
After migration across CPUs, KVM_GET_MSRS calls vcpu_load, posting the
interrupt and clearing the MSR:
vcpu_load() ->
kvm_arch_vcpu_load() ->
kvm_lapic_restart_hv_timer() ->
start_hv_timer() ->
apic_timer_expired() ->
kvm_apic_inject_pending_timer_irqs()
. post interrupt into the LAPIC state
. clear IA32_TSCDEADLINE
The saved LAPIC state will be missing the pending interrupt and the saved
MSR will be zero. Oops.
Fix by only posting an interrupt when we're attempting to enter the guest
(vcpu->wants_to_run == true), not for vcpu_load from other paths.
Assisted-by: gemini:gemini-3.1-pro-preview
Debugged-by: David Matlack <dmatlack@google.com>
Debugged-by: Sean Christopherson <seanjc@google.com>
Debugged-by: Jim Mattson <jmattson@google.com>
Debugged-by: James Houghton <jthoughton@google.com>
Signed-off-by: Venkatesh Srinivas <venkateshs@chromium.org>
Message-ID: <20260715234234.15382-2-venkateshs@chromium.org>
Reviewed-by: James Houghton <jthoughton@google.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Cc: stable@vger.kernel.org
Fixes: ae95f566b3 ("KVM: X86: TSCDEADLINE MSR emulation fastpath", 2020-05-15)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
The test asserted that the X86_FEATURE_SEV CPUID bit exactly matches
whether KVM offers KVM_X86_SEV_VM. That is not an invariant: when all
SEV ASIDs are assigned to SEV-SNP, KVM does not offer the SEV VM type
even though CPUID reports SEV, so the test aborts on an SNP-only host.
Derive SEV availability from KVM_CAP_VM_TYPES (as already done for SEV-ES
and SNP), assert only the one-way implication that a type offered by KVM
is also reported in CPUID, and TEST_REQUIRE() the SEV VM type so the test
skips cleanly when it is unavailable.
Reviewed-by: Tycho Andersen (AMD) <tycho@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Message-ID: <5d3c345113748f39b7982e365d241abaf3e11086.1784545391.git.dwmw@amazon.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
sev_smoke_test ran the plain SEV subtest unconditionally, gated only on
the X86_FEATURE_SEV CPUID bit, while gating SEV-ES and SNP on the
KVM_CAP_VM_TYPES bits. CPUID reporting SEV does not mean KVM offers the
SEV VM type: when all SEV ASIDs are assigned to SEV-SNP, KVM_X86_SEV_VM
is unavailable even though X86_FEATURE_SEV is set. On such a host the
test aborts in KVM_CREATE_VM instead of exercising the available modes.
Gate the SEV subtest on KVM_CAP_VM_TYPES like the others, so the test
runs the VM types the host actually offers.
Reviewed-by: Tycho Andersen (AMD) <tycho@kernel.org>
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Message-ID: <2b5e7a83d277134294199a455469bb436196b902.1784545391.git.dwmw@amazon.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
mmu_destroy_caches() destroys pte_list_desc_cache and
mmu_page_header_cache, but leaves both pointers unchanged. The pointers
live in kvm.ko, and therefore survive when a vendor module is unloaded
while kvm.ko remains loaded.
If creation of pte_list_desc_cache fails during a subsequent vendor
module load, its assignment sets pte_list_desc_cache to NULL and the
error path calls mmu_destroy_caches(). mmu_page_header_cache still
points to the cache destroyed during the preceding vendor module
unload. Passing that stale pointer to kmem_cache_destroy() causes a
slab use-after-free.
Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,
CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A
one-shot test hook forces pte_list_desc_cache to NULL on the second
invocation of kvm_mmu_vendor_module_init():
1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.
KASAN reports:
BUG: KASAN: slab-use-after-free in
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
kmem_cache_destroy+0x21/0x1d0
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
Allocated by task 16817:
__kmem_cache_create_args+0x12c/0x3b0
__kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]
kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]
...
Freed by task 16820:
kmem_cache_destroy+0x117/0x1d0
kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]
Clear both pointers immediately after destroying their caches so that
the stored state reflects the caches' lifetime and repeated cleanup is
safe.
With the fix applied, the same injected vendor module reload fails with
-ENOMEM as expected and produces no KASAN report.
Fixes: cb498ea2ce ("KVM: Portability: Combine kvm_init and kvm_init_x86")
Cc: stable@vger.kernel.org
Signed-off-by: Phil Rosenthal <phil@phil.gs>
Message-ID: <20260718-kvm-mmu-cache-uaf-v3-1-e103b93c74e1@phil.gs>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
kvm_mmu_zap_oldest_mmu_pages() excludes a shadow page whose root_count
is non-zero from top-level reclaim, because such a page cannot be
freed. The path in mmu_page_zap_pte() that recursively zaps a parentless
nested TDP child has no such check. As a result, a shadow page can
be zapped even if the page itself can't be freed; as the comment in
kvm_mmu_zap_oldest_mmu_pages() notes, zapping it will just force vCPUs
to rebuild the page.
As in top-level reclaim, do not recursively prepare zapping of a
nested TDP child whose root_count is non-zero.
Fixes: 2de4085ccc ("KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU. If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root. On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.
Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acb, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.
Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately.
