* Re: [PATCH v2] iio: dac: mcp47feb02: Fix passing uninitialized vref1_uV for no Vref1 case
From: Jonathan Cameron @ 2026-04-20 12:21 UTC (permalink / raw)
To: Ariana Lazar
Cc: David Lechner, Nuno Sá, Andy Shevchenko, Jonathan Cameron,
linux-iio, linux-kernel, Dan Carpenter
In-Reply-To: <20260420-mcp47feb02-fix4-v2-1-8b758eaa8bcf@microchip.com>
On Mon, 20 Apr 2026 11:04:12 +0300
Ariana Lazar <ariana.lazar@microchip.com> wrote:
> Ensure that if a device has Vref1 but reading the regulator returns an
> error, mcp47feb02_init_ctrl_regs() is not called with an uninitialized
> vref1_uV value.
Just to make it easier for folk to tell if this is critical or not:
Is it a real bug? See my reply (just now) to v1.
Otherwise, same thing I just raised on v1. Forgot to check if a new
version had come in today.
>
> Also add a device_property_present() check for the Vref1 supply before
> reading the regulator.
>
> Fixes: dd154646d292 ("iio: dac: mcp47feb02: Fix Vref validation [1-999] case")
> Reported-by: Dan Carpenter <error27@gmail.com>
> Closes: https://lore.kernel.org/all/adiPnla0M5EzvgD-@stanley.mountain/
> Signed-off-by: Ariana Lazar <ariana.lazar@microchip.com>
> ---
> Changes in v2:
> - return the reading regulator error to not use vref1_uV uninitialized in
> mcp47feb02_init_ctrl_regs() call
> - add device_property_present() check for the Vref1
> - Link to v1: https://lore.kernel.org/r/20260414-mcp47feb02-fix4-v1-1-9d71badfd25e@microchip.com
> ---
> drivers/iio/dac/mcp47feb02.c | 21 +++++++++++----------
> 1 file changed, 11 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/iio/dac/mcp47feb02.c b/drivers/iio/dac/mcp47feb02.c
> index faccb804a5ed548088aaf83266b16ed45a92916c..a876ed71ecdf101784e0f98668a1681a1cd19ed0 100644
> --- a/drivers/iio/dac/mcp47feb02.c
> +++ b/drivers/iio/dac/mcp47feb02.c
> @@ -1095,9 +1095,10 @@ static int mcp47feb02_probe(struct i2c_client *client)
> {
> const struct mcp47feb02_features *chip_features;
> struct device *dev = &client->dev;
> + int vdd_uV, vref_uV, vref1_uV;
> struct mcp47feb02_data *data;
> struct iio_dev *indio_dev;
> - int vref1_uV, vref_uV, vdd_uV, ret;
Solution is fine but this change seems to be unrelated noise.
> + int ret;
>
> indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
> if (!indio_dev)
> @@ -1146,16 +1147,16 @@ static int mcp47feb02_probe(struct i2c_client *client)
> dev_dbg(dev, "Vref is unavailable.\n");
> }
>
> - if (chip_features->have_ext_vref1) {
> + if (chip_features->have_ext_vref1 && device_property_present(dev, "vref1")) {
> ret = devm_regulator_get_enable_read_voltage(dev, "vref1");
> - if (ret > 0) {
> - vref1_uV = ret;
> - data->use_vref1 = true;
> - } else {
> - vref1_uV = 0;
> - dev_dbg(dev, "using internal band gap as voltage reference 1.\n");
> - dev_dbg(dev, "Vref1 is unavailable.\n");
> - }
> + if (ret < 0)
> + return ret;
> +
> + vref1_uV = ret;
> + data->use_vref1 = true;
> + } else {
> + vref1_uV = 0;
> + dev_dbg(dev, "using internal band gap as voltage reference 1.\n");
> }
>
> ret = mcp47feb02_init_ctrl_regs(data);
>
> ---
> base-commit: 51e7665ab81f02adc80a1219c260ee678e9c6eb8
> change-id: 20260414-mcp47feb02-fix4-614de9334f22
>
> Best regards,
^ permalink raw reply
* Re: [PATCH] nvme: core: reject invalid LBA data size from Identify Namespace
From: Daniel Wagner @ 2026-04-20 12:22 UTC (permalink / raw)
To: Chao Shi
Cc: Keith Busch, Jens Axboe, Christoph Hellwig, Sagi Grimberg,
Hannes Reinecke, linux-nvme, linux-kernel, Sungwoo Kim, Dave Tian,
Weidong Zhu
In-Reply-To: <20260418042835.420281-1-coshi036@gmail.com>
On Sat, Apr 18, 2026 at 12:28:34AM -0400, Chao Shi wrote:
> Fixes: 9419e71b8d67 ("nvme: move ns id info to struct nvme_ns_head")
This fixes tag is wrong. The above commit doesn't touch the code line
in question.
Probably a5b1cd61820e ("nvme: move a few things out of
nvme_update_disk_info") is the better choice here.
^ permalink raw reply
* Re: [PATCH 1/6] drm/connector: report IRQ_HPD events to drm_connector_oob_hotplug_event()
From: Dmitry Baryshkov @ 2026-04-20 12:22 UTC (permalink / raw)
To: Tomi Valkeinen
Cc: dri-devel, linux-kernel, linux-usb, intel-gfx, intel-xe,
linux-amlogic, linux-arm-kernel, linux-arm-msm, freedreno,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Heikki Krogerus, Greg Kroah-Hartman, Andrzej Hajda,
Neil Armstrong, Robert Foss, Laurent Pinchart, Jonas Karlman,
Jernej Skrabec, Adrien Grassein, Jani Nikula, Rodrigo Vivi,
Joonas Lahtinen, Tvrtko Ursulin, Kevin Hilman, Jerome Brunet,
Martin Blumenstingl, Rob Clark, Dmitry Baryshkov, Abhinav Kumar,
Jessica Zhang, Sean Paul, Marijn Suijten, Bjorn Andersson,
Konrad Dybcio, Pengyu Luo, Nikita Travkin, Yongxing Mou
In-Reply-To: <ac330f76-24dc-4f6b-aeaf-69176eb41298@ideasonboard.com>
On Mon, Apr 20, 2026 at 02:51:49PM +0300, Tomi Valkeinen wrote:
> Hi,
>
> On 20/04/2026 14:45, Dmitry Baryshkov wrote:
> > On Mon, Apr 20, 2026 at 02:01:57PM +0300, Tomi Valkeinen wrote:
> > > Hi,
> > >
> > > On 20/04/2026 12:50, Dmitry Baryshkov wrote:
> > > > On Mon, Apr 20, 2026 at 07:50:46AM +0300, Tomi Valkeinen wrote:
> > > > > Hi,
> > > > >
> > > > > On 18/04/2026 01:32, Dmitry Baryshkov wrote:
> > > > > > On Thu, Apr 16, 2026 at 11:10:03AM +0300, Tomi Valkeinen wrote:
> > > > > > > Hi,
> > > > > > >
> > > > > > > On 16/04/2026 02:22, Dmitry Baryshkov wrote:
> > > > > > > > The DisplayPort standard defines a special kind of events called IRQ.
> > > > > > > > These events are used to notify DP Source about the events on the Sink
> > > > > > > > side. It is extremely important for DP MST handling, where the MST
> > > > > > > > events are reported through this IRQ.
> > > > > > > >
> > > > > > > > In case of the USB-C DP AltMode there is no actual HPD pulse, but the
> > > > > > > > events are ported through the bits in the AltMode VDOs.
> > > > > > > >
> > > > > > > > Extend the drm_connector_oob_hotplug_event() interface and report IRQ
> > > > > > > > events to the DisplayPort Sink drivers.
> > > > > > > >
> > > > > > > > Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> > > > > > > > ---
> > > > > > > > drivers/gpu/drm/drm_connector.c | 4 +++-
> > > > > > > > drivers/usb/typec/altmodes/displayport.c | 12 ++++++++----
> > > > > > > > include/drm/drm_connector.h | 3 ++-
> > > > > > > > 3 files changed, 13 insertions(+), 6 deletions(-)
> > > > > > > >
> > > > > > > > diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
> > > > > > > > index 47dc53c4a738..5fdacbd84bd7 100644
> > > > > > > > --- a/drivers/gpu/drm/drm_connector.c
> > > > > > > > +++ b/drivers/gpu/drm/drm_connector.c
> > > > > > > > @@ -3510,6 +3510,7 @@ struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
> > > > > > > > * drm_connector_oob_hotplug_event - Report out-of-band hotplug event to connector
> > > > > > > > * @connector_fwnode: fwnode_handle to report the event on
> > > > > > > > * @status: hot plug detect logical state
> > > > > > > > + * @irq_hpd: HPD pulse detected
> > > > > > > > *
> > > > > > > > * On some hardware a hotplug event notification may come from outside the display
> > > > > > > > * driver / device. An example of this is some USB Type-C setups where the hardware
> > > > > > > > @@ -3520,7 +3521,8 @@ struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
> > > > > > > > * a drm_connector reference through calling drm_connector_find_by_fwnode().
> > > > > > > > */
> > > > > > > > void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode,
> > > > > > > > - enum drm_connector_status status)
> > > > > > > > + enum drm_connector_status status,
> > > > > > > > + bool irq_hpd)
> > > > > > > I find the "IRQ HPD" naming always confusing, even if I'm somewhat familiar
> > > > > > > with DP, but if someone has mainly worked on HDMI, I'm sure it's even worse.
> > > > > > >
> > > > > > > Can we define this a bit more precisely? Is 'irq_hpd' only for displayport?
> > > > > > > If so, perhaps 'dp_irq_hpd' or 'displayport_irq_hpd'. I might even call it
> > > > > > > 'dp_hpd_pulse', but maybe that's not good as the spec talks about HPD pulse
> > > > > > > for both short and long ones (although in the kernel doc you just write "HPD
> > > > > > > pulse")... The kernel doc could be expanded a bit to make it clear what this
> > > > > > > flag indicates.
> > > > > >
> > > > > > I attempted to stay away from defining a DP-specific flag, keeping it
> > > > > > generic enough. HDMI is pretty close (IMO) to requiring separate flag in
> > > > >
> > > > > If it's not specifically the DP IRQ HPD, then we need to define what it
> > > > > means. I tried to think what it would mean with HDMI, but I didn't come up
> > > > > with anything.
> > > >
> > > > I might be mistaken, but I had someting like HEAC HPD / EDID status
> > > > changes in mind (or HDCP-triggered HPD status changes). But here I
> > > > admit, I hadn't checked if it is actually applicable or not.
> > >
> > > Possibly, I'm not familiar with those.
> > >
> > > > Anyway, for e.g. DVI or VGA that means nothing. But, my point really is
> > > > to abstain from defining someting as DP-only in the top-level API.
> > >
> > > I'm fine with that, but then it really has to be defined =).
> > >
> > > > > > Linux. Likewise I'd rather not use "pulse". The DP AltMode defines a bit
> > > > > > in the VDO rather than a pulse.
> > > > > >
> > > > > > Anyway, if irq_hpd doesn't sound precise enough, what about "bool
> > > > > > extra_irq"? This would convey that this is the extra hpd-related IRQ,
> > > > > > but it would also be obvious that it's not related to the HPD pin
> > > > > > itself.
> > > > > We'd still need to define what exactly it means. I think it might be better
> > > > > to just define it as the DP IRQ HPD, as then the meaning is clear.
> > > > >
> > > > > Also, would an enum flags parameter be better than a bool parameter?
> > > >
> > > > Maybe not enum, but u32 param. Then it can become:
> > > >
> > > > @extra_status: additional type-specific information provided by the sink
> > > > without changing the HPD state
> > > >
> > > > void drm_connector_oob_hotplug_event(..., u32 extra_status);
> > > >
> > > > /* DP short HPD pulse or corresponding AltMode flag */
> > > > #define DRM_CONNECTOR_OOB_DP_IRQ_HPD BIT(0)
> > > > /* DP long HPD pulse, debounced XXX: do we need this? */
> > > > #define DRM_CONNECTOR_OOB_DP_REPLUG BIT(1)
> > >
> > > Why is u32 better than enum? So that we could e.g. pass short values inside
> > > the extra_status?
> >
> > No, my thought was to be able to define values specific to the
> > particular connector types and to be able to combine those values.
> >
> > After sending the email I started thinking about the bridged and
> > corresponding notifications. There having overlapping values will not
> > work becasue bridges in the chanin don't easily know the final connector
> > type.
>
> An enum can have overlapping values. I don't think there's much difference
> between u32 and an enum in C. I just like enum because 1) it groups the
> possible values in the header file, and 2) the function parameters can use
> the enum type, making it obvious what flags you are supposed to use there.
