| Age | Commit message (Collapse) | Author |
|---|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- Fix a range of use-after-frees during rcu pathwalk caused by non-rcu
frees.
Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash()
and ->d_compare() read in rcu mode has to be freed after a grace
period. umount(2) hides most of it because namespace_unlock() waits
for one, but a chdir() out of a lazily unmounted directory or the
close() of the last file on it drops the last reference without.
* ext4_get_link() reads the sbi and the extent status counters for a
symlink stored in a data block. Both are freed after a grace
period now.
* The unicode map of casefolded ext4, f2fs and tmpfs was freed under
generic_ci_d_hash() and generic_ci_d_compare().
* ntfs3 with nocase freed its sbi and mount options under its dentry
hash and compare. A remount freed the old options right away too.
* eventfs freed an eventfs_inode after an SRCU grace period only
while tracefs_d_revalidate() reads it under rcu_read_lock().
* afs and 9p are only saved by the grace period their private bdi
gets in bdi_unregister(). They stop depending on it.
* create_ipc_ns() leaked the mqueue mount and its superblock on a
late failure. A long-term mount needs kern_unmount().
- Don't let idle threads pin the initramfs.
The idle threads of the secondary cpus are forked from PID 1 with a
private copy of its fs_struct, aren't on the task list so
pivot_root() never moves them and never exit. So the initramfs stayed
pinned forever on every machine with more than one cpu, 70 to 150 MB
in the reports. They share init_fs now like init_task does.
- A mount that copy_tree() leaves out can't take over a lock.
copy_tree() drops mounts of mount namespace files from the copies it
makes for unshare(CLONE_NEWNS) and propagation without looking at
MNT_LOCKED. So root in a user namespace could bind a child's
/proc/<pid>/ns/mnt beneath a locked cover, let it take the lock over,
unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with
EPERM now and the move beneath a locked mount is refused up front.
- Revert "namei: don't reveal overmounted entries in refwalk" from the
rc7 fixes. The bug class is bigger than that patch.
- namei: lookup_fast_for_open() checked ->d_inode while
traverse_mounts() checks the type in d_flags, which is set second, so
a refwalk racing the instantiation could fail an O_CREAT open with
ENOENT. Use d_is_negative() in both places.
- Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount()
that mnt_get_count()'s own barrier made redundant.
- fsnotify: a mark added while fsnotify_destroy_marks() walks the
connector could be missed and the connector detached, so an fdinfo
read called igrab(NULL). New marks are refused during teardown.
- pipe: a failed second fasync enable on an O_RDWR FIFO removed the
existing reader entry and cleared FASYNC while the writer entry
stayed, a use-after-free in send_sigio() later.
- watch_queue: post_one_notification() could see nr_notes before the
note pool behind it and dereference a NULL array. An unprivileged
user can trigger that with a key watch. Publish nr_notes last.
- pid_namespace: zap_pid_ns_processes() waits without bound for a
tracer outside the namespace to reap its zombies and neither wait was
freezable, so every suspend attempt failed.
- exit: is_child_subreaper and has_child_subreaper shared a word with
other bitfields written without a common lock, so racing prctl()s
lost a bit. They are separate bools now.
- autofs: a notification write that failed on a pipe the daemon had
already replaced put the superblock into catatonic mode again and
closed the replacement. Only do that for the current pipe.
- ovl: reject a lowerdir ending with an unescaped backslash with EINVAL
instead of a confusing ENOENT later.
- ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks
the recovery participant list.
- samples/pidfd: fix the userprogs typo that kept pidfd-metadata from
being built.
* tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
Revert "namei: don't reveal overmounted entries in refwalk"
selftests/filesystems: test that a mntns file can't take over a lock
fs: let idle threads share init_fs
namespace: a mount that copy_tree() leaves out can't take over a lock
namei: test for a negative dentry the way traverse_mounts() does
fs: pass flags to copy_fs()
ovl: reject lowerdir ending with unescaped backslash
fsnotify: prevent mark additions during connector teardown
pid_namespace: make zap_pid_ns_processes() freezable
fs: drop the smp_mb()s that mnt_get_count() made redundant
autofs: ignore notification errors from a replaced pipe
ntfs3: free replaced mount options after a grace period
ntfs3: free the sbi after a grace period
unicode: free the map after a grace period
ipc: drop the mqueue mount with kern_unmount() on setup failure
eventfs: free the eventfs_inode after an rcu grace period too
9p: free the session after a grace period
watch_queue: Fix note pool publication race in watch_queue_set_size()
afs: free the super info after a grace period
pipe: preserve existing fasync readers on writer setup failure
...
|
|
kmem_cache_release() tests slab_state >= FULL after kmem_cache_destroy()
has dropped slab_mutex and unlinked the cache, and for a
SLAB_TYPESAFE_BY_RCU cache after rcu_barrier(). If slab_late_init() runs
before that test it sets slab_state to FULL but skips the unlinked cache,
which never got a sysfs entry, so sysfs_slab_release() calls kobject_put()
on a kobject that was never initialized:
WARNING: lib/kobject.c:734 at kobject_put+0x64/0x2c0, CPU#1: kworker/u8:3/55
kobject: '(null)' ((____ptrval____)): is not initialized, yet kobject_put() is being called.
refcount_t: underflow; use-after-free.
kobject_put+0x64/0x2c0
sysfs_slab_release+0xc/0x20
kmem_cache_destroy+0x104/0x1e0
bioset_exit+0x13c/0x1e0
disk_release+0x54/0x140
put_disk+0x18/0x40
floppy_async_init+0xbec/0xd10
slab_state >= FULL asks whether the cache has a kobject, which cache
creation skips while slab_state <= UP. UP is the state just below FULL,
so a false sample cannot skip a kobject_put() that was owed.