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Fixes: f95eec9bed ("KVM: x86/mmu: Don't put invalid SPs back on the list of active pages")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
free_nested() frees the shadow VMCS while vmcs01 still points to it. But
because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU
might migrate before the pointer is cleared and __loaded_vmcs_clear()
may then execute VMCLEAR.
The VMCS needs to stay attached until its explicit VMCLEAR completes, but
then it can be hidden and the page safely freed.
Fixes: 355f4fb140 ("kvm: nVMX: VMCLEAR an active shadow VMCS after last use")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
eprobe_dyn_event_match() checks if the target event system in argv[0]
matches ep->event_system using strncmp(ep->event_system, argv[0], len).
However, if ep->event_system is longer than len (e.g. "eprobes" vs
"ep/event"), strncmp() still returns 0 because the first len characters
match.
Check that ep->event_system[len] is '\0' to ensure exact system name
matching.
Link: https://lore.kernel.org/all/178454235856.290363.14872590900774231133.stgit@devnote2/
Fixes: 7d5fda1c84 ("tracing: Fix event probe removal from dynamic events")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
In __set_print_fmt(), LEN_OR_ZERO is defined as (len ? len - pos : 0).
If len is non-zero but smaller than pos, len - pos evaluates to a negative
integer. When passed as a size argument to snprintf(), this negative value
is cast to a large unsigned size_t, bypassing buffer size limits.
Ensure len > pos before subtracting to avoid integer underflow.
Link: https://lore.kernel.org/all/178454234934.290363.15247317871499514139.stgit@devnote2/
Fixes: 5bf652aaf4 ("tracing/probes: Integrate duplicate set_print_fmt()")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
If trace_probe_log.argc is 0 in __trace_probe_log_err(), the loop
constructing the command string will not execute and p will remain equal to
command. Writing to *(p - 1) will cause an out-of-bounds access before
command. This should not happen, but better to be treated.
Reject if trace_probe_log.argc is 0.
Link: https://lore.kernel.org/all/178454233992.290363.18323091580600697731.stgit@devnote2/
Fixes: ab105a4fb8 ("tracing: Use tracing error_log with probe events")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
In trace_probe_match_command_args(), a stack buffer buf[MAX_ARGSTR_LEN + 1]
(256 bytes) is used to format "<name>=<comm>". However, since name can
be up to 32 bytes (MAX_ARG_NAME_LEN) and comm up to 255 bytes
(MAX_ARGSTR_LEN), the formatted string can exceed 256 bytes and get
truncated by snprintf(), causing spurious argument matching failures.
Instead of formatting into a temporary buffer on stack, compare the
argument name, the '=' delimiter, and the comm expression directly.
Link: https://lore.kernel.org/all/178454233010.290363.10428767141343428804.stgit@devnote2/
Fixes: eb5bf81330 ("tracing/kprobe: Add per-probe delete from event")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
aren't considered appropriate for backporting. 10 are for MM.
All are singletons - please see the relevant changelogs for details.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCal5rBQAKCRDdBJ7gKXxA
jtgtAQCuWNUTCR7u+MzAuO3Nh46DxHXeb27OTHZL8JcazQTEQgD+NZfwqVYnNNX/
4CVqqZvrXJQDg0aiWtIP4VdLirNh/Ac=
=Gslp
-----END PGP SIGNATURE-----
Merge tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton:
"12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues
or aren't considered appropriate for backporting. 10 are for MM.
All are singletons - please see the relevant changelogs for details"
* tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mm/memory-failure: trace: change memory_failure_event to ras subsystem
mm: page_reporting: allow driver to set batch capacity
mm/kmemleak: fix checksum computation for per-cpu objects
mm/damon/core: disallow overlapping input ranges for damon_set_regions()
MAINTAINERS: add Usama as a THP reviewer
fat: avoid stack overflow warning
mm/damon/core: validate ranges in damon_set_regions()
m68k: avoid -Wunused-but-set-parameter in clear_user_page()
mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
mm/page_vma_mapped: fix device-private PMD handling
MAINTAINERS: s/SeongJae/SJ/
userfaultfd: prevent registration of special VMAs
tas2563_save_calibration() assigns cali_data.total_sz before it reads the
per-device calibration data from EFI, but its error paths return without
clearing it again. cali_data.cali_reg_array is left all zero, because the
function returns before the register addresses are assigned.
On the first playback tasdev_load_calibrated_data() does
if (!data || !cali_data->total_sz)
return;
which passes, since total_sz is still non-zero. It then issues five
4-byte bulk writes to p->r0_reg, p->r0_low_reg, p->invr0_reg, p->pow_reg
and p->tlimit_reg, all of which are 0. Register 0 decodes to book 0 /
page 0 / register 0x00, so the auto-incrementing block write zeroes
registers 0x00 to 0x03. Register 0x03 is PB_CFG1, which holds AMP_LEVEL,
so the amplifier gain is set to its minimum and the speaker stays silent.
This is reproducible on a Lenovo Yoga 7 14ARB7 (two TAS2563 on I2C,
ACPI INT8866) whose factory calibration was never written to UEFI, so the
EFI read fails with EFI_NOT_FOUND. The two woofers driven by the
amplifiers are silent while the tweeters driven directly by the ALC287
play. Reading the amplifier registers over i2c shows PWR_CTL = 0x00
(active) and the TDM slots correctly programmed by the RCA profile, but
PB_CFG1 = 0x00. With this change PB_CFG1 keeps its power-on default of
0x20 and both woofers play.
tas2781_save_calibration() in tas2781_hda.c already clears total_sz on
failure; do the same for the TAS2563 variant.
