Repository navigation
Conversation
Add embedded controller node for Glymur CRDs which adds fan control, temperature sensors, access to EC state changes through SCI events and suspend entry/exit notifications to the EC. Signed-off-by: Sibi Sankar <sibi.sankar@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Co-developed-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com> Signed-off-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com>
Add embedded controller node for Hamoa/Purwa CRDs which adds fan control, temperature sensors, access to EC internal state changes and suspend entry/exit notifications to the EC. Signed-off-by: Sibi Sankar <sibi.sankar@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Co-developed-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com> Signed-off-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com>
Add embedded controller node for Hamoa IOT EVK boards which adds fan control, temperature sensors, access to EC internal state changes and suspend entry/exit notifications to the EC. Signed-off-by: Sibi Sankar <sibi.sankar@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Gaurav Kohli <gaurav.kohli@oss.qualcomm.com> Tested-by: Gaurav Kohli <gaurav.kohli@oss.qualcomm.com> Co-developed-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com> Signed-off-by: Anvesh Jain P <anvesh.p@oss.qualcomm.com>
Add embedded controller node for Hamoa/Purwa CRDs which adds fan control, temperature sensors, access to EC internal state changes and suspend entry/exit notifications to the EC. link: https://lore.kernel.org/all/20260327-add-driver-for-ec-v7-0-7684c915e42c@oss.qualcomm.com/ Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
It is apparently not available, use eusb5 until we find out which is which also cleanup on i2c9 (keyboard) and i2c19, touchpad is no wakeup-source Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
to avoid oddities during boot Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
…nd DAIs Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
…tate The MSM DP bridge implements dp_audio_prepare and dp_audio_shutdown but not dp_audio_startup. drm_bridge_connector_audio_startup() treats a missing dp_audio_startup as success and allows the DPCM layer to proceed to dp_audio_prepare even when no display is connected. msm_dp_audio_prepare() then returns -EINVAL because power_on is false, producing continuous dmesg spam at boot and on every PipeWire re-probe: ASoC error (-22): at snd_soc_dai_hw_params() on i2s-hifi DisplayPort2 Playback: ASoC error (-22): at __soc_pcm_hw_params() Add a dp_audio_startup implementation that checks power_on and returns -ENOTSUPP when no display is connected, gating the entire audio setup sequence at startup so prepare is never reached when the DP link is not active. -ENOTSUPP is used deliberately as snd_soc_ret() in soc-utils.c treats it as an expected non-error condition and suppresses the log output, avoiding unnecessary noise when no display is attached. Signed-off-by: Steev Klimaszewski <threeway@gmail.com>
…llers Enable the gpi_dma0..gpi_dma2 controllers currently no clients yet Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Reference the reserved memory region for audio PD dynamic loading and remote heap requirements. Add the required VMID list for memory ownership transfers. Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
…me PM Convert the LPASS WSA macro codec driver to use the PM clock framework for runtime power management. The driver now relies on pm_clk helpers and runtime PM instead of manually enabling and disabling macro, dcodec, mclk, npl, and fsgen clocks. Runtime suspend and resume handling is delegated to the PM core via pm_clk_suspend() and pm_clk_resume(), while existing runtime PM callbacks continue to manage regcache state. This ensures clocks are enabled only when the WSA macro is active, improves power efficiency on LPASS platforms supporting LPI/island modes, and aligns the driver with common ASoC runtime PM patterns used across Qualcomm LPASS codec drivers. Signed-off-by: Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com>
…e PM Convert the LPASS VA macro codec driver to use the PM clock framework for runtime power management. The driver now relies on pm_clk helpers and runtime PM instead of manually enabling and disabling macro, dcodec, mclk, and npl clocks. All clock control during runtime suspend and resume is delegated to the PM core via pm_clk_suspend() and pm_clk_resume(). This change ensures clocks are only enabled when the VA macro is active, improves power efficiency on LPASS platforms supporting LPI/island modes, and aligns the driver with common ASoC runtime PM patterns used across Qualcomm LPASS codec drivers. Signed-off-by: Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com>
The NPL clock is only present on some platforms. When it is absent, wsa->npl remains NULL, but the driver unconditionally programs its rate. Guard clk_set_rate() for the NPL clock so platforms without NPL do not attempt to access it. No functional change on platforms that provide the NPL clock. Signed-off-by: Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com>
