Repository navigation
Conversation
…tate The MSM DP bridge implements dp_audio_prepare and dp_audio_shutdown but not dp_audio_startup. drm_bridge_connector_audio_startup() treats a missing dp_audio_startup as success and allows the DPCM layer to proceed to dp_audio_prepare even when no display is connected. msm_dp_audio_prepare() then returns -EINVAL because power_on is false, producing continuous dmesg spam at boot and on every PipeWire re-probe: ASoC error (-22): at snd_soc_dai_hw_params() on i2s-hifi DisplayPort2 Playback: ASoC error (-22): at __soc_pcm_hw_params() Add a dp_audio_startup implementation that checks power_on and returns -ENOTSUPP when no display is connected, gating the entire audio setup sequence at startup so prepare is never reached when the DP link is not active. -ENOTSUPP is used deliberately as snd_soc_ret() in soc-utils.c treats it as an expected non-error condition and suppresses the log output, avoiding unnecessary noise when no display is attached. Signed-off-by: Steev Klimaszewski <threeway@gmail.com>
…llers Enable the gpi_dma0..gpi_dma2 controllers currently no clients yet Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Reference the reserved memory region for audio PD dynamic loading and remote heap requirements. Add the required VMID list for memory ownership transfers. Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
…me PM Convert the LPASS WSA macro codec driver to use the PM clock framework for runtime power management. The driver now relies on pm_clk helpers and runtime PM instead of manually enabling and disabling macro, dcodec, mclk, npl, and fsgen clocks. Runtime suspend and resume handling is delegated to the PM core via pm_clk_suspend() and pm_clk_resume(), while existing runtime PM callbacks continue to manage regcache state. This ensures clocks are enabled only when the WSA macro is active, improves power efficiency on LPASS platforms supporting LPI/island modes, and aligns the driver with common ASoC runtime PM patterns used across Qualcomm LPASS codec drivers. Signed-off-by: Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com>
…e PM Convert the LPASS VA macro codec driver to use the PM clock framework for runtime power management. The driver now relies on pm_clk helpers and runtime PM instead of manually enabling and disabling macro, dcodec, mclk, and npl clocks. All clock control during runtime suspend and resume is delegated to the PM core via pm_clk_suspend() and pm_clk_resume(). This change ensures clocks are only enabled when the VA macro is active, improves power efficiency on LPASS platforms supporting LPI/island modes, and aligns the driver with common ASoC runtime PM patterns used across Qualcomm LPASS codec drivers. Signed-off-by: Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com>
The NPL clock is only present on some platforms. When it is absent, wsa->npl remains NULL, but the driver unconditionally programs its rate. Guard clk_set_rate() for the NPL clock so platforms without NPL do not attempt to access it. No functional change on platforms that provide the NPL clock. Signed-off-by: Ajay Kumar Nandam <ajay.nandam@oss.qualcomm.com>
- remove codec - remove codec, dmic, speaker related DAIs - remove swr config, lpass, wsa macro, va macro - add DisplayPort related DAIs - add DisplaPort sound names Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
and follow-up changes re thermal zones in dell xps13 9345 Thermal zones definition on sgerhold's branch was different (newer) Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
required for the ufs_mem_hc node. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Add status = "disabled" to ice@1d88000, cryptobam and general crypto nodes in hamoa.dtsi to avoid probe failures on platforms that don't use them. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
ICE is used by the UFS controller. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Add the dp altmode wiring from Denali. This consists of pmic-glink, ps883x retimers, and accompanying vregs and gpios. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
- re-enable scm compatible for obvious reasons - some sorting - pcie4 pinctrl - MAC hack Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
preliminary hack Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
To support sound over DisplayPort on the type-c ports, add the necessary DAI links and port naming. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
