April 2025 - Linux-stable-mirror

[tip: perf/urgent] perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.

by tip-bot2 for Sean Christopherson

The following commit has been merged into the perf/urgent branch of tip: Commit-ID: 58f6217e5d0132a9f14e401e62796916aa055c1b Gitweb: https://git.kernel.org/tip/58f6217e5d0132a9f14e401e62796916aa055c1b Author: Sean Christopherson <seanjc(a)google.com> AuthorDate: Fri, 25 Apr 2025 17:13:55 -07:00 Committer: Peter Zijlstra <peterz(a)infradead.org> CommitterDate: Wed, 30 Apr 2025 13:58:29 +02:00 perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on VM-Entry to a KVM guest, mask the value with the vCPU's desired PEBS_ENABLE value. Consulting only the host kernel's host vs. guest masks results in running the guest with PEBS enabled even when the guest doesn't want to use PEBS. Because KVM uses perf events to proxy the guest virtual PMU, simply looking at exclude_host can't differentiate between events created by host userspace, and events created by KVM on behalf of the guest. Running the guest with PEBS unexpectedly enabled typically manifests as crashes due to a near-infinite stream of #PFs. E.g. if the guest hasn't written MSR_IA32_DS_AREA, the CPU will hit page faults on address '0' when trying to record PEBS events. The issue is most easily reproduced by running `perf kvm top` from before commit 7b100989b4f6 ("perf evlist: Remove __evlist__add_default") (after which, `perf kvm top` effectively stopped using PEBS). The userspace side of perf creates a guest-only PEBS event, which intel_guest_get_msrs() misconstrues a guest-*owned* PEBS event. Arguably, this is a userspace bug, as enabling PEBS on guest-only events simply cannot work, and userspace can kill VMs in many other ways (there is no danger to the host). However, even if this is considered to be bad userspace behavior, there's zero downside to perf/KVM restricting PEBS to guest-owned events. Note, commit 854250329c02 ("KVM: x86/pmu: Disable guest PEBS temporarily in two rare situations") fixed the case where host userspace is profiling KVM *and* userspace, but missed the case where userspace is profiling only KVM. Fixes: c59a1f106f5c ("KVM: x86/pmu: Add IA32_PEBS_ENABLE MSR emulation for extended PEBS") Closes: https://lore.kernel.org/all/Z_VUswFkWiTYI0eD@do-x1carbon Reported-by: Seth Forshee <sforshee(a)kernel.org> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Tested-by: "Seth Forshee (DigitalOcean)" <sforshee(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20250426001355.1026530-1-seanjc@google.com --- arch/x86/events/intel/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index 00dfe48..c5f3854 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -4395,7 +4395,7 @@ static struct perf_guest_switch_msr *intel_guest_get_msrs(int *nr, void *data) arr[pebs_enable] = (struct perf_guest_switch_msr){ .msr = MSR_IA32_PEBS_ENABLE, .host = cpuc->pebs_enabled & ~cpuc->intel_ctrl_guest_mask, - .guest = pebs_mask & ~cpuc->intel_ctrl_host_mask, + .guest = pebs_mask & ~cpuc->intel_ctrl_host_mask & kvm_pmu->pebs_enable, }; if (arr[pebs_enable].host) {

7 months, 2 weeks

1
0
0 0

[PATCH v6 04/20] drm/xe: Timeslice GPU on atomic SVM fault

by Himal Prasad Ghimiray

From: Matthew Brost <matthew.brost(a)intel.com> Ensure GPU can make forward progress on an atomic SVM GPU fault by giving the GPU a timeslice of 5ms v2: - Reduce timeslice to 5ms - Double timeslice on retry - Split out GPU SVM changes into independent patch v5: - Double timeslice in a few more places Fixes: 2f118c949160 ("drm/xe: Add SVM VRAM migration") Cc: stable(a)vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost(a)intel.com> --- drivers/gpu/drm/xe/xe_svm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c index dcc84e65ca96..f967caabc895 100644 --- a/drivers/gpu/drm/xe/xe_svm.c +++ b/drivers/gpu/drm/xe/xe_svm.c @@ -790,6 +790,8 @@ int xe_svm_handle_pagefault(struct xe_vm *vm, struct xe_vma *vma, IS_ENABLED(CONFIG_DRM_XE_DEVMEM_MIRROR) ? SZ_64K : 0, .devmem_only = atomic && IS_DGFX(vm->xe) && IS_ENABLED(CONFIG_DRM_XE_DEVMEM_MIRROR), + .timeslice_ms = atomic && IS_DGFX(vm->xe) && + IS_ENABLED(CONFIG_DRM_XE_DEVMEM_MIRROR) ? 5 : 0, }; struct xe_svm_range *range; struct drm_gpusvm_range *r; @@ -829,6 +831,7 @@ int xe_svm_handle_pagefault(struct xe_vm *vm, struct xe_vma *vma, if (--migrate_try_count >= 0 && xe_svm_range_needs_migrate_to_vram(range, vma)) { err = xe_svm_alloc_vram(vm, tile, range, &ctx); + ctx.timeslice_ms <<= 1; /* Double timeslice if we have to retry */ if (err) { if (migrate_try_count || !ctx.devmem_only) { drm_dbg(&vm->xe->drm, @@ -848,6 +851,7 @@ int xe_svm_handle_pagefault(struct xe_vm *vm, struct xe_vma *vma, err = drm_gpusvm_range_get_pages(&vm->svm.gpusvm, r, &ctx); /* Corner where CPU mappings have changed */ if (err == -EOPNOTSUPP || err == -EFAULT || err == -EPERM) { + ctx.timeslice_ms <<= 1; /* Double timeslice if we have to retry */ if (migrate_try_count > 0 || !ctx.devmem_only) { if (err == -EOPNOTSUPP) { range_debug(range, "PAGE FAULT - EVICT PAGES"); @@ -887,6 +891,7 @@ int xe_svm_handle_pagefault(struct xe_vm *vm, struct xe_vma *vma, drm_exec_fini(&exec); err = PTR_ERR(fence); if (err == -EAGAIN) { + ctx.timeslice_ms <<= 1; /* Double timeslice if we have to retry */ range_debug(range, "PAGE FAULT - RETRY BIND"); goto retry; } -- 2.34.1