Signed-off-by: Philipp Oster <philippdev5396@outlook.de>
Link: https://patch.msgid.link/20260720-tas2781-calfix-v1-1-3a5fa6ad90bc@outlook.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add a codec SSID quirk for Samsung ELECTRONICS 750XBE/730XBE using
HDA_CODEC_QUIRK() instead of SND_PCI_QUIRK(), because the alsa-info
report from this device does not expose a PCI subsystem ID, only the
HDA codec subsystem ID (0x144d:0xc824) is available.
This applies ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET to fix sound
being very low and distorted on the headphone jack of this system.
Reported-by: Caio Ramos <caioramos97@gmail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=208663
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20260720123702.799474-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The firmware on the Lunnen Ground 14 marks pin 0x1b as unused even
though the internal speakers are connected to it. As a result, the
speakers are not detected.
Add a pin configuration quirk for PCI subsystem ID 2782:a212 to configure
pin 0x1b as an internal speaker.
The pin configuration was tested on a Lunnen Ground 14 (DMI product LL4FA)
with an ALC269VC codec. The internal speakers and microphone work as
expected.
Cc: stable@vger.kernel.org
Signed-off-by: Nikita Maksimov <nickstogramm@yandex.ru>
Link: https://patch.msgid.link/20260720180214.73770-1-nickstogramm@yandex.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The OCC poll response parser walks a counted list of sensor data blocks.
It used the static backing-array capacity as the parse boundary, but a
transport response makes only data_length bytes current and valid. A
truncated response can therefore make the parser consume a block header or
block extent outside the current response.
Use data_length as the parent boundary, prove the fixed poll header and
each current block header before reading them, and prove the complete block
before advancing. Keep parsed sensor metadata local until the complete
response has passed validation, then publish it. Propagate
malformed-response errors before publishing the OCC as active.
Fixes: aa195fe49b ("hwmon (occ): Parse OCC poll response")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20260720115826.14813-1-pengpeng@iscas.ac.cn
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
snd_timer_close_locked() drains the closing instance's own in-flight
callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a
master instance is closed, remove_slave_links() clears each slave's
->timer; the slave's own close then reads timer == NULL and takes the
branch that skips the drain entirely (snd_timer_stop_slave() also no-ops
on a NULL timer). So a slave whose callback is still running when the
master is closed is freed underneath the live callback, leading to
use-after-free.
Drain the slaves too before remove_slave_links() severs them.
snd_timer_stop() has already taken this instance off the active list, so
no new slave callback can be queued. Take the slaves off the ack list so
a pending one can't fire either, then wait for any that is already in
flight.
Fixes: 37745918e0 ("ALSA: timer: Introduce virtual userspace-driven timers")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/D26598EB-DBF7-4D76-9F71-8E4BD59822D4@doyensec.com
The userspace-driven timer (utimer) TRIGGER ioctl calls
snd_timer_interrupt() directly with no serialization, so two threads
triggering the same utimer can run snd_timer_interrupt() on one
snd_timer concurrently.
snd_timer_process_callbacks() drops timer->lock around each instance
callback and marks the in-flight callback with the single
SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that
bit to drain an in-flight callback before freeing the instance. The bit
cannot represent two concurrent callbacks: when a second interrupt
re-queues an instance whose callback is still running, both run at once,
the first to finish clears the bit, and the close-path drain then frees
the instance (and its callback_data) while the other callback is still
live - a use-after-free reachable by any user able to open
/dev/snd/timer, both via a user timer instance and via a sequencer queue
timer bound to the utimer.
snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so
a concurrent interrupt already observes it under the lock. Skip
re-queuing an instance (and its slaves) to the ack/sack list while its
callback is in flight; the accumulated pticks are delivered on the next
tick, so no event is lost.