remove standalone _dwc3 statements, integrate in the usb_ block Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Commit 47c88db ("arm64: dts: qcom: hamoa: Add remoteproc IOMMUS in EL2 device trees") added IOMMU stream configuration for the ADSP and CDSP remote processors directly into x1-el2.dtso. This configuration is only needed when Linux at EL2 is responsible for fully managing remote processor loading and IOMMU setup via PAS (Peripheral Authentication Service). Other EL2 configurations do not require these properties in the same way. Introduce a small dedicated overlay (x1-el2-pas.dtso) that includes the base EL2 overlay and provides the remoteproc IOMMU configuration. This keeps the generic x1-el2.dtso suitable for the configurations it was originally intended for. Fixes: 47c88db ("arm64: dts: qcom: hamoa: Add remoteproc IOMMUS in EL2 device trees") Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Checked against dsdt.dsl and AeoB file: its PMICGPIO 3 3, which translates to pmc8380_3 gpio3. Go figure. pmc8380_3 gpio3 is protected, though, and can't be claimed by backlight. And surprise: without it defined backlight adjustment works after suspend, too. Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
enable HDMI connector like in TB16 enable DP sound-DAIs enable fingerprint reader, too correct usb-sbu gpios (same as TB16) Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Userspace can probe all HDMI/DP PCM devices exposed by an ALSA card while building its profile set. For example, UCM-aware servers may try to open every DP PCM even when only one connector is currently plugged in. msm_dp_audio_prepare() currently returns -EINVAL when the DP controller is not powered. This protects against unclocked register access, but it also makes the inactive DP PCM fail during probing. If one such PCM is part of a UCM profile, the whole profile can be discarded even though jack and ELD state already mark the inactive connector as unavailable. Keep the clock-safety check, but treat an inactive controller as a no-op: skip the DP audio register programming and return success. Active streams still program the hardware as before, while unplugged or disabled outputs remain discoverable and report their availability through the usual jack and ELD controls. Fixes: 158b9aa ("drm/msm/dp: wait for audio notification before disabling clocks") Signed-off-by: Xilin Wu <sophon@radxa.com>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
The WSA8845 devices remain powered and advertise simple clock-stop support on Microsoft Denali. Treating each transient SoundWire detach as context loss dirties the full register cache and replays the cold transaction on attachment, unlike the hardware-qualified v19 lifecycle. Keep the initialized codec state across the Denali protected 2S 4-ohm detach and sync only writes queued while cache-only. Preserve the existing context-loss path, including full dirty-cache restore, for every other device and profile. Link: e72bffc Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit 09a3f4e)
DPCM releases the Denali VI and CPS backends before the front end performs its final protected graph stop. The graph correctly rejects those ready-to-not-ready transitions while start_count is nonzero, but the machine driver then aborts SoundWire hw_free and shutdown. This produces four -EBUSY warnings and can retain the stream runtime on every close. Treat only a busy readiness clear as deferred so SoundWire teardown continues. Complete both deferred clears after a confirmed final protected graph stop, under the existing protection lock. Keep ready transitions into a running graph rejected, and do not clear state after an uncertain or failed stop. Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit cceb155)
The Denali cold, start, and stop transactions already carry their own gain, current-limit, and watchdog state. Running the generic speaker post-PMU and PDM watchdog writes afterwards changes that qualified transition and can leave the paired amplifiers asymmetric. Restore the protected-profile bypass used by the qualified v19 path. Non-Denali and unprotected WSA884x users retain the generic programming. Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit e0fe0c6)
The hardware-qualified SP11 v19 path materializes TOP_CFG1 after each enabled VI feedback pair. The guarded 7.2.2 relift retained the feedback clocks but dropped this producer-side write, leaving the physical lane order inconsistent with the qualified V,I,V,I stream. Restore the write at the original lifecycle boundary and gate it with the existing protected-feedback profile. This is equivalent to the original Denali check while preserving upstream defaults and behavior on every other machine. Link: f17a678 Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit 156115d)
