From 762e78269933d3bd8c3580e0f49bf8a59002ee9f Mon Sep 17 00:00:00 2001 From: Jacob Martin Date: Thu, 21 May 2026 17:28:19 -0500 Subject: [PATCH 1/7] UBUNTU: Start new release Ignore: yes Signed-off-by: Jacob Martin --- debian.nvidia-6.17/changelog | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/debian.nvidia-6.17/changelog b/debian.nvidia-6.17/changelog index 6ce47210cd67c..68347e0237ef9 100644 --- a/debian.nvidia-6.17/changelog +++ b/debian.nvidia-6.17/changelog @@ -1,3 +1,11 @@ +linux-nvidia-6.17 (6.17.0-1019.19) UNRELEASED; urgency=medium + + CHANGELOG: Do not edit directly. Autogenerated at release. + CHANGELOG: Use the printchanges target to see the current changes. + CHANGELOG: Use the insertchanges target to create the final log. + + -- Jacob Martin Thu, 21 May 2026 17:28:19 -0500 + linux-nvidia-6.17 (6.17.0-1018.18) noble; urgency=medium * noble/linux-nvidia-6.17: 6.17.0-1018.18 -proposed tracker (LP: #2150807) From 85942237c09224a4aa499cb6fe8c0af2a92d94e8 Mon Sep 17 00:00:00 2001 From: Jacob Martin Date: Thu, 21 May 2026 17:29:28 -0500 Subject: [PATCH 2/7] UBUNTU: link-to-tracker: update tracking bug BugLink: https://bugs.launchpad.net/bugs/2153495 Properties: no-test-build Signed-off-by: Jacob Martin --- debian.nvidia-6.17/tracking-bug | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian.nvidia-6.17/tracking-bug b/debian.nvidia-6.17/tracking-bug index 7b34b11538516..201f574f716fa 100644 --- a/debian.nvidia-6.17/tracking-bug +++ b/debian.nvidia-6.17/tracking-bug @@ -1 +1 @@ -2150807 d2026.04.27-1 +2153495 d2026.05.20-1 From dc53e35259e98bd17fc31d1cf775838c03ca0bd8 Mon Sep 17 00:00:00 2001 From: Jacob Martin Date: Thu, 21 May 2026 17:33:18 -0500 Subject: [PATCH 3/7] UBUNTU: [Packaging] debian.nvidia-6.17/dkms-versions -- update from kernel-versions (main/d2026.05.20) BugLink: https://bugs.launchpad.net/bugs/1786013 Signed-off-by: Jacob Martin --- debian.nvidia-6.17/dkms-versions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian.nvidia-6.17/dkms-versions b/debian.nvidia-6.17/dkms-versions index 3bbe1eb0f1037..eb578e986417a 100644 --- a/debian.nvidia-6.17/dkms-versions +++ b/debian.nvidia-6.17/dkms-versions @@ -1,4 +1,4 @@ zfs-linux 2.3.4-1ubuntu2 modulename=zfs debpath=pool/universe/z/%package%/zfs-dkms_%version%_all.deb arch=amd64 arch=arm64 arch=ppc64el arch=s390x arch=riscv64 rprovides=spl-modules rprovides=spl-dkms rprovides=zfs-modules rprovides=zfs-dkms v4l2loopback 0.15.0-0ubuntu2.1 modulename=v4l2loopback debpath=pool/universe/v/%package%/v4l2loopback-dkms_%version%_all.deb arch=amd64 rprovides=v4l2loopback-modules rprovides=v4l2loopback-dkms mstflint 4.26.0-1 modulename=mstflint_access debpath=pool/universe/m/%package%/mstflint-dkms_%version%_all.deb arch=amd64 arch=arm64 rprovides=mstflint-modules rprovides=mstflint-dkms -nvidia-fs 2.28.2-1 modulename=nvidia-fs debpath=pool/universe/n/%package%/nvidia-fs-dkms_%version%_amd64.deb arch=amd64 arch=arm64 rprovides=nvidia-fs-modules rprovides=nvidia-fs-dkms type=standalone +nvidia-fs 2.28.4-1 modulename=nvidia-fs debpath=pool/universe/n/%package%/nvidia-fs-dkms_%version%_amd64.deb arch=amd64 arch=arm64 rprovides=nvidia-fs-modules rprovides=nvidia-fs-dkms type=standalone From bbcac7b13dce4411320d5edc107bf4c0ec1bb054 Mon Sep 17 00:00:00 2001 From: Jacob Martin Date: Thu, 21 May 2026 17:33:58 -0500 Subject: [PATCH 4/7] UBUNTU: [Config] nvidia-6.17: update annotations for missing whitespace Ignore: yes Signed-off-by: Jacob Martin --- debian.nvidia-6.17/config/annotations | 1 + 1 file changed, 1 insertion(+) diff --git a/debian.nvidia-6.17/config/annotations b/debian.nvidia-6.17/config/annotations index da33e0be1fd0a..a231bdfb9850a 100644 --- a/debian.nvidia-6.17/config/annotations +++ b/debian.nvidia-6.17/config/annotations @@ -258,6 +258,7 @@ CONFIG_ULTRASOC_SMB note<'Required for Grace enablem CONFIG_VFIO_CXL_CORE policy<{'amd64': 'y', 'arm64': 'y'}> CONFIG_VFIO_CXL_CORE note<'Enable VFIO CXL core for CXL Type-2 device passthrough support'> + # ---- Annotations without notes ---- CONFIG_ACPI_MPAM policy<{'amd64': '-', 'arm64': 'y'}> From 42cad5f4d28a80419064faacc306195f27d6adec Mon Sep 17 00:00:00 2001 From: Jacob Martin Date: Thu, 21 May 2026 17:34:48 -0500 Subject: [PATCH 5/7] UBUNTU: Ubuntu-nvidia-6.17-6.17.0-1019.19 Signed-off-by: Jacob Martin --- debian.nvidia-6.17/changelog | 313 ++++++++++++++++++++++++++++++++++- 1 file changed, 308 insertions(+), 5 deletions(-) diff --git a/debian.nvidia-6.17/changelog b/debian.nvidia-6.17/changelog index 68347e0237ef9..11559efd43d80 100644 --- a/debian.nvidia-6.17/changelog +++ b/debian.nvidia-6.17/changelog @@ -1,10 +1,313 @@ -linux-nvidia-6.17 (6.17.0-1019.19) UNRELEASED; urgency=medium +linux-nvidia-6.17 (6.17.0-1019.19) noble; urgency=medium - CHANGELOG: Do not edit directly. Autogenerated at release. - CHANGELOG: Use the printchanges target to see the current changes. - CHANGELOG: Use the insertchanges target to create the final log. + * noble/linux-nvidia-6.17: 6.17.0-1019.19 -proposed tracker (LP: #2153495) - -- Jacob Martin Thu, 21 May 2026 17:28:19 -0500 + * Packaging resync (LP: #1786013) + - [Packaging] update variants + - [Packaging] debian.nvidia-6.17/dkms-versions -- update from kernel- + versions (main/d2026.05.20) + + * CXL VFIO: Add CXL Type-2 device passthrough support (LP: #2152222) + - crypto: hisilicon - qm updates BAR configuration + - hisi_acc_vfio_pci: adapt to new migration configuration + - vfio/nvgrace-gpu: fix grammatical error + - vfio: Provide a get_region_info op + - vfio/hisi: Convert to the get_region_info op + - vfio/virtio: Convert to the get_region_info op + - vfio/nvgrace: Convert to the get_region_info op + - vfio/pci: Fill in the missing get_region_info ops + - vfio/mtty: Provide a get_region_info op + - vfio/mdpy: Provide a get_region_info op + - vfio/mbochs: Provide a get_region_info op + - vfio/platform: Provide a get_region_info op + - vfio/fsl: Provide a get_region_info op + - vfio/cdx: Provide a get_region_info op + - vfio/ccw: Provide a get_region_info op + - vfio/gvt: Provide a get_region_info op + - vfio: Require drivers to implement get_region_info + - vfio: Add get_region_info_caps op + - vfio/mbochs: Convert mbochs to use vfio_info_add_capability() + - vfio/gvt: Convert to get_region_info_caps + - vfio/ccw: Convert to get_region_info_caps + - vfio/pci: Convert all PCI drivers to get_region_info_caps + - vfio/platform: Convert to get_region_info_caps + - vfio: Move the remaining drivers to get_region_info_caps + - vfio: Remove the get_region_info op + - NVIDIA: VR: SAUCE: cxl: Add cxl_get_hdm_info() for HDM decoder metadata + - NVIDIA: VR: SAUCE: cxl: Declare cxl_find_regblock and + cxl_probe_component_regs in public header + - NVIDIA: VR: SAUCE: cxl: Move component/HDM register defines to + uapi/cxl/cxl_regs.h + - NVIDIA: VR: SAUCE: cxl: Split cxl_await_range_active() from media-ready + wait + - NVIDIA: VR: SAUCE: cxl: Record BIR and BAR offset in cxl_register_map + - NVIDIA: VR: SAUCE: vfio: UAPI for CXL-capable PCI device assignment + - NVIDIA: VR: SAUCE: vfio/pci: Add CXL state to vfio_pci_core_device + - NVIDIA: VR: SAUCE: vfio/pci: Add CONFIG_VFIO_CXL_CORE and stub CXL hooks + - NVIDIA: VR: SAUCE: vfio/cxl: Detect CXL DVSEC and probe HDM block + - NVIDIA: VR: SAUCE: vfio/pci: Export config access helpers + - NVIDIA: VR: SAUCE: vfio/cxl: Introduce HDM decoder register emulation + framework + - NVIDIA: VR: SAUCE: vfio/cxl: Wait for HDM ranges and create memdev + - NVIDIA: VR: SAUCE: vfio/cxl: CXL region management support + - NVIDIA: VR: SAUCE: vfio/cxl: DPA VFIO region with demand fault mmap and + reset zap + - NVIDIA: VR: SAUCE: vfio/cxl: Virtualize CXL DVSEC config writes + - NVIDIA: VR: SAUCE: vfio/cxl: Register regions with VFIO layer + - NVIDIA: VR: SAUCE: vfio/pci: Advertise CXL cap and sparse component BAR + to userspace + - NVIDIA: VR: SAUCE: vfio/cxl: Provide opt-out for CXL feature + - NVIDIA: VR: SAUCE: docs: vfio-pci: Document CXL Type-2 device + passthrough + - NVIDIA: VR: SAUCE: cxl: Export the CXL reset helpers for VFIO users + - NVIDIA: VR: SAUCE: vfio/pci: Wire CXL DPA reset handling + - NVIDIA: VR: SAUCE: vfio/cxl: Ensure PCI Memory Space is enabled before + post-reset BAR access + - NVIDIA: VR: SAUCE: vfio/cxl: preserve HDM decoder base addresses across + reset + - NVIDIA: VR: SAUCE: vfio/cxl: virtualize DVSEC STATUS2 register in + vconfig shadow + - NVIDIA: VR: SAUCE: vfio/cxl: Implement vfio_cxl_reset() + - NVIDIA: VR: SAUCE: config: Enable CONFIG_VFIO_CXL_CORE for CXL Type-2 + passthrough + + * Refresh series: Allow ATS to be always on for certain ATS-capable devices + (LP: #2150727) + - Revert "NVIDIA: VR: SAUCE: iommu/arm-smmu-v3: Allow ATS to be always on" + - Revert "NVIDIA: VR: SAUCE: PCI: Allow ATS to be always on for non-CXL + NVIDIA GPUs" + - Revert "NVIDIA: VR: SAUCE: PCI: Allow ATS to be always on for CXL.cache + capable devices" + - NVIDIA: VR: SAUCE: PCI: Allow ATS to be always on for CXL.cache capable + devices + - NVIDIA: VR: SAUCE: PCI: Allow ATS to be always on for pre-CXL devices + - NVIDIA: VR: SAUCE: iommu/arm-smmu-v3: Allow ATS to be always on + + * Backport lan743x driver patches (LP: #2152064) + - net: microchip: lan743x: add ethtool nway_reset support + - net: lan743x: fix SGMII detection on PCI1xxxx B0+ during warm reset + - net: lan743x: fix duplex configuration in mac_link_up + - net: lan743x: rename chip_rev to fpga_rev + + [ Ubuntu: 6.17.0-29.29 ] + + * questing/linux: 6.17.0-29.29 -proposed tracker (LP: #2151099) + * CVE-2026-31419 + - net: bonding: fix use-after-free in bond_xmit_broadcast() + * CVE-2026-31431 + - crypto: algif_aead - Revert to operating out-of-place + - crypto: algif_aead - snapshot IV for async AEAD requests + - crypto: authencesn - Do not place hiseq at end of dst for out-of-place + decryption + - crypto: authencesn - Fix src offset when decrypting in-place + - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl + - crypto: algif_aead - Fix minimum RX size check for decryption + * CVE-2026-31533 + - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption + * CVE-2026-31504 + - net: fix fanout UAF in packet_release() via NETDEV_UP race + + [ Ubuntu: 6.17.0-28.28 ] + + * questing/linux: 6.17.0-28.28 -proposed tracker (LP: #2150051) + * Linux kernel 6.17.0-22.22 breaks amdxdna (LP: #2149766) + - Revert "iommu: disable SVA when CONFIG_X86 is set" + + [ Ubuntu: 6.17.0-24.24 ] + + * questing/linux: 6.17.0-24.24 -proposed tracker (LP: #2148025) + * Remount ext4 to readonly with data=journal mode may dump call trace + (LP: #2147400) + - ext4: fix stale xarray tags after writeback + * System hangs during stress-ng stack test (LP: #2137755) + - mm, swap: fix swap cache index error when retrying reclaim + * BUG: kernel NULL pointer dereference when starting VM inside a container + (LP: #2147374) + - apparmor: fix NULL pointer dereference in __unix_needs_revalidation + * BUG: kernel NULL pointer dereference in amdgpu (LP: #2144577) + - drm/amdgpu: validate the flush_gpu_tlb_pasid() + - drm/amdgpu: Fix validating flush_gpu_tlb_pasid() + * Jellyfin Desktop Flatpak doesn't work with the current AppArmor