- remove codec - remove codec, dmic, speaker related DAIs - remove swr config, lpass, wsa macro, va macro - add DisplayPort related DAIs - add DisplaPort sound names Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
and follow-up changes re thermal zones in dell xps13 9345 Thermal zones definition on sgerhold's branch was different (newer) Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
required for the ufs_mem_hc node. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Add status = "disabled" to ice@1d88000, cryptobam and general crypto nodes in hamoa.dtsi to avoid probe failures on platforms that don't use them. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
ICE is used by the UFS controller. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Add the dp altmode wiring from Denali. This consists of pmic-glink, ps883x retimers, and accompanying vregs and gpios. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
- re-enable scm compatible for obvious reasons - some sorting - pcie4 pinctrl - MAC hack Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
preliminary hack Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
To support sound over DisplayPort on the type-c ports, add the necessary DAI links and port naming. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
remove standalone _dwc3 statements, integrate in the usb_ block Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
The hardware-qualified SP11 v19 image clears Offset2 while enabling the WSA VI and CPS master ports. The guarded 7.2.2 relift dropped that behavior. Apply the active value automatically only to WSA controller ports 10, 11 and 13 on Microsoft Denali. Keep the inactive transport configuration unchanged and leave generic controllers untouched. This restores the qualified behavior without exposing SP11 policy through a module parameter or making SP11 naming part of the public userspace contract. Link: 537d1ac Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit 618b3e1)
The guarded 7.2.2 port kept the 2S 4-ohm final values but dropped the hardware-qualified Denali WSA8845 cold, start and stop transactions. The right amplifier consequently reports PA status 0x6 and remains disabled during playback. Restore the v19 register sequences verbatim and select them only when the machine is Microsoft Denali, protected feedback is described, the speaker load is 4 ohms and the codec reports a 2S supply. Generic WSA884x devices retain the upstream lifecycle. Also restore the bounded PA FSM reset and retry path. Retain the relifted protection-clock accounting and keep a failed recovery as a hard playback error. Link: e72bffc Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit d1edbc8)
The WSA8845 devices remain powered and advertise simple clock-stop support on Microsoft Denali. Treating each transient SoundWire detach as context loss dirties the full register cache and replays the cold transaction on attachment, unlike the hardware-qualified v19 lifecycle. Keep the initialized codec state across the Denali protected 2S 4-ohm detach and sync only writes queued while cache-only. Preserve the existing context-loss path, including full dirty-cache restore, for every other device and profile. Link: e72bffc Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit 09a3f4e)
DPCM releases the Denali VI and CPS backends before the front end performs its final protected graph stop. The graph correctly rejects those ready-to-not-ready transitions while start_count is nonzero, but the machine driver then aborts SoundWire hw_free and shutdown. This produces four -EBUSY warnings and can retain the stream runtime on every close. Treat only a busy readiness clear as deferred so SoundWire teardown continues. Complete both deferred clears after a confirmed final protected graph stop, under the existing protection lock. Keep ready transitions into a running graph rejected, and do not clear state after an uncertain or failed stop. Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit cceb155)
The Denali cold, start, and stop transactions already carry their own gain, current-limit, and watchdog state. Running the generic speaker post-PMU and PDM watchdog writes afterwards changes that qualified transition and can leave the paired amplifiers asymmetric. Restore the protected-profile bypass used by the qualified v19 path. Non-Denali and unprotected WSA884x users retain the generic programming. Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit e0fe0c6)
The hardware-qualified SP11 v19 path materializes TOP_CFG1 after each enabled VI feedback pair. The guarded 7.2.2 relift retained the feedback clocks but dropped this producer-side write, leaving the physical lane order inconsistent with the qualified V,I,V,I stream. Restore the write at the original lifecycle boundary and gate it with the existing protected-feedback profile. This is equivalent to the original Denali check while preserving upstream defaults and behavior on every other machine. Link: f17a678 Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit 156115d)