The device writes event elements into coherent memory before publishing its event ring read pointer. Both gpi_process_events() and gpi_mark_stale_events() read that pointer through readl_relaxed() and then consume the event memory without an ordering guarantee. On architectures such as arm64, this can expose a published event before all its fields are visible. Denali QSPI exposed this as an accepted completion whose length was observed as zero. Use ordered MMIO reads only for the event pointer. Keep all other register accesses relaxed. This follows the ordered ioread32() pattern used by the Qualcomm IPA GSI event-ring consumer. Fixes: 5d0c353 ("dmaengine: qcom: Add GPI dma driver") Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit bd9f5e2) (cherry picked from commit f9c68b9)
Signed-off-by: Leon Silcott <leon@boasi.io>
Derive the softclip control register from the selected codec layout instead of combining the fixed v2.1 base with a version-dependent channel stride. This preserves v2.1 control addresses 0x604/0x644 and selects 0x644/0x664 for v2.5 and later. Keep the existing softclip enable and event policy. This is a register-layout correction, not a claim that softclip caused the Denali audio regression. Signed-off-by: Leon Silcott <leon@boasi.io>
Restore the VBAT/BCL event, widgets and routes from the qualified Denali integration source, together with its HD2 no-op and conditional primary half-dB policy. Retain the geocausa/SP11X1e-audio provenance of that source. Apply the seventeen cache-default differences to a private writable copy only for Denali. These remain cache assumptions, not forced register writes. Extend the v2.5 register access range only for Denali, and install the driver instance before regmap access callbacks can need it. Keep generic routes and defaults unchanged. Use separate Denali and generic route tables because common component routes are registered after probe. Do not change PA, VI or CPS ownership in this commit. This restores nominal source behavior, including the inherited shared-VBAT teardown and ignored event-write errors. Neither those behaviors nor the new guarded composition are hardware-qualified by the source trace tests. Link: 537d1ac Link: geocausa/SP11X1e-audio@31466d6 Signed-off-by: Leon Silcott <leon@boasi.io>
Restore the two SP/SPVI GET transactions in the qualified Denali setup order between the tag configuration and SPVI dynamic configuration. Derive their first-record query shape from the validated topology instead of introducing fixed instance IDs. Zero the request before filling it. Accept the GET response only when a pending command, opcode and token match, and validate response bounds before reporting completion. Preserve the existing protected-profile gate and transport error handling. The source order comes from the geocausa/SP11X1e-audio integration port. This does not decode calibration replies or prove that these queries resolve the speaker regression. Link: 537d1ac Link: geocausa/SP11X1e-audio@31466d6 Signed-off-by: Leon Silcott <leon@boasi.io>
Restore the qualified integration's per-record calibration replay when the aggregate returns EOPNOTSUPP. Validate the entire block's framing before sending it, retaining opaque instance IDs and query-only records. Continue past individual EOPNOTSUPP replies, but stop on hard failures. Serialize replay and retain its result on the persistent topology graph information so reopening a runtime graph cannot accept a partially failed replay. A topology reload resets this state. This intentionally replaces the legacy global once flag with per-topology ownership and sticky errors. The nominal replay is adapted from the geocausa/SP11X1e-audio integration port. Do not restore the legacy hard-aggregate-error diagnostic probes. The state and error-handling deviations still need hardware qualification. Link: 537d1ac Link: geocausa/SP11X1e-audio@31466d6 Signed-off-by: Leon Silcott <leon@boasi.io>
After both protected modules have been successfully disabled for missing VI/CPS feedback, send the qualified gain, filter, mute and channel-mixer tail. Reuse the same sequence for the fully configured protected path. Only confirm bypass after every required transaction succeeds. A failed disable or volume-tail transaction faults the graph and prevents prepare and start from treating partial configuration as success. Leave the unavailable/uncertain guard path's disable-only behavior unchanged. The nominal sequence is adapted from the geocausa/SP11X1e-audio integration port. Preserving it does not qualify bypass acoustics or speaker safety; the guarded error behavior and complete composition remain test candidates. Link: 537d1ac Link: geocausa/SP11X1e-audio@31466d6 Signed-off-by: Leon Silcott <leon@boasi.io>