Fixes: 37745918e0 ("ALSA: timer: Introduce virtual userspace-driven timers")
Cc: stable@vger.kernel.org
Suggested-by: Takashi Iwai <tiwai@suse.de>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/6F9B6501-8E65-4265-B02C-7EFB240D1664@doyensec.com
- Call flush_cache_vmap() after populating new vmemmap pages, on all
architectures. This avoids spurious faults on RISC-V
microarchitectures that cache PTEs marked as non-present
- Disable LTO for the vDSO to prevent the compiler from eliding
functions that are used, but which don't appear to be
- Fix an issue with libgcc's unwinder and signal handlers by dropping
an unnecessary CFI landing pad instruction in __vdso_rt_sigreturn
(similar to what was done on ARM64)
- Avoid reading uninitialized memory under certain conditions in
hwprobe_get_cpus()
- Save some memory and I$ when CONFIG_DYNAMIC_FTRACE=n by avoiding
our four-byte function alignment requirement in that case
- Avoid clang warnings about null-pointer arithmetic in the I/O-port
accessor macros (inb, outb, etc.) by ifdeffing them out when
!CONFIG_HAS_IOPORT
- Make the build of the lazy TLB flushing code in the vmalloc path
depend on CONFIG_64BIT and CONFIG_MMU (since those platforms are the
only ones that use it)
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpc+vAACgkQx4+xDQu9
KksZqw//fbTxRO0sOhv5h+UvJNfsKg43AZWpYVr6bGvtur3d5DUBBiIY+KOroT1Y
G3l9UvzFV6NIdvHNt3OOy9lIC25Oy0EC5MoCjToRSTOTH+EjsMgdZPMFOZh8VBkT
qnn1ehvtJSIYRmX+Xk6gPk8BQLxVbFkRedXUd24vMCSYwlt9MxqWeJjLlktm1slj
IjBWZRi5AOLGn4pVEztgMaGauxF5OObq2Cq5WjE2U1Pz/nvbAUMSBBNkJU739WOp
KK+Hr2HqcoOHbgDcElYsQEY+WMKUgn7cdv/tCLBLAIzGrthFkm/4FkIP327qkKyu
HDc3ef5VpPLY1MoS7hMFS5+HWJ4POEKaGEDf85HRIycr4mTsUUac4NtEoSvONhrP
x4jCRlu/PTWoX3n0RWR5ed5iWtk2tWCcQcaUCUYdJWPLHyJLq25TmQpvCbtfmHtI
1NySg0i4zL8tHJzCklJfwn8CyGfL1Gt627aQUHsJtMA6xeY73+zpxuOKrJElK/z7
4vHykuTlkBjnpVX+a4QImUOYQ6cJ+Km6jkwhvJAaKYXzCs4JFqolCSEg1q/eBGBk
ay9igMkpw+hy2o0OM9TdkEMPaDOsVO6XATjmoVfoyGqvMsZ4sFFHV1fiHqdE5FUE
uoQrbuJ6R729nEWEOoRdw9lGjOI+Hmv+bVKDLwpynSIfbw7TNIY=
=gKi/
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
- Call flush_cache_vmap() after populating new vmemmap pages, on all
architectures. This avoids spurious faults on RISC-V
microarchitectures that cache PTEs marked as non-present
- Disable LTO for the vDSO to prevent the compiler from eliding
functions that are used, but which don't appear to be
- Fix an issue with libgcc's unwinder and signal handlers by dropping
an unnecessary CFI landing pad instruction in __vdso_rt_sigreturn
(similar to what was done on ARM64)
- Avoid reading uninitialized memory under certain conditions in
hwprobe_get_cpus()
- Save some memory and I$ when CONFIG_DYNAMIC_FTRACE=n by avoiding our
four-byte function alignment requirement in that case
- Avoid clang warnings about null-pointer arithmetic in the I/O-port
accessor macros (inb, outb, etc.) by ifdeffing them out when
!CONFIG_HAS_IOPORT
- Make the build of the lazy TLB flushing code in the vmalloc path
depend on CONFIG_64BIT and CONFIG_MMU (since those platforms are the
only ones that use it)
* tag 'riscv-for-linus-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()
arch/riscv: vdso: remove CFI landing pad from rt_sigreturn
riscv: vdso: Do not use LTO for the vDSO
riscv: io: avoid null-pointer arithmetic in PIO helpers
riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE
mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap
riscv: mm: Make mark_new_valid_map() stuff depend on 64BIT && MMU
JBL Quantum650 Wireless (0ecb:2125) requires the same workaround that
was used for JBL Quantum610 and Quantum810 for limiting the sample rate.
Without it, the capture (microphone) stream fails to work. Setting the
QUIRK_FLAG_FIXED_RATE flag, as done for the sibling models, makes both
playback and capture work correctly.
Signed-off-by: Daniel C. Ribeiro <dcoutinho.96@gmail.com>
Link: https://patch.msgid.link/20260719090037.40149-1-dcoutinho.96@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpbBc8QHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpibUD/9SCYq0YZSH4fgwv6PwouAdw2/0TogbCf2E
OZ+oq76WYeG8Q95iFXLdjv72EkNi+m1cHesn89lhvZkHWu9TAKAeCoXcnfsLIpmp
60e6Dnz7GCTRsv2L9nBEEmsyQdYGVbbMes8hSpBXbcO1jczbr8x9nzBzkfR4XL3z
/Vqy1CK9lA0z1+0sVkUrjKt9li7BGodpUPiNdhMReu8nuwuy1mHJ585+Y6pkwHav
1TmaSiQ+NQxSLmyOwG1rzmzWCDdeszAa56exJ6L/T16RJ6rNTPcz2TCjsBcmuupo
UytqdUhKaqxlikfrdus0Cnjsn8ivTiXFfYnvNTAWThRuIq+ePC4nzWzuncJTeVdE
MIzfND6sTmfOG6Vchrx0CN92nv5gsOprxbLjbM28VSb5Xpad5PYMMGpdkBranI/9
zUkJi0fiJOp0i/uvpltdPqcgvPKBHBhLyi5GPVb+fjLJW2Gm1s1xcBfpKIj+2+S5
A3F2ac626DhcGrKQcZPl71RwAeEWRzP3Zr93Eg1oEQd9uqRz1jH2K8DCGh0fd9mP
FppUw/p4GbBnc8QVraIfAIssg12eFU2ZIHvWuTiB/1UnzMuS3gJ8pwEy0s/9ObUJ
+8vCI1fZDmbXN7T31rTl/X4npL0AfXtTbG61KcWqvbAhyVmmKNoNPHFj4SA3G0wF
p5Y7qj2Jmg==
=qHz/
-----END PGP SIGNATURE-----
Merge tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- Fixes for the dio bounce buffer helpers: correct the alignment of
bounced dio read bios to avoid a double unpin, handle huge zero
folios in bio_free_folios(), and don't warn on the larger-order folio
attempts in the greedy allocation path.