7 months, 2 weeks

1
0
0 0

[PATCH v6 03/20] drm/gpusvm: Add timeslicing support to GPU SVM

by Himal Prasad Ghimiray

From: Matthew Brost <matthew.brost(a)intel.com> Add timeslicing support to GPU SVM which will guarantee the GPU a minimum execution time on piece of physical memory before migration back to CPU. Intended to implement strict migration policies which require memory to be in a certain placement for correct execution. Required for shared CPU and GPU atomics on certain devices. Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory") Cc: stable(a)vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost(a)intel.com> --- drivers/gpu/drm/drm_gpusvm.c | 9 +++++++++ include/drm/drm_gpusvm.h | 5 +++++ 2 files changed, 14 insertions(+) diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c index a58d03e6cac2..c94a8d7a293d 100644 --- a/drivers/gpu/drm/drm_gpusvm.c +++ b/drivers/gpu/drm/drm_gpusvm.c @@ -1770,6 +1770,8 @@ int drm_gpusvm_migrate_to_devmem(struct drm_gpusvm *gpusvm, goto err_finalize; /* Upon success bind devmem allocation to range and zdd */ + devmem_allocation->timeslice_expiration = get_jiffies_64() + + msecs_to_jiffies(ctx->timeslice_ms); zdd->devmem_allocation = devmem_allocation; /* Owns ref */ err_finalize: @@ -1990,6 +1992,13 @@ static int __drm_gpusvm_migrate_to_ram(struct vm_area_struct *vas, void *buf; int i, err = 0; + if (page) { + zdd = page->zone_device_data; + if (time_before64(get_jiffies_64(), + zdd->devmem_allocation->timeslice_expiration)) + return 0; + } + start = ALIGN_DOWN(fault_addr, size); end = ALIGN(fault_addr + 1, size); diff --git a/include/drm/drm_gpusvm.h b/include/drm/drm_gpusvm.h index 653d48dbe1c1..eaf704d3d05e 100644 --- a/include/drm/drm_gpusvm.h +++ b/include/drm/drm_gpusvm.h @@ -89,6 +89,7 @@ struct drm_gpusvm_devmem_ops { * @ops: Pointer to the operations structure for GPU SVM device memory * @dpagemap: The struct drm_pagemap of the pages this allocation belongs to. * @size: Size of device memory allocation + * @timeslice_expiration: Timeslice expiration in jiffies */ struct drm_gpusvm_devmem { struct device *dev; @@ -97,6 +98,7 @@ struct drm_gpusvm_devmem { const struct drm_gpusvm_devmem_ops *ops; struct drm_pagemap *dpagemap; size_t size; + u64 timeslice_expiration; }; /** @@ -295,6 +297,8 @@ struct drm_gpusvm { * @check_pages_threshold: Check CPU pages for present if chunk is less than or * equal to threshold. If not present, reduce chunk * size. + * @timeslice_ms: The timeslice MS which in minimum time a piece of memory + * remains with either exclusive GPU or CPU access. * @in_notifier: entering from a MMU notifier * @read_only: operating on read-only memory * @devmem_possible: possible to use device memory @@ -304,6 +308,7 @@ struct drm_gpusvm { */ struct drm_gpusvm_ctx { unsigned long check_pages_threshold; + unsigned long timeslice_ms; unsigned int in_notifier :1; unsigned int read_only :1; unsigned int devmem_possible :1; -- 2.34.1

7 months, 2 weeks

1
0
0 0

[PATCH v6 01/20] drm/gpusvm: Introduce devmem_only flag for allocation

by Himal Prasad Ghimiray

This commit adds a new flag, devmem_only, to the drm_gpusvm structure. The purpose of this flag is to ensure that the get_pages function allocates memory exclusively from the device's memory. If the allocation from device memory fails, the function will return an -EFAULT error. Required for shared CPU and GPU atomics on certain devices. v3: - s/vram_only/devmem_only/ Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory") Cc: stable(a)vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost(a)intel.com> Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray(a)intel.com> --- drivers/gpu/drm/drm_gpusvm.c | 5 +++++ include/drm/drm_gpusvm.h | 2 ++ 2 files changed, 7 insertions(+) diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c index de424e670995..a58d03e6cac2 100644 --- a/drivers/gpu/drm/drm_gpusvm.c +++ b/drivers/gpu/drm/drm_gpusvm.c @@ -1454,6 +1454,11 @@ int drm_gpusvm_range_get_pages(struct drm_gpusvm *gpusvm, goto err_unmap; } + if (ctx->devmem_only) { + err = -EFAULT; + goto err_unmap; + } + addr = dma_map_page(gpusvm->drm->dev, page, 0, PAGE_SIZE << order, diff --git a/include/drm/drm_gpusvm.h b/include/drm/drm_gpusvm.h index df120b4d1f83..9fd25fc880a4 100644 --- a/include/drm/drm_gpusvm.h +++ b/include/drm/drm_gpusvm.h @@ -286,6 +286,7 @@ struct drm_gpusvm { * @in_notifier: entering from a MMU notifier * @read_only: operating on read-only memory * @devmem_possible: possible to use device memory + * @devmem_only: use only device memory * * Context that is DRM GPUSVM is operating in (i.e. user arguments). */ @@ -294,6 +295,7 @@ struct drm_gpusvm_ctx { unsigned int in_notifier :1; unsigned int read_only :1; unsigned int devmem_possible :1; + unsigned int devmem_only :1; }; int drm_gpusvm_init(struct drm_gpusvm *gpusvm, -- 2.34.1

7 months, 2 weeks

1
0
0 0

[PATCH V2 1/5] perf/x86/intel: Only check the group flag for X86 leader

by kan.liang＠linux.intel.com

From: Kan Liang <kan.liang(a)linux.intel.com> A warning in intel_pmu_lbr_counters_reorder() may be triggered by below perf command. perf record -e "{cpu-clock,cycles/call-graph="lbr"/}" -- sleep 1 It's because the group is mistakenly treated as a branch counter group. The hw.flags of the leader are used to determine whether a group is a branch counters group. However, the hw.flags is only available for a hardware event. The field to store the flags is a union type. For a software event, it's a hrtimer. The corresponding bit may be set if the leader is a software event. For a branch counter group and other groups that have a group flag (e.g., topdown, PEBS counters snapshotting, and ACR), the leader must be a X86 event. Check the X86 event before checking the flag. The patch only fixes the issue for the branch counter group. The following patch will fix the other groups. There may be an alternative way to fix the issue by moving the hw.flags out of the union type. It should work for now. But it's still possible that the flags will be used by other types of events later. As long as that type of event is used as a leader, a similar issue will be triggered. So the alternative way is dropped. Fixes: 33744916196b ("perf/x86/intel: Support branch counters logging") Reported-by: Luo Gengkun <luogengkun(a)huaweicloud.com> Closes: https://lore.kernel.org/lkml/20250412091423.1839809-1-luogengkun@huaweiclou… Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Cc: stable(a)vger.kernel.org --- arch/x86/events/perf_event.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h index 902bc42a6cfe..4fc61a09c30e 100644 --- a/arch/x86/events/perf_event.h +++ b/arch/x86/events/perf_event.h @@ -110,9 +110,16 @@ static inline bool is_topdown_event(struct perf_event *event) return is_metric_event(event) || is_slots_event(event); } +int is_x86_event(struct perf_event *event); + +static inline bool check_leader_group(struct perf_event *leader, int flags) +{ + return is_x86_event(leader) ? !!(leader->hw.flags & flags) : false; +} + static inline bool is_branch_counters_group(struct perf_event *event) { - return event->group_leader->hw.flags & PERF_X86_EVENT_BRANCH_COUNTERS; + return check_leader_group(event->group_leader, PERF_X86_EVENT_PEBS_CNTR); } static inline bool is_pebs_counter_event_group(struct perf_event *event) @@ -1129,7 +1136,6 @@ static struct perf_pmu_format_hybrid_attr format_attr_hybrid_##_name = {\ .pmu_type = _pmu, \ } -int is_x86_event(struct perf_event *event); struct pmu *x86_get_pmu(unsigned int cpu); extern struct x86_pmu x86_pmu __read_mostly; -- 2.38.1