Seen on sparc64 at boot, where the asynchronous floppy init tears down
its bio slab while the late initcalls are running.
Sample slab_state once, under slab_mutex which slab_late_init() holds
when it sets FULL, and use the result for both the unlink and the
release.
The history of this problem dates back to v3.2:
Commit 69cb8e6b7c29 ("slub: free slabs without holding locks") in
v3.2 moved sysfs_slab_remove() outside slub_lock and introduced
a race condition between kmem_cache_destroy() and slab_sysfs_init().
Commit 945cf2b6199be ("mm/sl[aou]b: Extract a common function for
kmem_cache_destroy") in v3.7 accidentally closed the race while
extracting a common implementation for kmem_cache_destroy().
Commit 5413dfba88d6 ("slub: drop mutex before deleting sysfs entry")
in v3.8 re-opened the race by dropping slab_mutex around
sysfs_slab_remove() in __kmem_cache_shutdown(), to avoid a lockdep
splat between slab_mutex and the sysfs lock.
Commit 657dc2f97220 ("slab: remove synchronous rcu_barrier() call in
memcg cache release path") in v4.11 shifted from synchronous
rcu_barrier() to asynchronous RCU work for SLAB_TYPESAFE_BY_RCU caches.
That commit, again, accidentally closed the race by moving
sysfs_slab_release() to shutdown_cache(), but only for
!SLAB_TYPESAFE_BY_RCU caches because destruction of
SLAB_TYPESAFE_BY_RCU caches is done in an RCU work.
Commit 0495e337b703 ("mm/slab_common: Deleting kobject in
kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") in
v6.0 re-introduced the race for !SLAB_TYPESAFE_BY_RCU caches.
Fixes: 69cb8e6b7c29 ("slub: free slabs without holding locks")
Fixes: 5413dfba88d6 ("slub: drop mutex before deleting sysfs entry")
Fixes: 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock")
Cc: stable@vger.kernel.org
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Link: https://patch.msgid.link/20261014150844.8536-1-kaloz@kernel.org
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
|
|
Since commit 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for
alloc_msg()"), alloc_msg() allocates with GFP_KERNEL, and a msg_msg is
accounted only through SLAB_ACCOUNT on its bucket caches. With
CONFIG_SLAB_BUCKETS=n, kmem_buckets_create() creates no caches and
kmem_buckets_alloc() is a GFP_KERNEL kmalloc() from the general caches,
which do not account it; the same happens when kmem_buckets_create()
fails. Either way, the allocation is not charged to the sender's memory
cgroup.
Allocate with GFP_KERNEL_ACCOUNT again, as before that commit, so the
allocation is charged whichever cache serves it.
Build tested ARCH=x86_64 defconfig with GCC 16.2.0, with
CONFIG_SLAB_BUCKETS as y and n.
Fixes: 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for alloc_msg()")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20261014052344.384723-2-kees@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
|
|
After 14 years at Oracle and 23 years working on Linux, I've decided to
step back for a while.
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt
RISC-V misc. devicetrees for v7.4
Microchip:
Add Valentina as a second maintainer because Daire is largely inactive.
Starfive:
Fix the PWM nodes, because a opencores,pwm-v1 instance only ever provides
one PWM channel.
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
* tag 'riscv-dt-for-v7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux:
riscv: dts: starfive: Correct pwm nodes
MAINTAINERS: update RISC-V Microchip maintainers
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
soc/dt
RISC-V Devicetrees for v7.4
Sophgo:
For CV18xx serials:
- Add an overlay to enable MAC and MDIO multiplexer to
reach the internal PHY so we can use Milk-V Duo 256M
board with optional ethernet interface.
- Fix the name of the internal PHY node.
- Drop reserved memory node, and leave FSBL to decide
this at runtime.
For SG2042:
- Limit SPI NOR to 12.5 MHz.
For SG2044:
- Enable both SPI NOR controllers.
Signed-off-by: Chen Wang <chen.wang@linux.dev>
* tag 'riscv-sophgo-dt-for-v7.4' of https://github.com/sophgo/linux:
riscv: dts: sophgo: sg2002-milkv-duo256m: drop reserved memory node
riscv: dts: sophgo: cv1800b-milkv-duo: drop reserved memory node
riscv: dts: sophgo: cv180x: Fix internal ephy node name
riscv: dts: sophgo: add Milk-V Duo 256M ethernet support overlay
riscv: dts: sophgo: Limit SG2042 SPI NOR to 12.5 MHz
riscv: dts: sophgo: Enable SPI NOR on SRD3-10
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
smp4m_ticker returns from smp4m_percpu_timer_interrupt() by writing the
interrupted %psr back with traps enabled, which drops PIL before
RESTORE_ALL. A level 14 tick pending again at that point can be taken
on top of the current trap frame, and back-to-back ticks can nest until
the 8K kernel stack runs into thread_info. Keep PIL at 15 until rett
restores the interrupted %psr, as real_irq_continue does.
smp4d_ticker and smpleon_ipi exit the same way and get the same change.