- Try a slab allocation in bio_alloc_bioset() before falling back to
the mempool, restoring the previous behavior for non-sleeping
allocations from a cache-enabled bioset.
- Serialize elevator changes for the same queue using the writer lock.
- Fix a race in blk_time_get_ns() where a task preempted between
setting PF_BLOCK_TS and the cached-timestamp reload could return 0.
- blk-cgroup fix for leaks and the online flag on a radix_tree_insert()
failure in blkg_create().
- Free the copied pages when blk_rq_map_kern() fails after
blk_rq_append_bio() rejects the bio.
- Remove manually added partitions on loop device detach, fixing dead
partition devices left behind and a subsequent LOOP_CONFIGURE -EBUSY
- Bound the AIX partition lvd scan to the sector that was actually
read.
- Show the block operation in error injection rules (Jackie)
* tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
block: fix aligning of bounced dio read bios
block: handle huge zero folios in bio_free_folios
block: try slab allocation in bio_alloc_bioset() before mempool
block: show operation in error injection rules
block: serialize elevator changes for the same queue using a writer lock
block: free copied pages when blk_rq_map_kern() fails
block: do not warn when doing greedy allocation in folio_alloc_greedy()
partitions: aix: bound the lvd scan to one sector
blk-cgroup: fix leaks and online flag on radix_tree_insert failure
loop: remove manually added partitions on detach
block: fix race in blk_time_get_ns() returning 0
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpbBbsQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpgpFD/9NnN5A9eMm+4ZeC41yeynykN1QOl5wCqoT
zi7CIizuwtsCQAjgpFUahMosvkLg3P77S/MJxqzlGVPhaSvp/QISxr7oH9WqyoYf
jEfi3Dx8XfdxK+5GG0dC7s4iiWuxZha7iGt4W2DZmjXWWu0ofCKB0FTVK7J/AkC0
7DA4hMmts643cE9pwmD1Bbuj7SYmqjneDhgwe/JaSuCiuuclN5L359E1rnxzc+dS
9McCmwPjwF0f+Vs9IWyHb1KNMBBmC2T0n2zvzKoJKL72mQ0v3IaOlGkUEDgp7EpT
TIK5rEKPl/Wpw970BOlzdYgD01vDiWeLuQQQlGfAaLheUUImLoFPo1rf/q8nCgFN
CVEWDSZZWRnwH6FjFCa5JwOS0B9YcamYzhkTck1O+g7KcNB6ZCU1zMX8+pCMEVgr
Ju5J2uoazT2txEZEgCSSUYLuRRSpz5P5s/VmFEXNxeRAhndlGhyNq16kVnRqyLfA
OzVS5uYeqSOlOYbY8pL4QkGaxBUr0CSBOnhCT7q9d8KYXnh9CHReFQcy9wPclSfd
D+F5v4CPqWN0tg2rrYBgo3Zpt4Mwb1JEiyOAaIapAKQT2T9tNtp1fubq4PA9c1ub
VkSRutPGeUWNC1fEjs67I9V3V0bzbR8j+AMC9AAFFqaqpn2B5NGHqvlcYdaNuuje
Dr7yXvROWw==
=Ue52
-----END PGP SIGNATURE-----
Merge tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Fix a use-after-free in the bpf-ops struct_ops path, where the same
io_uring_bpf_ops map could be registered more than once.
- Fix the deferred iovec free for the provided-buffer grow path, which
could leave the caller with a dangling iovec and result in repeated
frees. Follow-up to the earlier fix in this series.
- Zero-check the unused addr3/pad2 SQE fields for unlinkat
* tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/bpf-ops: reject re-registration of an already-bound ops
io_uring/fs: check unused sqe fields for unlinkat
io_uring/kbuf: free the replaced iovec after a successful grow
A couple of fairly routine driver fixes, nothing too remarkable.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpcxP4ACgkQJNaLcl1U
h9Cnigf9FRw9pWxDNEhhABYvy7A9kcSTYWDoYEoljdsvYzGCWpbkS9VCmiSOcxlA
WYrVkrknUrjnd2twMyqWSs3MGePcncEchlOKOqTF8bA12dKSiRgFlldZ5MoRgYrf
GAbFzlu0Z3wZgGK2n8NwHwQ4ut0LcM4PYYKqQ+nABbURmfCA+oCnbE2QhCdRxHUB
MtHiA1fzoBnnCHsDkRnI5MTbkKWA2r2nqzQY7pzojtwrR4xghm1MUO16gD5V8VM9
w5ndpdLIer3FtHpwy1OqtuvXnZJEu8xWqQ/uAv+HfdHsRvckPB6hKt6GkSKVdut/
R4e8ZbIuSfEwcwy8VC4fRQjVw5BNVQ==
=b2Lc
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A couple of fairly routine driver fixes, nothing too remarkable"
* tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled
spi: dw-dma: Wait for controller idle before completing Tx
One straightforward driver fix for some incorrectly described bitfields
in the ltc3676 driver.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpcxWoACgkQJNaLcl1U
h9Bj2Af+J+ibj5u+dpsT9GdFRkV3dkZtR7wAShFlbVYRI0dtEvrvAOFQ+/dh8whX
vRs8qvn8JtpXepUs2DsZlvB70CEdK5yYIuAQBJAj1QpolWLd069q0TK3fHAdqD6R
61KCpuhbQ8JTCYzL/BCmKhYTqr9A9vhC0hn6cFflqT3Ngunxvayal/pIiutC0S0W
AT57CKul41+DUPJ7XhKlCuuo2ZUL6wiYKkecRp8+hsMWllUaN9Jg+gsPKZQXwL18
ykKOsfYqQR+qinUNRqZTvzJUlMZNJCOpeTZnrVx1gIRv03UpCFnLSCQlDDRWqHkZ
CfDemVw6oZdyHY+0qNroKYENpbqWoA==
=SYeH
-----END PGP SIGNATURE-----
Merge tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fix from Mark Brown:
"One straightforward driver fix for some incorrectly described
