Repository navigation
Merge integration/aurora into aurora-wip - #761
Merged
Merged
Conversation
Submit validation (covers_ranges_batch and friends), translate_offset, vm_context_mask, new_execution_context and capacity only read VmInner, but took the full GPUVM exec lock: the VM reservation plus every external BO's reservation. Each submit therefore cost O(external BOs). Under virtio-gpu every guest BO is external (libkrun maps blobs through dma-buf export), so a game with ~15k BOs spent 12-20 ms per submit in drm_gpuvm_prepare_objects and was capped at single-digit fps. Every page-table and mapping change already holds the VM reservation, so readers need only that lock; use GpuVm::lock_inner() for them. Signed-off-by: Jonathan Goyvaerts <jonathan.goyvaerts@gmail.com> Assisted-by: LLM
Every map and unmap (user VM_BIND, kernel mappings such as each G17 submission's completion record, object teardown) took GpuVm::exec_lock(), i.e. drm_gpuvm_exec_lock(): the VM reservation plus the reservation of every external object. Under virtio-gpu every guest BO is external, so with ~15k BOs each bind and each submit spent around a millisecond in drm_gpuvm_prepare_objects(). This VM is IMMEDIATE_MODE and RESV_PROTECTED: VA updates need the VM reservation and each object's gpuva lock, which the link and unlink paths take themselves. Backing is pinned and its segments copied before any reservation is taken, no caller adds fences, and the driver already unmaps under the VM reservation alone on its low-memory path. Add GpuVm::exec_lock_vm(), which runs the drm_exec loop over the VM reservation (and an external obj, if given) without drm_gpuvm_prepare_objects(), and use it for all VA updates. Signed-off-by: Jonathan Goyvaerts <jonathan.goyvaerts@gmail.com> Assisted-by: LLM
…etired A queue remembered the earliest failed ordinal of each engine for good, and every later command whose prefix covered it was cancelled. GL orders each submission after every earlier one, so once one command of a queue failed, every later command of that queue was cancelled too. With cancellation no longer reported as a lost device, the client never noticed: after a CS2 GPU hang, one Hyprland render that sampled the game's failed buffer was cancelled, then every later Hyprland render (about 47 a second, all fences ECANCELED), and the screen kept the game's last frame until Hyprland or the machine restarted. New buffers did not help; the queue itself was poisoned. The record exists so that nothing runs before a failed producer the firmware may still own or replay. That holds only while the command keeps its VM pin: complete() and fail_unpublished() release it, fail_while_owned() keeps it until release_after_retirement(). Track the failed commands that still hold their pin and stop counting each one once it has released it. A failure that cannot be tracked for lack of memory keeps cancelling for good, as before. Signed-off-by: Jonathan Goyvaerts <jonathan.goyvaerts@gmail.com> Assisted-by: LLM
… the lid The fedora-aurora package builds a policy module of the same name, aurora_sep, but labels /dev/sep-bio aurora_sep_device_t where this tree says sep_bio_device_t. Only one module of a name is active per priority, so a Mac that moved from this tree's aurora-sep-selinux to the package logged "Context sep_bio_device_t became invalid" and was left with an unlabelled /dev/sep-bio, which fprintd may not open. Use the package's name. It follows the reference policy habit of prefixing a module's types with the module name. The package's module also has two rules this one lacks. libfprint's aurora build hides the reader while the lid is closed by following SW_LID on the input event devices. Under the targeted policy fprintd may not read those, logs "Cannot open /dev/input/eventN: Permission denied" and keeps offering Touch ID in clamshell. dev_read_input(fprintd_t) allows the read; the fprintd unit drop-in that libfprint ships already allows char-input for the device cgroup. The package also lets init_t open, read and query the device, for the readiness helpers its units run. Take both, so the two modules are the same policy. The README says what the input rule is for and that a module loaded by hand with semodule -i sits at priority 400 and shadows a packaged one. Bump the Fedora spec to 1-10 for the policy change, and the Arch pkgrel to 15 for the README checksum, since 1-9 and 14 went to the boot policy change. Built with the Fedora 44 selinux-policy-devel Makefile. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 7cc30f3)