Keep Denali's macro and dcodec votes for the device lifetime and cycle only mclk, optional npl and fsgen through runtime PM, in that order on resume and in reverse on suspend. This matches its qualified integration clock ownership instead of applying the newer all-clock PM policy. Retain the PM-clock framework path for all other devices. On Denali, propagate clock-enable failures and unwind partial acquisition. Clear cache-only only once the clocks are ready; on regcache-sync failure restore cache-only/dirty and release runtime references before returning the error. That sync-error handling deliberately differs from the legacy ignored error. Register a managed release action before the component and output clock so they are torn down first. Track acquired runtime references independently of PM status and disable PM before cleanup on remove or probe failure. Keep the three-second autosuspend delay and system-sleep policy unchanged. This is a Denali qualification candidate, not proof of physical power collapse or of the speaker regression's cause. The VA fsgen dependency and real PM/CCF/DAPM behavior still need qualification. Link: 537d1ac Link: jglathe@4d49f24 Signed-off-by: Leon Silcott <leon@boasi.io>
The Denali producer repair deliberately mutates a private reg_default copy before passing it to regmap. Its argument cannot be const; the generic CONST_STRUCT heuristic is not applicable to this use. Retain the diagnostic in the log, but accept it only when the complete patch has the reviewed stable patch ID, the resulting source blob matches exactly, and this exact warning is the sole diagnostic. The blob check is necessary because patch IDs also ignore significant whitespace in string literals. Do not ignore CONST_STRUCT globally or waive other findings in the same patch. Any source change requires a renewed review. This is a source-style exception, not a hardware or provenance waiver. All qualification and contributor-attestation gates remain unchanged. Signed-off-by: Leon Silcott <leon@boasi.io>
Allocate 7.2.5-jg-0sp11v3 for the guarded audio repair series. Keep its packages and modules distinct from the failed v2 hardware candidate; the calibration state changes exported AudioReach symbol checksums. Retain the prior v2 entry and existing source DTB/non-Stubble policy. No other packaging, configuration or kernel source is changed here. Compilation and linkage checks are not audio safety or hardware parity qualification. Preserve the known-good recovery kernel and keep this test carrier out of the integration target until its gates are met. Signed-off-by: Leon Silcott <leon@boasi.io>
Restore the DAC BLOCKCTRL3 and COMP/BOOST OFFSETCTRL2 SIMPLE-port capabilities from the qualified SP11 Golden transport originating in geocausa/SP11X1e-audio and carried by the integration source below. SoundWire can then write the existing master-derived banked values. Select the capabilities only for the Denali protected-feedback wiring with a four-ohm speaker description. Copy the sink properties into managed per-instance storage and leave the shared generic table unchanged. Return allocation failure before reset deassertion and component setup. Select transport from board wiring, not the VPHX status first read after attachment. Keep the measured supply and analog protection guards, gain, source ports, master tables, PCM lifecycle and userspace unchanged. This restores nominal source behavior, not proof that retained register values caused static. Require fresh package and hardware qualification before integration; compilation and host tests do not establish safety. Link: 537d1ac Signed-off-by: Leon Silcott <leon@boasi.io>
Allocate 7.2.5-jg-0sp11v4 for the guarded render port extension repair. Keep this candidate's packages and modules separate from the v3 hardware test, which still produced audible static after volume changes. Retain both previous qualification changelog entries, the GPI ordering repair and the existing source DTB/non-Stubble packaging policy. No other source or packaging changes are made by this version-only commit. Offline tests do not establish audible parity or physical speaker safety. Preserve the known-good recovery kernel and hold integration until fresh package, cold-boot audio and broader hardware qualification are complete. Signed-off-by: Leon Silcott <leon@boasi.io>
The CSID680 RDI path enables horizontal and vertical crop/drop without programming the corresponding configuration. Leave these optional operations disabled while retaining the timestamp, packing and interrupt setup. Do not add drop-pattern writes or sensor-specific crop geometry. Adapt the enable-bit correction from Jeroen Karsies' SP11 camera bring-up snapshot b08f76f40b8d7b715bd4da6aef484f86142cc147. This guarded adaptation is based on Jeroen's original CAMSS implementation in commit ae8ce1d84841a526644991ceb9b0e98c0bab36d3. Limit the change to receiver setup. This remains experimental groundwork: stream counters, capture layout and repeated starts still need validation on the target hardware. Link: karsies-wq/sp11-imx681-linux@ae8ce1d Link: https://github.com/karsies-wq/sp11-imx681-linux/blob/b08f76f40b8d7b715bd4da6aef484f86142cc147/camss/camss-csid-680.c Link: b910f68 Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit 72184c5) (cherry picked from commit 27fe066)