The device writes event elements into coherent memory before publishing its event ring read pointer. Both gpi_process_events() and gpi_mark_stale_events() read that pointer through readl_relaxed() and then consume the event memory without an ordering guarantee. On architectures such as arm64, this can expose a published event before all its fields are visible. Denali QSPI exposed this as an accepted completion whose length was observed as zero. Use ordered MMIO reads only for the event pointer. Keep all other register accesses relaxed. This follows the ordered ioread32() pattern used by the Qualcomm IPA GSI event-ring consumer. Fixes: 5d0c353 ("dmaengine: qcom: Add GPI dma driver") Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit bd9f5e2) (cherry picked from commit f9c68b9)
Signed-off-by: Leon Silcott <leon@boasi.io>
Derive the softclip control register from the selected codec layout instead of combining the fixed v2.1 base with a version-dependent channel stride. This preserves v2.1 control addresses 0x604/0x644 and selects 0x644/0x664 for v2.5 and later. Keep the existing softclip enable and event policy. This is a register-layout correction, not a claim that softclip caused the Denali audio regression. Signed-off-by: Leon Silcott <leon@boasi.io>
Restore the VBAT/BCL event, widgets and routes from the qualified Denali integration source, together with its HD2 no-op and conditional primary half-dB policy. Retain the geocausa/SP11X1e-audio provenance of that source. Apply the seventeen cache-default differences to a private writable copy only for Denali. These remain cache assumptions, not forced register writes. Extend the v2.5 register access range only for Denali, and install the driver instance before regmap access callbacks can need it. Keep generic routes and defaults unchanged. Use separate Denali and generic route tables because common component routes are registered after probe. Do not change PA, VI or CPS ownership in this commit. This restores nominal source behavior, including the inherited shared-VBAT teardown and ignored event-write errors. Neither those behaviors nor the new guarded composition are hardware-qualified by the source trace tests. Link: 537d1ac Link: geocausa/SP11X1e-audio@31466d6 Signed-off-by: Leon Silcott <leon@boasi.io>
Restore the two SP/SPVI GET transactions in the qualified Denali setup order between the tag configuration and SPVI dynamic configuration. Derive their first-record query shape from the validated topology instead of introducing fixed instance IDs. Zero the request before filling it. Accept the GET response only when a pending command, opcode and token match, and validate response bounds before reporting completion. Preserve the existing protected-profile gate and transport error handling. The source order comes from the geocausa/SP11X1e-audio integration port. This does not decode calibration replies or prove that these queries resolve the speaker regression. Link: 537d1ac Link: geocausa/SP11X1e-audio@31466d6 Signed-off-by: Leon Silcott <leon@boasi.io>
Restore the qualified integration's per-record calibration replay when the aggregate returns EOPNOTSUPP. Validate the entire block's framing before sending it, retaining opaque instance IDs and query-only records. Continue past individual EOPNOTSUPP replies, but stop on hard failures. Serialize replay and retain its result on the persistent topology graph information so reopening a runtime graph cannot accept a partially failed replay. A topology reload resets this state. This intentionally replaces the legacy global once flag with per-topology ownership and sticky errors. The nominal replay is adapted from the geocausa/SP11X1e-audio integration port. Do not restore the legacy hard-aggregate-error diagnostic probes. The state and error-handling deviations still need hardware qualification. Link: 537d1ac Link: geocausa/SP11X1e-audio@31466d6 Signed-off-by: Leon Silcott <leon@boasi.io>
After both protected modules have been successfully disabled for missing VI/CPS feedback, send the qualified gain, filter, mute and channel-mixer tail. Reuse the same sequence for the fully configured protected path. Only confirm bypass after every required transaction succeeds. A failed disable or volume-tail transaction faults the graph and prevents prepare and start from treating partial configuration as success. Leave the unavailable/uncertain guard path's disable-only behavior unchanged. The nominal sequence is adapted from the geocausa/SP11X1e-audio integration port. Preserving it does not qualify bypass acoustics or speaker safety; the guarded error behavior and complete composition remain test candidates. Link: 537d1ac Link: geocausa/SP11X1e-audio@31466d6 Signed-off-by: Leon Silcott <leon@boasi.io>