Broken since 2.1.36 (sun4m), 2.1.97 (sun4d) and 2.6.33 (LEON).
Cc: stable@vger.kernel.org
Tested-by: Ramin Moussavi <ramin.moussavi@yacoub.de>
Tested-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/20261016080942.13167-1-kaloz@kernel.org
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into soc/dt
RISC-V SpacemiT DT changes for 7.4
For K3 SoC
- Correct CLINT and ACLINT
- Add USB nodes info
- Add cpu scaling
- Add rfkill node
- Add i2s info
- Fix IMSIC
- Enable thermal and fan control (CTF230)
For K1 SoC
- Set mac address from eeprom
- Enable onboard eeprom
MISC Changes:
- MAINTAINERS updates
* tag 'spacemit-dt-for-7.4-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: (27 commits)
riscv: dts: spacemit: set ETH MAC from eeprom for OrangePi
riscv: dts: spacemit: k3: Replace incorrect CLINT node with ACLINT nodes
irqchip/aclint-sswi: Add support for SpacemiT K3
dt-bindings: timer: sifive,clint: Remove spacemit,k3-clint
dt-bindings: interrupt-controller: thead,c900-aclint-sswi: Add SpacemiT K3
dt-bindings: interrupt-controller: thead,c900-aclint-mswi: Add SpacemiT K3
dt-bindings: timer: thead,c900-aclint-mtimer: Add SpacemiT K3
riscv: dts: spacemit: k3-com260-ifx: Add rfkill nodes
riscv: dts: spacemit: k3-com260-ifx: Add USB nodes
riscv: dts: spacemit: k3-com260: keep dldo4 enabled
riscv: dts: spacemit: k3: add rfkill node for WLAN on the K3 Pico-ITX board
riscv: dts: spacemit: k3: add rfkill node for Bluetooth on Pico-ITX board
riscv: dts: spacemit: k3: add USB3 B and C controllers for Pico-ITX board
riscv: dts: spacemit: k3: move USB3 phy to board level
riscv: dts: spacemit: set console baud rate on OrangePi RV2
riscv: dts: spacemit: orangepi-r2s: Add cpu scaling for K1 SoC
riscv: dts: spacemit: orangepi-rv2: Add cpu scaling for K1 SoC
riscv: dts: spacemit: k1-musepi-pro: add cpu scaling
MAINTAINERS: add entry for SpacemiT reset controller driver
riscv: dts: spacemit: k3: add i2s0-i2s5 nodes
...
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
ublk_ch_release() takes a device reference and queues exit_work. The VFS
module reference held through the file operations is dropped after
->release() returns. A queued work item does not acquire its own module
reference for the callback.
Consequently, normal module removal can start while exit_work is pending or
executing. In addition to the worker callback itself, the final device put
can invoke ublk_cdev_rel(), which is also module code.
Take a module reference while ->release() is still covered by the file
operations reference and drop it only after the worker has completed its
final device put. A rearming worker retains the same reference.
Merely canceling exit_work during module exit is insufficient. The worker
is the terminal path for the device reference taken by ublk_ch_release(),
so its cancellation would strand that reference and skip the associated
cleanup.
Fixes: c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed")
Cc: stable@vger.kernel.org
Signed-off-by: sonotri <sono7ri@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Link: https://patch.msgid.link/20261015120654.241354-1-sono7ri@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
Commit 9ad8e5af3279 ("blk-mq: Pass tag_set to blk_mq_free_rq_map/tags")
added the argument so that both helpers could reach the tag set's
tags_srcu. Now that the SRCU instance is global, nothing uses it.
Remove it.
No functional change.
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Acked-by: Paul E. McKenney <paulmck@kernel.org>
Link: https://patch.msgid.link/20261001-bug-blk-mq-global-tags-srcu-v1-2-e8415da10d1b@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
Freed request pages and flush queues are handed to call_srcu() so that
concurrent tag iterators never see them disappear. Each tag set embeds
its own srcu_struct for this, which blk_mq_free_tag_set() has to drain
with srcu_barrier() before cleanup_srcu_struct(). The barrier waits for
a full SRCU grace period even when the callbacks are long done, adding
1-3 ms to every tag set teardown. Drivers that free tag sets under a
lock make it worse: ublk does it under the global ublk_ctl_mutex, so
deleting devices from many threads serializes on that grace period.
The callbacks free memory that only blk-mq owns. They touch neither
the tag set nor driver code, so they don't need a per-set domain.
Replace the per-set srcu_struct with a single global one. Freeing a tag
set no longer waits for a grace period, and each tag set no longer
allocates per-CPU SRCU state. The read side is unchanged. The only cost
is that a long-running iterator can now delay these frees for other tag
sets too, which only postpones freeing memory.