7 months, 2 weeks

2
1
0 0

[PATCH v2 00/23] Add support for HEVC and VP9 codecs in decoder

by Dikshita Agarwal

Hi All, This patch series adds initial support for the HEVC(H.265) and VP9 codecs in iris decoder. The objective of this work is to extend the decoder's capabilities to handle HEVC and VP9 codec streams, including necessary format handling and buffer management. In addition, the series also includes a set of fixes to address issues identified during testing of these additional codecs. These patches also address the comments and feedback received from the RFC patches previously sent. I have made the necessary improvements based on the community's suggestions. Changes in v2: - Added Changes to make sure all buffers are released in session close (bryna) - Added tracking for flush responses to fix a timing issue. - Added a handling to fix timing issue in reconfig - Splitted patch 06/20 in two patches (Bryan) - Added missing fixes tag (bryan) - Updated fluster report (Nicolas) - Link to v1: https://lore.kernel.org/r/20250408-iris-dec-hevc-vp9-v1-0-acd258778bd6@quic… Changes sinces RFC: - Added additional fixes to address issues identified during further testing. - Moved typo fix to a seperate patch [Neil] - Reordered the patches for better logical flow and clarity [Neil, Dmitry] - Added fixes tag wherever applicable [Neil, Dmitry] - Removed the default case in the switch statement for codecs [Bryan] - Replaced if-else statements with switch-case [Bryan] - Added comments for mbpf [Bryan] - RFC: https://lore.kernel.org/linux-media/20250305104335.3629945-1-quic_dikshita@… This patch series depends on [1] & [2] [1] https://lore.kernel.org/linux-media/20250417-topic-sm8x50-iris-v10-v7-0-f02… [2] https://lore.kernel.org/linux-media/20250424-qcs8300_iris-v5-0-f118f505c300… These patches are tested on SM8250 and SM8550 with v4l2-ctl and Gstreamer for HEVC and VP9 decoders, at the same time ensured that the existing H264 decoder functionality remains uneffected. Note: 1 of the fluster compliance test is fixed with firmware [3] [3]: https://lore.kernel.org/linux-firmware/1a511921-446d-cdc4-0203-084c88a5dc1e… The result of fluster test on SM8550: 131/147 testcases passed while testing JCT-VC-HEVC_V1 with GStreamer-H.265-V4L2-Gst1.0. The failing test case: - 10 testcases failed due to unsupported 10 bit format. - DBLK_A_MAIN10_VIXS_4 - INITQP_B_Main10_Sony_1 - TSUNEQBD_A_MAIN10_Technicolor_2 - WP_A_MAIN10_Toshiba_3 - WP_MAIN10_B_Toshiba_3 - WPP_A_ericsson_MAIN10_2 - WPP_B_ericsson_MAIN10_2 - WPP_C_ericsson_MAIN10_2 - WPP_E_ericsson_MAIN10_2 - WPP_F_ericsson_MAIN10_2 - 4 testcase failed due to unsupported resolution - PICSIZE_A_Bossen_1 - PICSIZE_B_Bossen_1 - WPP_D_ericsson_MAIN10_2 - WPP_D_ericsson_MAIN_2 - 2 testcase failed due to CRC mismatch - RAP_A_docomo_6 - RAP_B_Bossen_2 - BUG reported: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4392 Analysis - First few frames in this discarded by firmware and are sent to driver with 0 filled length. Driver send such buffers to client with timestamp 0 and payload set to 0 and make buf state to VB2_BUF_STATE_ERROR. Such buffers should be dropped by GST. But instead, the first frame displayed as green frame and when a valid buffer is sent to client later with same 0 timestamp, its dropped, leading to CRC mismatch for first frame. 235/305 testcases passed while testing VP9-TEST-VECTORS with GStreamer-VP9-V4L2-Gst1.0. The failing test case: - 64 testcases failed due to unsupported resolution - vp90-2-02-size-08x08.webm - vp90-2-02-size-08x10.webm - vp90-2-02-size-08x16.webm - vp90-2-02-size-08x18.webm - vp90-2-02-size-08x32.webm - vp90-2-02-size-08x34.webm - vp90-2-02-size-08x64.webm - vp90-2-02-size-08x66.webm - vp90-2-02-size-10x08.webm - vp90-2-02-size-10x10.webm - vp90-2-02-size-10x16.webm - vp90-2-02-size-10x18.webm - vp90-2-02-size-10x32.webm - vp90-2-02-size-10x34.webm - vp90-2-02-size-10x64.webm - vp90-2-02-size-10x66.webm - vp90-2-02-size-16x08.webm - vp90-2-02-size-16x10.webm - vp90-2-02-size-16x16.webm - vp90-2-02-size-16x18.webm - vp90-2-02-size-16x32.webm - vp90-2-02-size-16x34.webm - vp90-2-02-size-16x64.webm - vp90-2-02-size-16x66.webm - vp90-2-02-size-18x08.webm - vp90-2-02-size-18x10.webm - vp90-2-02-size-18x16.webm - vp90-2-02-size-18x18.webm - vp90-2-02-size-18x32.webm - vp90-2-02-size-18x34.webm - vp90-2-02-size-18x64.webm - vp90-2-02-size-18x66.webm - vp90-2-02-size-32x08.webm - vp90-2-02-size-32x10.webm - vp90-2-02-size-32x16.webm - vp90-2-02-size-32x18.webm - vp90-2-02-size-32x32.webm - vp90-2-02-size-32x34.webm - vp90-2-02-size-32x64.webm - vp90-2-02-size-32x66.webm - vp90-2-02-size-34x08.webm - vp90-2-02-size-34x10.webm - vp90-2-02-size-34x16.webm - vp90-2-02-size-34x18.webm - vp90-2-02-size-34x32.webm - vp90-2-02-size-34x34.webm - vp90-2-02-size-34x64.webm - vp90-2-02-size-34x66.webm - vp90-2-02-size-64x08.webm - vp90-2-02-size-64x10.webm - vp90-2-02-size-64x16.webm - vp90-2-02-size-64x18.webm - vp90-2-02-size-64x32.webm - vp90-2-02-size-64x34.webm - vp90-2-02-size-64x64.webm - vp90-2-02-size-64x66.webm - vp90-2-02-size-66x08.webm - vp90-2-02-size-66x10.webm - vp90-2-02-size-66x16.webm - vp90-2-02-size-66x18.webm - vp90-2-02-size-66x32.webm - vp90-2-02-size-66x34.webm - vp90-2-02-size-66x64.webm - vp90-2-02-size-66x66.webm - 2 testcases failed due to unsupported format - vp91-2-04-yuv422.webm - vp91-2-04-yuv444.webm - 1 testcase failed with CRC mismatch - vp90-2-22-svc_1280x720_3.ivf - Bug reported: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4371 - 2 testcase failed due to unsupported resolution after sequence change - vp90-2-21-resize_inter_320x180_5_1-2.webm - vp90-2-21-resize_inter_320x180_7_1-2.webm - 1 testcase failed due to unsupported stream - vp90-2-16-intra-only.webm The result of fluster test on SM8250: 133/147 testcases passed while testing JCT-VC-HEVC_V1 with GStreamer-H.265-V4L2-Gst1.0. The failing test case: - 10 testcases failed due to unsupported 10 bit format. - DBLK_A_MAIN10_VIXS_4 - INITQP_B_Main10_Sony_1 - TSUNEQBD_A_MAIN10_Technicolor_2 - WP_A_MAIN10_Toshiba_3 - WP_MAIN10_B_Toshiba_3 - WPP_A_ericsson_MAIN10_2 - WPP_B_ericsson_MAIN10_2 - WPP_C_ericsson_MAIN10_2 - WPP_E_ericsson_MAIN10_2 - WPP_F_ericsson_MAIN10_2 - 4 testcase failed due to unsupported resolution - PICSIZE_A_Bossen_1 - PICSIZE_B_Bossen_1 - WPP_D_ericsson_MAIN10_2 - WPP_D_ericsson_MAIN_2 232/305 testcases passed while testing VP9-TEST-VECTORS with GStreamer-VP9-V4L2-Gst1.0. The failing test case: - 64 testcases failed due to unsupported resolution - vp90-2-02-size-08x08.webm - vp90-2-02-size-08x10.webm - vp90-2-02-size-08x16.webm - vp90-2-02-size-08x18.webm - vp90-2-02-size-08x32.webm - vp90-2-02-size-08x34.webm - vp90-2-02-size-08x64.webm - vp90-2-02-size-08x66.webm - vp90-2-02-size-10x08.webm - vp90-2-02-size-10x10.webm - vp90-2-02-size-10x16.webm - vp90-2-02-size-10x18.webm - vp90-2-02-size-10x32.webm - vp90-2-02-size-10x34.webm - vp90-2-02-size-10x64.webm - vp90-2-02-size-10x66.webm - vp90-2-02-size-16x08.webm - vp90-2-02-size-16x10.webm - vp90-2-02-size-16x16.webm - vp90-2-02-size-16x18.webm - vp90-2-02-size-16x32.webm - vp90-2-02-size-16x34.webm - vp90-2-02-size-16x64.webm - vp90-2-02-size-16x66.webm - vp90-2-02-size-18x08.webm - vp90-2-02-size-18x10.webm - vp90-2-02-size-18x16.webm - vp90-2-02-size-18x18.webm - vp90-2-02-size-18x32.webm - vp90-2-02-size-18x34.webm - vp90-2-02-size-18x64.webm - vp90-2-02-size-18x66.webm - vp90-2-02-size-32x08.webm - vp90-2-02-size-32x10.webm - vp90-2-02-size-32x16.webm - vp90-2-02-size-32x18.webm - vp90-2-02-size-32x32.webm - vp90-2-02-size-32x34.webm - vp90-2-02-size-32x64.webm - vp90-2-02-size-32x66.webm - vp90-2-02-size-34x08.webm - vp90-2-02-size-34x10.webm - vp90-2-02-size-34x16.webm - vp90-2-02-size-34x18.webm - vp90-2-02-size-34x32.webm - vp90-2-02-size-34x34.webm - vp90-2-02-size-34x64.webm - vp90-2-02-size-34x66.webm - vp90-2-02-size-64x08.webm - vp90-2-02-size-64x10.webm - vp90-2-02-size-64x16.webm - vp90-2-02-size-64x18.webm - vp90-2-02-size-64x32.webm - vp90-2-02-size-64x34.webm - vp90-2-02-size-64x64.webm - vp90-2-02-size-64x66.webm - vp90-2-02-size-66x08.webm - vp90-2-02-size-66x10.webm - vp90-2-02-size-66x16.webm - vp90-2-02-size-66x18.webm - vp90-2-02-size-66x32.webm - vp90-2-02-size-66x34.webm - vp90-2-02-size-66x64.webm - vp90-2-02-size-66x66.webm - 2 testcases failed due to unsupported format - vp91-2-04-yuv422.webm - vp91-2-04-yuv444.webm - 1 testcase failed with CRC mismatch - vp90-2-22-svc_1280x720_3.ivf - Bug raised: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4371 - 5 testcase failed due to unsupported resolution after sequence change - vp90-2-21-resize_inter_320x180_5_1-2.webm - vp90-2-21-resize_inter_320x180_7_1-2.webm - vp90-2-21-resize_inter_320x240_5_1-2.webm - vp90-2-21-resize_inter_320x240_7_1-2.webm - vp90-2-18-resize.ivf - 1 testcase failed with CRC mismatch - vp90-2-16-intra-only.webm Analysis: First few frames are marked by firmware as NO_SHOW frame. Driver make buf state to VB2_BUF_STATE_ERROR for such frames. Such buffers should be dropped by GST. But instead, the first frame is being displayed and when a valid buffer is sent to client later with same timestamp, its dropped, leading to CRC mismatch for first frame. Signed-off-by: Dikshita Agarwal <quic_dikshita(a)quicinc.com> --- Dikshita Agarwal (23): media: iris: Skip destroying internal buffer if not dequeued media: iris: Update CAPTURE format info based on OUTPUT format media: iris: Add handling for corrupt and drop frames media: iris: Avoid updating frame size to firmware during reconfig media: iris: Send V4L2_BUF_FLAG_ERROR for buffers with 0 filled length media: iris: Drop port check for session property response media: iris: Add handling for no show frames media: iris: Improve last flag handling media: iris: Skip flush on first sequence change media: iris: Prevent HFI queue writes when core is in deinit state media: iris: Remove redundant buffer count check in stream off media: iris: Remove deprecated property setting to firmware media: iris: Fix missing function pointer initialization media: iris: Fix NULL pointer dereference media: iris: Fix typo in depth variable media: iris: Add a comment to explain usage of MBPS media: iris: Track flush responses to prevent premature completion media: iris: Fix buffer preparation failure during resolution change media: iris: Add HEVC and VP9 formats for decoder media: iris: Add platform capabilities for HEVC and VP9 decoders media: iris: Set mandatory properties for HEVC and VP9 decoders. media: iris: Add internal buffer calculation for HEVC and VP9 decoders media: iris: Add codec specific check for VP9 decoder drain handling drivers/media/platform/qcom/iris/iris_buffer.c | 52 ++- drivers/media/platform/qcom/iris/iris_buffer.h | 3 +- drivers/media/platform/qcom/iris/iris_ctrls.c | 35 +- drivers/media/platform/qcom/iris/iris_hfi_common.h | 1 + .../platform/qcom/iris/iris_hfi_gen1_command.c | 48 ++- .../platform/qcom/iris/iris_hfi_gen1_defines.h | 5 +- .../platform/qcom/iris/iris_hfi_gen1_response.c | 39 +- .../platform/qcom/iris/iris_hfi_gen2_command.c | 143 +++++++- .../platform/qcom/iris/iris_hfi_gen2_defines.h | 5 + .../platform/qcom/iris/iris_hfi_gen2_response.c | 58 ++- drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +- drivers/media/platform/qcom/iris/iris_instance.h | 8 + .../platform/qcom/iris/iris_platform_common.h | 28 +- .../media/platform/qcom/iris/iris_platform_gen2.c | 198 ++++++++-- .../platform/qcom/iris/iris_platform_qcs8300.h | 126 +++++-- .../platform/qcom/iris/iris_platform_sm8250.c | 15 +- drivers/media/platform/qcom/iris/iris_vb2.c | 18 +- drivers/media/platform/qcom/iris/iris_vdec.c | 117 +++--- drivers/media/platform/qcom/iris/iris_vdec.h | 11 + drivers/media/platform/qcom/iris/iris_vidc.c | 9 +- drivers/media/platform/qcom/iris/iris_vpu_buffer.c | 397 ++++++++++++++++++++- drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 46 ++- 22 files changed, 1154 insertions(+), 210 deletions(-) --- base-commit: 398a1b33f1479af35ca915c5efc9b00d6204f8fa change-id: 20250428-qcom-iris-hevc-vp9-eb31f30c3390 prerequisite-message-id: <20250417-topic-sm8x50-iris-v10-v7-0-f020cb1d0e98(a)linaro.org> prerequisite-patch-id: 35f8dae1416977e88c2db7c767800c01822e266e prerequisite-patch-id: 2bba98151ca103aa62a513a0fbd0df7ae64d9868 prerequisite-patch-id: 0e43a6d758b5fa5ab921c6aa3c19859e312b47d0 prerequisite-patch-id: b7b50aa1657be59fd51c3e53d73382a1ee75a08e prerequisite-patch-id: 30960743105a36f20b3ec4a9ff19e7bca04d6add prerequisite-patch-id: b93c37dc7e09d1631b75387dc1ca90e3066dce17 prerequisite-patch-id: afffe7096c8e110a8da08c987983bc4441d39578 prerequisite-message-id: <20250424-qcs8300_iris-v5-0-f118f505c300(a)quicinc.com> prerequisite-patch-id: 2e72fe4d11d264db3d42fa450427d30171303c6f prerequisite-patch-id: 3398937a7fabb45934bb98a530eef73252231132 prerequisite-patch-id: feda620f147ca14a958c92afdc85a1dc507701ac prerequisite-patch-id: 07ba0745c7d72796567e0a57f5c8e5355a8d2046 prerequisite-patch-id: e35b05c527217206ae871aef0d7b0261af0319ea Best regards, -- Dikshita Agarwal <quic_dikshita(a)quicinc.com>