>
> > I think you are correct here, it should be the enum. With the first
> > iteration defined as:
> >
> > /**
> > * enum drm_connector_status_extra - additional events sent by the sink
> > * together or in replacement of the HPD status changes
> > /
> > enum drm_connector_status_extra {
> > /**
> > * @DRM_CONNECTOR_DP_IRQ_HPD: DisplayPort Sink has sent the
> > * IRQ_HPD (either by the HPD short pulse or via the AltMode event).
> > */
> > DRM_CONNECTOR_DP_IRQ_HPD = BIT(0),
> > };
> >
> > /**
> > * @extra_status: additional information provided by the sink without
> > * changing the HPD state (or in addition to such a change). It is an
> > * OR of the values defined in the drm_connector_status_extra enum.
> > */
> > void drm_connector_oob_hotplug_event(..., u32 extra_status);
>
> Looks good to me, except I'd use "enum drm_connector_status_extra" instead
> of u32 there in the function parameters.
I had bad feelings about passing OR or enum values as an enum value.
But then... I don't see values to OR. All expected events come one by
one. Let's drop that part too. Thanks for your comments!
>
> Tomi
>
>
> _______________________________________________
> linux-amlogic mailing list
> linux-amlogic@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-amlogic
--
With best wishes
Dmitry
^ permalink raw reply
* Re: [PATCH] dt-bindings: iio: dac: mcp47feb02: Fix I2C address in example
From: Jonathan Cameron @ 2026-04-20 12:22 UTC (permalink / raw)
To: Ariana Lazar
Cc: David Lechner, Nuno Sá, Andy Shevchenko, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Conor Dooley, Jonathan Cameron,
linux-iio, devicetree, linux-kernel
In-Reply-To: <20260420-mcp47feb02-fix6-v1-1-ae1808fea11d@microchip.com>
On Mon, 20 Apr 2026 13:36:02 +0300
Ariana Lazar <ariana.lazar@microchip.com> wrote:
> Change example reg value from 0 to 0x60 in order to use a valid I2C address
>
> Fixes: 4ba12d304175 ("dt-bindings: iio: dac: adding support for Microchip MCP47FEB02")
> Link: https://lore.kernel.org/all/dd0dbadb-604b-4f12-8674-268b7db096fd@baylibre.com/
> Signed-off-by: Ariana Lazar <ariana.lazar@microchip.com>
> ---
> .../bindings/iio/dac/microchip,mcp47feb02.yaml | 32 +++++++++++-----------
> 1 file changed, 16 insertions(+), 16 deletions(-)
>
> diff --git a/Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml b/Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml
> index d2466aa6bda2106a8b695347a0edf38462294d03..95ddc8321eff34ed27dab8ce712210d2cb9ae785 100644
> --- a/Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml
> +++ b/Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml
> @@ -280,23 +280,23 @@ examples:
>
> #address-cells = <1>;
> #size-cells = <0>;
> - dac@0 {
> - compatible = "microchip,mcp47feb02";
> - reg = <0>;
> - vdd-supply = <&vdac_vdd>;
> - vref-supply = <&vref_reg>;
> + dac@60 {
> + compatible = "microchip,mcp47feb02";
Why is this indent changing?
> + reg = <0x60>;
> + vdd-supply = <&vdac_vdd>;
> + vref-supply = <&vref_reg>;
>
> - #address-cells = <1>;
> - #size-cells = <0>;
> - channel@0 {
> - reg = <0>;
> - label = "Adjustable_voltage_ch0";
> - };
> + #address-cells = <1>;
> + #size-cells = <0>;
> + channel@0 {
> + reg = <0>;
> + label = "Adjustable_voltage_ch0";
> + };
>
> - channel@1 {
> - reg = <0x1>;
> - label = "Adjustable_voltage_ch1";
> - };
> - };
> + channel@1 {
> + reg = <0x1>;
> + label = "Adjustable_voltage_ch1";
> + };
> + };
> };
> ...
>
> ---
> base-commit: d2a4ec19d2a2e54c23b5180e939994d3da4a6b91
> change-id: 20260417-mcp47feb02-fix6-bd6694d84750
>
> Best regards,
^ permalink raw reply
* [PATCH v2 5/5] scsi: scsi_devinfo: add COMPAQ PD-1 multi-LUN ATAPI device quirk
From: Phil Pemberton @ 2026-04-20 12:23 UTC (permalink / raw)
To: Damien Le Moal, Niklas Cassel
Cc: James E . J . Bottomley, Martin K . Petersen, Hannes Reinecke,
linux-ide, linux-scsi, linux-kernel, Phil Pemberton
In-Reply-To: <20260420122321.4161027-1-philpem@philpem.me.uk>
The COMPAQ PD-1 (OEM Panasonic/Matsushita LF-1195C) is a PD/CD combo
drive that exposes two ATAPI LUNs: LUN 0 is a CD-ROM (TYPE_ROM),
LUN 1 is a 650 MB PD (TYPE_DISK).
Add it to the SCSI device list with:
- BLIST_FORCELUN: tells the SCSI layer to scan past LUN 0
- BLIST_SINGLELUN: serialises commands across the two LUNs, since
the drive has a single transport and cannot handle concurrent
operations on both
The INQUIRY strings as reported by the device are:
Vendor: "COMPAQ " (T10 format, space-padded)
Product: "PD-1"
Signed-off-by: Phil Pemberton <philpem@philpem.me.uk>
---
drivers/scsi/scsi_devinfo.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 68a992494b12..06b211b93567 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -150,6 +150,7 @@ static struct {
{"COMPAQ", "MSA1000", NULL, BLIST_SPARSELUN | BLIST_NOSTARTONADD},
{"COMPAQ", "MSA1000 VOLUME", NULL, BLIST_SPARSELUN | BLIST_NOSTARTONADD},
{"COMPAQ", "HSV110", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD},
+ {"COMPAQ", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
{"DDN", "SAN DataDirector", "*", BLIST_SPARSELUN},
{"DEC", "HSG80", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD},
{"DELL", "PV660F", NULL, BLIST_SPARSELUN},
--
2.43.0
^ permalink raw reply related
* [GIT PULL] printk for 7.1
From: Petr Mladek @ 2026-04-20 12:23 UTC (permalink / raw)
To: Linus Torvalds
Cc: Sergey Senozhatsky, Steven Rostedt, John Ogness, Andy Shevchenko,
Rasmus Villemoes, Peter Zijlstra, Petr Mladek, linux-kernel
Hi Linus,
please pull the latest printk changes from
git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux.git tags/printk-for-7.1
=======================================
- Fix printk ring buffer initialization and sanity checks.
- Workaround printf kunit test compilation with gcc < 12.1.
- Add IPv6 address printf format tests.
- Misc code and documentation cleanup.
----------------------------------------------------------------
Geert Uytterhoeven (1):
lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
John Ogness (2):
printk_ringbuffer: Fix get_data() size sanity check
printk_ringbuffer: Add sanity check for 0-size data
Loïc Grégoire (1):
printk: ringbuffer: fix errors in comments
Petr Mladek (3):
printf: Compile the kunit test with DISABLE_BRANCH_PROFILING DISABLE_BRANCH_PROFILING
Merge branch 'for-7.1-printf-kunit-build' into for-linus
Merge branch 'rework/prb-fixes' into for-linus
Shuvam Pandey (1):
printf: add IPv6 address format tests
Thorsten Blum (1):
lib/vsprintf: use bool for local decode variable
feng.zhou (1):
printk: Fix _DESCS_COUNT type for 64-bit systems
include/linux/printk.h | 5 +++--
kernel/printk/printk_ringbuffer.c | 27 +++++++++++++++------------
kernel/printk/printk_ringbuffer.h | 4 ++--
lib/tests/Makefile | 2 ++
lib/tests/printf_kunit.c | 22 ++++++++++++++++++++++
lib/vsprintf.c | 4 ++--
6 files changed, 46 insertions(+), 18 deletions(-)
^ permalink raw reply
* [PATCH] drm/appletbdrm: Use kvzalloc for big allocations
From: Sasha Finkelstein @ 2026-04-20 12:17 UTC (permalink / raw)
To: Aun-Ali Zaidi, Aditya Garg, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter
Cc: dri-devel, linux-kernel, soopyc, Sasha Finkelstein
This driver is attached to a ~2000x80 screen, which is a lot more than
a single page. This causes out of memory errors in some rare cases.
Reported-by: soopyc <cassie@soopy.moe>
Closes: https://github.com/t2linux/fedora/issues/51
Signed-off-by: Sasha Finkelstein <k@chaosmail.tech>
---
drivers/gpu/drm/tiny/appletbdrm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/tiny/appletbdrm.c b/drivers/gpu/drm/tiny/appletbdrm.c
index 3bae91d7eefe..278bb23fe4c8 100644
--- a/drivers/gpu/drm/tiny/appletbdrm.c
+++ b/drivers/gpu/drm/tiny/appletbdrm.c
@@ -353,7 +353,7 @@ static int appletbdrm_primary_plane_helper_atomic_check(struct drm_plane *plane,
frames_size +
sizeof(struct appletbdrm_fb_request_footer), 16);
- appletbdrm_state->request = kzalloc(request_size, GFP_KERNEL);
+ appletbdrm_state->request = kvzalloc(request_size, GFP_KERNEL);
if (!appletbdrm_state->request)
return -ENOMEM;
@@ -543,7 +543,7 @@ static void appletbdrm_primary_plane_destroy_state(struct drm_plane *plane,
{
struct appletbdrm_plane_state *appletbdrm_state = to_appletbdrm_plane_state(state);
- kfree(appletbdrm_state->request);
+ kvfree(appletbdrm_state->request);
kfree(appletbdrm_state->response);
__drm_gem_destroy_shadow_plane_state(&appletbdrm_state->base);
---
base-commit: c1f49dea2b8f335813d3b348fd39117fb8efb428
change-id: 20260420-x86-tb-vmalloc-4c94d5eaeeae
Best regards,
--
Sasha Finkelstein <k@chaosmail.tech>
^ permalink raw reply related
* Re: [PATCH v3 2/3] remoteproc: imx_rproc: Program non-zero SM CPU/LMM reset vector
From: Daniel Baluta @ 2026-04-20 12:28 UTC (permalink / raw)
To: Peng Fan (OSS)
Cc: Bjorn Andersson, Mathieu Poirier, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Frank Li, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Daniel Baluta,
linux-remoteproc, devicetree, imx, linux-arm-kernel, linux-kernel,
Peng Fan
In-Reply-To: <20260415-imx943-rproc-v3-2-9fa7528db8ca@nxp.com>
On Wed, Apr 15, 2026 at 10:49 AM Peng Fan (OSS) <peng.fan@oss.nxp.com> wrote:
>
> From: Peng Fan <peng.fan@nxp.com>
>
> Cortex-M[7,33] processors use a fixed reset vector table format:
>
> 0x00 Initial SP value
> 0x04 Reset vector
> 0x08 NMI
> 0x0C ...
> ...
> IRQ[n]
>
> In ELF images, the corresponding layout is:
>
> reset_vectors: --> hardware reset address
> .word __stack_end__
> .word Reset_Handler
> .word NMI_Handler
> .word HardFault_Handler
> ...
> .word UART_IRQHandler
> .word SPI_IRQHandler
> ...
>
> Reset_Handler: --> ELF entry point address
> ...
>
> The hardware fetches the first two words from reset_vectors and populates
> SP with __stack_end__ and PC with Reset_Handler. Execution proceeds from
> Reset_Handler.
>
> However, the ELF entry point does not always match the hardware reset
> address. For example, on i.MX94 CM33S:
>
> ELF entry point: 0x0ffc211d
> hardware reset base: 0x0ffc0000 (default reset value, sw programmable)
>
> Current driver always programs the reset vector as 0. But i.MX94 CM33S's
> default reset base is 0x0ffc0000, so the correct reset vector must be
> passed to the SM API; otherwise the M33 Sync core cannot boot successfully.
>
> rproc_elf_get_boot_addr() returns the ELF entry point, which is not the
> hardware reset vector address. Fix the issue by deriving the hardware reset
> vector locally using a SoC-specific mask:
>
> reset_vector = rproc->bootaddr & reset_vector_mask
>
> The ELF entry point semantics remain unchanged. The masking is applied only
> at the point where the SM reset vector is programmed.
>
> Add reset_vector_mask = GENMASK_U32(31, 16) to the i.MX95 M7 configuration
> so the hardware reset vector is derived correctly. Without this mask, the
> SM reset vector would be programmed with an unaligned ELF entry point and
> the M7 core would fail to boot.