On 7.3-rc5 in a 16-vCPU VM, with 1 queue and depth 16 per ublk device,
median of 3 runs (5 for the 16-thread null_blk case):
before after
ublk DEL_DEV p50, serial 3.45 ms 0.17 ms
ublk delete 1000 devices, serial 19.5 s 14.9 s
ublk delete 4000 devices, 16 thr 19.0 s 2.9 s
null_blk destroy 500 devs, serial 9.97 s 9.25 s
null_blk destroy 256 devs, 16 thr 5.15 s 4.30 s
Fixes: ad0d05dbddc1 ("blk-mq: Defer freeing of tags page_list to SRCU callback")
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
Reviewed-by: Ming Lei <tom.leiming@gmail.com>
Acked-by: Paul E. McKenney <paulmck@kernel.org>
Link: https://patch.msgid.link/20261001-bug-blk-mq-global-tags-srcu-v1-1-e8415da10d1b@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
One problem that was brought up is that the file table size is often a
limiting factor when working with dma-bufs, which is quite an old
problem. With a single io_uring people can work it around by closing
the dma-buf fd after registration, but for more complex cases we need
a way to dynamically register it into another ring. We also need to
deduplicate internal registrations as each creates a new attachment and
related structures, which could involve large allocations and iommu
mappings. Solve it by enabling io_uring buffer cloning.
I made dma-bufs registered for io_uring not cloneable between rings
because the implementation could modify parts of struct io_buf_dma
without any locking and sharing it would've created races. That was an
optimisation that got dropped at some point for simplicity, so we can
safely enable cloning back as long as IORING_SETUP_IOPOLL rejection
is honoured. Kill the uncloneable flag as unused as well.
Reported-by: William Power <william.power@intel.com>
Reported-by: Tushar Gohad <tushar.gohad@intel.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/b76cf21ee0e2362489c864e43781b20d95fd75f7.1792142588.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
Add a kerneldoc for dma_buf_io_init_map().
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/a9fdfbe6e447ac583f4d3a3f981b203141a624c4.1792144609.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
Fix some typos and inconsistencies in dma-buf-io kernel docs.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/f328e279c3995cd36458ba2684c91d1bf24f057d.1792144609.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
There is a weird indention I botched while rebasing, fix it.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/de91f480f8507d44ddf99c193ef63dec0f02c749.1792142187.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
The comment says that priority-inversion IOs are "punted to
@ioc->aux_iocg", but no aux_iocg field ever existed in struct ioc.
The comment was introduced already stale by commit da437b95db83
("blk-iocost: grab ioc->lock for debt handling"). Update it to
describe the current use_debt / iocg->abs_vdebt mechanism.
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://patch.msgid.link/20260922043856.2020116-5-cui.tao@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
ioc_rqos_done() only accounts READ and WRITE completions, so zone
append completions are excluded from the latency window: the vrate
feedback loop cannot see ZA-induced latency, leaving it unable to
respond to device saturation caused by zone appends. Similarly,
calc_size_vtime_cost_builtin() does not classify zone append as a
write operation.
Charging (the cost model) and feedback (the latency window) are
separate mechanisms, so this is not covered by the previous patch
that prices zone appends.
Treat zone append as WRITE for both latency accounting and cost
classification.
Fixes: 0512a75b98f8 ("block: Introduce REQ_OP_ZONE_APPEND")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://patch.msgid.link/20260922043856.2020116-4-cui.tao@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
Zone append is a primary write operation for zoned devices; zoned xfs
and btrfs use it for data writes. It is priced at zero, so the zone
append portion of zoned workloads runs outside the controller: a
1%-weight cgroup issued 16000 appends at zero cost on a zoned null_blk.
Treat REQ_OP_ZONE_APPEND the same as REQ_OP_WRITE so it goes through
the existing seq/rand classification and charging.
Fixes: 0512a75b98f8 ("block: Introduce REQ_OP_ZONE_APPEND")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://patch.msgid.link/20260922043856.2020116-3-cui.tao@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
The builtin linear cost model defines coefficients only for READ and
WRITE, so the flush component of IOs is priced at zero: standalone
flushes (the dataless REQ_OP_WRITE | REQ_PREFLUSH bios from
blkdev_issue_flush()) and the pre-flush the block layer issues ahead of
data-bearing REQ_PREFLUSH bios are both free. A cgroup limited to 1%
weight could issue an unbounded number of flushes without being
throttled: an fsync loop produced ~510k flushes in 12s with
cost.usage staying at zero, monopolizing the device while iocost
reported no activity. On ext4, a write+fsync workload showed the same
gap: the write component was charged but the flush component was not.
A flush is not like a write and the write coefficients say nothing
about what it costs, so instead of pricing it off them, add a flushiops
entry to io.cost.model, following the existing iops parameters: it sets
the rate at which flushes are charged, LCOEF_FLUSH =
VTIME_PER_SEC / flushiops. The linear model cannot express how the
cost of a flush depends on the preceding writes, so this is a
per-request policy charge: a user-tunable knob rather than a hardware
property. A bio with REQ_PREFLUSH is charged one flush on top of its
data cost, and a bio with REQ_FUA one more flush on devices without
native FUA support. Zero (the default and the builtin profiles) means
no charge, so nothing changes until the parameter is configured.
Also skip the iocg->cursor update for dataless bios: they only reach it
once priced, and their bi_sector is not a data position, so setting
the cursor from it would misclassify the following IOs.
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://patch.msgid.link/20260922043856.2020116-2-cui.tao@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
M48 is a heterogeneous board made by Draeger that is based on two
independent cpus, that are monitoring each other. One of them is
imx6, the other is Altera SoCFPGA Cyclone 5. The latter is booting
independently off qspi.
This one adds the DT for the Altera SoCFPGA part of M48.
Signed-off-by: Petko Manolov <petko.manolov@konsulko.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
|
|
M48 is a heterogeneous board made by Draeger that is based on two
independent cpus, that are monitoring each other. One of them is
imx6, the other is Altera SoCFPGA Cyclone 5. The latter is booting
independently off qspi.