Select the MIPI_RAW write-client mode used in Jeroen Karsies' SP11 camera bring-up snapshot b08f76f40b8d7b715bd4da6aef484f86142cc147. Name the mode bit and set it together with the existing write-client enable bit. Keep stride, image configuration, packing, frame increment, interrupts and stream lifecycle unchanged. This does not establish alignment padding for unaligned packed RAW widths and does not enable any sensor. This guarded adaptation is based on Jeroen's original CAMSS implementation in the first linked commit. It remains experimental until VFE680 stream status and capture layout are validated on the target hardware. Link: karsies-wq/sp11-imx681-linux@ae8ce1d Link: https://github.com/karsies-wq/sp11-imx681-linux/blob/b08f76f40b8d7b715bd4da6aef484f86142cc147/camss/camss-vfe-680.c Link: 651e711 Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit bdda2ab) (cherry picked from commit 036db4b)
Restore the CSID-specific part of the qualified camera path: detect the one-trio C-PHY RAW10 3844x2640 sink format, decode it for the receiver crop, program a 3840-pixel horizontal crop, and expose 3840 pixels on the CSID source pad. Keep the final source branch's exact 3840-or-3844 IMX681 signature helper so the standalone 3840x2640 driver can use the same guarded diagnostics. C-PHY routing itself is already carried by the preceding beta camera topic, so it is intentionally not duplicated here. This extracts the remaining receiver-crop and standalone-signature behavior from the two linked hardware-qualified source commits while preserving their author. Link: 73960c7 Link: 6621d73 Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit ed5610b) (cherry picked from commit fcf78c6)
Program period 1 and pattern 0 for the frame, pixel, and line drop engines. This preserves every RDI sample explicitly instead of relying on reset values, while the independently configured IMX681 horizontal crop remains enabled only for its exact C-PHY RAW10 geometry. Extract the CSID portion of the hardware-qualified source commit and preserve its author. Sensor, PHY, device-tree, and packaging changes from that original multi-area commit are already represented by the preceding beta camera topic. Link: 1592ec3 Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit 3760fbf) (cherry picked from commit 37a2c79)
Track the last subdevice that accepted stream start. If a later subdevice fails, stop only the subdevices that were successfully started before tearing down the media pipeline. Reuse the same helper for normal stream stop and keep teardown going after nonfatal stop errors. This preserves the CAMSS portion of the hardware-qualified source commit. Its sensor, CCS, and packaging changes are not copied because the beta already uses the validated standalone IMX681 driver and focused packaging. Link: 0097c12 Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit b8bcbfa) (cherry picked from commit 21735e3)
Sample read-only CSID680 receiver, packet, error, IRQ, crop, and linked- RDI state while its clocks are still running. Sample matching VFE680 write-master and IRQ state before disabling the writer. Keep the source branch's narrow activation signature: X1E80100, one-trio C-PHY RAW10, 3840x2640 or its 3844-pixel pre-crop form, and the exact packed VFE output geometry. Other SoCs, D-PHY routes, formats, and VFE Lite remain unchanged. This extracts the active CAMSS diagnostics from the hardware-qualified source commit and preserves its author. The old CCS sensor diagnostics are not copied: the qualified final tree replaced that unbound path with the standalone IMX681 driver. Link: 4d190bc Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit 11ae21d) (cherry picked from commit 3b0058e)
The qualified integration source applied its CSID680 keep-all state and VFE680 MIPI RAW write mode to every user of those shared blocks. Preserve the observed behavior for the X1E80100 C-PHY RAW10 IMX681 route while restoring the existing programming for all other formats and SoCs. Use the already exact transport and geometry signature for containment. For that route, keep crop/drop disabled unless the 3844-to-3840 horizontal crop is selected, explicitly program all drop engines to keep every sample, and select the MIPI RAW VFE write-client mode. Other routes retain their prior RDI flags, reset-value drop state, and VFE mode. This is an intentional guardrail relative to the qualified source, not a claim of cross-device equivalence. The SP11 path and a non-SP11 VFE680 RDI path both require hardware qualification before integration. Signed-off-by: Leon Silcott <leon@boasi.io> (cherry picked from commit f1ee66a) (cherry picked from commit 7e4c2c5)