7 months, 2 weeks

6
34
0 0

[PATCH] accel/ivpu: Increase state dump msg timeout

by Jacek Lawrynowicz

Increase JMS message state dump command timeout to 100 ms. On some platforms, the FW may take a bit longer than 50 ms to dump its state to the log buffer and we don't want to miss any debug info during TDR. Fixes: 5e162f872d7a ("accel/ivpu: Add FW state dump on TDR") Cc: <stable(a)vger.kernel.org> # v6.13+ Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz(a)linux.intel.com> --- drivers/accel/ivpu/ivpu_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/ivpu/ivpu_hw.c b/drivers/accel/ivpu/ivpu_hw.c index ec9a3629da3a9..633160470c939 100644 --- a/drivers/accel/ivpu/ivpu_hw.c +++ b/drivers/accel/ivpu/ivpu_hw.c @@ -119,7 +119,7 @@ static void timeouts_init(struct ivpu_device *vdev) else vdev->timeout.autosuspend = 100; vdev->timeout.d0i3_entry_msg = 5; - vdev->timeout.state_dump_msg = 10; + vdev->timeout.state_dump_msg = 100; } } -- 2.45.1

7 months, 2 weeks

2
2
0 0

possible deadlock in blk_mq_freeze_queue in Linux6.1.25(longterm maintenance, last updated on April 25, 2025)