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Petko Manolov <petko.manolov@konsulko.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
|
|
Add a vendor prefix for Draegar AG, which is Draegerwerk AG & Co. KGaA
Link: https://www.draeger.com/de_de/Home
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Petko Manolov <petko.manolov@konsulko.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
|
|
The HP OmniBook 7 14-hg0xxx (SSID 103C8F07) uses two CS35L41
amplifiers connected via I2C. The left speaker works, but the right
speaker is silent because the cs35l41-hda driver fails to probe with
-EINVAL:
cs35l41-hda i2c-CSC3551:00-cs35l41-hda.0: Failed property cirrus,dev-index: -22
cs35l41-hda i2c-CSC3551:00-cs35l41-hda.0: error -EINVAL: Platform not supported
cs35l41-hda i2c-CSC3551:00-cs35l41-hda.0: probe with driver cs35l41-hda failed with error -22
Add the missing SSID entry to the CS35L41 configuration and property
tables, using the generic DSD configuration and the same parameters as
other HP laptops (e.g. 103C8CDE). This allows both amplifiers to probe
and restores the right speaker.
Tested on HP OmniBook 7 14-hg0xxx (SSID 103C8F07).
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=222124
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20261016130219.690074-1-zhangheng@kylinos.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
The laptop has a malformed _DSD which causes the cirrus,dev-index
property to fail to parse, so it needs to be supported using the
configuration table.
Signed-off-by: Sven Jans <skbotnl@disroot.org>
Link: https://patch.msgid.link/20260824142209.4945-1-skbotnl@disroot.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
Commit 3a3e810e9108 ("ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin
14 GT") added a quirk mapping SSID 17aa:3912 to
ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN, chosen by analogy with
neighboring SSIDs (0x390d, 0x3911, 0x391a) without being verified on
hardware, as noted in that commit's own message.
I have since tested it on the actual hardware (Lenovo Xiaoxin Pro 14
ASP10, same 17aa:3912 SSID) and confirmed it does not fix the reported
issue. ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN only repoints pin 0x17
and the preferred DAC pairs for the bass speaker; it does not touch
the codec's vendor processing coefficients. The actual symptom -
constant electrical hiss/crackle on both the headphone jack and the
internal speakers, independent of volume - is unrelated to pin/DAC
routing and is also present on stock Windows before the Realtek
driver is installed, which points at those coefficients being left
at their power-on default.
To find the correct values, I passed the physical HD Audio controller
through to a Windows 10 VM (VFIO, with QEMU patched to log CORB verb
traffic) and captured the coefficient writes the vendor Realtek driver
performs at init. Replaying a single one of them on Linux via hda-verb
reproducibly eliminates the headphone jack noise:
hda-verb /dev/snd/hwC#D0 0x20 SET_COEF_INDEX 0x36
hda-verb /dev/snd/hwC#D0 0x20 SET_PROC_COEF 0x77d7
This has held up across reboots and kernel updates for several weeks
(applied via a small systemd oneshot unit while testing).
Add a dedicated fixup that performs this coefficient write and chains
it with the existing ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN (which may
still be relevant for the bass speaker pin wiring on this board), and
point the 17aa:3912 quirk entry at it instead.
Honesty note: this fixes the headphone jack. The internal speakers
still have noise under certain conditions (notably worse on AC power)
that I have not been able to isolate via coefficient-table replay;
that part remains open. Sending what is verified to work rather than
holding this back.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221203
Fixes: 3a3e810e9108 ("ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT")
Signed-off-by: Viktor Menshin <ripeeerr@gmail.com>
Link: https://patch.msgid.link/20261015132157.57198-1-ripeeerr@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
Quirky device sample:
usb 5-2: new high-speed USB device number 2 using xhci_hcd
usb 5-2: New USB device found, idVendor=046d, idProduct=08e5, bcdDevice= 0.0c
usb 5-2: New USB device strings: Mfr=0, Product=2, SerialNumber=0
usb 5-2: Product: HD Pro Webcam C920
...
uvcvideo 5-2:1.0: Found UVC 1.00 device HD Pro Webcam C920 (046d:08e5)
uvcvideo 5-2:1.1: Failed to set UVC probe control : -32 (exp. 26).
usb 5-2: current rate 16000 is different from the runtime rate 32000
usb 5-2: reset high-speed USB device number 2 using xhci_hcd
usb 5-2: current rate 16000 is different from the runtime rate 32000
usb 5-2: current rate 16000 is different from the runtime rate 32000
usb 5-2: current rate 16000 is different from the runtime rate 32000
Signed-off-by: Nicolas Chauvet <kwizart@gmail.com>
Link: https://patch.msgid.link/20261016094404.13802-1-kwizart@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt
T-HEAD device tree changes for v7.4
Add the Milk-V Meles, a single board computer with the TH1520 SoC:
- Document the board compatible alongside the BeagleV Ahead
- Add the base device tree with UART0, eMMC, microSD, Gigabit Ethernet
and the PWM fan
- Enable the AP6256 Wi-Fi module on SDIO1
- Enable HDMI output through the DC8200 display controller and the
DW-HDMI transmitter
Also update MAINTAINERS: move the T-Head SoC tree T: entry to kernel.org
* tag 'thead-dt-for-v7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux:
MAINTAINERS: Move RISC-V T-Head SoC tree to kernel.org
riscv: dts: thead: enable HDMI on Milk-V Meles
riscv: dts: thead: enable AP6256 Wi-Fi on Milk-V Meles
riscv: dts: thead: add Milk-V Meles
dt-bindings: riscv: thead: add Milk-V Meles
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
__fuse_copy_file_range() selects its request opcode and output buffer
using fc->no_copy_file_range_64, then reads the flag again to handle the
reply. Copies to different destination inodes can run concurrently on
the same connection, so the flag may change while a request is pending.