…ETY.md The boot policy change rewrote load-driver and XART-SAFETY.md but left their old sums in the Arch PKGBUILD, so makepkg refuses the sources and tests/test_packaging.py fails on integration/aurora. Use the sums of the files in the tree. Every source sum now matches its file. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With controller wake enabled, bcm4377_suspend() returns success even when enable_irq_wake() fails. The MSI is then not a wake source, although HCI has been suspended for remote wake and the function remains in D0. A fault-injected callback test reproduces a zero return with HCI still suspended and no wake reference after enable_irq_wake() returns -ENXIO. Return the arming error and undo HCI suspension using the existing resume path. Clear the powered-resume epoch before that rollback, since no system sleep completed, and preserve the original error if HCI rollback also fails. Arm the IRQ before saving PCI state, so an aborted suspend does not leave a saved-state marker. The PM core does not invoke resume for the device whose suspend callback failed. The extracted PM callbacks pass host tests with mocked kernel APIs for arming failure, rollback failure, repeated successful wake cycles, wake-disabled quiescence and HCI suspend failure, with recovery support on and off. ARM64 kernel build and hardware wake qualification remain pending; this does not establish the cause of a particular machine hang. Fixes: 0609ca7 ("Bluetooth: hci_bcm4377: Support remote wakeup") Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> (cherry picked from commit d808471) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nvalidated When a queue is destroyed while it still has jobs on the GPU, drm_sched_fini() cancels the scheduler jobs, but the firmware keeps running the commands it already holds. Each work queue then stays alive only through its event slot and is dropped from the completion path as soon as its last stamp is seen. Dropping it frees its queue info (ring state, ring and notifier list), and the last command frees the queue's notifier and threshold. Those come from the shared and private kernel allocators, so the memory can be reused right away. The GPU context that the firmware still associates those structures with is only invalidated at the next alloc(), so until then the firmware can still refer to a work queue whose memory has already been handed out. The context data already keeps the tile vertex buffer alive until it is invalidated. Do the same for the queue structures. A GpuContext now keeps a list of retained objects. A work queue moves its queue info there when it is dropped, and the queue adds its notifier when it is created. The list travels with the context data to the garbage list and is freed once DestroyContext has completed. The queue info points to the context weakly now, since the context owns it from then on. This closes the lifetime window for those two objects. On its own it does not stop the sustained-teardown firmware crash on the M1 Pro (G13X): that crash still reproduces with this change, so at least one other kernel object on the teardown path is read by the firmware after it is freed and reused. Investigation continues. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> (cherry picked from commit d5ee0bd) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The T6030 backend is already enabled in the shared kernel fragment, but it has a separate build option and repeated conditional code. Compile it with the common SIO driver and select its boot-table validator, FIFO threshold and descriptor handling through the existing apple,t6030-sio compatible. The generic apple,sio profile retains the M1/M2 behavior. Keep the protocol-10 validation and refuse incompatible tables before DMA or hardware setup. Remove APPLE_SIO_T6030 and its shared fragment request. Update the binding description, synthetic DT overlay and KUnit probe cases to cover the specific match, missing/older tables and an unknown compatible. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> (cherry picked from commit e3653e6) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Building G15 and G16 together exposes stale initializers and calls in the G15 adapter. Initialise the inactive G16 platform owner and preserve the RTKit default protocol negotiation and legacy shmem callback. Resolve timestamp handles through Buffer::firmware_mapping(), retaining the firmware mapping and rejecting CPU-only destinations. Pass no reserved region map when walking G15 host-allocated RAM page tables, matching the same shared API contract already used by G16. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> (cherry picked from commit a2b3221) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Distinguish ordinary armed wake IRQs from filtered NO_SUSPEND transport interrupts, and describe how to identify a suspend-entry or resume stall. Cover SMC, dockchannel, USB, Bluetooth and RTC prerequisites without assuming one radio or PMIC across Apple Silicon boards. Document a source-by-source test matrix, wake-policy checks and recovery requirements. Restrict s2idle timed PM tests to checkpoints reached before the idle loop; processors and core can otherwise cause real sleep. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> (cherry picked from commit 1ea4c92, rebased onto integration/aurora) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#472 added a T6050 PMP registry-v2 path to apple_rtkit_rx_work(): endpoint 7 now goes to apple_rtkit_pmp_aux_rx() when rtk->pmp_registry_v2 is set. The ordered-rx fixture extracts apple_rtkit_rx_work(), but its struct apple_rtkit has no such field and nothing defines the new handler, so the group stopped compiling and the apple-dcp host suite went from 80/80 to 79/80 on integration/aurora. Give the fixture struct apple_rtkit the field and stub the handler the way the CoreAnalytics one is stubbed, as unreachable in this fixture. No assertion changes. The edid group also still passes on the tree before #472, where the stub is unused. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dcpext_probe has no consumer; the external display paths already use their compatible and firmware admission rules. Remove the unused registration. The generic show_notch preference already applies to the 14.x and 26.6 internal displays. Use it directly and remove t6030_show_notch, which only duplicated that choice for those firmware variants. Document the command-line migration while retaining the common notch preference and the matching m1n1 framebuffer preference. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> (cherry picked from commit 6b0a32b)
Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> (cherry picked from commit c3a5cff)
Stock bindgen 0.73.2 drops the alignment of an explicitly aligned empty C struct. With CONFIG_SCHEDSTATS=n the empty, cacheline-aligned sched_statistics in task_struct loses its alignment, the following fields move, and Rust read a scheduler list pointer as task_struct.mm. The Asahi RSS charge then faulted in percpu_counter_add_batch. With --no-layout-tests the build gives no sign of this. Drop --no-layout-tests again so every Rust build checks the size, alignment and offsets bindgen emits, and select the corrected generator in tools/aurora-bindgen automatically when it has been prepared (also for O= builds). build.py now defaults to tools/aurora-bindgen/build and publishes build/bin/bindgen only after its compile tests pass. An explicit BINDGEN= still wins. The Fedora, Arch and NixOS kernel packages and the fleet recipe already build with the corrected generator. Drop the stale dead_code expectation on Device::parent(), which made the WERROR KUnit build fail once a driver uses parent() with AUXILIARY_BUS=n. Add the rust-build CI job that prepares the corrected generator and compiles the SEP module for arm64. The SEP ABI and recovery tests from aurora-wip stay there until the v5 enrolment ABI lands. This takes aurora-wip's b47f666, 7b563df, b18158c and 2706037, and the CI step from 5449640, and replaces the opt-in default from 4c56f9c. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-pmp-aux selftests: apple-dcp: follow the PMP auxiliary buffer in ordered-rx
The T8132 support in atc.c added the PIPE lock timeout helper, T8132 lane and PIPE back ends, a USB2-only power restore and new state members. The harness extracts the driver bodies, so it stopped compiling on integration/aurora. Extract atcphy_pipehandler_lock_timeout() with the other driver functions, since the ACK polling moved into it, and point the missing-ack-check mutation there. Add the new members to the modeled structs, and stub the T8132 back ends and the USB2-only power restore with assertions: the modeled machines never select that generation. All 36 cases pass and all 49 mutations are killed. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tools: asahi: model the T8132 members in the ATCPHY USB3 harness
…mandatory rust: keep bindgen layout checks in every build
…-alias drm/apple: drop dcpext_probe and the M3 notch alias
The supplier link from each T6041 port controller to its display processor becomes a managed device link. Unbinding the processor therefore unbinds the port controllers as well, and USB on those ports is down until the processor is bound again. A stateless link would avoid that, but it would leave the port unusable. The controller holds one mux handle for its USB and display muxes, and once the display route is unregistered, typec_mux_begin() refuses every transaction on that handle with -ENODEV. A controller left bound could not even return the port to the safe or USB state on the next plug, and would never take the routes the processor registers when it is bound again. With the managed link the controller probes again once the processor is back, with every mux. Also note why the deferred probe timeout cannot make a controller take only its USB muxes. The wait is a fwnode link until the processor has a device, which the timeout does not touch. The device is created with its node enabled, and from then on the Type-C core defers for the routes that are not registered yet. No functional change. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bluetooth: bcm4377: abort suspend if wake IRQ arming fails