by Jianzhou Zhao

Hello, I found a potential bug titled " possible deadlock in blk_mq_freeze_queue" with modified syzkaller in the Linux6.12.25(longterm maintenance, last updated on April 25, 2025) If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao <luckd0g(a)163.com>, xingwei lee <xrivendell7(a)gmail.com> The commit of the kernel is : ef4999852d307d38cfdecd91ed6892cc03beb9b8 kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=55f8591b98dd132 compiler: gcc version 11.4.0 Unfortunately, although my fuzz testing tool can trigger this bug relatively frequently, it still cannot generate a reproduction program. ------------[ cut here ]----------------------------------------- TITLE: possible deadlock in blk_mq_freeze_queue ------------[ cut here ]------------ loop6: detected capacity change from 1024 to 1023 ====================================================== WARNING: possible circular locking dependency detected 6.12.25 #1 Not tainted ------------------------------------------------------ syz.8.1968/32422 is trying to acquire lock: ffffffff8e34acc0 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:318 [inline] ffffffff8e34acc0 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4068 [inline] ffffffff8e34acc0 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:4146 [inline] ffffffff8e34acc0 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x56/0x3e0 mm/slub.c:4322 but task is already holding lock: ffff8880435f1468 (&q->q_usage_counter(io)#23){++++}-{0:0}, at: blk_freeze_queue block/blk-mq.c:224 [inline] ffff8880435f1468 (&q->q_usage_counter(io)#23){++++}-{0:0}, at: blk_mq_freeze_queue+0x15/0x20 block/blk-mq.c:234 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (&q->q_usage_counter(io)#23){++++}-{0:0}: bio_queue_enter block/blk.h:76 [inline] blk_mq_submit_bio+0x22fd/0x2dd0 block/blk-mq.c:3088 __submit_bio+0x63b/0x10b0 block/blk-core.c:629 __submit_bio_noacct_mq block/blk-core.c:716 [inline] submit_bio_noacct_nocheck block/blk-core.c:745 [inline] submit_bio_noacct_nocheck+0x6cc/0xd30 block/blk-core.c:722 submit_bio_noacct+0x6c9/0x1fc0 block/blk-core.c:868 xfs_buf_ioapply_map fs/xfs/xfs_buf.c:1585 [inline] _xfs_buf_ioapply+0xa65/0xed0 fs/xfs/xfs_buf.c:1673 __xfs_buf_submit+0x26c/0x700 fs/xfs/xfs_buf.c:1757 xfs_buf_submit fs/xfs/xfs_buf.c:61 [inline] _xfs_buf_read fs/xfs/xfs_buf.c:808 [inline] xfs_buf_read_map+0x672/0xde0 fs/xfs/xfs_buf.c:872 xfs_trans_read_buf_map+0x356/0xcf0 fs/xfs/xfs_trans_buf.c:289 xfs_trans_read_buf fs/xfs/xfs_trans.h:212 [inline] xfs_imap_to_bp+0x110/0x2a0 fs/xfs/libxfs/xfs_inode_buf.c:138 xfs_inode_item_precommit+0x5d9/0x980 fs/xfs/xfs_inode_item.c:174 xfs_trans_run_precommits fs/xfs/xfs_trans.c:802 [inline] __xfs_trans_commit+0x303/0xda0 fs/xfs/xfs_trans.c:845 xfs_trans_commit+0x117/0x1b0 fs/xfs/xfs_trans.c:930 xfs_qm_qino_alloc+0x4da/0x700 fs/xfs/xfs_qm.c:861 xfs_qm_init_quotainos+0x526/0x6e0 fs/xfs/xfs_qm.c:1664 xfs_qm_init_quotainfo+0xf8/0xb00 fs/xfs/xfs_qm.c:667 xfs_qm_mount_quotas+0x59/0x650 fs/xfs/xfs_qm.c:1514 xfs_mountfs+0x1c0e/0x20e0 fs/xfs/xfs_mount.c:984 xfs_fs_fill_super+0x148f/0x1f30 fs/xfs/xfs_super.c:1764 get_tree_bdev_flags+0x389/0x620 fs/super.c:1636 vfs_get_tree+0x90/0x340 fs/super.c:1814 do_new_mount fs/namespace.c:3512 [inline] path_mount+0x1290/0x1bc0 fs/namespace.c:3839 do_mount+0xf8/0x110 fs/namespace.c:3852 __do_sys_mount fs/namespace.c:4062 [inline] __se_sys_mount fs/namespace.c:4039 [inline] __x64_sys_mount+0x193/0x230 fs/namespace.c:4039 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&xfs_nondir_ilock_class#3){++++}-{3:3}: down_write_nested+0x96/0x210 kernel/locking/rwsem.c:1693 xfs_ilock+0x35c/0x420 fs/xfs/xfs_inode.c:164 xfs_reclaim_inode fs/xfs/xfs_icache.c:981 [inline] xfs_icwalk_process_inode fs/xfs/xfs_icache.c:1675 [inline] xfs_icwalk_ag+0xa64/0x17c0 fs/xfs/xfs_icache.c:1757 xfs_icwalk+0x4b/0xa0 fs/xfs/xfs_icache.c:1805 xfs_reclaim_inodes_nr+0x1ad/0x2b0 fs/xfs/xfs_icache.c:1047 super_cache_scan+0x364/0x490 fs/super.c:227 do_shrink_slab+0x464/0x11d0 mm/shrinker.c:437 shrink_slab+0x336/0x12c0 mm/shrinker.c:664 shrink_one+0x4a8/0x7d0 mm/vmscan.c:4835 shrink_many mm/vmscan.c:4896 [inline] lru_gen_shrink_node mm/vmscan.c:4974 [inline] shrink_node+0x24da/0x3b50 mm/vmscan.c:5954 kswapd_shrink_node mm/vmscan.c:6782 [inline] balance_pgdat+0x9d0/0x1670 mm/vmscan.c:6974 kswapd+0x538/0xc70 mm/vmscan.c:7243 kthread+0x342/0x450 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #0 (fs_reclaim){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain kernel/locking/lockdep.c:3904 [inline] __lock_acquire+0x2940/0x4810 kernel/locking/lockdep.c:5202 lock_acquire kernel/locking/lockdep.c:5825 [inline] lock_acquire+0x1b4/0x590 kernel/locking/lockdep.c:5790 __fs_reclaim_acquire mm/page_alloc.c:3853 [inline] fs_reclaim_acquire+0x102/0x150 mm/page_alloc.c:3867 might_alloc include/linux/sched/mm.h:318 [inline] slab_pre_alloc_hook mm/slub.c:4068 [inline] slab_alloc_node mm/slub.c:4146 [inline] __kmalloc_cache_noprof+0x56/0x3e0 mm/slub.c:4322 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] kobject_uevent_env+0x23a/0x16b0 lib/kobject_uevent.c:540 set_capacity_and_notify+0x1cb/0x250 block/genhd.c:95 loop_set_size.isra.0+0x2f/0xc0 drivers/block/loop.c:232 loop_set_status+0x486/0x740 drivers/block/loop.c:1210 loop_set_status_old+0x148/0x1c0 drivers/block/loop.c:1313 lo_ioctl+0xc5e/0x1830 drivers/block/loop.c:1466 blkdev_ioctl+0x27b/0x6d0 block/ioctl.c:693 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: fs_reclaim --> &xfs_nondir_ilock_class#3 --> &q->q_usage_counter(io)#23 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&q->q_usage_counter(io)#23); lock(&xfs_nondir_ilock_class#3); lock(&q->q_usage_counter(io)#23); lock(fs_reclaim); *** DEADLOCK *** 3 locks held by syz.8.1968/32422: #0: ffff888020454b70 (&lo->lo_mutex){+.+.}-{3:3}, at: loop_set_status+0x2a/0x740 drivers/block/loop.c:1176 #1: ffff8880435f1468 (&q->q_usage_counter(io)#23){++++}-{0:0}, at: blk_freeze_queue block/blk-mq.c:224 [inline] #1: ffff8880435f1468 (&q->q_usage_counter(io)#23){++++}-{0:0}, at: blk_mq_freeze_queue+0x15/0x20 block/blk-mq.c:234 #2: ffff8880435f14a0 (&q->q_usage_counter(queue)#7){+.+.}-{0:0}, at: blk_freeze_queue block/blk-mq.c:224 [inline] #2: ffff8880435f14a0 (&q->q_usage_counter(queue)#7){+.+.}-{0:0}, at: blk_mq_freeze_queue+0x15/0x20 block/blk-mq.c:234 stack backtrace: CPU: 0 UID: 0 PID: 32422 Comm: syz.8.1968 Not tainted 6.12.25 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_circular_bug.isra.0+0x5e5/0x9f0 kernel/locking/lockdep.c:2074 check_noncircular+0x2f1/0x3d0 kernel/locking/lockdep.c:2206 check_prev_add kernel/locking/lockdep.c:3161 [inline] check_prevs_add kernel/locking/lockdep.c:3280 [inline] validate_chain kernel/locking/lockdep.c:3904 [inline] __lock_acquire+0x2940/0x4810 kernel/locking/lockdep.c:5202 lock_acquire kernel/locking/lockdep.c:5825 [inline] lock_acquire+0x1b4/0x590 kernel/locking/lockdep.c:5790 __fs_reclaim_acquire mm/page_alloc.c:3853 [inline] fs_reclaim_acquire+0x102/0x150 mm/page_alloc.c:3867 might_alloc include/linux/sched/mm.h:318 [inline] slab_pre_alloc_hook mm/slub.c:4068 [inline] slab_alloc_node mm/slub.c:4146 [inline] __kmalloc_cache_noprof+0x56/0x3e0 mm/slub.c:4322 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] kobject_uevent_env+0x23a/0x16b0 lib/kobject_uevent.c:540 set_capacity_and_notify+0x1cb/0x250 block/genhd.c:95 loop_set_size.isra.0+0x2f/0xc0 drivers/block/loop.c:232 loop_set_status+0x486/0x740 drivers/block/loop.c:1210 loop_set_status_old+0x148/0x1c0 drivers/block/loop.c:1313 lo_ioctl+0xc5e/0x1830 drivers/block/loop.c:1466 blkdev_ioctl+0x27b/0x6d0 block/ioctl.c:693 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f22897ac5ad Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f228a5f2f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f22899e5fa0 RCX: 00007f22897ac5ad RDX: 0000200000000080 RSI: 0000000000004c02 RDI: 0000000000000006 RBP: 00007f228984458e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f22899e5fa0 R15: 00007f228a5d3000 </TASK> =================================================================== I hope it helps. Best regards Jianzhou Zhao