bitfields in the ltc3676 driver"
* tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
- Reject too long acpi_rsdp= boot parameter values
(Thorsten Blum)
- Validate console=uart8250 baud rate to fix early boot hang
(Thorsten Blum)
- Remove dead Makefile rule (Ethan Nelson-Moore)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpcjhMRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gVUw//UmbQ3jby1pvjDfAeJeqI8x2iCY2F9N5l
AqPD3371RPNzyx5uqyz4dLY94M31JW4jqzxntbIhGJrm9aXPLRTVzfMjF6sd9Lmj
lkMyHW+a4DVtA7oVSk2INebGUX2t+cpGLcF+9/yH3QavpLIXL9BNz5vDYqS0POMc
EitNNNqmO4+/f6oLf7Xxfl8Z2z2cVhcPCj1EG8b/rOWKeFmw1teuVu+dSagnV7Cn
/Hi4S8Q5HYUvvFBIFxgtuPW5S8HlTINhaE8hiat+Z0BENlAnbNThGEpz7hdogXAq
VDFwGPsjg3AF2agTWnF3e7Vs2CdDLHgcdTxUGII2lhZ9wCXzQ72+qXajf9PPynzH
YV9xtPw0a4sTDcR4QtdgBneCLf320WmbV6aH+tm9aZ1LIcPUgBO0qxYI/Ff1Frm8
NI1LxZJMiVfNNpFBk4JW/V1QKo3Padjhzfc23Rb4/8Xpu+S+Cu31pligIH3Rtnhm
pNt6Bv8eV61QJMZvjy4+5MouFfK2rL3YyEiE/WMP5cRhOCaK10hgDDEqCbuL5IRV
AgYMqGQPLTbZbdZZ1oSub+OPIRidMDfITlLoR9ggcJgNrV5J4tGysgAJWU2fCDoR
5dvRlzeQ0cjmCVMC+FVjQAahjBX5KqAQolDuDGB/vAAvxiir711ZO7g9UTCCRWQg
Bq1slSZ0WEc=
=upW0
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Reject too long acpi_rsdp= boot parameter values (Thorsten Blum)
- Validate console=uart8250 baud rate to fix early boot hang (Thorsten
Blum)
- Remove dead Makefile rule (Ethan Nelson-Moore)
* tag 'x86-urgent-2026-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot: Validate console=uart8250 baud rate to fix early boot hang
x86/boot: Reject too long acpi_rsdp= values
x86/cpu: Remove Makefile rule for removed UMC CPU support
Do not assume there are only bank 0 and bank 1 available, just use '!='
for bank comparison.
Fixes: d0ddfd241e ("hwmon: (asus-ec-sensors) add driver for ASUS EC")
Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
Link: https://lore.kernel.org/r/20260711074217.554656-1-eugene.shalygin@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
MAX34451 and ADPM chips do not support standard PMBus VIN/IIN limit
registers, manufacturer specific min/max registers, or undercurrent
or undertemperature fault limits. STATUS_BYTE and STATUS_OTHER are also
not available. Accessing these non-existent registers during driver
initialization triggers a CML error and asserts ALERT. Handled by
blocking these functions during read/write.
Fixes: 7a001dbab4 ("hwmon: (pmbus/max34440) Add support for MAX34451.")
Fixes: 629cf8f6c2 ("hwmon: (pmbus/max34440) Add support for ADPM12160")
Fixes: 2e0b52f1ae ("hwmon: (pmbus/max34440): add support adpm12200")
Fixes: 479bfeba2e ("hwmon: (pmbus/max34440): add support adpm12250")
Signed-off-by: Alexis Czezar Torreno <alexisczezar.torreno@analog.com>
Link: https://lore.kernel.org/r/20260716-max34451_fixes-v1-1-a941b27eaecb@analog.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
- Fix checksum lib on machines without the vector facility where the
non-vector fallback made csum_partial() calculate the checksum from
address 0 instead of the provided buffer
- Fix cpum_cf perf event initialization missing speculation barrier for
user controlled event numbers used as generic event array indexes
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpcDpgACgkQjYWKoQLX
FBizogf/fOTDdmXPx2xp5PFadlaoVnRmycslrPDog+lVp2tl+RXlAU6mKT27gcXT
2G/PCF9SjYQSQdGztMNPCh6Az1cAo+XvhADtElumRAjlybTYlk++aallv5+buHRS
Z2jEnurYVWQaQP/PpFDIUhh7Yf6ggrctXuRdYgyJv/5Siy4OQYQEpWQazQXyfOZI
506gQ2M4mD8dIJRgZygM7tQztR7K8IFDIUPzxMCiBKj9XQQBpZ0Q9SOm07nL6dtS
MHcXbyd80XbvVoYNCZHquktJ4ZOvru+sA65Hd94TSHOQRDxuuiDueo6VYPPqBX5o
/ENY4mFt0aD7m0lbTqMyxrUI2bDzLg==
=WPyD
-----END PGP SIGNATURE-----
Merge tag 's390-7.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Vasily Gorbik:
- Fix checksum lib on machines without the vector facility where the
non-vector fallback made csum_partial() calculate the checksum from
address 0 instead of the provided buffer
- Fix cpum_cf perf event initialization missing speculation barrier for
user controlled event numbers used as generic event array indexes
* tag 's390-7.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
s390/checksum: Fix csum_partial() without vector facility
The biggest core change is the reliable wake fix for scsi_schedule_eh
which is used by both libata and libsas which could otherwise cause
error handler hangs due to rare races. All other fixes are in drivers
(well except the export symbol removal) the next biggest being the
target PR-OUT transportid parsing fix.
Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
-----BEGIN PGP SIGNATURE-----
iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCalvAVRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
c2hpcC5jb20ACgkQ50LJTO6YrIUI/QD+Kr/rBo60RkNJfsdC6vmHj0+pkkSpQNkM
XGTZXjPz+poBAL7ybOwWvQWYoJ2LLDg10F9dSb68DxE2FJAS3lzM0IGf
=dhtX
-----END PGP SIGNATURE-----
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"The biggest core change is the reliable wake fix for scsi_schedule_eh
which is used by both libata and libsas which could otherwise cause
error handler hangs due to rare races.
All other fixes are in drivers (well except the export symbol removal)
the next biggest being the target PR-OUT transportid parsing fix"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
scsi: elx: efct: Fix I/O leak on unsupported additional CDB
scsi: core: wake eh reliably when using scsi_schedule_eh
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
scsi: target: Bound PR-OUT TransportID parsing to the received buffer
scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
scsi: sg: Report request-table problems when any status is set
scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()
scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
scsi: core: Remove export for scsi_device_from_queue()
imx: fix empty SMBus block reads in atomic and IRQ paths
spacemit: return IRQ_NONE for empty interrupt status
mlxbf: fix a use-after-free issue
mediatek: restore WRRD support without automatic restart
CREDITS: add Wolfram Sang
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCaltX3AAKCRDaeAVmJtMt
bqqgAPsFCe+3Y/71UNBWzOEI99zUlyFu7OH7Rt/015HVXsmelgEAjkQ0X5RX2Njg
AswoeT+OGvxxVxlNeNMMrxAM4s6caQU=
=yKh8
-----END PGP SIGNATURE-----
Merge tag 'i2c-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c fixes from Andi Shyti:
"A handful of small fixes for host controller drivers.
One patch also adds Wolfram Sang to CREDITS after more than a decade
of work on I2C"
* tag 'i2c-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
i2c: mediatek: fix WRRD for SoCs without auto_restart option
i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED
i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ)
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
CREDITS: Add Wolfram Sang
HP Pavilion x360 sets a bogus PCI SSID (103c:0000), hence the driver
picks up a wrong quirk entry, resulting in an almost silent output.
And yet, the existing quirk for x390 doesn't seem sufficing, and we
need the extra setup for the amp.
This patch adds the quirk entry for the codec SSID (103c:8486) to
initialize the amp via COEF verbs and chains to the existing quirk for
another x360 model to address the silent output.
Closes: https://lore.kernel.org/CAF2ktaUW2oaWwGazGtJQ3o1JyE2R4O2xPd-Dchr=qqi7_QRruQ@mail.gmail.com
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260716064916.540616-1-tiwai@suse.de
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpa3JoACgkQiiy9cAdy
T1EP7wv9FiM0oUOekxfydVFTMdpzkMpvBHcLoVSpnFjvgJZVh4gOmvyY0fRuXKRB
o40SAoBvZP5KRe6qjBxo2o+z4T6NpRY+K1ftv0xxFvgDZ3+wvyV6jEf80cLnoDAl
xqOji4PeeZfrKVwPYAFTVWhImQZ9IZuP3cBpZKqf5EWYovk43Ex/VQCqnVdAMY33
fvdUEY1u8HVVILOzHRWvo7QAlyw6SEBjdmTLqCB2mNDwBcfg1C/zuvbf8KYS4LXu
+C8F137JlSz6tplrTBGIq3FVwLxhGunZwanO3IVM8B0+FhSsedWT/qS5CbgijZxn
GpT9CBKWN/KU3YPHEFDKxcSkJAc0MA20cb9LRUdIy7uv+OnYVV2oY209dukj8RpI
05F8RC1frrdhY9vZZhjIw/x5jbrHb4cGEohGyB6pH8C1gJc1AOuFBEZ7X7dHgGqA
jjJ3bBD4f8mL7Pim37gubyCYvO/MtjEkKYWvoWxtjWewHxpJdvH+JefnOz8Cyp94
BXR4hd1r
=K5Ks
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd
Pull smb server fixes from Steve French:
"ksmbd server fixes, mostly addressing malformed SMB request
handling and connection/session lifetime issues, including
two information-disclosure or memory-safety bugs in the SMB2
request/response paths.