drm/asahi: keep work-queue firmware structures until the context is invalidated
dmaengine: apple-sio: select firmware behavior from compatible data
docs: explain Apple s2idle wake paths and qualification
Since commit cda3744 ("wifi: brcmfmac bound association IEs to returned payloads") the "assoc_info" iovar is queried with an 8-byte buffer, the size of the two lengths the driver reads. The firmware fails a get whose buffer is shorter than its whole association record, so every association on the BCM4387 and BCM4388 now logs brcmf_get_assoc_ies: could not get assoc info (-52) and cfg80211 gets no association request or response IEs, and the WMM AC priorities are never read. Saved boot logs show the message on every association after that change and on none before it. Query with WL_ASSOC_INFO_MAX bytes as before, into the buffer the IE queries already use, and keep the bounds checks on what the firmware returns. Fixes: cda3744 ("wifi: brcmfmac bound association IEs to returned payloads") Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit cfbedf6)
Every DCP plane advertises formats with alpha but no "pixel blend mode" property, so drm_mode_config_validate() warns once per plane at boot: [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup. Please fix. Without the property userspace must assume pre-multiplied alpha, while the driver leaves is_premultiplied clear for every alpha format and DCP blends those by coverage. Create the property. DCP blends pre-multiplied when the surface's is_premultiplied flag is set and by coverage when it is clear, so expose both, with pre-multiplied as the default the uAPI documents, and set the flag from the plane state. The H17P swap surface has no is_premultiplied byte and its firmware applies alpha as coverage, so H17P planes expose coverage only. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4d1241d)
Probe resets the function with pci_reset_function_locked() while the driver is bound. The driver has no reset_prepare or reset_done handler, so since commit a3151e6 ("PCI: Warn if a running device is unaware of reset") every boot logs hci_bcm4377 0000:01:00.1: resetting hci_bcm4377 0000:01:00.1: reset done on the M1 Pro, the M2 and the M4 Pro. The warning has a point: a reset from the PCI core or from sysfs while the controller runs loses its firmware and rings, and nothing in the driver notices until commands time out. Add the handlers. Probe resets before it sets the driver data, and bcm4377_pci_reset() already quiesces and restarts the controller around its own reset, so both are left alone. Any other reset keeps the interrupt off while it runs and then rebinds the driver, the recovery the driver already uses after a command timeout; that path moves into bcm4377_queue_rebind() so both callers share it. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit ec5c702)
With 16K pages the page block order follows the PMD order, so a page block is 32 MiB. khugepaged sizes min_free_kbytes from the page block size, eleven blocks per zone, which comes to 360448 kB (352 MiB) on every 8 GB Mac with this config. The low and high watermarks follow at 440 MiB and 528 MiB, and the per-CPU page list limits are derived from the low watermark, so another 250 to 440 MiB of free pages sits on per-CPU lists where MemFree and MemAvailable do not count it. On a MacBook Neo (8 GB) idling at the GNOME desktop this explains about 1.4 GiB of the 2.9 GiB that free and the desktop monitors report as used: 1.2 GiB of watermark deductions in MemAvailable plus 265 MiB on the per-CPU lists. kswapd also keeps about half a gigabyte free that the page cache could use. The M2 MacBook Air shows the same 360448 kB. Cap the page block order at 7, a 2 MiB block, the same size 4K arm64 and x86 kernels use. min_free_kbytes on the Neo drops to about 22 MiB and the high watermark to about 37 MiB. 32 MiB transparent huge pages are still allocated; compaction needs more free blocks to build one, as the Kconfig help notes. THP is madvise only in our configs. CMA areas need 2 MiB alignment instead of 32 MiB. Booted in QEMU (virt, 6 CPUs, 8 GB, 16K pages, THP madvise) with only this option changed: order 11: min_free_kbytes 411824, MemAvailable 7476144 kB order 7: min_free_kbytes 45056, MemAvailable 8026816 kB QEMU has two zones, so its values are twice a single-zone Mac's. A 128 MiB MADV_HUGEPAGE region got 4 of 4 32 MiB THPs with no fallback on both kernels. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit a6d008b)