Keep Denali's macro and dcodec votes for the device lifetime and cycle only mclk, optional npl and fsgen through runtime PM, in that order on resume and in reverse on suspend. This matches its qualified integration clock ownership instead of applying the newer all-clock PM policy. Retain the PM-clock framework path for all other devices. On Denali, propagate clock-enable failures and unwind partial acquisition. Clear cache-only only once the clocks are ready; on regcache-sync failure restore cache-only/dirty and release runtime references before returning the error. That sync-error handling deliberately differs from the legacy ignored error. Register a managed release action before the component and output clock so they are torn down first. Track acquired runtime references independently of PM status and disable PM before cleanup on remove or probe failure. Keep the three-second autosuspend delay and system-sleep policy unchanged. This is a Denali qualification candidate, not proof of physical power collapse or of the speaker regression's cause. The VA fsgen dependency and real PM/CCF/DAPM behavior still need qualification. Link: 537d1ac Link: jglathe@4d49f24 Signed-off-by: Leon Silcott <leon@boasi.io>
The Denali producer repair deliberately mutates a private reg_default copy before passing it to regmap. Its argument cannot be const; the generic CONST_STRUCT heuristic is not applicable to this use. Retain the diagnostic in the log, but accept it only when the complete patch has the reviewed stable patch ID, the resulting source blob matches exactly, and this exact warning is the sole diagnostic. The blob check is necessary because patch IDs also ignore significant whitespace in string literals. Do not ignore CONST_STRUCT globally or waive other findings in the same patch. Any source change requires a renewed review. This is a source-style exception, not a hardware or provenance waiver. All qualification and contributor-attestation gates remain unchanged. Signed-off-by: Leon Silcott <leon@boasi.io>
Allocate 7.2.5-jg-0sp11v3 for the guarded audio repair series. Keep its packages and modules distinct from the failed v2 hardware candidate; the calibration state changes exported AudioReach symbol checksums. Retain the prior v2 entry and existing source DTB/non-Stubble policy. No other packaging, configuration or kernel source is changed here. Compilation and linkage checks are not audio safety or hardware parity qualification. Preserve the known-good recovery kernel and keep this test carrier out of the integration target until its gates are met. Signed-off-by: Leon Silcott <leon@boasi.io>
Restore the DAC BLOCKCTRL3 and COMP/BOOST OFFSETCTRL2 SIMPLE-port capabilities from the qualified SP11 Golden transport originating in geocausa/SP11X1e-audio and carried by the integration source below. SoundWire can then write the existing master-derived banked values. Select the capabilities only for the Denali protected-feedback wiring with a four-ohm speaker description. Copy the sink properties into managed per-instance storage and leave the shared generic table unchanged. Return allocation failure before reset deassertion and component setup. Select transport from board wiring, not the VPHX status first read after attachment. Keep the measured supply and analog protection guards, gain, source ports, master tables, PCM lifecycle and userspace unchanged. This restores nominal source behavior, not proof that retained register values caused static. Require fresh package and hardware qualification before integration; compilation and host tests do not establish safety. Link: 537d1ac Signed-off-by: Leon Silcott <leon@boasi.io>
Allocate 7.2.5-jg-0sp11v4 for the guarded render port extension repair. Keep this candidate's packages and modules separate from the v3 hardware test, which still produced audible static after volume changes. Retain both previous qualification changelog entries, the GPI ordering repair and the existing source DTB/non-Stubble packaging policy. No other source or packaging changes are made by this version-only commit. Offline tests do not establish audible parity or physical speaker safety. Preserve the known-good recovery kernel and hold integration until fresh package, cold-boot audio and broader hardware qualification are complete. Signed-off-by: Leon Silcott <leon@boasi.io>
This was referenced Sep 30, 2026
Owner
Author
|
Closing this superseded review/qualification vehicle without merging. Current review work is tracked in ooaklee/linux_ms_dev_kit-sp11#58, ooaklee/linux_ms_dev_kit-sp11#68; ooaklee/linux_ms_dev_kit-sp11#68 is the single combined 7.2.5 qualification candidate. This does not discard the original feature intent or close any outstanding acceptance gate. The current combined source is This PR's branch and exact head |
7 of 11 tasks
kyjus25
pushed a commit
to kyjus25/linux_ms_dev_kit-sp11
that referenced
this pull request
Oct 14, 2026