profile + (LP: #2142956) + - SAUCE: apparmor5.0.0 [53/57]: apparmor: fix af_unix local addr mediation + binding + * Fine grained network mediation was broken if v8/v9 was used (LP: #2142860) + - SAUCE: apparmor5.0.0 [29/57]: apparmor: fix fine grained inet mediation + sock_file_perm + * Enable CirrusLogic audio solution CS42L45+CS35L63 on AMD and Intel PTL + (LP: #2143104) + - ASoC: amd: acp: Add ACP7.0 match entries for cs35l56 and cs42l43 + - ASoC: amd: acp: soc-acpi: add is_device_rt712_vb() helper + - ASoC: amd: acp: Sort match table into most specific first + - ASoC: amd: acp: Rename Cirrus Logic component match entries to include + link and uid + - ASoC: amd: acp: Sort Cirrus Logic match entries + - ASoC: amd: acp: Add ACP7.0 match entries for Cirrus Logic parts + - ASoC: amd: acp: Fix Kconfig dependencies for + SND_SOC_ACPI_AMD_SDCA_QUIRKS + - [Config] Enable SND_SOC_ACPI_AMD_SDCA_QUIRKS + - soundwire: amd: add clock init control function + - soundwire: amd: refactor bandwidth calculation logic + * CVE-2026-23112 + - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec + * Canonical Kmod 2025 key rotation (LP: #2147447) + - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing + extensible + - [Packaging] ubuntu-compatible-signing -- allow consumption of positive + certs + - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key + - [Config] prepare for Canonical Kmod key rotation + - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key + - [Packaging] ensure our cert rollups are always fresh + * Questing update: upstream stable patchset 2026-03-24 (LP: #2146193) + - mptcp: fallback earlier on simult connection + - mm: consider non-anon swap cache folios in folio_expected_ref_count() + - mptcp: ensure context reset on disconnect() + - wifi: mac80211: Discard Beacon frames to non-broadcast address + - net: phy: mediatek: fix nvmem cell reference leak in + mt798x_phy_calibration + - drm/amdgpu: Forward VMID reservation errors + - sched/fair: Small cleanup to sched_balance_newidle() + - sched/fair: Small cleanup to update_newidle_cost() + - sched/fair: Proportional newidle balance + - Revert "iommu/amd: Skip enabling command/event buffers for kdump" + - sched/proxy: Yield the donor task + - drm: nova: depend on CONFIG_64BIT + - sched/core: Add comment explaining force-idle vruntime snapshots + - mm/huge_memory: merge uniform_split_supported() and + non_uniform_split_supported() + - drm/amdgpu: don't attach the tlb fence for SI + - sched_ext: fix uninitialized ret on alloc_percpu() failure + - idpf: fix LAN memory regions command on some NVMs + - Bluetooth: MGMT: report BIS capability flags in supported settings + - powerpc/tools: drop `-o pipefail` in gcc check scripts + - net: airoha: Move net_devs registration in a dedicated routine + - net: wangxun: move PHYLINK dependency + - platform/x86/intel/pmt: Fix kobject memory leak on init failure + - bng_en: update module description + - mcb: Add missing modpost build support + - net: mdio: rtl9300: use scoped for loops + - tools/sched_ext: fix scx_show_state.py for scx_root change + - platform/x86/intel/pmt/discovery: use valid device pointer in + dev_err_probe + - net: fib: restore ECMP balance from loopback + - RDMA/mana_ib: check cqe length for kernel CQs + - drm/gem-shmem: Fix the MODULE_LICENSE() string + - kunit: Enforce task execution in {soft,hard}irq contexts + - ublk: don't pass q_id to ublk_queue_cmd_buf_size() + - ublk: implement NUMA-aware memory allocation + - ublk: scan partition in async way + - drm/xe/guc: READ/WRITE_ONCE g2h_fence->done + - IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path + - hisi_acc_vfio_pci: Add .match_token_uuid callback in + hisi_acc_vfio_pci_migrn_ops + - mm, swap: do not perform synchronous discard during allocation + - clk: qcom: mmcc-sdm660: Add missing MDSS reset + - clk: qcom: Fix SM_VIDEOCC_6350 dependencies + - [Config] set CONFIG_SM_GCC_6350, CONFIG_SM_VIDEOCC_6350 to '-' + - clk: qcom: Fix dependencies of QCS_{DISP,GPU,VIDEO}CC_615 + - [Config] set CONFIG_QCS_{DISP,GPU,VIDEO}CC_615 to '-' + - arm64: dts: ti: k3-am62d2-evm: Fix regulator properties + - arm64: dts: ti: k3-am62d2-evm: Fix PMIC padconfig + - arm64: dts: st: Add memory-region-names property for stm32mp257f-ev1 + - arm64: dts: qcom: sm6350: Fix wrong order of freq-table-hz for UFS + - NFSD: Make FILE_SYNC WRITEs comply with spec + - nvmet: pci-epf: move DMA initialization to EPC init callback + - PCI: dwc: Add support for ELBI resource mapping + - PCI: meson: Fix parsing the DBI register region + - power: supply: max77705: Fix potential IRQ chip conflict when probing + two devices + - media: iris: Refine internal buffer reconfiguration logic for resolution + change + - LoongArch: Fix arch_dup_task_struct() for CONFIG_RANDSTRUCT + - mm/damon/tests/core-kunit: fix memory leak in + damon_test_set_filters_default_reject() + - mm/damon/tests/core-kunit: handle alloc failures on + damon_test_set_filters_default_reject() + - mm/damon/tests/core-kunit: handle alloc failures on + damos_test_filter_out() + - af_unix: don't post cmsg for SO_INQ unless explicitly asked for + - kernel/kexec: change the prototype of kimage_map_segment() + - selftests/mm: fix thread state check in uffd-unit-tests + - LoongArch: BPF: Save return address register ra to t0 before trampoline + - LoongArch: BPF: Enable trampoline-based tracing for module functions + - LoongArch: BPF: Adjust the jump offset of tail calls + - platform/x86: samsung-galaxybook: Fix problematic pointer cast + - platform/x86: alienware-wmi-wmax: Add support for new Area-51 laptops + - platform/x86: alienware-wmi-wmax: Add AWCC support for Alienware x16 + - platform/x86: alienware-wmi-wmax: Add support for Alienware 16X Aurora + - drm/amdgpu/sdma6: Update SDMA 6.0.3 FW version to include UMQ protected- + fence fix + - drm/rockchip: Set VOP for the DRM DMA device + - drm/mediatek: mtk_hdmi: Fix probe device leaks + - drm/mediatek: ovl_adaptor: Fix probe device leaks + - drm/amd: Fix unbind/rebind for VCN 4.0.5 + - drm/rockchip: vop2: Use OVL_LAYER_SEL configuration instead of use + win_mask calculate used layers + - drm/bridge: ti-sn65dsi83: ignore PLL_UNLOCK errors + - drm/nouveau/gsp: Allocate fwsec-sb at boot + - drm/xe/eustall: Disallow 0 EU stall property values + - drm/xe/svm: Fix a debug printout + - powercap: intel_rapl: Add support for Wildcat Lake platform + - powercap: intel_rapl: Add support for Nova Lake processors + - LoongArch: BPF: Enhance the bpf_arch_text_poke() function + - SAUCE: remove git merge section marker + - Upstream stable to v6.12.65, v6.18.4 + * Questing update: upstream stable patchset 2026-03-24 (LP: #2146193) // + CVE-2025-71141 + - drm/tilcdc: Fix removal actions in case of failed probe + * Questing update: upstream stable patchset 2026-03-24 (LP: #2146193) // + CVE-2025-71090 + - nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() + * Questing update: upstream stable patchset 2026-03-24 (LP: #2146193) // + CVE-2025-71139 + - kernel/kexec: fix IMA when allocation happens in CMA area + * Questing update: upstream stable patchset 2026-03-24 (LP: #2146193) // + CVE-2025-71152 + - net: dsa: properly keep track of conduit reference + * Questing update: upstream stable patchset 2026-03-24 (LP: #2146193) // + CVE-2025-71142 + - cpuset: fix warning when disabling remote partition + * Questing update: upstream stable patchset 2026-03-24 (LP: #2146193) // + CVE-2025-71155 + - KVM: s390: Fix gmap_helper_zap_one_page() again + * Questing update: upstream stable patchset 2026-03-24 (LP: #2146193) // + CVE-2025-71134 + - mm/page_alloc: change all pageblocks migrate type on coalescing + * CVE-2026-23394 + - af_unix: Give up GC if MSG_PEEK intervened. + * [SRU] MIPI camera is not working after upgrading to 6.17-oem + (LP: #2145171) + - SAUCE: ACPI: respect items already in honor_dep before skipping + * ADATA SU680 causes repeated SATA resets and I/O errors on Ubuntu unless + link power management is forced to max_performance (LP: #2144060) + - ata: libata-core: disable LPM on ADATA SU680 SSD + * [SRU] Fix for i915 PSR issue on SDC panels on Intel PTL (LP: #2144637) + - drm/i915/psr: Panel Replay SU cap dpcd read return value + - drm/i915/psr: Add panel granularity information into intel_connector + - drm/i915/psr: Use SU granularity information available in + intel_connector + - drm/dp: Add definition for Panel Replay full-line granularity + - drm/i915/psr: Fix for Panel Replay X granularity DPCD register handling + * Got black screen after clicked logout button (LP: #2143100) + - drm/i915/alpm: ALPM disable fixes + * Dell Machines cannot boot into OS with 6.17.0-1012-oem (LP: #2144522) + - drm/amd: Disable MES LR compute W/A + - drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52 + * [SRU] Duplicated entries in /proc//mountinfo (LP: #2143083) + - namespace: fix proc mount iteration + * CVE-2026-23274 + - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels + * macvlan: observe an RCU grace period in macvlan_common_newlink() error + path (LP: #2144380) // CVE-2026-23209 + - macvlan: observe an RCU grace period in macvlan_common_newlink() error + path + * CVE-2026-23351 + - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase + * CVE-2026-23231 + - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() + + -- Jacob Martin Thu, 21 May 2026 17:34:48 -0500 linux-nvidia-6.17 (6.17.0-1018.18) noble; urgency=medium From 745cbbd9c8c8eb752d10a8ecdcd218c61acbca82 Mon Sep 17 00:00:00 2001 From: Fenghua Yu Date: Mon, 15 Jun 2026 16:14:16 +0000 Subject: [PATCH 6/7] arm_mpam: Consider overflow in bandwidth counter state Use the overflow status bit to track overflow on each bandwidth counter read and add the counter size to the correction when overflow is detected. This assumes that only a single overflow has occurred since the last read of the counter. Overflow interrupts, on hardware that supports them could be used to remove this limitation. Cc: Zeng Heng Reviewed-by: Gavin Shan Reviewed-by: Zeng Heng Reviewed-by: Jonathan Cameron Reviewed-by: Shaopeng Tan Reviewed-by: Fenghua Yu Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Shaopeng Tan Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas (backported from commit b35363793291e36c91d4a5b62d7ae7079c70d826) Signed-off-by: Fenghua Yu [fenghuay: Differences from upstream b35363793291: - Retains NV long-counter read paths, reset_on_next_read, and T241 now *= 64. - Applies T241 overflow correction * 64 inline in __ris_msmon_read() (moved to mpam_msmon_overflow_val() wrapper in the 9e5afb7 follow-up commit). ] --- drivers/resctrl/mpam_devices.c | 41 ++++++++++++++++----------------- drivers/resctrl/mpam_internal.h | 2 +- 2 files changed, 21 insertions(+), 22 deletions(-) diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c index caf88c460dd28..3bac6745ac73b 100644 --- a/drivers/resctrl/mpam_devices.c +++ b/drivers/resctrl/mpam_devices.c @@ -1382,17 +1382,8 @@ static void write_msmon_ctl_flt_vals(struct mon_read *m, u32 ctl_val, static u64 mpam_msmon_overflow_val(enum mpam_device_features type) { - /* TODO: implement scaling counters */ - switch (type) { - case mpam_feat_msmon_mbwu_63counter: - return GENMASK_ULL(62, 0); - case mpam_feat_msmon_mbwu_44counter: - return GENMASK_ULL(43, 0); - case mpam_feat_msmon_mbwu_31counter: - return GENMASK_ULL(30, 0); - default: - return 0; - } + /* TODO: scaling, and long counters */ + return BIT_ULL(hweight_long(MSMON___VALUE)); } /* Call with MSC lock held */ @@ -1400,8 +1391,9 @@ static void __ris_msmon_read(void *arg) { bool nrdy = false; bool config_mismatch; + bool overflow; struct mon_read *m = arg; - u64 now, overflow_val = 0; + u64 now; struct mon_cfg *ctx = m->ctx; bool reset_on_next_read = false; struct mpam_msc_ris *ris = m->ris; @@ -1431,13 +1423,20 @@ static void __ris_msmon_read(void *arg) * This saves waiting for 'nrdy' on subsequent reads. */ read_msmon_ctl_flt_vals(m, &cur_ctl, &cur_flt); + overflow = cur_ctl & MSMON_CFG_x_CTL_OFLOW_STATUS; + clean_msmon_ctl_val(&cur_ctl); gen_msmon_ctl_flt_vals(m, &ctl_val, &flt_val); config_mismatch = cur_flt != flt_val || cur_ctl != (ctl_val | MSMON_CFG_x_CTL_EN); - if (config_mismatch || reset_on_next_read) + if (config_mismatch || reset_on_next_read) { write_msmon_ctl_flt_vals(m, ctl_val, flt_val); + overflow = false; + } else if (overflow) { + mpam_write_monsel_reg(msc, CFG_MBWU_CTL, + cur_ctl & ~MSMON_CFG_x_CTL_OFLOW_STATUS); + } switch (m->type) { case mpam_feat_msmon_csu: @@ -1477,18 +1476,18 @@ static void __ris_msmon_read(void *arg) mbwu_state = &ris->mbwu_state[ctx->mon]; - /* Add any pre-overflow value to the mbwu_state->val */ - if (mbwu_state->prev_val > now) { - overflow_val = mpam_msmon_overflow_val(m->type); + if (overflow) { + u64 overflow_val = mpam_msmon_overflow_val(m->type); + if (mpam_has_quirk(T241_MBW_COUNTER_SCALE_64, msc)) overflow_val *= 64; - overflow_val -= mbwu_state->prev_val; + mbwu_state->correction += overflow_val; } - mbwu_state->prev_val = now; - mbwu_state->correction += overflow_val; - - /* Include bandwidth consumed before the last hardware reset */ + /* + * Include bandwidth consumed before the last hardware reset and + * a counter size increment for each overflow. + */ now += mbwu_state->correction; break; default: diff --git a/drivers/resctrl/mpam_internal.h b/drivers/resctrl/mpam_internal.h index e006a1bdbd1ec..913821416bde6 100644 --- a/drivers/resctrl/mpam_internal.h +++ b/drivers/resctrl/mpam_internal.h @@ -327,7 +327,7 @@ struct msmon_mbwu_state { /* * The value to add to the new reading to account for power management, - * and shifts to trigger the overflow interrupt. + * and overflow. */ u64 correction; From 10c5aaac161a6dd48d12d9a0bdecc414c9c9c7c7 Mon Sep 17 00:00:00 2001 From: Fenghua Yu Date: Mon, 15 Jun 2026 16:14:16 +0000 Subject: [PATCH 7/7] arm_mpam: Use long MBWU counters if supported Now that the larger counter sizes are probed, make use of them. Callers of mpam_msmon_read() may not know (or care!) about the different counter sizes. Allow them to specify mpam_feat_msmon_mbwu and have the driver pick the counter to use. Only 32bit accesses to the MSC are required to be supported by the spec, but these registers are 64bits. The lower half may overflow into the higher half between two 32bit reads. To avoid this, use a helper that reads the top half multiple times to check for overflow. Signed-off-by: Rohit Mathew [morse: merged multiple patches from Rohit, added explicit counter selection ] Signed-off-by: James Morse Cc: Peter Newman Reviewed-by: Ben Horgan Reviewed-by: Jonathan Cameron Reviewed-by: Fenghua Yu Reviewed-by: Gavin Shan Reviewed-by: Shaopeng Tan Tested-by: Fenghua Yu Tested-by: Shaopeng Tan Tested-by: Carl Worth Tested-by: Gavin Shan Tested-by: Zeng Heng Tested-by: Hanjun Guo Signed-off-by: Ben Horgan Signed-off-by: Catalin Marinas (backported from commit 9e5afb7c32830bcd123976a7729ef4e2dff0cd77) Signed-off-by: Fenghua Yu [fenghuay: Partial port; NV tree already has long-counter read paths, mpam_msc_read_mbwu_l(), and T241-MPAM-6 workaround (d7c811dd0171). This commit ports per-width overflow correction, OFLOW_STATUS_L overflow detection, and T241 overflow correction scaling via mpam_msmon_overflow_val(). Differences from upstream 9e5afb7/dc48eb1: - 44/63-bit overflow: check OFLOW_STATUS_L | OFLOW_STATUS; upstream 9e5afb7 uses OFLOW_STATUS_L only. - T241 now *= 64 applies to all counter widths; upstream dc48eb1 skips 63-bit. ] --- drivers/resctrl/mpam_devices.c | 52 +++++++++++++++++++++++++--------- 1 file changed, 39 insertions(+), 13 deletions(-) diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c index 3bac6745ac73b..dac1ddd28e5a9 100644 --- a/drivers/resctrl/mpam_devices.c +++ b/drivers/resctrl/mpam_devices.c @@ -1380,10 +1380,31 @@ static void write_msmon_ctl_flt_vals(struct mon_read *m, u32 ctl_val, } } -static u64 mpam_msmon_overflow_val(enum mpam_device_features type) +static u64 __mpam_msmon_overflow_val(enum mpam_device_features type) { - /* TODO: scaling, and long counters */ - return BIT_ULL(hweight_long(MSMON___VALUE)); + /* TODO: implement scaling counters */ + switch (type) { + case mpam_feat_msmon_mbwu_63counter: + return BIT_ULL(hweight_long(MSMON___LWD_VALUE)); + case mpam_feat_msmon_mbwu_44counter: + return BIT_ULL(hweight_long(MSMON___L_VALUE)); + case mpam_feat_msmon_mbwu_31counter: + return BIT_ULL(hweight_long(MSMON___VALUE)); + default: + return 0; + } +} + +static u64 mpam_msmon_overflow_val(enum mpam_device_features type, + struct mpam_msc *msc) +{ + u64 overflow_val = __mpam_msmon_overflow_val(type); + + if (mpam_has_quirk(T241_MBW_COUNTER_SCALE_64, msc) && + type != mpam_feat_msmon_mbwu_63counter) + overflow_val *= 64; + + return overflow_val; } /* Call with MSC lock held */ @@ -1410,7 +1431,9 @@ static void __ris_msmon_read(void *arg) FIELD_PREP(MSMON_CFG_MON_SEL_RIS, ris->ris_idx); mpam_write_monsel_reg(msc, CFG_MON_SEL, mon_sel); - if (m->type == mpam_feat_msmon_mbwu) { + if (m->type == mpam_feat_msmon_mbwu_31counter || + m->type == mpam_feat_msmon_mbwu_44counter || + m->type == mpam_feat_msmon_mbwu_63counter) { mbwu_state = &ris->mbwu_state[ctx->mon]; if (mbwu_state) { reset_on_next_read = mbwu_state->reset_on_next_read; @@ -1423,7 +1446,13 @@ static void __ris_msmon_read(void *arg) * This saves waiting for 'nrdy' on subsequent reads. */ read_msmon_ctl_flt_vals(m, &cur_ctl, &cur_flt); - overflow = cur_ctl & MSMON_CFG_x_CTL_OFLOW_STATUS; + + if (mpam_feat_msmon_mbwu_31counter == m->type) + overflow = cur_ctl & MSMON_CFG_x_CTL_OFLOW_STATUS; + else if (mpam_feat_msmon_mbwu_44counter == m->type || + mpam_feat_msmon_mbwu_63counter == m->type) + overflow = cur_ctl & (MSMON_CFG_MBWU_CTL_OFLOW_STATUS_L | + MSMON_CFG_x_CTL_OFLOW_STATUS); clean_msmon_ctl_val(&cur_ctl); gen_msmon_ctl_flt_vals(m, &ctl_val, &flt_val); @@ -1435,7 +1464,9 @@ static void __ris_msmon_read(void *arg) overflow = false; } else if (overflow) { mpam_write_monsel_reg(msc, CFG_MBWU_CTL, - cur_ctl & ~MSMON_CFG_x_CTL_OFLOW_STATUS); + cur_ctl & + ~(MSMON_CFG_x_CTL_OFLOW_STATUS | + MSMON_CFG_MBWU_CTL_OFLOW_STATUS_L)); } switch (m->type) { @@ -1476,13 +1507,8 @@ static void __ris_msmon_read(void *arg) mbwu_state = &ris->mbwu_state[ctx->mon]; - if (overflow) { - u64 overflow_val = mpam_msmon_overflow_val(m->type); - - if (mpam_has_quirk(T241_MBW_COUNTER_SCALE_64, msc)) - overflow_val *= 64; - mbwu_state->correction += overflow_val; - } + if (overflow) + mbwu_state->correction += mpam_msmon_overflow_val(m->type, msc); /* * Include bandwidth consumed before the last hardware reset and