>
> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
^ permalink raw reply
* Re: [PATCH v8 3/6] liveupdate: add LUO_SESSION_MAGIC magic inode type
From: Christian Brauner @ 2026-04-20 12:26 UTC (permalink / raw)
To: luca.boccassi
Cc: kexec, linux-mm, graf, rppt, pasha.tatashin, pratyush,
linux-kernel
In-Reply-To: <20260418163358.2304490-4-luca.boccassi@gmail.com>
On Sat, Apr 18, 2026 at 05:28:20PM +0100, luca.boccassi@gmail.com wrote:
> From: Luca Boccassi <luca.boccassi@gmail.com>
>
> In userspace when managing LUO sessions we want to be able to identify
> a FD as a LUO session, in order to be able to do the special handling
> that they require in order to function as intended on kexec.
>
> Currently this requires scraping procfs and doing string matching on
> the prefix of the dname, which is not an ideal interface.
>
> Add a singleton inode type with a magic value, so that we can
> programmatically identify a fd as a LUO session via fstatfs().
>
> Signed-off-by: Luca Boccassi <luca.boccassi@gmail.com>
> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> ---
> include/uapi/linux/magic.h | 1 +
> kernel/liveupdate/luo_core.c | 10 +++-
> kernel/liveupdate/luo_internal.h | 2 +
> kernel/liveupdate/luo_session.c | 89 ++++++++++++++++++++++++++++++--
> 4 files changed, 96 insertions(+), 6 deletions(-)
>
> diff --git a/include/uapi/linux/magic.h b/include/uapi/linux/magic.h
> index 4f2da935a76c..4f51005522ff 100644
> --- a/include/uapi/linux/magic.h
> +++ b/include/uapi/linux/magic.h
> @@ -105,5 +105,6 @@
> #define PID_FS_MAGIC 0x50494446 /* "PIDF" */
> #define GUEST_MEMFD_MAGIC 0x474d454d /* "GMEM" */
> #define NULL_FS_MAGIC 0x4E554C4C /* "NULL" */
> +#define LUO_SESSION_MAGIC 0x4c554f53 /* "LUOS" */
>
> #endif /* __LINUX_MAGIC_H__ */
> diff --git a/kernel/liveupdate/luo_core.c b/kernel/liveupdate/luo_core.c
> index dda7bb57d421..f1a63ebe4fa4 100644
> --- a/kernel/liveupdate/luo_core.c
> +++ b/kernel/liveupdate/luo_core.c
> @@ -197,9 +197,17 @@ static int __init luo_late_startup(void)
> if (!liveupdate_enabled())
> return 0;
>
> + err = luo_session_fs_init();
> + if (err) {
> + luo_global.enabled = false;
> + return err;
> + }
> +
> err = luo_fdt_setup();
> - if (err)
> + if (err) {
> + luo_session_fs_cleanup();
> luo_global.enabled = false;
> + }
>
> return err;
> }
> diff --git a/kernel/liveupdate/luo_internal.h b/kernel/liveupdate/luo_internal.h
> index 8083d8739b09..d4ac7b4c5882 100644
> --- a/kernel/liveupdate/luo_internal.h
> +++ b/kernel/liveupdate/luo_internal.h
> @@ -79,6 +79,8 @@ struct luo_session {
>
> int luo_session_create(const char *name, struct file **filep);
> int luo_session_retrieve(const char *name, struct file **filep);
> +int __init luo_session_fs_init(void);
> +void __init luo_session_fs_cleanup(void);
> int __init luo_session_setup_outgoing(void *fdt);
> int __init luo_session_setup_incoming(void *fdt);
> int luo_session_serialize(void);
> diff --git a/kernel/liveupdate/luo_session.c b/kernel/liveupdate/luo_session.c
> index 5e316a4c5d71..21cbe99fc819 100644
> --- a/kernel/liveupdate/luo_session.c
> +++ b/kernel/liveupdate/luo_session.c
> @@ -50,7 +50,6 @@
>
> #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
>
> -#include <linux/anon_inodes.h>
> #include <linux/cleanup.h>
> #include <linux/err.h>
> #include <linux/errno.h>
> @@ -62,7 +61,10 @@
> #include <linux/libfdt.h>
> #include <linux/list.h>
> #include <linux/liveupdate.h>
> +#include <linux/magic.h>
> +#include <linux/mount.h>
> #include <linux/mutex.h>
> +#include <linux/pseudo_fs.h>
> #include <linux/rwsem.h>
> #include <linux/slab.h>
> #include <linux/unaligned.h>
> @@ -363,18 +365,73 @@ static const struct file_operations luo_session_fops = {
> .unlocked_ioctl = luo_session_ioctl,
> };
>
> +static struct vfsmount *luo_session_mnt __ro_after_init;
> +static struct inode *luo_session_inode __ro_after_init;
> +
> +/*
> + * Reject all attribute changes on the singleton session inode.
> + * Without this the VFS falls back to simple_setattr(), allowing
> + * fchmod()/fchown() to modify the shared inode.
> + */
> +static int luo_session_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
> + struct iattr *attr)
Don't duplicate, please. Use the generic helper instead:
int anon_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
struct iattr *attr)
> +{
> + return -EOPNOTSUPP;
> +}
> +
> +static const struct inode_operations luo_session_inode_operations = {
> + .setattr = luo_session_setattr,
> +};
> +
> +static char *luo_session_dname(struct dentry *dentry, char *buffer, int buflen)
> +{
> + return dynamic_dname(buffer, buflen, "luo_session:%s",
> + dentry->d_name.name);
Use the luo_session:[%s] which is the canonical format for this
(ignoring historcal abberations).
> +}
> +
> +static const struct dentry_operations luo_session_dentry_operations = {
> + .d_dname = luo_session_dname,
> +};
> +
> +static int luo_session_init_fs_context(struct fs_context *fc)
> +{
> + struct pseudo_fs_context *ctx;
> +
> + ctx = init_pseudo(fc, LUO_SESSION_MAGIC);
I'd just call that LUO_FS_MAGIC.
> + if (!ctx)
> + return -ENOMEM;
> +
> + fc->s_iflags |= SB_I_NOEXEC;
> + fc->s_iflags |= SB_I_NODEV;
ctx->s_d_flags |= DCACHE_DONTCACHE;
static const struct super_operations luo_session_sops = {
.drop_inode = inode_just_drop,
.statfs = simple_statfs,
};
> + ctx->dops = &luo_session_dentry_operations;
ctx->ops = &luo_session_sops;
> + return 0;
> +}
> +
> +static struct file_system_type luo_session_fs_type = {
> + .name = "luo_session",
> + .init_fs_context = luo_session_init_fs_context,
> + .kill_sb = kill_anon_super,
> +};
> +
> /* Create a "struct file" for session */
> static int luo_session_getfile(struct luo_session *session, struct file **filep)
Luo is going full anti-pattern here. This whole return via a function
argument completely messes up the later codepths. We don't do manual
get_unused_fd_flags() flags and then file in new code, and then fail
in-between:
argp->fd = get_unused_fd_flags(O_CLOEXEC);
if (argp->fd < 0)
return argp->fd;
err = luo_session_create(argp->name, &file);
if (err)
goto err_put_fd;
err = luo_ucmd_respond(ucmd, sizeof(*argp));
if (err)
goto err_put_file;
fd_install(argp->fd, file);
Restructure the code so it just becomes:
struct file *luo_session_create(argp->name);
static int luo_ioctl_create_session(struct luo_ucmd *ucmd)
{
struct liveupdate_ioctl_create_session *argp = ucmd->cmd;
return FD_ADD(O_CLOEXEC, luo_session_create(argp->name));
}
and get rid of all this state and error handling. Please fix this.
> {
> - char name_buf[128];
> + char name_buf[LIVEUPDATE_SESSION_NAME_LENGTH + 1];
> struct file *file;
>
> lockdep_assert_held(&session->mutex);
> - snprintf(name_buf, sizeof(name_buf), "[luo_session] %s", session->name);
> - file = anon_inode_getfile(name_buf, &luo_session_fops, session, O_RDWR);
> - if (IS_ERR(file))
> +
> + ihold(luo_session_inode);
Right, you're now sharing the same inode among all luo sessions. So
you've gained the ability to recognize luo inodes via fstatfs() but you
still can't compare two luo session file descriptors for equality using
stat() which is a major win and if you're doing this work anyway, let's
just go the extra step. You can mostly mirror pidfs and it's not
difficult:
// unique inode numbers for the lifetime of the system instead of using
// the shared ino allocator that can overflow
DEFINE_COOKIE(luo_session_cookie);
static u64 luo_alloc_ino(void)
{
u64 ino;
preempt_disable();
ino = gen_cookie_next(&luo_ino_cookie);
preempt_enable();
VFS_WARN_ON_ONCE(ino < 1);
return ino;
}
static struct inode *luo_new_inode()
{
inode = new_inode_pseudo(sb);
inode->i_flags |= S_IMMUTABLE;
inode->i_mode |= S_IRWXU;
inode->i_flags |= S_PRIVATE | S_ANON_INODE;
simple_inode_init_ts(inode);
inode->i_op = &luo_session_inode_operations;
// Make sure to leave inode->i_fop unset so it luo fds cannot be reopened via procfs
// Unique 64-bit inode. On 32-bit this will obviously be
// truncated but a) LUO doesn't support 32-bit b) let's declare
// anyone that wants LUO on 32-bit insane c) who uses more than
// 32-bit worth of luo sessions d) if that's really something
// you want to address you can do so later doing the same thing
// I did for pidfs (see there for context).
inode->i_ino = luo_alloc_ino();
inode->i_generation = pidfs_gen(pid->ino);
simple_inode_init_ts(inode);
return inode;
}
Now you can do
stat(fd_luo1, &st1);
stat(fd_luo2, &st2);
if (st1.st_dev == st2.st_dev && st1.st_ino == st2.st_ino)
return true; // same luo session
Sooner or later you will want this. Let's do it correctly, right now.
A bigger design question for the LUO people:
How do the lifetimes of the luo session and the luo fd relate to each
other? The way the code is structured it looks like the luo session
thing that you currently store in the file:
file->private_data = session;
outlives the file? Why?
Imho, two things should change in addition to the switch to the tiny fs:
(1) The lifetime of the luo session object should be tied to the
lifetime of the session file descriptor so that when the last file
descriptor for that luo session is closed the @session thing gets
cleaned up. I assume that's the case anyway?
(2) Instead of stashing the session in file->private_data store it in
inode->private_data. This has various advantages:
* You can stash other information in file->private_data.
* You can at some point have multiple files referring to the same
inode/luo session.
> +
> + snprintf(name_buf, sizeof(name_buf), "%s", session->name);
> + file = alloc_file_pseudo(luo_session_inode, luo_session_mnt, name_buf,
> + O_RDWR, &luo_session_fops);
> + if (IS_ERR(file)) {
> + iput(luo_session_inode);
> return PTR_ERR(file);
> + }
>
> + file->private_data = session;
> *filep = file;
>
> return 0;
> @@ -653,3 +710,25 @@ void luo_session_resume(void)
> up_write(&luo_session_global.outgoing.rwsem);
> up_write(&luo_session_global.incoming.rwsem);
> }
> +
> +int __init luo_session_fs_init(void)
> +{
> + luo_session_mnt = kern_mount(&luo_session_fs_type);
> + if (IS_ERR(luo_session_mnt))
panic()
> + return PTR_ERR(luo_session_mnt);
> +
> + luo_session_inode = alloc_anon_inode(luo_session_mnt->mnt_sb);
> + if (IS_ERR(luo_session_inode)) {
> + kern_unmount(luo_session_mnt);
> + return PTR_ERR(luo_session_inode);
> + }
> + luo_session_inode->i_op = &luo_session_inode_operations;
Kill all of this now that you allocate inodes on-demand.
> +
> + return 0;
> +}
> +
> +void __init luo_session_fs_cleanup(void)
> +{
> + iput(luo_session_inode);
> + kern_unmount(luo_session_mnt);
> +}
> --
> 2.47.3
>
^ permalink raw reply
* Re: [PATCH v3] iio: adc: npcm: fix unbalanced clk_disable_unprepare()
From: Jonathan Cameron @ 2026-04-20 12:28 UTC (permalink / raw)
To: David Carlier
Cc: tmaimon77, avifishman70, tali.perry1, andrew, venture, yuenn,
benjaminfair, dlechner, nuno.sa, andy, andriy.shevchenko, openbmc,
linux-iio, linux-kernel
In-Reply-To: <20260414123006.262152-1-devnexen@gmail.com>
On Tue, 14 Apr 2026 13:30:06 +0100
David Carlier <devnexen@gmail.com> wrote:
> The driver acquired the ADC clock with devm_clk_get() and read its
> rate, but never called clk_prepare_enable(). The probe error path and
> npcm_adc_remove() both called clk_disable_unprepare() unconditionally,
> causing the clk framework's enable/prepare counts to underflow on
> probe failure or module unbind.
>
> The issue went unnoticed because NPCM BMC firmware leaves the ADC
> clock enabled at boot, so the driver happened to work in practice.