commit aedf2ef upstream. If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk->ops->install_pte is not specified, the code continues to the next PMD entry in the range without resetting walk->action to ACTION_SUBTREE. This leaves walk->action erroneously set to ACTION_AGAIN, which is incorrect. This was incorrect but not problematic up until commit 3b89863 ("mm/pagewalk: fix race between concurrent split and refault") which updated walk_pud_range() to check for walk->action == ACTION_AGAIN upon walk_pmd_range()'s return, causing the PUD walk to be retried. In this case this results in duplicate walk callbacks being invoked, which is erroneous and will break any caller that is not idempotent with respect to this (and waste time for those which are). The result is an out-of-bounds write, triggered by a local fuzzer: [ 2.272695] ================================================================== [ 2.273471] BUG: KASAN: slab-out-of-bounds in __mincore_unmapped_range+0x14f/0x190 [ 2.274302] Write of size 1 at addr ffff888008d9b000 by task poc/106 [ 2.274966] [ 2.275154] CPU: 0 UID: 1000 PID: 106 Comm: poc Not tainted 7.2.0-rc6-00429-ga7c7074b58d2 ooaklee#55 PREEMPT(lazy) [ 2.275159] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.275164] Call Trace: [ 2.275170] <TASK> [ 2.275172] dump_stack_lvl+0x53/0x70 [ 2.275200] print_report+0xd0/0x630 [ 2.275210] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2.275219] ? irqentry_exit+0xd2/0x670 [ 2.275224] ? irqentry_exit+0xd2/0x670 [ 2.275226] ? __virt_addr_valid+0xef/0x1a0 [ 2.275239] ? __mincore_unmapped_range+0x14f/0x190 [ 2.275242] kasan_report+0xce/0x100 [ 2.275245] ? __mincore_unmapped_range+0x14f/0x190 [ 2.275248] __mincore_unmapped_range+0x14f/0x190 [ 2.275252] mincore_unmapped_range+0x45/0x70 [ 2.275254] walk_pgd_range+0xafc/0xfc0 [ 2.275261] ? __pfx_walk_pgd_range+0x10/0x10 [ 2.275264] ? __update_load_avg_se+0x3d1/0x670 [ 2.275275] __walk_page_range+0xc0/0x310 [ 2.275278] ? __pfx_find_vma+0x10/0x10 [ 2.275281] ? finish_task_switch.isra.0+0x16d/0x4f0 [ 2.275290] walk_page_range_mm_unsafe+0x26f/0x3a0 [ 2.275293] ? __pfx_mtree_load+0x10/0x10 [ 2.275298] ? __pfx_walk_page_range_mm_unsafe+0x10/0x10 [ 2.275302] ? __free_frozen_pages+0x54d/0x7e0 [ 2.275308] __do_sys_mincore+0x132/0x380 [ 2.275311] do_syscall_64+0xf9/0x540 [ 2.275316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2.275322] RIP: 0033:0x422ccd [ 2.275326] Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 2.275329] RSP: 002b:00007fffffffec18 EFLAGS: 00000287 ORIG_RAX: 000000000000001b [ 2.275337] RAX: ffffffffffffffda RBX: 0000000000000066 RCX: 0000000000422ccd [ 2.275339] RDX: 00000000004d0940 RSI: 0000000001000000 RDI: 00007ffff4000000 [ 2.275340] RBP: 00000000004d0940 R08: 0000000000000100 R09: 0000000000000100 [ 2.275342] R10: 0000000000000100 R11: 0000000000000287 R12: 20c49ba5e353f7cf [ 2.275343] R13: 00000000004990d3 R14: 0000000000000000 R15: 0000000000000001 [ 2.275346] </TASK> [ 2.275347] [ 2.296904] The buggy address belongs to the object at ffff888008d9b000 [ 2.296904] which belongs to the cache sigqueue of size 80 [ 2.298151] The buggy address is located 0 bytes inside of [ 2.298151] allocated 80-byte region [ffff888008d9b000, ffff888008d9b050) [ 2.299408] [ 2.299601] The buggy address belongs to the physical page: [ 2.300191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8d9b [ 2.301001] flags: 0x100000000000000(node=0|zone=1) [ 2.301535] page_type: f5(slab) [ 2.301884] raw: 0100000000000000 ffff888107e46780 dead000000000122 0000000000000000 [ 2.302687] raw: 0000000000000000 0000000800240024 00000000f5000000 0000000000000000 [ 2.303489] page dumped because: kasan: bad access detected [ 2.304092] [ 2.304276] Memory state around the buggy address: [ 2.304801] ffff888008d9af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2.305567] ffff888008d9af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2.306340] >ffff888008d9b000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2.307115] ^ [ 2.307474] ffff888008d9b080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2.308237] ffff888008d9b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2.308997] ================================================================== A specific example of this breaking things is mincore which walks an internal cursor data structure a byte at a time on assumption that page table entry callbacks are called only once for each entry. Fix the problem by resetting walk->action to ACTION_SUBTREE prior to the none check. The pattern also exists in walk_pud_range() so fix it there too. This issue was found through AI-based fuzzing. Link: https://lore.kernel.org/20260811161949.3879321-2-imv4bel@gmail.com Fixes: 3b89863 ("mm/pagewalk: fix race between concurrent split and refault") Assisted-by: Claude:claude-opus-5 Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Max Boone <mboone@akamai.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Qualification only — do not merge or install unattended
7.2.5-jg-0sp11v4-qcom-x1ehas now passed the first user-observed audio/inputtrial on one Denali OLED Surface Pro 11. The v3 candidate in #54 still produced
audible static/squelching after volume changes; the v4 trial below did not.