7 months, 2 weeks

1
0
0 0

KASAN: slab-use-after-free Read in perf_uprobe_destroy in linux6.12.25(longterm maintenance)

by Jianzhou Zhao

Hello, I found a potential bug titled " KASAN: slab-use-after-free Read in perf_uprobe_destroy " with modified syzkaller in the Linux6.12.25(longterm maintenance, last updated on April 25, 2025) If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao <luckd0g(a)163.com>, xingwei lee <xrivendell7(a)gmail.com>, Penglei Jiang <superman.xpt(a)gmail.com> The commit of the kernel is : ef4999852d307d38cfdecd91ed6892cc03beb9b8 kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=55f8591b98dd132 compiler: gcc version 11.4.0 I put the reproduction program of this bug at the end of the email. ------------[ cut here ]----------------------------------------- TITLE: KASAN: slab-use-after-free Read in perf_uprobe_destroy ------------[ cut here ]------------ ================================================================== BUG: KASAN: slab-use-after-free in perf_trace_event_close kernel/trace/trace_event_perf.c:190 [inline] BUG: KASAN: slab-use-after-free in perf_uprobe_destroy+0x1d6/0x200 kernel/trace/trace_event_perf.c:344 Read of size 8 at addr ffff888028f59060 by task syz.0.14/12239 CPU: 0 UID: 0 PID: 12239 Comm: syz.0.14 Not tainted 6.12.25 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc0/0x5e0 mm/kasan/report.c:488 kasan_report+0x93/0xc0 mm/kasan/report.c:601 perf_trace_event_close kernel/trace/trace_event_perf.c:190 [inline] perf_uprobe_destroy+0x1d6/0x200 kernel/trace/trace_event_perf.c:344 __free_event+0x1d9/0x870 kernel/events/core.c:5330 perf_event_alloc kernel/events/core.c:12437 [inline] perf_event_alloc+0x1246/0x37d0 kernel/events/core.c:12210 __do_sys_perf_event_open+0x44c/0x2aa0 kernel/events/core.c:12847 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb0d09ac5ad Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb0d18f5f98 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007fb0d0be5fa0 RCX: 00007fb0d09ac5ad RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 RBP: 00007fb0d0a4458e R08: 000000000000000a R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fb0d0be5fa0 R15: 00007fb0d18d6000 </TASK> Allocated by task 12239: kasan_save_stack+0x24/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x1a5/0x3e0 mm/slub.c:4327 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] trace_probe_init+0xbc/0x5f0 kernel/trace/trace_probe.c:2050 alloc_trace_uprobe+0xa5/0x310 kernel/trace/trace_uprobe.c:347 create_local_trace_uprobe+0x10d/0x4c0 kernel/trace/trace_uprobe.c:1643 perf_uprobe_init+0x13a/0x220 kernel/trace/trace_event_perf.c:319 perf_uprobe_event_init+0x103/0x1d0 kernel/events/core.c:10715 perf_try_init_event+0x137/0xd70 kernel/events/core.c:11976 perf_init_event kernel/events/core.c:12064 [inline] perf_event_alloc kernel/events/core.c:12345 [inline] perf_event_alloc+0x101a/0x37d0 kernel/events/core.c:12210 __do_sys_perf_event_open+0x44c/0x2aa0 kernel/events/core.c:12847 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 12239: kasan_save_stack+0x24/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3a/0x60 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x54/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2372 [inline] slab_free mm/slub.c:4611 [inline] kfree+0x14e/0x4a0 mm/slub.c:4759 trace_probe_unlink+0x185/0x200 kernel/trace/trace_probe.c:2016 trace_probe_cleanup+0x168/0x1d0 kernel/trace/trace_probe.c:2034 free_trace_uprobe.part.0+0x1b/0x80 kernel/trace/trace_uprobe.c:371 free_trace_uprobe kernel/trace/trace_uprobe.c:367 [inline] destroy_local_trace_uprobe+0x5d/0x80 kernel/trace/trace_uprobe.c:1682 perf_try_init_event+0x44b/0xd70 kernel/events/core.c:12007 perf_init_event kernel/events/core.c:12064 [inline] perf_event_alloc kernel/events/core.c:12345 [inline] perf_event_alloc+0x101a/0x37d0 kernel/events/core.c:12210 __do_sys_perf_event_open+0x44c/0x2aa0 kernel/events/core.c:12847 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888028f59000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 96 bytes inside of freed 512-byte region [ffff888028f59000, ffff888028f59200) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28f58 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b041c80 ffffea0000a70200 dead000000000002 raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801b041c80 ffffea0000a70200 dead000000000002 head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 head: 00fff00000000002 ffffea0000a3d601 ffffffffffffffff 0000000000000000 head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9461, tgid 9461 (syz-executor), ts 105252344888, free_ts 105090780548 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook mm/page_alloc.c:1558 [inline] prep_new_page+0x31b/0x3a0 mm/page_alloc.c:1566 get_page_from_freelist+0x19fb/0x33b0 mm/page_alloc.c:3476 __alloc_pages_noprof+0x324/0x6b0 mm/page_alloc.c:4754 alloc_pages_mpol_noprof+0x2ce/0x610 mm/mempolicy.c:2269 alloc_slab_page mm/slub.c:2442 [inline] allocate_slab mm/slub.c:2608 [inline] new_slab+0x253/0x430 mm/slub.c:2662 ___slab_alloc+0xe1c/0x1720 mm/slub.c:3850 __slab_alloc.isra.0+0x56/0xb0 mm/slub.c:3940 __slab_alloc_node mm/slub.c:3993 [inline] slab_alloc_node mm/slub.c:4154 [inline] __kmalloc_cache_noprof+0x37f/0x3e0 mm/slub.c:4322 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] fib6_info_alloc+0xc9/0x290 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x341/0x1610 net/ipv6/route.c:3802 ip6_route_add+0x26/0x160 net/ipv6/route.c:3896 addrconf_prefix_route.isra.0+0x302/0x510 net/ipv6/addrconf.c:2486 inet6_addr_add+0x73a/0xc10 net/ipv6/addrconf.c:3083 inet6_rtm_newaddr+0x116a/0x18b0 net/ipv6/addrconf.c:5068 rtnetlink_rcv_msg+0x3c9/0xfc0 net/core/rtnetlink.c:6678 netlink_rcv_skb+0x165/0x450 net/netlink/af_netlink.c:2537 page last free pid 9499 tgid 9499 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x799/0x1320 mm/page_alloc.c:2659 __put_partials+0x151/0x170 mm/slub.c:3177 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x50/0x130 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x165/0x1c0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x67/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4117 [inline] slab_alloc_node mm/slub.c:4166 [inline] __kmalloc_cache_noprof+0x12a/0x3e0 mm/slub.c:4322 kmalloc_noprof include/linux/slab.h:878 [inline] call_modprobe kernel/module/kmod.c:84 [inline] __request_module+0x2a2/0x6b0 kernel/module/kmod.c:173 dev_load+0x1ff/0x240 net/core/dev_ioctl.c:645 dev_ioctl+0x518/0x10b0 net/core/dev_ioctl.c:709 sock_do_ioctl+0x1ca/0x260 net/socket.c:1241 sock_ioctl+0x23a/0x6c0 net/socket.c:1346 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888028f58f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888028f58f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888028f59000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888028f59080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888028f59100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include <dirent.h> #include <endian.h> #include <errno.h> #include <fcntl.h> #include <signal.h> #include <stdarg.h> #include <stdbool.