>
> Switch to devm_clk_get_enabled() so the clock is properly enabled
> during probe and automatically released by the device-managed
> cleanup, and drop the now-redundant clk_disable_unprepare() from
> both the probe error path and remove().
>
> While at it, drop the duplicate error message on devm_request_irq()
> failure since the IRQ core already logs it.
>
> Fixes: 9bf85fbc9d8f ("iio: adc: add NPCM ADC driver")
> Signed-off-by: David Carlier <devnexen@gmail.com>
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Applied to the fixes-togreg branch of iio.git. Note I'll rebase that on rc1
once available, before sending a pull request.
Thanks,
Jonathan
> ---
> v3: mention the dev_err drop in the commit log and collapse the
> single-statement -ENODEV branch (Andy Shevchenko).
> v2: drop redundant dev_err() on devm_request_irq() failure since the
> IRQ core already logs it, and remove the now-single-statement
> braces (Andy Shevchenko).
>
> drivers/iio/adc/npcm_adc.c | 25 ++++++++-----------------
> 1 file changed, 8 insertions(+), 17 deletions(-)
>
> diff --git a/drivers/iio/adc/npcm_adc.c b/drivers/iio/adc/npcm_adc.c
> index ddabb9600d46..61c8b825bda1 100644
> --- a/drivers/iio/adc/npcm_adc.c
> +++ b/drivers/iio/adc/npcm_adc.c
> @@ -231,7 +231,7 @@ static int npcm_adc_probe(struct platform_device *pdev)
> if (IS_ERR(info->reset))
> return PTR_ERR(info->reset);
>
> - info->adc_clk = devm_clk_get(&pdev->dev, NULL);
> + info->adc_clk = devm_clk_get_enabled(&pdev->dev, NULL);
> if (IS_ERR(info->adc_clk)) {
> dev_warn(&pdev->dev, "ADC clock failed: can't read clk\n");
> return PTR_ERR(info->adc_clk);
> @@ -244,17 +244,13 @@ static int npcm_adc_probe(struct platform_device *pdev)
> info->adc_sample_hz = clk_get_rate(info->adc_clk) / ((div + 1) * 2);
>
> irq = platform_get_irq(pdev, 0);
> - if (irq < 0) {
> - ret = irq;
> - goto err_disable_clk;
> - }
> + if (irq < 0)
> + return irq;
>
> ret = devm_request_irq(&pdev->dev, irq, npcm_adc_isr, 0,
> "NPCM_ADC", indio_dev);
> - if (ret < 0) {
> - dev_err(dev, "failed requesting interrupt\n");
> - goto err_disable_clk;
> - }
> + if (ret < 0)
> + return ret;
>
> reg_con = ioread32(info->regs + NPCM_ADCCON);
> info->vref = devm_regulator_get_optional(&pdev->dev, "vref");
> @@ -262,7 +258,7 @@ static int npcm_adc_probe(struct platform_device *pdev)
> ret = regulator_enable(info->vref);
> if (ret) {
> dev_err(&pdev->dev, "Can't enable ADC reference voltage\n");
> - goto err_disable_clk;
> + return ret;
> }
>
> iowrite32(reg_con & ~NPCM_ADCCON_REFSEL,
> @@ -272,10 +268,8 @@ static int npcm_adc_probe(struct platform_device *pdev)
> * Any error which is not ENODEV indicates the regulator
> * has been specified and so is a failure case.
> */
> - if (PTR_ERR(info->vref) != -ENODEV) {
> - ret = PTR_ERR(info->vref);
> - goto err_disable_clk;
> - }
> + if (PTR_ERR(info->vref) != -ENODEV)
> + return PTR_ERR(info->vref);
>
> /* Use internal reference */
> iowrite32(reg_con | NPCM_ADCCON_REFSEL,
> @@ -314,8 +308,6 @@ static int npcm_adc_probe(struct platform_device *pdev)
> iowrite32(reg_con & ~NPCM_ADCCON_ADC_EN, info->regs + NPCM_ADCCON);
> if (!IS_ERR(info->vref))
> regulator_disable(info->vref);
> -err_disable_clk:
> - clk_disable_unprepare(info->adc_clk);
>
> return ret;
> }
> @@ -332,7 +324,6 @@ static void npcm_adc_remove(struct platform_device *pdev)
> iowrite32(regtemp & ~NPCM_ADCCON_ADC_EN, info->regs + NPCM_ADCCON);
> if (!IS_ERR(info->vref))
> regulator_disable(info->vref);
> - clk_disable_unprepare(info->adc_clk);
> }
>
> static struct platform_driver npcm_adc_driver = {
^ permalink raw reply
* Re: [PATCH] nvme: core: reject invalid LBA data size from Identify Namespace
From: Maurizio Lombardi @ 2026-04-20 12:22 UTC (permalink / raw)
To: Chao Shi, Keith Busch, Jens Axboe, Christoph Hellwig,
Sagi Grimberg, Daniel Wagner, Hannes Reinecke, linux-nvme,
linux-kernel
Cc: Sungwoo Kim, Dave Tian, Weidong Zhu
In-Reply-To: <20260418042835.420281-1-coshi036@gmail.com>
On Sat Apr 18, 2026 at 6:28 AM CEST, Chao Shi wrote:
> nvme_update_ns_info_block() trusts id->lbaf[lbaf].ds from the
> controller and assigns it directly to ns->head->lba_shift without
> bounds checking. nvme_lba_to_sect() then does:
>
> return lba << (head->lba_shift - SECTOR_SHIFT);
>
> When called with lba = le64_to_cpu(id->nsze) to compute the device
> capacity, an attacker-controlled controller can choose ds < 9 or a
> combination of (ds, nsze) that makes the left shift overflow
> sector_t. The former is a C undefined behaviour that UBSAN reports
> as a BUG; the latter silently yields a bogus capacity that the
> block layer then trusts for bounds checking.
>
> Validate ds against SECTOR_SHIFT and use check_shl_overflow() to
> compute capacity so that any (ds, nsze) combination that would
> overflow sector_t is rejected. The namespace is skipped with -EIO
> instead of crashing the kernel. This is reachable by a malicious
> NVMe device, a buggy firmware, or an attacker-controlled NVMe-oF
> target.
>
> Stack trace (UBSAN, ds < 9 variant):
>
> RIP: nvme_lba_to_sect drivers/nvme/host/nvme.h:699 [inline]
> RIP: nvme_update_ns_info_block.cold+0x5/0x7
> Call Trace:
> nvme_update_ns_info+0x175/0xd90 drivers/nvme/host/core.c:2467
> nvme_validate_ns drivers/nvme/host/core.c:4299 [inline]
> nvme_scan_ns drivers/nvme/host/core.c:4350
> nvme_scan_ns_async+0xa5/0xe0 drivers/nvme/host/core.c:4383
> async_run_entry_fn
> process_one_work
> worker_thread
> kthread
>
> Found by Syzkaller.
>
> Fixes: 9419e71b8d67 ("nvme: move ns id info to struct nvme_ns_head")
> Acked-by: Sungwoo Kim <iam@sung-woo.kim>
> Acked-by: Dave Tian <daveti@purdue.edu>
> Acked-by: Weidong Zhu <weizhu@fiu.edu>
> Signed-off-by: Chao Shi <coshi036@gmail.com>
> ---
> drivers/nvme/host/core.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
> index 1e33af94c24..9b3bf3e4075 100644
> --- a/drivers/nvme/host/core.c
> +++ b/drivers/nvme/host/core.c
> @@ -2407,9 +2407,19 @@ static int nvme_update_ns_info_block(struct nvme_ns *ns,
> lim = queue_limits_start_update(ns->disk->queue);
>
> memflags = blk_mq_freeze_queue(ns->disk->queue);
> + if (id->lbaf[lbaf].ds < SECTOR_SHIFT ||
> + check_shl_overflow(le64_to_cpu(id->nsze),
> + id->lbaf[lbaf].ds - SECTOR_SHIFT,
> + &capacity)) {
> + dev_warn_once(ns->ctrl->device,
> + "invalid LBA data size %u, skipping namespace\n",
> + id->lbaf[lbaf].ds);
Just a nit:
If I'm reading the NVMe spec correctly, ds == 0 has a special meaning:
'LBA format is not currently available.'
maybe we should use a different dev_warn() for ds == 0 ?
Maurizio
^ permalink raw reply
* [PATCH v7 0/5] kunit: Add support for suppressing warning backtraces
From: Albert Esteve @ 2026-04-20 12:28 UTC (permalink / raw)
To: Arnd Bergmann, Brendan Higgins, David Gow, Rae Moar,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Jonathan Corbet, Shuah Khan, Andrew Morton
Cc: linux-kernel, linux-arch, linux-kselftest, kunit-dev, dri-devel,
workflows, linux-doc, peterz, Alessandro Carminati, Guenter Roeck,
Kees Cook, Albert Esteve, Linux Kernel Functional Testing,
Dan Carpenter, Maíra Canal, Kees Cook, Simona Vetter,
David Gow
Some unit tests intentionally trigger warning backtraces by passing bad
parameters to kernel API functions. Such unit tests typically check the
return value from such calls, not the existence of the warning backtrace.
Such intentionally generated warning backtraces are neither desirable
nor useful for a number of reasons:
- They can result in overlooked real problems.
- A warning that suddenly starts to show up in unit tests needs to be
investigated and has to be marked to be ignored, for example by
adjusting filter scripts. Such filters are ad hoc because there is
no real standard format for warnings. On top of that, such filter
scripts would require constant maintenance.
One option to address the problem would be to add messages such as
"expected warning backtraces start/end here" to the kernel log.
However, that would again require filter scripts, might result in
missing real problematic warning backtraces triggered while the test
is running, and the irrelevant backtrace(s) would still clog the
kernel log.
Solve the problem by providing a means to identify and suppress specific
warning backtraces while executing test code. Support suppressing multiple
backtraces while at the same time limiting changes to generic code to the
absolute minimum.
Overview:
Patch#1 Introduces the suppression infrastructure.
Patch#2 Mitigates the impact of suppression.
Patch#3 Adds selftests to validate the functionality.
Patch#4 Demonstrates real-world usage in the DRM subsystem.
Patch#5 Documents the new API and usage guidelines.
Design Notes:
The objective is to suppress unwanted WARN*() generated messages.
Although most major architectures share common bug handling via `lib/bug.c`
and `report_bug()`, some minor or legacy architectures still rely on their
own platform-specific handling. This divergence must be considered in any
such feature. Additionally, a key challenge in implementing this feature is
the fragmentation of `WARN*()` message emission: part of the output is
produced in the macro itself (via __warn_printk()), and part in the exception
handler.
Lessons from the Previous Attempt:
In earlier iterations, suppression logic was added inside the
`__report_bug()` function to intercept WARN*() output. To implement the
check in the bug handler code, two strategies were considered:
* Strategy #1: Use `kallsyms` to infer the originating function. This
approach proved unreliable due to compiler-induced transformations
such as inlining, cloning, and code fragmentation.
* Strategy #2: Store function name `__func__` in `struct bug_entry` in
the `__bug_table`. However, `__func__` is a compiler-generated symbol,
which complicates relocation and linking in position-independent code.
Additionally, architectures not using the unified `BUG()` path would
still require ad-hoc handling.
A per-macro solution was also attempted (v5-v6), injecting checks
directly into the `WARN*()` macros in `include/asm-generic/bug.h`.
While this offered full control, it required modifying the generic
bug header and was considered too invasive and damaging the critical
path, and thus incorrect [1].
Current Proposal: Check in `warn_slowpath_fmt()` and `__report_bug()`.
Suppression is checked at two points in the warning path:
- In `warn_slowpath_fmt()` (kernel/panic.c), for architectures without
__WARN_FLAGS. The check runs before any output, fully suppressing
both message and backtrace.
- In `__report_bug()` (lib/bug.c), for architectures that define
__WARN_FLAGS. The check runs before `__warn()` is called, suppressing
the backtrace and stack dump. On this path, the `WARN()` format message
may still appear in the kernel log since `__warn_printk()` executes
before the trap.
This approach avoids modifying include/asm-generic/bug.h entirely,
requires no architecture-specific code, and limits changes to generic
code to the absolute minimum.
A helper function, `__kunit_is_suppressed_warning()`, walks an RCU-
protected list of active suppressions, matching by current task. The
suppression state is dynamically allocated via kunit_kzalloc() and
tied to the KUnit test lifecycle via kunit_add_action(), ensuring
automatic cleanup at test exit.
To minimize runtime impact when no suppressions are active, an atomic
counter tracks the number of active suppressions.
`__kunit_is_suppressed_warning()` checks this counter first and returns
immediately when it is zero, avoiding the RCU-protected list traversal
in the common case.
This series is based on the RFC patch and subsequent discussion at
https://patchwork.kernel.org/project/linux-kselftest/patch/02546e59-1afe-4b08-ba81-d94f3b691c9a@moroto.mountain/
and offers a more comprehensive solution of the problem discussed there.