- validate FILE_ALLOCATION_INFORMATION before block rounding to
prevent a client-controlled overflow from truncating a file.
- pin connections while asynchronous oplock and lease-break
notifications are pending.
- initialize compound SMB2 READ alignment padding, preventing
disclosure of uninitialized heap bytes.
- release the allocated alternate-stream xattr name after rename.
- size multichannel binding session-key buffers for the largest
permitted key, avoiding a stack buffer overflow.
- remove a disconnecting connection's channels from every session,
including channels whose binding state has since changed.
- serialize binding preauthentication-session lookup and update
against its teardown.
- check that every compound request element contains StructureSize2
before reading it"
* tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd:
ksmbd: validate compound request size before reading StructureSize2
ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp
ksmbd: remove stale channels from all sessions on teardown
ksmbd: fix stack buffer overflow in multichannel session-key copy
ksmbd: fix memory leak of xattr_stream_name in smb2_rename()
ksmbd: zero the smb2_read alignment tail to avoid an infoleak
ksmbd: pin conn during async oplock break notification
ksmbd: fix integer overflow in set_file_allocation_info()
- Interrupt initialization and handling Fixes for the Designware
ahci_dwc driver (Rosen)
- Avoid possible infinite loop when scanning completion in the
Designware ahci_dwc driver (Rosen)
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCalrPMQAKCRDdoc3SxdoY
dnQ3AP9NaxQu5xoACQtFtNPb8CyY35CRclAKZsKk+/clCNAVwwEAuUo2rgw/eAfP
w98ZEvN1HMRqW4dbatv2d3zNw2L8Iw8=
=9+gW
-----END PGP SIGNATURE-----
Merge tag 'ata-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Damien Le Moal:
- Interrupt initialization and handling fixes for the Designware
ahci_dwc driver (Rosen)
- Avoid possible infinite loop when scanning completion in the
Designware ahci_dwc driver (Rosen)
* tag 'ata-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
ata: sata_dwc_460ex: use platform_get_irq()
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
Now that proper fixes have been found, let's revert this workaround.
This reverts commit a1fc7bf667.
Tested-by: Mario Limonciello (AMD) <superm1@kernel.org>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit f64a9be5653689ff43e148cd8a6483077488c8e5)
Cc: stable@vger.kernel.org # 8382cd234981: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
Cc: stable@vger.kernel.org # 48ab86360af1: drm/amd/display: check GRPH_FLIP status before sending event
Cc: stable@vger.kernel.org
[Why]
After unifying DCN interrupt sources under VUPDATE_NO_LOCK, we have two
remaining issues to clean up:
1. On DCN, flip completion is now delivered from VUPDATE_NO_LOCK
(dm_crtc_high_irq_handler) instead of GRPH_PFLIP. But VUPDATE_NO_LOCK
fires every frame, regardless of whether a flip has latched.
2. There is a window during commit where a flip is armed (pflip_status =
SUBMITTED) but not yet programmed into HW. If the VUPDATE_NO_LOCK
fires in that window, its handler would deliver a flip event to
userspace before HW has latched to it. If userspace then renders to
what it believes is now the back buffer (but HW is still latched to
it!), it will cause display corruption. This issue seemed to have
been introduced by:
commit 1159898a88 ("drm/amd/display: Handle commit plane with no FB.")
Enabling replay or psr extended the duration of this window, and
hence made corruption more likely to be observed.
[How]
* Move acrtc->event/pflip_status arming to after
update_planes_and_stream_adapter() has programmed the flip into HW.
This closes the window where pflip_status is SUBMITTED but the flip is
not yet programmed.
* Add dc_get_flip_pending_on_otg(), which reads the HUBP flip-pending
status straight from HW for the pipe(s) bound to an OTG instance. It
is keyed only by otg_inst and does not take or mutate a
dc_plane_state, so it is safe to call from the OTG interrupt handler
without racing a concurrent commit that may be modifying plane state.
* Optimistically query for flip-pending after programming, in the event
that HW latched to the new fb between programming start and arming
event. If it latched, send the vblank event immediately, rather than
wait for the next vblank IRQ.
* In the VUPDATE_NO_LOCK handler, only deliver flip completion once
dc_get_flip_pending_on_otg() reports the flip is no longer pending.
Otherwise leave the flip armed and retry on the next vupdate.
* For DCE, maintain the existing behavior of arming flips before
programming, and relying on GRPH_FLIP to fire at HW latch.
v2:
* Drop flip_programmed completion object, instead move
event/pflip_status arming after programming.
* For DCN, optimistically query for flip pending immediately after
programming, and if it latched, send event right away.
v3:
* Fix event timestamps on optimistic flip latch detection, where it's
possible for it to run *before* the vupdate IRQ updates the timestamp.
* Add more docstrings for DCN vblank handling.
* Clean up if conditions in dm_arm_vblank_event().
* Code style cleanup on braces surrounding multi-line statements.
Fixes: 9b47278cec ("drm/amd/display: temp w/a for dGPU to enter idle optimizations")
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/3787
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141
Assisted-by: Copilot:claude-opus-4.8
Tested-by: Mario Limonciello (AMD) <superm1@kernel.org>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit f64a9be5653689ff43e148cd8a6483077488c8e5)
Cc: stable@vger.kernel.org # 8382cd234981: drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
Cc: stable@vger.kernel.org