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/prctl.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <sys/wait.h> #include <time.h> #include <unistd.h> static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } void execute_one(void) { if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } memcpy((void*)0x200000000000, ".pending_reads\000", 15); syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000000ul, /*flags=O_SYNC|O_NOATIME|O_LARGEFILE|O_CREAT|O_APPEND*/ 0x149440, /*mode=*/0); *(uint32_t*)0x200000000040 = 8; *(uint32_t*)0x200000000044 = 0x80; *(uint8_t*)0x200000000048 = 2; *(uint8_t*)0x200000000049 = 0; *(uint8_t*)0x20000000004a = 0; *(uint8_t*)0x20000000004b = 0; *(uint32_t*)0x20000000004c = 0; *(uint64_t*)0x200000000050 = 0; *(uint64_t*)0x200000000058 = 0x6a484; *(uint64_t*)0x200000000060 = 4; STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 0, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 1, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 2, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 3, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 4, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 5, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 6, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 7, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 8, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 9, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 10, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 11, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 12, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 13, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 14, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 15, 2); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 17, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 18, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 1, 19, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 20, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 21, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 22, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 23, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 24, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 25, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 26, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 27, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 28, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 29, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 30, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 31, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 32, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 33, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 34, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 35, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 36, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 37, 1); STORE_BY_BITMASK(uint64_t, , 0x200000000068, 0, 38, 26); *(uint32_t*)0x200000000070 = 7; *(uint32_t*)0x200000000074 = 0; *(uint64_t*)0x200000000078 = 0x200000000000; *(uint64_t*)0x200000000080 = 0; *(uint64_t*)0x200000000088 = 0; *(uint64_t*)0x200000000090 = 0; *(uint32_t*)0x200000000098 = 0; *(uint32_t*)0x20000000009c = 0; *(uint64_t*)0x2000000000a0 = 0x40000000000000; *(uint32_t*)0x2000000000a8 = 0; *(uint16_t*)0x2000000000ac = 0; *(uint16_t*)0x2000000000ae = 0; *(uint32_t*)0x2000000000b0 = 9; *(uint32_t*)0x2000000000b4 = 0; *(uint64_t*)0x2000000000b8 = 0; syscall(__NR_perf_event_open, /*attr=*/0x200000000040ul, /*pid=*/0, /*cpu=*/0ul, /*group=*/-1, /*flags=PERF_FLAG_FD_CLOEXEC|PERF_FLAG_FD_OUTPUT*/ 0xaul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; loop(); return 0; } =================================================================== I hope it helps. Best regards Jianzhou Zhao

7 months, 2 weeks

1
0
0 0

sound/pci/hda: add quirk for HP Spectre x360 15-eb0xxx

by Ezra Khuzadi

sound/pci/hda: add quirk for HP Spectre x360 15-eb0xxx Add subsystem ID 0x86e5 for HP Spectre x360 15-eb0xxx so that ALC285_FIXUP_HP_SPECTRE_X360_EB1 (GPIO amp-enable, mic-mute LED and pinconfigs) is applied. Tested on HP Spectre x360 15-eb0043dx (Vendor 0x10ec0285, Subsys 0x103c86e5) with legacy HDA driver and hda-verb toggles: $ cat /proc/asound/card0/codec#0 \ | sed -n -e '1,5p;/Vendor Id:/p;/Subsystem Id:/p' Codec: Realtek ALC285 Vendor Id: 0x10ec0285 Subsystem Id: 0x103c86e5 $ dmesg | grep -i realtek [ 5.828728] snd_hda_codec_realtek ehdaudio0D0: ALC285: picked fixup for PCI SSID 103c:86e5 Signed-off-by: Ezra Khuzadi <ekhuzadi(a)uci.edu> --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 877137cb09ac..82ad105e7fa9 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -10563,6 +10563,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO), + SND_PCI_QUIRK(0x103c, 0x86e5, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), SND_PCI_QUIRK(0x103c, 0x86e7, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), SND_PCI_QUIRK(0x103c, 0x86e8, "HP Spectre x360 15-eb0xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), SND_PCI_QUIRK(0x103c, 0x86f9, "HP Spectre x360 13-aw0xxx", ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED),

7 months, 2 weeks

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror April 2025