Allocate 7.2.5-jg-0sp11v5 for the seven held camera ports replayed onto the pinned v4 audio/input reference. Keep the previous changelog entries, audio/input source, device trees and packaging flags unchanged. This is a separate experimental dependency-group carrier, not a replacement for the held camera topic or a complete integration branch. RAW layout, continuous capture, controls, LED, teardown/error recovery, resume and non-Denali qualification remain open. No build result establishes protection state or author attestation, and no installation or merge is authorized here. Signed-off-by: Leon Silcott <leon@boasi.io>
This was referenced Oct 1, 2026
Owner
Author
|
Closing this superseded review/qualification vehicle without merging. Current review work is tracked in ooaklee/linux_ms_dev_kit-sp11#56, ooaklee/linux_ms_dev_kit-sp11#68; ooaklee/linux_ms_dev_kit-sp11#68 is the single combined 7.2.5 qualification candidate. This does not discard the original feature intent or close any outstanding acceptance gate. The current combined source is This PR's branch and exact head The bounded v5 installation and ordinary camera preview/reopen/indicator trial remain recorded in this PR's description. The seven camera ports were replayed into v8 and mapped back to ooaklee/linux_ms_dev_kit-sp11#56; the separate v5 ABI/changelog and build-input history remain here, rather than being relabelled as v8 results. |
kyjus25
pushed a commit
to kyjus25/linux_ms_dev_kit-sp11
that referenced
this pull request
Oct 14, 2026
commit c9e9bb7 upstream. nvmet_pci_epf_exec_iod_work() submits an I/O command with req->execute() and then waits for the command to complete and transfers the data back to the host. This wait is not needed for commands that do not transfer data from the device to the host. To decide whether that wait is needed, it reads iod->data_len and iod->dma_dir after calling req->execute(). However, once req->execute() is called, the command may complete asynchronously on another CPU. For commands that do not require a device-to-host data transfer, nvmet_pci_epf_queue_response() calls nvmet_pci_epf_complete_iod() directly, which can free the iod before it reads iod->data_len and iod->dma_dir, resulting in the KFENCE use-after- free: BUG: KFENCE: use-after-free read in nvmet_pci_epf_exec_iod_work+0x288/0x798 [nvmet_pci_epf] Use-after-free read at 0x00000000fdfa6d03 (in kfence-ooaklee#63): nvmet_pci_epf_exec_iod_work+0x288/0x798 [nvmet_pci_epf] process_one_work+0x15c/0x4f0 worker_thread+0x18c/0x30c kthread+0x130/0x140 ret_from_fork+0x10/0x20 kfence-ooaklee#63: 0x00000000e3de0e71-0x00000000c938ad62, size=712, cache=kmalloc-1k allocated by task 10 on cpu 0 at 73.995480s (0.005122s ago): mempool_kmalloc+0x1c/0x28 mempool_alloc_noprof+0x40/0x9c nvmet_pci_epf_poll_sqs_work+0xd4/0x344 [nvmet_pci_epf] process_one_work+0x15c/0x4f0 worker_thread+0x18c/0x30c kthread+0x130/0x140 ret_from_fork+0x10/0x20 freed by task 131 on cpu 3 at 73.995521s (0.008385s ago): mempool_kfree+0x10/0x20 mempool_free+0x44/0x64 nvmet_pci_epf_free_iod+0x88/0x98 [nvmet_pci_epf] nvmet_pci_epf_cq_work+0xfc/0x280 [nvmet_pci_epf] process_one_work+0x15c/0x4f0 worker_thread+0x18c/0x30c kthread+0x130/0x140 ret_from_fork+0x10/0x20 Fix this by referring to iod->data_len and iod->dma_dir before calling req->execute(). The remaining iod accesses such as iod->status are only reached on the device-to-host read path. In this case, nvmet_pci_epf_queue_response() signals iod->done instead of freeing the iod, so the iod stays valid. Fixes: 0faa0fe ("nvmet: New NVMe PCI endpoint function target driver") Cc: stable@vger.kernel.org Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Camera dependency-group candidate — bounded v5 functional trial passed
This separate
7.2.5-jg-0sp11v5carrier starts from the tested v4 head in #55(
b9c141a6da73249aecb793b2ce1ac77645e6a00f). Its candidate head remainsbd255637156cbd9941c9dd8d0c609f0744e48de5, treed6389e6a385630271e3743ebe087bf0460c75e12. Keep this draft unmerged and do notinstall or test it unattended.
The user reports working stereo/volume/notifications, both microphones, stable
touch and pen, Wi-Fi, and basic functionality after both restart and full
shutdown/power-on on v4. The front camera also works on a video-conferencing
site on v4, with its indicator on while active and, as the user subsequently
confirmed, off after closing the site. This is a normal-close observation,
not repeated-capture or failure-path lifecycle qualification. Recording and
measured layout/quality remain unqualified. These observations do not establish
speaker-protection state, suspend/resume, or acceptance of the additional
experimental camera-topic behavior. The working front camera is not a new v5
achievement. The separate bounded v5 functional trial is recorded below; it
does not establish full camera-topic qualification.