…eblock Carry the fleet10-tested boot-log fixes and page block order from aurora-wip
The CLPC sampler gained dense light GPU work (264558d) and floor release counters (87e3a4d). The host test still extracted the old bodies, so it stopped compiling. Two of its mutations had also gone stale: the streaming and PMP-backoff strings no longer appear in the driver, so those controls tested nothing. Extract the dense and counter helpers, give the fake GPU a submission sequence, and check that dense submissions on T8140 earn the floor, that one sparse or late period ends the streak, and that the release and return counters follow the PMP backoff. Rewrite the stale mutations against the current code, add controls for the new paths, and refuse any mutation that no longer changes the source. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tools/asahi: cover the new RTKit buffers in the OSLog test
tools/asahi: model the yielded Type-C port in the tunnel route test
…lated tools/asahi: load mt7932_power by path in the 6 GHz policy tool
…4377-resume test The bcm4377-resume host test stopped compiling after two driver changes. Commit 0877cd7 ("arm64: apple: enable J713 Bluetooth with scoped radio DMA") made the hardware variant table name its context register through BCM4377_BAR2_CONTEXT_ADDR_HI and BCM4388_BAR2_CONTEXT_ADDR_HI. The test compiles that table unchanged but never had those macros. Commit afd5117 ("Bluetooth: bcm4377: abort suspend if wake IRQ arming fails") made bcm4377_suspend() call bcm4377_resume() to undo a failed arming, through a forward declaration ahead of suspend. The test pastes suspend before resume, so the call became an implicit declaration that clashed with the later static definition. Take every #define the variant table refers to from the driver source, and take the forward declaration of bcm4377_resume() from the driver as well, so both follow the code instead of being restated in the fixture. The controls, assertions and the five mutations are unchanged, and each mutation is still killed by its control. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The bcm4377-id host test compiles the gate from before commit 8935b9f ("Bluetooth: bcm4377: match the hardware table ID for J493 recovery") against the current hardware tables, and it required the hardware struct and the variant table to be byte for byte the same in the old and the current driver. Commit 0877cd7 ("arm64: apple: enable J713 Bluetooth with scoped radio DMA") added a context register field to both, so that check failed with any pre-fix ref. The new table entries also name BCM4377_BAR2_CONTEXT_ADDR_HI and BCM4388_BAR2_CONTEXT_ADDR_HI, which the test never defined, so even the positive build stopped compiling. Keep the exact match for the chip enum, the PCI ID table, the probe selection and the reset registration, which is what the old gate is paired with. For the struct and the table, check what the gate reads instead, the id field and the same chip to ID mapping in both versions. Take every #define the variant table refers to from the driver source. All five builds keep their expected results, and with the pre-fix ref the original, decimal ID, other chip and board bypass gates still abort on the probe registration check. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The dma-heap-fd host test compiles the real dma_heap_ioctl() against a small user space harness that defines max() but not max3(). Commit d59676b ("dma-buf: heaps: use max3 in dma_heap_ioctl") came in with the 7.3 base and changed the ioctl to size its buffer with max3(), so the positive build stopped compiling with an implicit declaration error. Define max3() in the harness the same way the kernel composes it from max(). The bodies under test, the old ref build and all five mutations are unchanged. With the parent of 30d0aff ("dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds") as the old ref, the positive build passes at both page sizes and the original and every mutation still abort on their assertions. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…test The test copies the real VmStatus::report_failure body into a host prelude. Commit f227c76 ("drm/asahi: log the first GPU work failure reported to each G17 VM") made that body use a warned flag, and commit 769e0b0 ("drm/asahi: g17: log a closed client's teardown failures at debug level") made it call unobserved_teardown and mod_pr_debug. The prelude had none of these, so the control no longer built. Give the host VmStatus the client_closed and warned fields, add ENOENT and a mod_pr_debug stub next to pr_warn, and extract the real unobserved_teardown body with the other status methods. The control and all nine mutations run as before, and the removed-fix control still reproduces the lost input error with --ref ffe8011^. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… test The test extracts the priority policy from WorkQueue::new as the text between the PRIORITY lookup and the WorkQueueInner literal. Commit ab30807 ("drm/asahi: keep work-queue firmware structures until the context is invalidated") moved the QueueInfo allocation out of that literal to just after the policy, so the extracted body pulled in try_init!, alloc, gpu_context and DebugFlags::VerboseFaults and no longer built. End the extracted body at the close of the compute priority override, which is the last statement of the policy in the current driver and in the older ones. All four mutations are unchanged and still fail, and --old-ref c8aed72^ still fails the same assertions. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…h test The PMP report entry probe gained an apple,irq-safe opt-in that sets GENPD_FLAG_IRQ_SAFE (540f52f). The host fixture had no such flag, so the extracted probe stopped compiling. Define the flag, let the fake OF node carry apple,irq-safe and read it from the overlay alongside the other entry properties. Check that each entry gets the ACTIVE_WAKEUP and IRQ_SAFE flags its overlay node asks for, and add a case where only one entry opts in. Two new mutations drop the flag and set it without the property, and both are killed. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The AV1 capture tail gained a per-frame segmentation map below the CDFs (57b0e7c), and the preamble now refuses frames larger than the capture format and out-of-range primary references (9fb5f79). The host test did not extract avd_av1_seg_size() and its fixture had no decoded format or s8, so it stopped compiling. Extract avd_av1_seg_size() and avd_av1_set_seg(), give the fixture buffers a DMA address, and give the context a decoded format. The reservation check now counts the map and places it between the compressed data and the CDFs, and the preamble check covers the map address. New cases cover the size and reference index guards, and the map that set_seg zeroes, copies from a reference with the same MiCols and MiRows, or leaves for the AVD, with the CPU and DMA offsets agreeing. Every mutation now names the text it rewrites and is refused if the driver no longer contains it. Four new ones break the map CPU offset, the MiCols match, the reference index bound and the frame width guard, and all six are killed. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The association capability event gained a dynamic debug line for the generated HT capabilities (b23d29d). It looks the element up with cfg80211_find_elem(), which the host fixture did not provide, so the extracted mt_link_event() stopped compiling. Define WLAN_EID_HT_CAPABILITY, give struct element its real id and length header, and add a cfg80211_find_elem() that walks only the IEs it is given. The capability event had no case before, so add one where a generated HT element is exported and the lookup reads the driver's copy, and one where a malformed element fails the attempt without any lookup. The four existing mutations are unchanged and still killed. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eo stability test Several driver changes left this harness behind. The MT7932 6 GHz station support (12010e0) made channels band-qualified, added channels6, PSD and VLP handling to the regulatory notifier and a band argument to mt7932_policy_permits(), so the harness stopped compiling. The DWC3 glue gained a runtime PM reference (c8372a0), a host-only role mark (a50abc4) and a set_role that can fail (3949e36). DockChannel no longer makes the receive IRQ a wake IRQ and requests it with IRQF_NO_SUSPEND instead (f98122b), so the wake case and its mutation tested behavior the driver no longer has. Give the fixture the nl80211 band, 6 GHz channels with frequency, PSD and VLP flags, a recording cfg80211 rule lookup and the missing helpers. The regulatory case now checks band-qualified permission where channel numbers overlap, that only 6 GHz channels consult the rule, that the VLP-client channel stays out of the domain and the others lose NO_IR, that the policy pass lifts NO_IR only under a rule without it, and that the disable bitmap spans every channel. The USB case checks that the runtime PM reference is dropped exactly once per stop and kept while the reset assert fails, that a refused PHY role stops the core before any host or gadget start, and that only a host-only host start marks the host role before the core comes up. The wake case now checks that the device is a wakeup source without a wake IRQ, and runs the RX IRQ request statement from dockchannel_init() to check its flags. The wake-irq mutation now restores the old wake IRQ, and new rx-suspend, usb-rpm, vlp-client and six-band mutations join it. Every mutation is refused if it no longer matches the driver. All seven mutations and both old-code controls are killed. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…HPD, sender and EDID tests Since the HPD reply check (e8f48a6), driver work reached this tree that the extracted units never followed, so three of them stopped compiling. The 14.7 external role closes its AV client on an HPD low (cadaaeb). Compact EPIC on desktop 26.x endpoints (8e82151, 9987082) gave the sender a compact path, the HPD request a status word reply and the legacy EDID reader a 2 KiB request. The sender gained a legacy reply-length interface on top of afk_send_command_common() (e6c1062), and the legacy EDID reader now bounds the EDID by the reported reply length (48cbf95). HPD: count dcpavserv_v14_close() calls and check that only an HPD low closes the AV client, before the request goes out. On compact EPIC check that a zero status is accepted without an echo and that any nonzero status is refused. Sender: extract afk_send_command_common(), the reply-length wrapper and the compact status allocator. Legacy reply lengths go through the real completer, and the test checks the bounded copy with zero fill, the oversized refusal, the U32 overflow and NULL guards, and that AFK-v2 refuses the interface without sending. Compact requests check the status echo mapping and that no DMA or tag slot is used. EDID: model the reply-length call and the compact buffer size. The legacy reader keeps its checksum tolerance but now refuses a truncated reply, a wrong max_size echo, partial blocks and a short block count. Its compact request asks for 2 KiB and expects that size echoed. Add EOVERFLOW and EOPNOTSUPP to the host errno header. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The host tests extract production code from this tree and build it on the host. Nothing ran them automatically, so a driver change could break one while the kernel build stayed green, and by 2026-10-30 seventeen of them had stopped passing. Add tools/asahi/run-host-tests.py. It runs every tools/asahi test under python3 -I in its own directory, together with its mutation and old-code controls, plus the Rust and shell tests there and the apple-dcp, apple- afkv2 (gcc and clang, with sanitizers), asahi-g15 and asahi-m4 selftests. A mutation only counts as killed when the built control reports the failure, so a mutant that just stops compiling fails the run. A tools/asahi test that is not registered in the runner also fails it, so new tests cannot be skipped by accident. Add a workflow that runs it on ubuntu-24.04 with pinned Python 3.14, rustc 1.96.0, clang 18 and gcc 13, for every push and pull request on integration/aurora and aurora-wip. The checkout keeps the commit history without trees so the old-code controls can read their revisions. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ut probe The C layout probe includes the tree's asahi_drm.h, which pulls in drm_mode.h and so <linux/bits.h>. That header only exists in recent kernel UAPI exports. On a host with older ones, such as Ubuntu 24.04's 6.8 linux-libc-dev, the probe stopped compiling and test-uapi failed. Search the tree's include/uapi after the system headers. Headers the host already has still come from the host, and only the missing ones come from the tree. The measured layout is unchanged. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first run on ubuntu-24.04 found two gaps in the toolchain setup. The apple-dcp usb-kconfig case configures the tree with LLVM=1, which needs ld.lld. The g15-pb-growth and g15-stats-drain tests ask rustup for their own toolchain unless HOSTRUSTC names a compiler. Install lld 18 next to clang 18, and point HOSTRUSTC at the pinned rustc. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci: run every host test on each push and pull request
…-link soc: apple: display gate: say why the port controller link stays managed
drm/asahi: keep G15 compatible with the shared G16 interfaces
…-type-v2 tools: aurora-sep: share the SELinux device type and let fprintd read the lid (rebased)