[1] https://lore.kernel.org/all/CAGegRW76X8Fk_5qqOBw_aqBwAkQTsc8kXKHEuu9ECeXzdJwMSw@mail.gmail.com/
Changes since RFC:
- Introduced CONFIG_KUNIT_SUPPRESS_BACKTRACE
- Minor cleanups and bug fixes
- Added support for all affected architectures
- Added support for counting suppressed warnings
- Added unit tests using those counters
- Added patch to suppress warning backtraces in dev_addr_lists tests
Changes since v1:
- Rebased to v6.9-rc1
- Added Tested-by:, Acked-by:, and Reviewed-by: tags
[I retained those tags since there have been no functional changes]
- Introduced KUNIT_SUPPRESS_BACKTRACE configuration option, enabled by
default.
Changes since v2:
- Rebased to v6.9-rc2
- Added comments to drm warning suppression explaining why it is needed.
- Added patch to move conditional code in arch/sh/include/asm/bug.h
to avoid kerneldoc warning
- Added architecture maintainers to Cc: for architecture specific patches
- No functional changes
Changes since v3:
- Rebased to v6.14-rc6
- Dropped net: "kunit: Suppress lock warning noise at end of dev_addr_lists tests"
since 3db3b62955cd6d73afde05a17d7e8e106695c3b9
- Added __kunit_ and KUNIT_ prefixes.
- Tested on interessed architectures.
Changes since v4:
- Rebased to v6.15-rc7
- Dropped all code in __report_bug()
- Moved all checks in WARN*() macros.
- Dropped all architecture specific code.
- Made __kunit_is_suppressed_warning nice to noinstr functions.
Changes since v5:
- Rebased to v7.0-rc3
- Added RCU protection for the suppressed warnings list.
- Added static key and branching optimization.
- Removed custom `strcmp` implementation and reworked
__kunit_is_suppressed_warning() entrypoint function.
Changes since v6:
- Moved suppression checks from WARN*() macros to warn_slowpath_fmt()
and __report_bug().
- Replaced stack-allocated suppression struct with kunit_kzalloc() heap
allocation tied to the KUnit test lifecycle.
- Changed suppression strategy from function-name matching to task-scoped:
all warnings on the current task are suppressed between START and END,
rather than only warnings originating from a specific named function.
- Simplified macro API: removed KUNIT_DECLARE_SUPPRESSED_WARNING(),
the START macro now takes (test) and handles allocation internally.
- Removed static key and branching optiomization, as by the time it
was executed, callers are already in warn slowpaths.
- Link to v6: https://lore.kernel.org/r/20260317-kunit_add_support-v6-0-dd22aeb3fe5d@redhat.com
Alessandro Carminati (2):
bug/kunit: Core support for suppressing warning backtraces
bug/kunit: Suppressing warning backtraces reduced impact on WARN*()
sites
Guenter Roeck (3):
Add unit tests to verify that warning backtrace suppression works.
drm: Suppress intentional warning backtraces in scaling unit tests
kunit: Add documentation for warning backtrace suppression API
Documentation/dev-tools/kunit/usage.rst | 30 ++++++-
drivers/gpu/drm/tests/drm_rect_test.c | 16 ++++
include/asm-generic/bug.h | 48 +++++++----
include/kunit/bug.h | 62 ++++++++++++++
include/kunit/test.h | 1 +
lib/kunit/Kconfig | 9 ++
lib/kunit/Makefile | 9 +-
lib/kunit/backtrace-suppression-test.c | 105 ++++++++++++++++++++++++
lib/kunit/bug.c | 54 ++++++++++++
9 files changed, 316 insertions(+), 18 deletions(-)
create mode 100644 include/kunit/bug.h
create mode 100644 lib/kunit/backtrace-suppression-test.c
create mode 100644 lib/kunit/bug.c
--
2.34.1
---
Alessandro Carminati (2):
bug/kunit: Core support for suppressing warning backtraces
bug/kunit: Reduce runtime impact of warning backtrace suppression
Guenter Roeck (3):
kunit: Add backtrace suppression self-tests
drm: Suppress intentional warning backtraces in scaling unit tests
kunit: Add documentation for warning backtrace suppression API
Documentation/dev-tools/kunit/usage.rst | 30 ++++++++++-
drivers/gpu/drm/tests/drm_rect_test.c | 14 +++++
include/kunit/bug.h | 56 ++++++++++++++++++++
include/kunit/test.h | 1 +
kernel/panic.c | 8 ++-
lib/bug.c | 8 +++
lib/kunit/Kconfig | 9 ++++
lib/kunit/Makefile | 9 +++-
lib/kunit/backtrace-suppression-test.c | 90 ++++++++++++++++++++++++++++++++
lib/kunit/bug.c | 91 +++++++++++++++++++++++++++++++++
10 files changed, 312 insertions(+), 4 deletions(-)
---
base-commit: 80234b5ab240f52fa45d201e899e207b9265ef91
change-id: 20260312-kunit_add_support-2f35806b19dd
Best regards,
--
Albert Esteve <aesteve@redhat.com>
^ permalink raw reply
* [PATCH v7 1/5] bug/kunit: Core support for suppressing warning backtraces
From: Albert Esteve @ 2026-04-20 12:28 UTC (permalink / raw)
To: Arnd Bergmann, Brendan Higgins, David Gow, Rae Moar,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Jonathan Corbet, Shuah Khan, Andrew Morton
Cc: linux-kernel, linux-arch, linux-kselftest, kunit-dev, dri-devel,
workflows, linux-doc, peterz, Alessandro Carminati, Guenter Roeck,
Kees Cook, Albert Esteve
In-Reply-To: <20260420-kunit_add_support-v7-0-e8bc6e0f70de@redhat.com>
From: Alessandro Carminati <acarmina@redhat.com>
Some unit tests intentionally trigger warning backtraces by passing bad
parameters to kernel API functions. Such unit tests typically check the
return value from such calls, not the existence of the warning backtrace.
Such intentionally generated warning backtraces are neither desirable
nor useful for a number of reasons:
- They can result in overlooked real problems.
- A warning that suddenly starts to show up in unit tests needs to be
investigated and has to be marked to be ignored, for example by
adjusting filter scripts. Such filters are ad hoc because there is
no real standard format for warnings. On top of that, such filter
scripts would require constant maintenance.
Solve the problem by providing a means to identify and suppress specific
warning backtraces while executing test code. Support suppressing multiple
backtraces while at the same time limiting changes to generic code to the
absolute minimum.
Implementation details:
Suppression is checked at two points in the warning path:
- In warn_slowpath_fmt(), the check runs before any output, fully
suppressing both message and backtrace.
- In __report_bug(), the check runs before __warn() is called,
suppressing the backtrace and stack dump. Note that on this path,
the WARN() format message may still appear in the kernel log since
__warn_printk() runs before the trap that enters __report_bug().
A helper function, `__kunit_is_suppressed_warning()`, walks an
RCU-protected list of active suppressions, matching by current task.
The suppression state is tied to the KUnit test lifecycle via
kunit_add_action(), ensuring automatic cleanup at test exit.
The list of suppressed warnings is protected with RCU to allow
concurrent read access without locks.
The implementation is deliberately simple and avoids architecture-specific
optimizations to preserve portability.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Alessandro Carminati <acarmina@redhat.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Signed-off-by: Albert Esteve <aesteve@redhat.com>
---
include/kunit/bug.h | 56 +++++++++++++++++++++++++++++++++++
include/kunit/test.h | 1 +
kernel/panic.c | 8 ++++-
lib/bug.c | 8 +++++
lib/kunit/Kconfig | 9 ++++++
lib/kunit/Makefile | 6 ++--
lib/kunit/bug.c | 84 ++++++++++++++++++++++++++++++++++++++++++++++++++++
7 files changed, 169 insertions(+), 3 deletions(-)
diff --git a/include/kunit/bug.h b/include/kunit/bug.h
new file mode 100644
index 0000000000000..e52c9d21d9fe6
--- /dev/null
+++ b/include/kunit/bug.h
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * KUnit helpers for backtrace suppression
+ *
+ * Copyright (C) 2025 Alessandro Carminati <acarmina@redhat.com>
+ * Copyright (C) 2024 Guenter Roeck <linux@roeck-us.net>
+ */
+
+#ifndef _KUNIT_BUG_H
+#define _KUNIT_BUG_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/kconfig.h>
+
+struct kunit;
+
+#ifdef CONFIG_KUNIT_SUPPRESS_BACKTRACE
+
+#include <linux/types.h>
+
+struct task_struct;
+
+struct __suppressed_warning {
+ struct list_head node;
+ struct task_struct *task;
+ int counter;
+};
+
+struct __suppressed_warning *
+__kunit_start_suppress_warning(struct kunit *test);
+void __kunit_end_suppress_warning(struct kunit *test,
+ struct __suppressed_warning *warning);
+int __kunit_suppressed_warning_count(struct __suppressed_warning *warning);
+bool __kunit_is_suppressed_warning(void);
+
+#define KUNIT_START_SUPPRESSED_WARNING(test) \
+ struct __suppressed_warning *__kunit_suppress = \
+ __kunit_start_suppress_warning(test)
+
+#define KUNIT_END_SUPPRESSED_WARNING(test) \
+ __kunit_end_suppress_warning(test, __kunit_suppress)
+
+#define KUNIT_SUPPRESSED_WARNING_COUNT() \
+ __kunit_suppressed_warning_count(__kunit_suppress)
+
+#else /* CONFIG_KUNIT_SUPPRESS_BACKTRACE */
+
+#define KUNIT_START_SUPPRESSED_WARNING(test)
+#define KUNIT_END_SUPPRESSED_WARNING(test)
+#define KUNIT_SUPPRESSED_WARNING_COUNT() 0
+static inline bool __kunit_is_suppressed_warning(void) { return false; }
+
+#endif /* CONFIG_KUNIT_SUPPRESS_BACKTRACE */
+#endif /* __ASSEMBLY__ */
+#endif /* _KUNIT_BUG_H */
diff --git a/include/kunit/test.h b/include/kunit/test.h
index 9cd1594ab697d..4ec07b3fa0204 100644
--- a/include/kunit/test.h
+++ b/include/kunit/test.h
@@ -10,6 +10,7 @@
#define _KUNIT_TEST_H
#include <kunit/assert.h>
+#include <kunit/bug.h>
#include <kunit/try-catch.h>
#include <linux/args.h>
diff --git a/kernel/panic.c b/kernel/panic.c
index c78600212b6c1..d7a7a679f56c4 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -39,6 +39,7 @@
#include <linux/sys_info.h>
#include <trace/events/error_report.h>
#include <asm/sections.h>
+#include <kunit/bug.h>
#define PANIC_TIMER_STEP 100
#define PANIC_BLINK_SPD 18
@@ -1080,9 +1081,14 @@ void __warn(const char *file, int line, void *caller, unsigned taint,
void warn_slowpath_fmt(const char *file, int line, unsigned taint,
const char *fmt, ...)
{
- bool rcu = warn_rcu_enter();
+ bool rcu;
struct warn_args args;
+ if (__kunit_is_suppressed_warning())
+ return;
+
+ rcu = warn_rcu_enter();
+
pr_warn(CUT_HERE);
if (!fmt) {
diff --git a/lib/bug.c b/lib/bug.c
index 623c467a8b76c..606205c8c302f 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -48,6 +48,7 @@
#include <linux/rculist.h>
#include <linux/ftrace.h>
#include <linux/context_tracking.h>
+#include <kunit/bug.h>
extern struct bug_entry __start___bug_table[], __stop___bug_table[];
@@ -223,6 +224,13 @@ static enum bug_trap_type __report_bug(struct bug_entry *bug, unsigned long buga
no_cut = bug->flags & BUGFLAG_NO_CUT_HERE;
has_args = bug->flags & BUGFLAG_ARGS;
+ /*
+ * Before the once logic so suppressed warnings do not consume
+ * the single-fire budget of WARN_ON_ONCE().
+ */
+ if (warning && __kunit_is_suppressed_warning())
+ return BUG_TRAP_TYPE_WARN;
+
if (warning && once) {
if (done)
return BUG_TRAP_TYPE_WARN;
diff --git a/lib/kunit/Kconfig b/lib/kunit/Kconfig
index 498cc51e493dc..57527418fcf09 100644
--- a/lib/kunit/Kconfig
+++ b/lib/kunit/Kconfig
@@ -15,6 +15,15 @@ menuconfig KUNIT
if KUNIT
+config KUNIT_SUPPRESS_BACKTRACE
+ bool "KUnit - Enable backtrace suppression"
+ default y
+ help
+ Enable backtrace suppression for KUnit. If enabled, backtraces
+ generated intentionally by KUnit tests are suppressed. Disable
+ to reduce kernel image size if image size is more important than
+ suppression of backtraces generated by KUnit tests.