Exact delta and preserved provenance
Relative to v4, this carrier contains precisely the seven ports from #56
(
7e4c2c58713ed112592e547facf1acb3ef555602), replayed usingcherry-pick -x,and one separate qualification changelog commit. Original authors, author
dates, messages, attribution and stable patch identities are retained; no
contributor sign-off is invented. All five final CAMSS blobs match #56.
Only these paths change relative to v4:
drivers/media/platform/qcom/camss/camss-csid-680.cdrivers/media/platform/qcom/camss/camss-csid.cdrivers/media/platform/qcom/camss/camss-csid.hdrivers/media/platform/qcom/camss/camss-vfe-680.cdrivers/media/platform/qcom/camss/camss-video.cdebian.qcom-x1e/changelogThe ports cover receiver crop, CSID680 keep-all state, VFE680 MIPI RAW mode,
start unwind, stop diagnostics and receiver-specific containment. Every other
audio, input, DT, build-flag and CI-policy blob is unchanged from v4. No battery
or power-profile topic is added. The existing v4 changelog history is unchanged.
The finished image, headers and complete module inventory independently confirm
the new ABI,
7.2.5-jg-0sp11v5-qcom-x1e.Review and source-check boundaries
This draft targets beta to expose the complete inherited composition to the
existing integration workflow. It is not a request to merge that composition.
The meaningful camera-only review range is the eight commits after pinned v4;
the beta-relative local validator covers 63 topic commits, including the
explicitly approved upstream refresh. Existing held topic heads remain intact.
Source checks include the actual exact six-path Git delta, eight synthetic
out-of-scope whitelist-predicate controls, seven original/replay metadata and
patch-identity comparisons, five final-blob comparisons, and both immediate-v4
and beta-relative validators. The synthetic path controls are not independently
committed mutation builds. Source checks are not hardware qualification.
A later checkout audit found that hosted checkpatch runs omit the tracked
spelling and const-structure tables, limiting their style coverage. Restoring
those unchanged inputs locally leaves the pinned source tree unchanged; both
the eight-commit immediate-v4 and 63-commit beta ranges pass with the complete
tables. Earlier hosted green results are not retroactively strengthened.
Independent CI-only draft #64 provisions the inputs and rejects missing tables
and diagnostic-tool failures; it has its own exact hosted proof, but is not
merged or rolled into this pinned hardware carrier.
The unchanged standalone camera head already passed a full raw ARM64
Image/modules/DTBs build. That separate result is not an installable v5 bundle
or a v5 hardware pass; it was not rebuilt merely to repeat the same result.
Finished local bundle — October 1 UTC
The single normal exact-head Lexr build completed with exit status zero at
23:33:27 UTC. Lexr
v0.5.0-rc.5, commitb74247d08f7c, used the same immutablecontainer and recipe as v4, normal source-mode packaging, and distinct work,
volume and output identities. No control output was reset or reused, and the
40 GiB admission threshold was not lowered.
The five finished packages are image, modules, architecture headers, common
headers and generic boot support. Their metadata, sizes and checksums match
the exact source revision/tree and independently recorded recipe/inventory.
The effective delivery is
external-required: zero embedded DTBs and tworequired, same-build Denali OLED/LCD DTBs. The two required DTB digests are
identical to v4's same-build outputs.
Isolated extraction-only inspection passed:
header release/config and common-header root.
modules.orderclosure and every module's v5 vermagic.the finished packaged
Module.symversis byte-identical to v4.source-rendered image post-install script and exact-ABI trigger contract.
relocated manifest/package bytes were checked again afterward.
only exact candidate versions and six exact temporary Equivs email
diagnostics. No blanket warning waiver was added.
Maintainer scripts were extracted and checked, not executed. These local
results do not establish installation, boot, camera behavior, protection,
resume, non-Denali containment or full dependency-group acceptance.
The actual packaged config differs from v4 only in the explicit
CONFIG_VERSION_SIGNATUREchange. The actual build-host inventory differsin exactly five packages:
libssl-dev:arm64,libssl3t64:arm64,openssl-provider-legacyandopensslupdate from3.5.5-1ubuntu3.6to3.5.5-1ubuntu3.7;linux-libc-dev:arm64updates from7.0.0-34.34to7.0.0-38.38. Every other installed package version matches v4. The independentlycaptured inventory matches the finished provenance fingerprint. This is not an
identical-full-inventory, byte-identical-image or signing-byte claim. Host
userspace headers do not change the target kernel version. The artifact checks
above passed under this explicit input drift; they do not prove hardware
equivalence or waive later runtime qualification.
Recorded digests:
92db6f09252d761daa6009fe4e2f0f4b7d1bb7f896aa6992076f18b82211b97a.549604a049f4359d8e4faa832704e04ed95bb2e4fb03ca6162a21660680552ee.085ca74ad2631b744516d5a51ae1c96ad8ea3a6a9d99515e7cf1209c3f8b254c.c390edbf007a8759acb82b21b674d8836b26b0a39c471af488c2f3c20b2ed6a9.Surface installation and ordinary-use trial — October 2
The explicitly authorized five-package installation completed successfully
using the existing Lexr
v0.5.0-rc.5binary, sourceb74247d08f7c. A rootGNU-screen session performed current-state preflight and package simulation,
then installation and post-install checks. The simulation and actual package
delta contain only four new exact-version kernel/header packages and the
boot-support upgrade. No package removal or userspace/topology swap occurred.
The verified v23 fallback differs from the then-running v4 kernel, so the
explicit
--forceacknowledges that mismatch; no overwrite or unverifiedpackage allowance was used. The v23 boot default/fallback and existing boot
payloads were preserved. No automatic reboot or hardware stimulus was issued.
The user subsequently reported on v5:
Cycle counts, durations and v5 warm/cold trial details were not specified.
These are ordinary-use reports on one Denali OLED unit, not measured quality,
buffer-layout, failure-injection or full stability results.
A separately authorized passive root-screen capture confirms the running v5
ABI, matching installed image/initramfs/OLED DTB hashes, ready boot doctor,
unchanged v23 default/fallback, clean package audit and unchanged boot identity
during collection. All seventeen captures returned zero and their saved
checksums were validated. The bounded snapshot shows taint zero, no deferred
probes or D-state tasks and no BUG/Oops/Call-trace/hung-task-pattern matches.
All 863 collected audio userspace path/digest pairs match v4. File identity
does not attest the loaded image, DSP topology, calibration or protection.
One camera stop snapshot records the VFE MIPI RAW enable/mode value, 4800-byte
stride and corresponding frame increment. ECC/CRC and sampled VFE violation/
overflow counters are zero. The sampled CSID horizontal-crop bit is absent;
this supports the native-3840-compatible path, not a 3844-to-3840 crop pass or
captured-buffer packing/layout proof. Pending IRQ values require separate
hardware interpretation. A single snapshot does not independently verify
every close/reopen cycle or the indicator's failure-path lifecycle.
Known APM command timeout, unsupported calibration, DSP error and GPR-port
diagnostics remain unresolved. Legacy ignored options and the CAMSS test-
generator entity warning are also present; the journal is not declared clean.
No protection, suspend/resume or non-SP11 pass is claimed.
An advisory OpenCode Zai-Codex / GLM-5.1 review concluded that ordinary camera
use plus regression smoke checks passed at their declared scope. This is not
an acceptance authority or contributor sign-off. Battery-only qualification
is the next separate track; the review does not authorize a merge or replace
the remaining camera/acceptance gates.
Qualification checklist
exact beta/candidate parents and candidate tree; all 63 topic commits
pass, with the limited hosted style coverage described above.
same-build DTBs and boot-support hook/trigger contract inspection.
ABI/installed-artifact checks, with v23 default/fallback preserved.
indicator on/off, plus brief audio/microphone/touch/pen smoke checks.
failure-path lifecycle.
Keep v23 as the recovery reference and boot default. Publishing this evidence
does not authorize further installations, camera stimulus, reboot or suspend.
Retain #56 and historical camera review #40 as separate held reviews;
working front-camera functionality on v4 is not grounds to discard their
additional behavior, nor proof that every port is necessary or qualified.