This is not a full-feature integration PR, a long-term stability result or a
speaker-protection qualification. Keep the working
7.2.0-jg-0sp11v23-qcom-x1eas the recovery reference and boot default.Desktop mute is not established speaker isolation.
Change since v3
Only two paths differ from the v3 carrier:
sound/soc/codecs/wsa884x.c: restore the qualified DACBLOCKCTRL3andCOMP/BOOST
OFFSETCTRL2capabilities for the explicitly selected Denaliprotected-feedback, four-ohm wiring. Use a managed instance-owned copy;
leave the shared generic sink table unchanged. Allocation failure returns
before reset deassertion and component registration.
debian.qcom-x1e/changelog: allocate the fresh v4 ABI, retaining the v3/v2entries byte-for-byte. This isolates the candidate's packages and behavior;
it does not assert an exported-symbol CRC change.
The identical SoundWire core already derives the banked values from the
master tables. For both speakers the restored capabilities enable the
qualified DAC/COMP/BOOST writes of
0x00/0x07/0x1f. The live registervalues on failing hardware have not been measured; omission is a source
parity gap, not established causality.
Transport selection uses initialized board wiring, not the supply state
first measured after attachment. Existing measured-supply/analog guards,
protection, gain, source ports, master tables, PCM lifecycle and userspace
remain unchanged. No deprecated compatibility parameter is reintroduced.
Attribution and dependency boundaries
The render repair credits the qualified transport originating in
geocausa/SP11X1e-audio, carried by
integration commit 537d1ac.
It is also replayed with
cherry-pick -xon the experimental Golden topic,preserving author, author date and message. No contributor sign-off is invented.
The carrier retains the 7.2.5 refresh (#51), GPI ordering (#52), guarded
TX/Golden audio ports (#53) and v3 calibration/query/producer/volume-tail/PM
repairs (#54). This keeps previously tested input ordering in the candidate
without moving GPI into the dedicated Golden topic. The entire Golden/carrier
tree difference remains exactly GPI and the qualification changelog.
The held microphone, Golden, camera, battery and power-profile topics remain
separate review/qualification tracks; their existing PR heads are not silently
replaced or approved by this diagnostic carrier. #47 remains held.
Upstream/userspace assessment
Comparing the actual original upstream 7.2.0 source with current upstream
e57ec2987d45(7.2.5) shows unchanged Qualcomm audio and SoundWire drivertrees. Shared ALSA PCM trigger, GLINK ordering and PAS error-path changes
remain relevant possibilities; this does not exclude wider base effects.
AudioReach topology PR76
adds a different SP11 graph under the same topology basename as the custom
FullIO graph. That is a package-ownership/update collision risk, not evidence
that the saved failing-v3 files were replaced. Saved v23/v3 on-disk audio
captures match; loaded DSP topology/firmware identity remains a separate check.
Do not swap topology/UCM or blindly revert upstream fixes during this test.
Offline evidence and remaining gates
broken variants detected, with ASan/UBSan. These mock hardware I/O.
W=1codec-object compilation passes. This is not a linkedmodule, full package build or hardware test.
51 against beta. An initial local run with upstream as the PR review base
incorrectly included inherited packaging history and failed; the real
beta-relative review range passes without changing CI policy.
do_dtbs=trueanddo_stubble=false.v0.5.0-rc.5, current sourceb74247d08f7c.The build-host inventory differs from v3 in exactly four OpenSSL-family
packages updated from
3.5.5-1ubuntu3.5to3.5.5-1ubuntu3.6; every otherinstalled package version matches. Module signing uses host OpenSSL, so the
candidate has a separately pinned inventory and fresh artifact hashes. It
is not an identical-full-inventory control, and no byte-identical signing
or hardware-equivalence claim follows. Previous control pins stay unchanged.