+
config KUNIT_DEBUGFS
bool "KUnit - Enable /sys/kernel/debug/kunit debugfs representation" if !KUNIT_ALL_TESTS
default KUNIT_ALL_TESTS
diff --git a/lib/kunit/Makefile b/lib/kunit/Makefile
index 656f1fa35abcc..fe177ff3ebdef 100644
--- a/lib/kunit/Makefile
+++ b/lib/kunit/Makefile
@@ -16,8 +16,10 @@ ifeq ($(CONFIG_KUNIT_DEBUGFS),y)
kunit-objs += debugfs.o
endif
-# KUnit 'hooks' are built-in even when KUnit is built as a module.
-obj-$(if $(CONFIG_KUNIT),y) += hooks.o
+# KUnit 'hooks' and bug handling are built-in even when KUnit is built
+# as a module.
+obj-$(if $(CONFIG_KUNIT),y) += hooks.o \
+ bug.o
obj-$(CONFIG_KUNIT_TEST) += kunit-test.o
obj-$(CONFIG_KUNIT_TEST) += platform-test.o
diff --git a/lib/kunit/bug.c b/lib/kunit/bug.c
new file mode 100644
index 0000000000000..356c8a5928828
--- /dev/null
+++ b/lib/kunit/bug.c
@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * KUnit helpers for backtrace suppression
+ *
+ * Copyright (C) 2025 Alessandro Carminati <acarmina@redhat.com>
+ * Copyright (C) 2024 Guenter Roeck <linux@roeck-us.net>
+ */
+
+#include <kunit/bug.h>
+#include <kunit/resource.h>
+#include <linux/export.h>
+#include <linux/rculist.h>
+#include <linux/sched.h>
+
+#ifdef CONFIG_KUNIT_SUPPRESS_BACKTRACE
+
+static LIST_HEAD(suppressed_warnings);
+
+static void __kunit_suppress_warning_remove(struct __suppressed_warning *warning)
+{
+ list_del_rcu(&warning->node);
+ synchronize_rcu(); /* Wait for readers to finish */
+}
+
+KUNIT_DEFINE_ACTION_WRAPPER(__kunit_suppress_warning_cleanup,
+ __kunit_suppress_warning_remove,
+ struct __suppressed_warning *);
+
+struct __suppressed_warning *
+__kunit_start_suppress_warning(struct kunit *test)
+{
+ struct __suppressed_warning *warning;
+ int ret;
+
+ warning = kunit_kzalloc(test, sizeof(*warning), GFP_KERNEL);
+ if (!warning)
+ return NULL;
+
+ warning->task = current;
+ list_add_rcu(&warning->node, &suppressed_warnings);
+
+ ret = kunit_add_action_or_reset(test,
+ __kunit_suppress_warning_cleanup,
+ warning);
+ if (ret)
+ return NULL;
+
+ return warning;
+}
+EXPORT_SYMBOL_GPL(__kunit_start_suppress_warning);
+
+void __kunit_end_suppress_warning(struct kunit *test,
+ struct __suppressed_warning *warning)
+{
+ if (!warning)
+ return;
+ kunit_release_action(test, __kunit_suppress_warning_cleanup, warning);
+}
+EXPORT_SYMBOL_GPL(__kunit_end_suppress_warning);
+
+int __kunit_suppressed_warning_count(struct __suppressed_warning *warning)
+{
+ return warning ? warning->counter : 0;
+}
+EXPORT_SYMBOL_GPL(__kunit_suppressed_warning_count);
+
+bool __kunit_is_suppressed_warning(void)
+{
+ struct __suppressed_warning *warning;
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(warning, &suppressed_warnings, node) {
+ if (warning->task == current) {
+ warning->counter++;
+ rcu_read_unlock();
+ return true;
+ }
+ }
+ rcu_read_unlock();
+
+ return false;
+}
+
+#endif /* CONFIG_KUNIT_SUPPRESS_BACKTRACE */
--
2.52.0
^ permalink raw reply related
* [PATCH v7 2/5] bug/kunit: Reduce runtime impact of warning backtrace suppression
From: Albert Esteve @ 2026-04-20 12:28 UTC (permalink / raw)
To: Arnd Bergmann, Brendan Higgins, David Gow, Rae Moar,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Jonathan Corbet, Shuah Khan, Andrew Morton
Cc: linux-kernel, linux-arch, linux-kselftest, kunit-dev, dri-devel,
workflows, linux-doc, peterz, Alessandro Carminati, Albert Esteve
In-Reply-To: <20260420-kunit_add_support-v7-0-e8bc6e0f70de@redhat.com>
From: Alessandro Carminati <acarmina@redhat.com>
KUnit support is not consistently present across distributions, some
include it in their stock kernels, while others do not.
While both KUNIT and KUNIT_SUPPRESS_BACKTRACE can be considered debug
features, the fact that some distros ship with KUnit enabled means it's
important to minimize the runtime impact of this patch.
To that end, this patch adds an atomic counter that tracks the number
of active suppressions. __kunit_is_suppressed_warning() checks this
counter first and returns immediately when no suppressions are active,
avoiding RCU-protected list traversal in the common case.
Signed-off-by: Alessandro Carminati <acarmina@redhat.com>
Signed-off-by: Albert Esteve <aesteve@redhat.com>
---
lib/kunit/bug.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/kunit/bug.c b/lib/kunit/bug.c
index 356c8a5928828..a7a88f0670d44 100644
--- a/lib/kunit/bug.c
+++ b/lib/kunit/bug.c
@@ -8,6 +8,7 @@
#include <kunit/bug.h>
#include <kunit/resource.h>
+#include <linux/atomic.h>
#include <linux/export.h>
#include <linux/rculist.h>
#include <linux/sched.h>
@@ -15,11 +16,13 @@
#ifdef CONFIG_KUNIT_SUPPRESS_BACKTRACE
static LIST_HEAD(suppressed_warnings);
+static atomic_t suppressed_warnings_cnt = ATOMIC_INIT(0);
static void __kunit_suppress_warning_remove(struct __suppressed_warning *warning)
{
list_del_rcu(&warning->node);
synchronize_rcu(); /* Wait for readers to finish */
+ atomic_dec(&suppressed_warnings_cnt);
}
KUNIT_DEFINE_ACTION_WRAPPER(__kunit_suppress_warning_cleanup,
@@ -37,6 +40,7 @@ __kunit_start_suppress_warning(struct kunit *test)
return NULL;
warning->task = current;
+ atomic_inc(&suppressed_warnings_cnt);
list_add_rcu(&warning->node, &suppressed_warnings);
ret = kunit_add_action_or_reset(test,
@@ -68,6 +72,9 @@ bool __kunit_is_suppressed_warning(void)
{
struct __suppressed_warning *warning;
+ if (!atomic_read(&suppressed_warnings_cnt))
+ return false;
+
rcu_read_lock();
list_for_each_entry_rcu(warning, &suppressed_warnings, node) {
if (warning->task == current) {
--
2.52.0
^ permalink raw reply related
* [PATCH v7 3/5] kunit: Add backtrace suppression self-tests
From: Albert Esteve @ 2026-04-20 12:28 UTC (permalink / raw)
To: Arnd Bergmann, Brendan Higgins, David Gow, Rae Moar,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Jonathan Corbet, Shuah Khan, Andrew Morton
Cc: linux-kernel, linux-arch, linux-kselftest, kunit-dev, dri-devel,
workflows, linux-doc, peterz, Guenter Roeck,
Linux Kernel Functional Testing, Dan Carpenter,
Alessandro Carminati, Albert Esteve, Kees Cook
In-Reply-To: <20260420-kunit_add_support-v7-0-e8bc6e0f70de@redhat.com>
From: Guenter Roeck <linux@roeck-us.net>
Add unit tests to verify that warning backtrace suppression works,
covering WARN() and WARN_ON() with direct calls, indirect calls
through helper functions, and multiple warnings in a single window.
If backtrace suppression does _not_ work, the unit tests will likely
trigger unsuppressed backtraces, which should actually help to get
the affected architectures / platforms fixed.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Acked-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Alessandro Carminati <acarmina@redhat.com>
Signed-off-by: Albert Esteve <aesteve@redhat.com>
---
lib/kunit/Makefile | 3 ++
lib/kunit/backtrace-suppression-test.c | 90 ++++++++++++++++++++++++++++++++++
2 files changed, 93 insertions(+)
diff --git a/lib/kunit/Makefile b/lib/kunit/Makefile
index fe177ff3ebdef..b2f2b8ada7b71 100644
--- a/lib/kunit/Makefile
+++ b/lib/kunit/Makefile
@@ -23,6 +23,9 @@ obj-$(if $(CONFIG_KUNIT),y) += hooks.o \
obj-$(CONFIG_KUNIT_TEST) += kunit-test.o
obj-$(CONFIG_KUNIT_TEST) += platform-test.o
+ifeq ($(CONFIG_KUNIT_SUPPRESS_BACKTRACE),y)
+obj-$(CONFIG_KUNIT_TEST) += backtrace-suppression-test.o
+endif
# string-stream-test compiles built-in only.
ifeq ($(CONFIG_KUNIT_TEST),y)
diff --git a/lib/kunit/backtrace-suppression-test.c b/lib/kunit/backtrace-suppression-test.c
new file mode 100644
index 0000000000000..2ba5dcb5fef35
--- /dev/null
+++ b/lib/kunit/backtrace-suppression-test.c
@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * KUnit test for suppressing warning tracebacks.
+ *
+ * Copyright (C) 2024, Guenter Roeck
+ * Author: Guenter Roeck <linux@roeck-us.net>
+ */
+
+#include <kunit/test.h>
+#include <linux/bug.h>
+
+static void backtrace_suppression_test_warn_direct(struct kunit *test)
+{
+ KUNIT_START_SUPPRESSED_WARNING(test);
+ WARN(1, "This backtrace should be suppressed");
+ KUNIT_END_SUPPRESSED_WARNING(test);
+
+ KUNIT_EXPECT_EQ(test, KUNIT_SUPPRESSED_WARNING_COUNT(), 1);
+}
+
+static void trigger_backtrace_warn(void)
+{
+ WARN(1, "This backtrace should be suppressed");
+}
+
+static void backtrace_suppression_test_warn_indirect(struct kunit *test)
+{
+ KUNIT_START_SUPPRESSED_WARNING(test);
+ trigger_backtrace_warn();
+ KUNIT_END_SUPPRESSED_WARNING(test);
+
+ KUNIT_EXPECT_EQ(test, KUNIT_SUPPRESSED_WARNING_COUNT(), 1);
+}
+
+static void backtrace_suppression_test_warn_multi(struct kunit *test)
+{
+ KUNIT_START_SUPPRESSED_WARNING(test);
+ WARN(1, "This backtrace should be suppressed");
+ trigger_backtrace_warn();
+ KUNIT_END_SUPPRESSED_WARNING(test);
+
+ KUNIT_EXPECT_EQ(test, KUNIT_SUPPRESSED_WARNING_COUNT(), 2);
+}
+
+static void backtrace_suppression_test_warn_on_direct(struct kunit *test)
+{
+ if (!IS_ENABLED(CONFIG_DEBUG_BUGVERBOSE) && !IS_ENABLED(CONFIG_KALLSYMS))
+ kunit_skip(test, "requires CONFIG_DEBUG_BUGVERBOSE or CONFIG_KALLSYMS");
+
+ KUNIT_START_SUPPRESSED_WARNING(test);
+ WARN_ON(1);
+ KUNIT_END_SUPPRESSED_WARNING(test);
+
+ KUNIT_EXPECT_EQ(test, KUNIT_SUPPRESSED_WARNING_COUNT(), 1);
+}
+
+static void trigger_backtrace_warn_on(void)
+{
+ WARN_ON(1);
+}
+
+static void backtrace_suppression_test_warn_on_indirect(struct kunit *test)
+{
+ if (!IS_ENABLED(CONFIG_DEBUG_BUGVERBOSE))
+ kunit_skip(test, "requires CONFIG_DEBUG_BUGVERBOSE");
+
+ KUNIT_START_SUPPRESSED_WARNING(test);
+ trigger_backtrace_warn_on();
+ KUNIT_END_SUPPRESSED_WARNING(test);
+
+ KUNIT_EXPECT_EQ(test, KUNIT_SUPPRESSED_WARNING_COUNT(), 1);
+}
+
+static struct kunit_case backtrace_suppression_test_cases[] = {
+ KUNIT_CASE(backtrace_suppression_test_warn_direct),
+ KUNIT_CASE(backtrace_suppression_test_warn_indirect),
+ KUNIT_CASE(backtrace_suppression_test_warn_multi),
+ KUNIT_CASE(backtrace_suppression_test_warn_on_direct),
+ KUNIT_CASE(backtrace_suppression_test_warn_on_indirect),
+ {}
+};
+
+static struct kunit_suite backtrace_suppression_test_suite = {
+ .name = "backtrace-suppression-test",
+ .test_cases = backtrace_suppression_test_cases,
+};
+kunit_test_suites(&backtrace_suppression_test_suite);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("KUnit test to verify warning backtrace suppression");
--
2.52.0
^ permalink raw reply related
* Re: [PATCH v3 4/7] arm64: dts: qcom: talos: Add QSPI support
From: Dmitry Baryshkov @ 2026-04-20 12:29 UTC (permalink / raw)
To: Viken Dadhaniya
Cc: Mark Brown, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Bjorn Andersson, Konrad Dybcio, cros-qcom-dts-watchers,
linux-arm-msm, linux-spi, devicetree, linux-kernel
In-Reply-To: <20260420-spi-nor-v3-4-7de325a29010@oss.qualcomm.com>
On Mon, Apr 20, 2026 at 11:42:51AM +0530, Viken Dadhaniya wrote:
> The Talos (QCS615) platform includes a QSPI controller used for accessing
> external flash storage. Add the QSPI OPP table, TLMM pinmux entries, and
> the QSPI controller node to enable support for this hardware.