A sleeping sender that finds the send FIFO full waits on tx_empty for the send-empty interrupt, and gives up after 500 ms. Two things make it miss free space and time out with room in the FIFO: - The interrupt reports an empty FIFO. A firmware that takes some of the queued messages but not all of them frees space without raising it. - Two senders can wait at once, for example a driver starting its endpoints while the RTKit work item acknowledges a syslog message. The handler masks the interrupt and calls complete(), which wakes only one of them. The other sleeps on with the interrupt masked. A sender that timed out also masked it, stranding any sender still waiting. On the J616s (M4 Pro) this delayed the AOP start on some warm boots. One endpoint start failed 504 ms after it was issued, while the AOP firmware was logging over syslog: 2.891389 aop: ep 0x28 init sent 3.395337 aop: Failed to send management message type 0x05: -110 3.395341 aop: Retrying unsent endpoint start 0x29 3.395354 aop: ep 0x2b init sent 3.402107 aop: syslog message: ... AOP IS READY The retry and the next three requests went out within 20 us, so the FIFO had room when the first send gave up, and the firmware reported ready 7 ms later. In an earlier boot the same stall made an AFK init time out after the firmware had reported ready, and the probe failed. Wake every waiter with complete_all(), and check the FIFO again every 2 ms while waiting, until the same 500 ms deadline. A woken sender that still finds the FIFO full rearms the interrupt before it waits, as before. A sender that times out now leaves the interrupt unmasked for the others. tx_irq_unmasked still records the state, so the enable stays balanced: the handler masks it when it fires, and provider removal masks it otherwise. Atomic senders, which poll, are unchanged. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
…very media: apple: isp: recover from P010 IPC timeouts and drop the drm_mm dependency
drm/asahi: lock only the VM reservation for VM queries and VA updates
…ement drm/asahi: g17: stop cancelling behind a failed command once it has retired
Brings the tested integration/aurora work that aurora-wip still lacked: the GPU VM reservation locking (PR 521), the G17 failed-command retirement (PR 556), the shared aurora-sep SELinux type and Arch checksums (PR 584), the bindgen layout-check CI triggers (PR 607) and the display gate comment (PR 613). The rest of integration/aurora since the last sync is already on aurora-wip in its own commits. Conflicts: - drivers/gpu/drm/asahi/mmu.rs: keep aurora-wip's SAFETY comments and take PR 521's exec_lock_vm() in the map_pages and unmap paths. - drivers/gpu/drm/asahi/g17/queue/mod.rs: keep aurora-wip's rustfmt layout of the compute input-source gate and take PR 556's FailureRecord::earliest() check through self.failures.iter_mut(). - Documentation/rust/bindgen-layout-checks.rst and .github/workflows/sep-source.yml: PR 607 is integration/aurora's backport of aurora-wip's own layout-check commits, so keep aurora-wip (which also has the alignment probe from PR 726) and add only the Makefile, rust/ and tools/aurora-bindgen/ path triggers for the rust-build job. - tools/aurora-sep packaging: both sides took Fedora 1-10, so the SELinux change becomes 1-11 after the orphan identity tool; Arch pkgrel 16, with every sum taken from the merged files. - Documentation/gpu/drivers.rst, drivers/gpu/drm/asahi/workqueue.rs, tools/asahi/neo-stability-tests.py and tools/asahi/run-host-tests.py: the integration/aurora commits are already on aurora-wip; keep aurora-wip. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
This was referenced Nov 2, 2026
mchalunderscore
pushed a commit
to mchalunderscore/linux
that referenced
this pull request
Nov 4, 2026
Bring integration/aurora up to aurora-wip 437edfa, the source of the 7.3.0-aurora-fleet14b kernel that was promoted on the M1 Pro, M2, Neo and J616s on 2026-11-01. This takes the aurora-wip work since the two branches diverged, including the 2026-11-01 sync of integration/aurora into aurora-wip (aurora-silicon#761), up to and including aurora-silicon#764. integration/aurora had two changes aurora-wip lacked at this point: the tipd late USB4 router fix (aurora-silicon#855) and SEP keybag creation in the shared xART window (aurora-silicon#856). aurora-wip carries the same patches as aurora-silicon#858 and aurora-silicon#860, which come in with a later batch. Two conflicts, both where the two sides added lines next to each other: the KUnit prototype list in tps6598x.h (both kept, in aurora-silicon#858's order) and the aurora-sep PKGBUILD checksums (recomputed from the merged files; they match aurora-silicon#860's). The merged tree is identical to aurora-wip 437edfa with the aurora-silicon#858 and aurora-silicon#860 patches applied. Assisted-by: LLM Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges integration/aurora (41c4055) into aurora-wip, so aurora-wip holds everything tested on integration/aurora: the GPU VM reservation locking (#521), the G17 failed-command retirement (#556), the shared aurora-sep SELinux type and Arch checksums, the bindgen layout-check CI triggers and the display gate comment. The rest of integration/aurora since the last sync was already on aurora-wip in its own commits. The merge commit message lists each conflict and how it was resolved; the GPU resolutions are the ones the J616s ran today.
Checked on the merge tree (aurora-wip 5cf4c5e plus this merge):
🤖 Generated with Claude Code