For example, task A submits FUSE_COPY_FILE_RANGE_64 and waits for its
reply. Task B submits the same opcode, receives -ENOSYS and sets
no_copy_file_range_64. When A receives a successful reply, it reads the
uninitialized outarg.size instead of outarg_64.bytes_copied. This can
produce an incorrect return value, page cache invalidation range and
inode size update, and disclose stack contents if automatic stack
initialization is disabled.
If A also receives -ENOSYS, it instead mistakes that reply for rejection
of the legacy opcode and sets no_copy_file_range, skipping the legacy
fallback and unnecessarily disabling copy offload for the connection.
KCSAN reported the conflicting accesses:
BUG: KCSAN: data-race in __fuse_copy_file_range / __fuse_copy_file_range
read to 0xffff8881014a4d4d of 1 bytes by task 123 on cpu 4:
__fuse_copy_file_range+0x1a7/0x6e0
fuse_copy_file_range+0x54/0xd0
vfs_copy_file_range+0x290/0x9d0
__do_sys_copy_file_range+0x10f/0x2f0
write to 0xffff8881014a4d4d of 8 bytes by task 119 on cpu 0:
__fuse_copy_file_range+0x633/0x6e0
fuse_copy_file_range+0x54/0xd0
vfs_copy_file_range+0x290/0x9d0
__do_sys_copy_file_range+0x10f/0x2f0
The bug can lead to leak kernel base address for KASLR bypass, the
corresponding reproducer can be provided per request.
Use args.opcode for both -ENOSYS handling and output buffer selection.
It records the opcode actually sent and is updated on fallback, keeping
each reply tied to its request regardless of concurrent flag updates.
Fixes: 7a37f55af7af ("fuse: add COPY_FILE_RANGE_64 that allows large copies")
Cc: stable@vger.kernel.org
Assisted-by: GPT-6 Astra
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
|
|
Add a new device match for the PCI subdev id found on the Dell
Latitude 7455 laptop.
Fixes: a39ac4651e3b ("power: sequencing: pcie-m2: Match WCN6855 and WCN7851 UART BT variants by subdevice ID")
Signed-off-by: Val Packett <val@packett.cool>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20261016051745.577777-1-val@packett.cool
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into pwrseq/for-next
Linux 7.3-rc7
|
|
Manual merge fixup in audit_tree.c:kill_rules() to work around a conflict
with a UAF fix that was merged for v7.3-rc6.
* audit/dev:
audit: separate file and process capability storage
audit: Fix filter rule accounting after automatic removal
audit: use copied skb length in kauditd_send_multicast_skb()
audit: add missing unlikely hint to audit_dummy_context() wrappers
audit: free proctitle in context so it can be re-set by fork on exec_binprm
|
|
There are spelling mistakes in the descr literal strings. Fix them.
Fixes: 095ddb501b39 ("selftests/bpf: Add sockopt case to verify prog_type")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20261012212334.183116-1-colin.i.king@gmail.com
|
|
* audit/topic-7.3-audit_fsopen:
audit: add FSOPEN record to log filesystem name
|
|
The /proc/mounts fallback in get_tracefs_pipe() accepts only non-tracefs
mount points, so a tracefs mounted outside the default locations is
ignored: bpftool prog tracelog then mounts a second tracefs, or exits
silently with --nomount. Negate the condition.
Fixes: be3245e22d22 ("tools: bpftool: attempt to mount tracefs if required for tracelog cmd")
Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20261016015057.127061-1-chenyuan_fl@163.com
|
|
missed_kprobe attaches test1 to bpf_fentry_test1 and test2 to
bpf_kfunc_common_test, which test1 calls. test_missed_perf_kprobe()
expects the kprobe of test2 to miss exactly one run, the one test1
triggers, since kprobes don't nest.
The test is not serial, and the kprobe on bpf_fentry_test1 is global.
Any other test that does bpf_prog_test_run() on a fentry/fexit program
calls bpf_fentry_test1() and thereby fires test1, which calls
bpf_kfunc_common_test() from kprobe context. The kprobe of test2 then
counts an extra miss, and the test reads 2 instead of 1.
Expect at least one miss, as missed_kprobe_recursion does since commit
08a7078feacf ("selftests/bpf: Improve missed_kprobe_recursion test
robustness").
Fixes: 01e4ae474e39 ("selftests/bpf: Add test for missed counts of perf event link kprobe")
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20261009-selftests-bpf-missed-perf-kprobe-v1-1-c9d0f75f6f99@gmail.com
|
|
stm32_gpio_domain_activate() writes the EXTI interrupt multiplexer
through a regmap obtained from the generic syscon driver. The irq core
calls .activate from __setup_irq() with the raw desc->lock held, so this
happens in a raw atomic section. regmap-mmio sets fast_io, and syscon
does not ask for a raw spinlock, so the regmap is protected by a
spinlock_t. On PREEMPT_RT that is a sleeping lock, which must not be
taken there. lockdep reports it as soon as a GPIO interrupt is
requested:
[ BUG: Invalid wait context ]
7.1.13 #7 Not tainted
-----------------------------
kworker/u8:1/29 is trying to lock:
(syscon:117:(&syscon_config)->lock){....}-{3:3}, at: regmap_lock_spinlock
other info that might help us debug this:
context-{5:5}
5 locks held by kworker/u8:1/29:
#0: ((wq_completion)async){+.+.}-{0:0}, at: process_one_work
#1: ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work
#2: (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper
#3: (&desc->request_mutex){+.+.}-{4:4}, at: __setup_irq
#4: (&irq_desc_lock_class){-...}-{2:2}, at: __setup_irq
The driver was already aware of running in atomic context there: it uses
the _in_atomic() hwspinlock primitives around the very same access. The
syscon lock is the one lock in that section it does not control.
Program the mux from .alloc instead, which runs in a sleepable context.
That callback already owns this resource: it reserves the mux line in
pctl->irqmux_map under irqmux_lock, so writing the value it just claimed
is a natural fit, and the value only depends on the bank.
Nothing requires the mux to be reprogrammed at interrupt startup time:
the domain has no .deactivate, .free() only releases the irqmux_map bit
without touching the registers.
Keep the access inside the existing irqmux_lock section rather than
after it. hwspin_lock_timeout_in_atomic() deliberately skips the local
lock that the other hwspinlock modes take, so its caller is responsible
for disabling preemption and for excluding other local contexts; every
other hwspinlock user in this driver relies on bank->lock for that.
irqmux_lock plays the same role here, and it also turns the mux
reservation and the mux write into a single critical section. Nesting
the regmap spinlock_t inside irqmux_lock, itself a spinlock_t, is what
the wait-context checker expects.
Note that this bounds the semaphore hold time on !PREEMPT_RT only. On
PREEMPT_RT spinlock_t disables neither interrupts nor preemption, so the
hardware semaphore can be held across a preemptible section and a
coprocessor contending for it may poll for an unbounded time. That is
not introduced here: bank->lock is a spinlock_t too, so every existing
hwspinlock user in this driver behaves the same way on PREEMPT_RT.
Removing that exposure requires the EXTI mux regmap to be raw-spinlock
based, which the syscon core does not currently offer, and is left for a
separate change.
While moving the code, release the mux reservation when the hwspinlock
cannot be taken, which the .activate callback had no way of doing.
Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Closes: https://lore.kernel.org/all/20220202174430.pf37tt6lua2op3gc@pengutronix.de/
Signed-off-by: Ju Nan <junan76@163.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
|
|
HWSPNLCK_TIMEOUT is passed to hwspin_lock_timeout_in_atomic(), whose
timeout argument is in milliseconds, not microseconds:
atomic_delay += HWSPINLOCK_RETRY_DELAY_US;
if (atomic_delay > to * 1000)
return -ETIMEDOUT;
The hwspinlock core documents this explicitly:
If the mode is HWLOCK_IN_ATOMIC (called from an atomic context) the
timeout is handled with busy-waiting delays, hence shall not exceed
few msecs.
Fixes: 290a9f937e5a ("pinctrl: stm32: use the hwspin_lock_timeout_in_atomic() API")
Signed-off-by: Ju Nan <junan76@163.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
|
|
Currently microblaze userprogs are built for whichever endianness is the
default for the used toolchain. They may not be the correct one for the
actually built kernel.
Implement the correct hooks to build userprogs so they can run on the
built kernel. Also test the endianness in CC_CAN_LINK.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20260919-microblaze-cc-can-link-v1-1-01da67e75ebb@weissschuh.net
Signed-off-by: Michal Simek <michal.simek@amd.com>
|
|
synonym reports: "The dock (USB 0b05:182f) reports brightness on the ASUS
vendor usage page 0xff31, usages 0x10 and 0x20, which hid-asus already maps to
KEY_BRIGHTNESSDOWN / KEY_BRIGHTNESSUP. Because the device is not in
asus_devices[], it is claimed by hid-generic, which ignores the vendor page
entirely, so Fn+F5 and Fn+F6 produce no input events at all - not even a
scancode. Keys on the standard consumer page (volume) on the same device work
fine, which makes this look like a backlight or ACPI problem rather than a HID
one."
Add the device ID.
Reported-by: synonym <20000l@pm.me>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
|
|
Smatch warns about inconsistent indenting in
rt721_sdca_jack_detect_handler(): the rt_sdca_index_read() call that
samples the JD pin state, and the following mask of real_JD, are
indented one level deeper than the surrounding statements, so they
look like part of the preceding block although they are not.
Re-indent them to match the rest of the block. No functional change.
Fixes: e2eb4873b901 ("ASoC: rt721-sdca: Adjust blindwrite flow to fix type detection issue")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610080041.JAcitVQd-lkp@intel.com/
Signed-off-by: Jack Yu <jack.yu@realtek.com>
Link: https://patch.msgid.link/20261016082243.1352940-1-jack.yu@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
The DMIC does not work on the MSI Alpha 17 C7VF because the ACP6x
machine driver lacks a matching DMI quirk. Add the DMI entry so the
driver binds correctly and the DMIC is functional.
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=222112
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Link: https://patch.msgid.link/20261016124030.664895-1-zhangheng@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Release the DMA channel directly and consolidate the error paths.