>
> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
> ---
> arch/arm64/boot/dts/qcom/talos.dtsi | 80 +++++++++++++++++++++++++++++++++++++
> 1 file changed, 80 insertions(+)
>
You got r-b's for v2. Looks like they got ignored...
--
With best wishes
Dmitry
^ permalink raw reply
* [PATCH v7 4/5] drm: Suppress intentional warning backtraces in scaling unit tests
From: Albert Esteve @ 2026-04-20 12:28 UTC (permalink / raw)
To: Arnd Bergmann, Brendan Higgins, David Gow, Rae Moar,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Jonathan Corbet, Shuah Khan, Andrew Morton
Cc: linux-kernel, linux-arch, linux-kselftest, kunit-dev, dri-devel,
workflows, linux-doc, peterz, Guenter Roeck,
Linux Kernel Functional Testing, Dan Carpenter, Maíra Canal,
Alessandro Carminati, Albert Esteve, Simona Vetter
In-Reply-To: <20260420-kunit_add_support-v7-0-e8bc6e0f70de@redhat.com>
From: Guenter Roeck <linux@roeck-us.net>
The drm_test_rect_calc_hscale and drm_test_rect_calc_vscale unit tests
intentionally trigger warning backtraces by providing bad parameters to
the tested functions. What is tested is the return value, not the existence
of a warning backtrace. Suppress the backtraces to avoid clogging the
kernel log and distraction from real problems.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Acked-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Maíra Canal <mcanal@igalia.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: David Airlie <airlied@gmail.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Alessandro Carminati <acarmina@redhat.com>
Signed-off-by: Albert Esteve <aesteve@redhat.com>
---
drivers/gpu/drm/tests/drm_rect_test.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/gpu/drm/tests/drm_rect_test.c b/drivers/gpu/drm/tests/drm_rect_test.c
index 17e1f34b76101..1dd7d819165e7 100644
--- a/drivers/gpu/drm/tests/drm_rect_test.c
+++ b/drivers/gpu/drm/tests/drm_rect_test.c
@@ -409,8 +409,15 @@ static void drm_test_rect_calc_hscale(struct kunit *test)
const struct drm_rect_scale_case *params = test->param_value;
int scaling_factor;
+ /*
+ * drm_rect_calc_hscale() generates a warning backtrace whenever bad
+ * parameters are passed to it. This affects all unit tests with an
+ * error code in expected_scaling_factor.
+ */
+ KUNIT_START_SUPPRESSED_WARNING(test);
scaling_factor = drm_rect_calc_hscale(¶ms->src, ¶ms->dst,
params->min_range, params->max_range);
+ KUNIT_END_SUPPRESSED_WARNING(test);
KUNIT_EXPECT_EQ(test, scaling_factor, params->expected_scaling_factor);
}
@@ -420,8 +427,15 @@ static void drm_test_rect_calc_vscale(struct kunit *test)
const struct drm_rect_scale_case *params = test->param_value;
int scaling_factor;
+ /*
+ * drm_rect_calc_vscale() generates a warning backtrace whenever bad
+ * parameters are passed to it. This affects all unit tests with an
+ * error code in expected_scaling_factor.
+ */
+ KUNIT_START_SUPPRESSED_WARNING(test);
scaling_factor = drm_rect_calc_vscale(¶ms->src, ¶ms->dst,
params->min_range, params->max_range);
+ KUNIT_END_SUPPRESSED_WARNING(test);
KUNIT_EXPECT_EQ(test, scaling_factor, params->expected_scaling_factor);
}
--
2.52.0
^ permalink raw reply related
* Re: [PATCH] tee: optee: Allow MT_NORMAL_TAGGED shared memory
From: Sumit Garg @ 2026-04-20 12:29 UTC (permalink / raw)
To: Hirokazu Honda; +Cc: jens.wiklander, op-tee, linux-kernel
In-Reply-To: <20260416221819.3600289-1-hiroh@google.com>
On Thu, Apr 16, 2026 at 03:18:19PM -0700, Hirokazu Honda wrote:
> From: Hirokazu Honda <hiroh@chromium.org>
>
> On ARM64, shared memory can have MT_NORMAL_TAGGED attribute when using
> the Memory Tagging Extension (MTE). The OP-TEE driver needs to
> recognize this as normal memory to allow sharing such buffers with the
> Secure World.
>
> Signed-off-by: Hirokazu Honda <hiroh@chromium.org>
> ---
> drivers/tee/optee/call.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
-Sumit
>
> diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
> index 9effe88049e9..e046aff61828 100644
> --- a/drivers/tee/optee/call.c
> +++ b/drivers/tee/optee/call.c
> @@ -602,7 +602,8 @@ static bool is_normal_memory(pgprot_t p)
> return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) ||
> ((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK));
> #elif defined(CONFIG_ARM64)
> - return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL);
> + return ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL)) ||
> + ((pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL_TAGGED));
> #else
> #error "Unsupported architecture"
> #endif
> --
> 2.54.0.rc1.513.gad8abe7a5a-goog
>
^ permalink raw reply
* [PATCH v7 5/5] kunit: Add documentation for warning backtrace suppression API
From: Albert Esteve @ 2026-04-20 12:28 UTC (permalink / raw)
To: Arnd Bergmann, Brendan Higgins, David Gow, Rae Moar,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Jonathan Corbet, Shuah Khan, Andrew Morton
Cc: linux-kernel, linux-arch, linux-kselftest, kunit-dev, dri-devel,
workflows, linux-doc, peterz, Guenter Roeck,
Linux Kernel Functional Testing, Dan Carpenter,
Alessandro Carminati, Albert Esteve, Kees Cook, David Gow
In-Reply-To: <20260420-kunit_add_support-v7-0-e8bc6e0f70de@redhat.com>
From: Guenter Roeck <linux@roeck-us.net>
Document API functions for suppressing warning backtraces.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Acked-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: David Gow <davidgow@google.com>
Signed-off-by: Alessandro Carminati <acarmina@redhat.com>
Signed-off-by: Albert Esteve <aesteve@redhat.com>
---
Documentation/dev-tools/kunit/usage.rst | 30 +++++++++++++++++++++++++++++-
1 file changed, 29 insertions(+), 1 deletion(-)
diff --git a/Documentation/dev-tools/kunit/usage.rst b/Documentation/dev-tools/kunit/usage.rst
index ebd06f5ea4550..76e85412f240e 100644
--- a/Documentation/dev-tools/kunit/usage.rst
+++ b/Documentation/dev-tools/kunit/usage.rst
@@ -157,6 +157,34 @@ Alternatively, one can take full control over the error message by using
if (some_setup_function())
KUNIT_FAIL(test, "Failed to setup thing for testing");
+Suppressing warning backtraces
+------------------------------
+
+Some unit tests trigger warning backtraces either intentionally or as side
+effect. Such backtraces are normally undesirable since they distract from
+the actual test and may result in the impression that there is a problem.
+
+Such backtraces can be suppressed with **task scope suppression**: while
+``START`` / ``END`` is active on the current task, the backtrace and stack
+dump from warnings on that task are suppressed. Wrap the call from your test
+in that window, like shown in the following code.
+
+.. code-block:: c
+
+ static void some_test(struct kunit *test)
+ {
+ KUNIT_START_SUPPRESSED_WARNING(test);
+ trigger_backtrace();
+ KUNIT_END_SUPPRESSED_WARNING(test);
+ }
+
+``KUNIT_SUPPRESSED_WARNING_COUNT()`` returns the number of suppressed backtraces.
+If the suppressed backtrace was triggered on purpose, this can be used to check
+if the backtrace was actually triggered.
+
+.. code-block:: c
+
+ KUNIT_EXPECT_EQ(test, KUNIT_SUPPRESSED_WARNING_COUNT(), 1);
Test Suites
~~~~~~~~~~~
@@ -1211,4 +1239,4 @@ For example:
dev_managed_string = devm_kstrdup(fake_device, "Hello, World!");
// Everything is cleaned up automatically when the test ends.
- }
\ No newline at end of file
+ }
--
2.52.0
^ permalink raw reply related
* Re: [PATCH v2 1/2] cdrom: gdrom: replace port I/O with MMIO accessors
From: Adrian McMenamin @ 2026-04-20 12:29 UTC (permalink / raw)
To: Florian Fuchs
Cc: linux-sh, John Paul Adrian Glaubitz, Artur Rojek, linux-kernel
In-Reply-To: <20260419162823.2829286-2-fuchsfl@gmail.com>
On Sun, 19 Apr 2026 at 17:29, Florian Fuchs <fuchsfl@gmail.com> wrote:
>
This patch addresses the bug and is logically correct and so looks good to me.
Reviewed-by: Adrian McMenamin <adrianmcmenamin@gmail.com>
^ permalink raw reply
* Re: [PATCH v2] drm/amdgpu: fix root reservation in amdgpu_vm_handle_fault
From: Christian König @ 2026-04-20 12:29 UTC (permalink / raw)
To: Pierre-Eric Pelloux-Prayer, Alex Deucher, David Airlie,
Simona Vetter
Cc: amd-gfx, dri-devel, linux-kernel
In-Reply-To: <20260420121438.1612-1-pierre-eric.pelloux-prayer@amd.com>
On 4/20/26 14:14, Pierre-Eric Pelloux-Prayer wrote:
> svm_range_restore_pages might reserve the root bo so it must
> be called after unreserving it.
>
> ---
> v2:
> - don't modify amdgpu_vm_lock_by_pasid
> - add a TODO
> ---
>
> Fixes: 32b486e8541c ("drm/amdgpu: extract amdgpu_vm_lock_by_pasid from amdgpu_vm_handle_fault")
> Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 17 ++++++++++++++---
> 1 file changed, 14 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> index 63156289ae7f..799a1803d941 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
> @@ -3026,11 +3026,22 @@ bool amdgpu_vm_handle_fault(struct amdgpu_device *adev, u32 pasid,
>
> is_compute_context = vm->is_compute_context;
>
> - if (is_compute_context && !svm_range_restore_pages(adev, pasid, vmid,
> - node_id, addr >> PAGE_SHIFT, ts, write_fault)) {
> + if (is_compute_context) {
> + /* Unreserve root since svm_range_restore_pages might try to reserve it. */
> + /* TODO: rework svm_range_restore_pages so that this isn't necessary. */
> amdgpu_bo_unreserve(root);
> +
> + if (!svm_range_restore_pages(adev, pasid, vmid,
> + node_id, addr >> PAGE_SHIFT, ts, write_fault)) {
> + amdgpu_bo_unref(&root);
> + return true;
> + }
> amdgpu_bo_unref(&root);
> - return true;
> +
> + /* Double check that the VM still exists. */
Probably better to write "Re-acquire the VM lock, could be that the VM was freed in between.".
With that done Reviewed-by: Christian König <christian.koenig@amd.com>.