The exact-head normal source-mode build completed successfully. The finished
five-package bundle passes independent extraction-only inspection and native,
relocated and runtime-only Lexr inspection. Its compressed ARM64 image identifies
the exact v4 ABI; a real v3-image-as-v4 negative control is rejected. All 7,816
modules pass the exact module-set and matched-header symbol/depmod checks.
The 32,012 packaged export rows are byte-identical to v3. The same-build OLED/LCD
DTB digests, boot-support registry/helper/hooks and exact-ABI image trigger
contract pass. Effective delivery is external-required, with no embedded DTBs.
No package maintainer scripts were executed by the extraction-only checks.
All 73 warning diagnostics match v1/v2/v3 controls after normalizing only the
exact package version and six exact temporary Equivs email diagnostics. No new
warning is waived. The completed build receipt pins source, tree, recipe and
the separately recorded host inventory. These remain local artifact checks.
Separate Surface installation and user-observed functional results are recorded
below; neither proves loaded-DSP identity or speaker-protection state.
Surface trial — 2026-10-01
Source remains pinned at
b9c141a6da73249aecb793b2ce1ac77645e6a00f.The separately authorized installation completed successfully. Passive checks
confirmed the running v4 ABI and matching installed kernel, initramfs and
same-build OLED DTB digests. Lexr's boot doctor reports ready, with an owned v4
entry and v23 still the default/fallback. All 863 captured audio userspace
path/digest pairs match the saved v23 baseline; no topology/UCM swap was made
for this trial. Both amplifiers are bound; the captured idle PCM devices were
closed. The snapshot had no deferred probes or D-state tasks and no
BUG/Oops/Call-trace/hung-task match in the collected current-boot log. These
are bounded snapshots, not future stability or complete error-path proofs.
The user then reported these successful ordinary-use tests:
without lingering static.
observation, not objective acoustic calibration or independently measured
channel-routing qualification.
at least 5–10 minutes.
not separately qualified.
confirmed that its indicator lit while active and turned off after closing
the site on v4. This is a user-observed normal-close indicator pass, not
qualification of repeated capture, failed-start/stop or other teardown paths.
Recording and measured layout/quality remain unqualified. This records
inherited v4 functionality, not acceptance of the separate camera topic's
RAW/layout or stream-lifecycle ports in [HELD 7.2.5] media: qcom: port guarded SP11 camera parity #56.
These are user-observed results on one device, distinct from the passive
identity checks. The user subsequently confirmed that the basic functionality
worked after both a restart and a full shutdown followed by powering on.
This establishes a user-observed warm/cold functional pass, not exact trial
counts, independently captured logs of each boot or longer-term stress stability.
No repeat of passed ordinary tests is required solely to collect more logs.
GET_SPF_STATE timeouts, unsupported aggregate-calibration and GPR
unregistered-port diagnostics remain unresolved. Absence of audible static
does not establish loaded-DSP identity, calibration correctness or active
speaker protection; no diagnostic or intentional deviation is waived here.
The selected sleep mode remains
s2idle [deep]; the previous same-base deepentry hard freeze remains unresolved. Neither deep nor s2idle suspend was
tested in this trial. A recovery-ready, separately supervised plan is required
before any new suspend test.
The stacked topic PRs #56–61 have passed local exact-range checks. Their hosted
checks remain absent because their current workflow targets beta-based PRs,
not the refresh/TX/battery dependency bases. The separate CI-only draft #62
adds the three exact dependency-base filters; its actual refresh-base hosted
check passes. The policy has not been rolled into the hardware topics, and
their own exact hosted checks remain an open gate before final integration.
No tested head is moved or check weakened by this policy preparation.
A subsequent checkout audit found that the hosted workflow omits checkpatch's
tracked spelling and const-structure tables. Its green results therefore have
limited style coverage. An independent CI-only correction must include those
inputs and reject missing tables; it must not move tested hardware heads or
broaden existing validator exceptions.
same-build OLED/LCD DTBs and boot-support hooks/trigger inspection.
and fallback; no automatic reboot or audio stimulus.
lingering static; clear short recordings from both microphones.
documented deviations and explicit acceptance before final integration.
Keep beta and the reviewed topic heads held. A green build must not bypass
hardware qualification or justify dropping behavior from the working integration.