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Use the existing fast variable instead of testing for TDES_FLAGS_FAST in
dd->flags again.
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Use two separate input and output scatterlists instead of an array.
Also use DMA_SLAVE_BUSWIDTH_4_BYTES directly and drop the now-unused
addr_width variable.
Signed-off-by: Thorsten Blum <blum@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
The email address bounced. I couldn't find a newer one in recent git history,
so delete this email entry.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Right now, there's a theoretical window during which the GPU can populate
the cache with data from a VM that's about to be evicted through the
UPDATE(UNMAPPED) command.
In practice this won't happen (hence the absence of Fixes tag) because
when panthor_mmu_as_disable() is called, the VM is guaranteed to be idle
(no active CSG pointing to this VM), but as we say, better safe than
sorry.
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260924-panthor-mmu-fixes-v1-3-e25f9b106466@collabora.com
|
|
We're trying to be smart by skipping the UPDATE(UNMAPPED) step, but
it remains to be proven it adds any noticeable overhead. Moreover, it's
breaking the assumption that, once the VM is unbound, no access can
happen on it.
For instance, say the panthor_mmu_as_enable() call in panthor_vm_active()
fails after we've called panthor_vm_release_as_locked(), we're now in a
state where the HW still points to the old page table, but SW slot points
to the new VM, which is not truly HW-bound.
If, after the as_slots lock is released, the evicted VM itself is
released, the HW might have access to memory that has been returned
to the system until the reset we scheduled (because of the faulty
AS_COMMAND) is effective.
Let's make this bullet-proof by doing a full bound -> unbound -> bound
cycle on AS slot recycling.
Fixes: 32e593d74c39 ("drm/panthor: Make sure caches are flushed/invalidated when an AS is recycled")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260924-panthor-mmu-fixes-v1-2-e25f9b106466@collabora.com
|
|
Don't invalidate the OTHER caches (AKA L1 read-only caches) since
this seems to trip out the flush-elimination logic on v13, and it's not
needed in practice (can't leak other context data because of TLB
invalidation or corrupt physical pages returned to the system because
it's a RO cache).
It's also worth noting that the downstream driver has been avoid
OTHER caches invalidation from the start, and that we were doing
the same until atomic page table update was introduced.
Fixes: 6e2d3b3e8589 ("drm/panthor: Add support for atomic page table updates")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
[Update comment as suggested by sashiko]
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20260924-panthor-mmu-fixes-v1-1-e25f9b106466@collabora.com
|
|
The BIOS on the Dell 14S DS14265 (ACP PCI revision 0x72) reports
acp-audio-config-flag = FLAG_AMD_LEGACY_ONLY_DMIC. As a result
snd_pci_ps returns early and the SoundWire links are never scanned,
while the legacy snd_acp_pci driver probes the device, finds no
matching machine driver ("No matching ASoC machine driver found") and
no internal sound card is created. The CS42L45 headset codec on link 0
and the two CS35L63 speaker amplifiers on link 1 never enumerate.
Add a DMI entry for the model to the ACP70 ACPI flag override table so
the firmware-provided flag is overridden and snd_pci_ps probes instead.
Match on the product name rather than the board name, as the same
symptom has been reported on several boards of this model (09PVND,
0M0J65, 0C7F12).
Tested on a DS14265 (board 09PVND, BIOS 1.5.3) with Debian's 7.2.6
kernel, with and without this entry. With it, snd_pci_ps binds, both
SoundWire links come up, the CS42L45 and both CS35L63 enumerate, the
existing CS42L45 + 2x CS35L63 machine entry matches, the amplifiers
load their firmware and calibration, and the amd-soundwire card plays
through both the internal speakers and the headphone jack. Also
build-tested on asoc-next with W=1.
Developed with AI assistance. Claude read the ACP driver source,
identified the BIOS flag as the cause and the override table as the
fix, wrote the DMI entry and the out-of-tree test module, and drafted
this changelog. All hardware testing was done by the submitter, who
has reviewed the change, understands it and takes responsibility for
it.
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Art O Cathain <art.home@gmail.com>
Reviewed-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Link: https://patch.msgid.link/20261016-dell-14s-acp-v1-1-89b40d95720c@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm
Pull CPUFreq Arm updates for 7.4 from Viresh Kumar:
"- Minor fixes to in various cpufreq drivers (Alexander Koskovich, Daniel
Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,
Sumeet Pawnikar, and Xueqin Luo).
- Fix wrong behaviors on multi-node servers in Loongson driver (Huacai Chen).
- Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet Koseoglu).
- Add suspend OPP to mediatek driver and DT (Ryan Brue)."
* tag 'cpufreq-arm-updates-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm:
cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
cpufreq: loongson3: Replace per-package mutex with per-node
cpufreq: loongson3: Adjust the width of id and val in smc_message
cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend
cpufreq: mediatek: Enter system sleep at the suspend OPP
cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing
cpufreq: qcom-nvmem: Add IPQ9650 support
cpufreq: Add Milos to cpufreq-dt-platdev blocklist
cpufreq: Use %pe to print error pointers symbolically
rust: rcpufreq_dt: add module alias
cpufreq: sti: avoid NULL dereference in dev_err()
cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv
cpufreq: sparc-us2e: fix frequency table index copy-paste error
rust: cpufreq: reject NULL from cpufreq_cpu_get()
cpufreq: airoha: fix probe failure with correct error check
|