> + vm = amdgpu_vm_lock_by_pasid(adev, &root, pasid);
> + if (!vm)
> + return false;
> }
>
> addr /= AMDGPU_GPU_PAGE_SIZE;
^ permalink raw reply
* Re: [syzbot ci] Re: mm: improve folio refcount scalability
From: Gorbunov Ivan @ 2026-04-20 12:29 UTC (permalink / raw)
To: syzbot ci, akpm, apopple, artem.kuzin, baolin.wang, david,
gladyshev.ilya1, harry.yoo, kirill, liam.howlett, linux-kernel,
linux-mm, lorenzo.stoakes, mhocko, muchun.song, rppt, surenb,
torvalds, vbabka, willy, yuzhao, ziy
Cc: syzbot, syzkaller-bugs
In-Reply-To: <69e5fad2.a00a0220.9259.0002.GAE@google.com>
Apologies to all. The logic in the debug check was accidentally inverted
during rebase
#syz test
diff --git a/include/linux/page_ref.h b/include/linux/page_ref.h
index 32194e953674..ca6e43b0cf95 100644
--- a/include/linux/page_ref.h
+++ b/include/linux/page_ref.h
@@ -64,7 +64,7 @@ static inline void __page_ref_unfreeze(struct page
*page, int v)
static inline bool __page_count_is_frozen(int count)
{
- return count > 0 && !((count & PAGEREF_FROZEN_BIT) != 0);
+ return count & PAGEREF_FROZEN_BIT;
}
static inline int page_ref_count(const struct page *page)
On 4/20/2026 1:07 PM, syzbot ci wrote:
> syzbot ci has tested the following series
>
> [v2] mm: improve folio refcount scalability
> https://lore.kernel.org/all/cover.1776350895.git.gorbunov.ivan@h-partners.com
> * [PATCH v2 1/2] mm: drop page refcount zero state semantics
> * [PATCH v2 2/2] mm: implement page refcount locking via dedicated bit
>
> and found the following issue:
> kernel BUG in get_page_bootmem
>
> Full report is available here:
> https://ci.syzbot.org/series/eb14b73a-c461-4be5-b5af-91864e939f4c
>
> ***
>
> kernel BUG in get_page_bootmem
>
> tree: mm-new
> URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/akpm/mm.git
> base: f4279f87cd6c82ebdaccdc56f38e7b80ca7fcc03
> arch: amd64
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> config: https://ci.syzbot.org/builds/60ced5f4-8c33-43ea-a4ee-92d9b2b8f949/config
>
> ACPI: HPET id: 0x8086a201 base: 0xfed00000
> CPU topo: Max. logical packages: 2
> CPU topo: Max. logical nodes: 1
> CPU topo: Num. nodes per package: 1
> CPU topo: Max. logical dies: 2
> CPU topo: Max. dies per package: 1
> CPU topo: Max. threads per core: 1
> CPU topo: Num. cores per package: 1
> CPU topo: Num. threads per package: 1
> CPU topo: Allowing 2 present CPUs plus 0 hotplug CPUs
> kvm-guest: APIC: eoi() replaced with kvm_guest_apic_eoi_write()
> PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff]
> PM: hibernation: Registered nosave memory: [mem 0x0009f000-0x000fffff]
> PM: hibernation: Registered nosave memory: [mem 0x7ffdf000-0xffffffff]
> [gap 0xc0000000-0xfed1bfff] available for PCI devices
> Booting paravirtualized kernel on KVM
> clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
> Zone ranges:
> DMA [mem 0x0000000000001000-0x0000000000ffffff]
> DMA32 [mem 0x0000000001000000-0x00000000ffffffff]
> Normal [mem 0x0000000100000000-0x000000023fffffff]
> Device empty
> Movable zone start for each node
> Early memory node ranges
> node 0: [mem 0x0000000000001000-0x000000000009efff]
> node 0: [mem 0x0000000000100000-0x000000007ffdefff]
> node 0: [mem 0x0000000100000000-0x0000000160000fff]
> node 1: [mem 0x0000000160001000-0x000000023fffffff]
> Initmem setup node 0 [mem 0x0000000000001000-0x0000000160000fff]
> Initmem setup node 1 [mem 0x0000000160001000-0x000000023fffffff]
> On node 0, zone DMA: 1 pages in unavailable ranges
> On node 0, zone DMA: 97 pages in unavailable ranges
> On node 0, zone Normal: 33 pages in unavailable ranges
> setup_percpu: NR_CPUS:8 nr_cpumask_bits:2 nr_cpu_ids:2 nr_node_ids:2
> percpu: Embedded 71 pages/cpu s250120 r8192 d32504 u2097152
> kvm-guest: PV spinlocks disabled, no host support
> Kernel command line: earlyprintk=serial net.ifnames=0 sysctl.kernel.hung_task_all_cpu_backtrace=1 ima_policy=tcb nf-conntrack-ftp.ports=20000 nf-conntrack-tftp.ports=20000 nf-conntrack-sip.ports=20000 nf-conntrack-irc.ports=20000 nf-conntrack-sane.ports=20000 binder.debug_mask=0 rcupdate.rcu_expedited=1 rcupdate.rcu_cpu_stall_cputime=1 no_hash_pointers page_owner=on sysctl.vm.nr_hugepages=4 sysctl.vm.nr_overcommit_hugepages=4 secretmem.enable=1 sysctl.max_rcu_stall_to_panic=1 msr.allow_writes=off coredump_filter=0xffff root=/dev/sda console=ttyS0 vsyscall=native numa=fake=2 kvm-intel.nested=1 spec_store_bypass_disable=prctl nopcid vivid.n_devs=64 vivid.multiplanar=1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2 netrom.nr_ndevs=32 rose.rose_ndevs=32 smp.csd_lock_timeout=100000 watchdog_thresh=55 workqueue.watchdog_thresh=140 sysctl.net.core.netdev_unregister_timeout_secs=140 dummy_hcd.num=32 max_loop=32 nbds_max=32 \
> Kernel command line: comedi.comedi_num_legacy_minors=4 panic_on_warn=1 root=/dev/sda console=ttyS0 root=/dev/sda1
> Unknown kernel command line parameters "nbds_max=32", will be passed to user space.
> printk: log buffer data + meta data: 262144 + 917504 = 1179648 bytes
> software IO TLB: area num 2.
> Fallback order for Node 0: 0 1
> Fallback order for Node 1: 1 0
> Built 2 zonelists, mobility grouping on. Total pages: 1834877
> Policy zone: Normal
> mem auto-init: stack:all(zero), heap alloc:on, heap free:off
> stackdepot: allocating hash table via alloc_large_system_hash
> stackdepot hash table entries: 1048576 (order: 12, 16777216 bytes, linear)
> stackdepot: allocating space for 8192 stack pools via memblock
> ------------[ cut here ]------------
> kernel BUG at ./include/linux/page_ref.h:171!
> Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
> CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted syzkaller #0 PREEMPT(undef)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> RIP: 0010:get_page_bootmem+0x188/0x190
> Code: 86 ff 90 0f 0b e8 98 52 86 ff 90 0f 0b e8 90 52 86 ff 48 89 df 48 c7 c6 00 e4 dd 8b e8 51 d7 e8 fe 90 0f 0b e8 79 52 86 ff 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90
> RSP: 0000:ffffffff8e407e50 EFLAGS: 00010093
> RAX: ffffffff823f42b7 RBX: ffffea00057ffec0 RCX: ffffffff8e494ec0
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
> RBP: 0000000000000001 R08: ffffea00057ffef7 R09: 1ffffd4000afffde
> R10: dffffc0000000000 R11: fffff94000afffdf R12: dffffc0000000000
> R13: 0000000000000000 R14: ffffea00057ffef4 R15: 0000000000000003
> FS: 0000000000000000(0000) GS:ffff88818de62000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffff88823ffff000 CR3: 000000000e54c000 CR4: 00000000000000b0
> Call Trace:
> <TASK>
> register_page_bootmem_info_node+0x88/0x410
> register_page_bootmem_info+0x77/0xc0
> mem_init+0x5a/0xb0
> mm_core_init+0x79/0xb0
> start_kernel+0x15a/0x3d0
> x86_64_start_reservations+0x24/0x30
> x86_64_start_kernel+0x143/0x1c0
> common_startup_64+0x13e/0x147
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:get_page_bootmem+0x188/0x190
> Code: 86 ff 90 0f 0b e8 98 52 86 ff 90 0f 0b e8 90 52 86 ff 48 89 df 48 c7 c6 00 e4 dd 8b e8 51 d7 e8 fe 90 0f 0b e8 79 52 86 ff 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90
> RSP: 0000:ffffffff8e407e50 EFLAGS: 00010093
> RAX: ffffffff823f42b7 RBX: ffffea00057ffec0 RCX: ffffffff8e494ec0
> RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
> RBP: 0000000000000001 R08: ffffea00057ffef7 R09: 1ffffd4000afffde
> R10: dffffc0000000000 R11: fffff94000afffdf R12: dffffc0000000000
> R13: 0000000000000000 R14: ffffea00057ffef4 R15: 0000000000000003
> FS: 0000000000000000(0000) GS:ffff88818de62000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffff88823ffff000 CR3: 000000000e54c000 CR4: 00000000000000b0
>
>
> ***
>
> If these findings have caused you to resend the series or submit a
> separate fix, please add the following tag to your commit message:
> Tested-by: syzbot@syzkaller.appspotmail.com
>
> ---
> This report is generated by a bot. It may contain errors.
> syzbot ci engineers can be reached at syzkaller@googlegroups.com.
>
> To test a patch for this bug, please reply with `#syz test`
> (should be on a separate line).
>
> The patch should be attached to the email.
> Note: arguments like custom git repos and branches are not supported.
^ permalink raw reply related
* Re: [PATCH] dt-bindings: iio: dac: mcp47feb02: Fix I2C address in example
From: Krzysztof Kozlowski @ 2026-04-20 12:29 UTC (permalink / raw)
To: Ariana Lazar, Jonathan Cameron, David Lechner, Nuno Sá,
Andy Shevchenko, Rob Herring, Krzysztof Kozlowski, Conor Dooley
Cc: Conor Dooley, Jonathan Cameron, linux-iio, devicetree,
linux-kernel
In-Reply-To: <20260420-mcp47feb02-fix6-v1-1-ae1808fea11d@microchip.com>
On 20/04/2026 12:36, Ariana Lazar wrote:
> Change example reg value from 0 to 0x60 in order to use a valid I2C address
>
> Fixes: 4ba12d304175 ("dt-bindings: iio: dac: adding support for Microchip MCP47FEB02")
No bug here, that's just example DTS, so drop the fixes. Otherwise
please explain the bug in commit msg.
> Link: https://lore.kernel.org/all/dd0dbadb-604b-4f12-8674-268b7db096fd@baylibre.com/
So you got this report 2 weeks ago and what happened exactly? What are
you fixing here?
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH] iio: adc: ad7816: use sysfs_emit() instead of sprintf()
From: Greg KH @ 2026-04-20 12:30 UTC (permalink / raw)
To: Minu Jin
Cc: lars, jic23, Michael.Hennerich, andy, linux-iio, linux-staging,
linux-kernel
In-Reply-To: <20260420112720.1662703-1-s9430939@naver.com>
On Mon, Apr 20, 2026 at 08:27:20PM +0900, Minu Jin wrote:
> Replace sprintf() with sysfs_emit().
> sysfs_emit() is preferred than sprintf() in show() functions.
For _new_ functions, not existing ones.
> It has aware of the PAGE_SIZE buffer limit and ensures safe buffer handling.
Are any of the current usages incorrect? If not, no need to change
this.
thanks,
greg k-h
^ permalink raw reply
* [PATCH v2 0/3] ASoC: qcom: lpass: Switch VA/WSA macros to PM clock framework
From: Ajay Kumar Nandam @ 2026-04-20 12:28 UTC (permalink / raw)
To: Srinivas Kandagatla, Liam Girdwood, Mark Brown, Jaroslav Kysela,
Takashi Iwai
Cc: linux-sound, linux-arm-msm, linux-kernel, mohammad.rafi.shaik,
ajay.nandam
This series converts LPASS WSA and VA macro codec drivers to the PM
clock framework for runtime PM clock handling.
Clock enable/disable sequencing during runtime suspend/resume is moved
to pm_clk helpers, while regcache state handling remains in the driver
runtime PM callbacks. This aligns these codec drivers with common LPASS
runtime PM patterns and reduces idle clock voting.
Patch 3 switches WSA MCLK clock registration to devm-managed
clk_hw registration.
---
v1: lore.kernel.org/r/20260413121824.375473-1-ajay.nandam@oss.qualcomm.com
Changes since v1:
- Fixed runtime resume error handling in WSA/VA paths:
- keep regcache cache-only on pm_clk_resume() failure
- unwind clocks with pm_clk_suspend() if regcache_sync() fails
- Dropped the separate "Guard optional NPL clock rate programming"
patch as discussed on list
Ajay Kumar Nandam (3):
ASoC: codecs: lpass-wsa-macro: Switch to PM clock framework for
runtime PM
ASoC: codecs: lpass-va-macro: Switch to PM clock framework for runtime
PM
ASoC: codecs: lpass-wsa-macro: Use devm_clk_hw_register() for MCLK
output
sound/soc/codecs/lpass-va-macro.c | 123 ++++++++++++++---------------
sound/soc/codecs/lpass-wsa-macro.c | 115 +++++++++------------------
2 files changed, 97 insertions(+), 141 deletions(-)
--
2.34.1
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox